STE WILLIAMS

Dating site for cheaters Ashley Madison has thrown US$11.2 million on the bed to make its 2015 data leak go away.

The site, which used the slogan “Life is short, have an affair”, was infamously hacked in 2015, lost millions of users’ records, prompting a denial from Conservative MP listed in the trove and prompting face-palms-a-plenty from infosec experts who quickly found basic security mistakes on the site.

Ashley Madison and sibling site “Established Men”, which “connects ambitious and attractive young women with successful, generous men”, are now part of a Canadian outfit called Ruby Corp which last Friday announced the settlement with a group of plaintiffs.

The settlement will see “contribute a total of $11.2 million USD to a settlement fund, which will provide, among other things, payments to settlement class members who submit valid claims for alleged losses resulting from the data breach and alleged misrepresentations as described further in the proposed settlement agreement.”

“Valid claims” is important, because the announcement notes that whoever broke into Ashley Madison had lots of time to rummage around inside and create fake records. “Therefore, ruby wishes to clarify that merely because a person’s name or other information appears to have been released in the data breach does not mean that person actually was a member of Ashley Madison.”

All you John Smiths and David Browns out there can therefore give up on your chance for a quick buck. And if you were a member, you probably had little chance of a quick anything: Ashley Madison’s membership appears to have been 99 per cent male. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/17/ashley_madison_settlment/

A new report has found that 41% of Americans have personally experienced online harassment, 66% have seen it directed to others, and 62% consider it a major problem.

The Pew Research Center survey of 4,248 US adults shows that the number has crept up since the center last did a study of this type in 2014. Three years ago, 35% of all adults had experienced some form of online harassment.

Some of the trollery is just part of online life: something we can ignore or shrug off, such as name-calling or attempts to embarrass us.

But nearly one in five Americans – 18% – have been recipients of the truly nasty, be it threats of violence, sustained harassment, sexual harassment or stalking.

From the report:

At its most severe, it can compromise users’ privacy, force them to choose when and where to participate online, or even pose a threat to their physical safety.

When asked who should clean up the mess, be it with policing or policies, Americans mostly point to online companies and platforms. Only 15% of respondents didn’t think that online services should be held responsible for users’ behavior or content, compared with 79% who think they should.

Then again, a majority of Americans – 60% – think we’re all on the hook when it comes to sticking up for each other in the face of harassment. Another 15% said that peer pressure is the single most effective way to address online harassment. Many think police should also be involved: 49% think law enforcement should play a major role in addressing online harassment, and 31% say stronger laws are the single-most effective way to address this issue.

But as Twitter and other social media platforms well know, it’s frustratingly difficult to balance the right to free speech with people’s rights to feel safe and welcome online.

Men are somewhat more likely to be harassed online – 44% of men and 37% of women say they’ve been harassed. Men are also modestly more prone to being called offensive names (30% vs. 23%) or receiving physical threats (12% vs. 8%).

But women are far more likely to be abused on sexual terms. Some 21% of women ages 18 to 29 report being sexually harassed online: more than double the share among men in the same age group (9%). Meanwhile, 53% of young women – aged between 18 and 29 – report that someone has sent them explicit images they didn’t ask for. Women are also more shaken by their online abuse: 35% of women who have experienced any type of online harassment describe their most recent incident as either extremely or very upsetting, which is about twice the share among men (16%).

Differences in opinion on which is more important – free expression or freedom from abuse – vary significantly by gender. Most women – 63% – say people should be able to feel welcome and safe in online spaces, compared to 43% of men. Men are also much more likely than women to say that people should be able to speak their minds freely online (56% of men vs. 36% of women).

The study quoted women on what gender-based harassment looks like:

Any woman who has an opinion online is bound to get men who through anonymity feel the need to threaten and assault them. I had a friend who got a stalker from posting a political Facebook post.

Usually men harassing or threatening females for posting any provocative pictures or an opinion different from his own.

Sexual harassment, extreme name-calling, taking sexual abuse I went through and broadcasting it in such a way that I was asking for what happened to me, more lies, that I am an immodest woman for breastfeeding my daughter…

Mostly on dating websites my friends have had experiences where once turned down, men threaten to beat and rape them, murder them, call them names, threaten to ruin their reputation, etc. I have never used a dating website because of what I have seen.

The most recent US election has spawned its own wave of vitriol. The report cited these people’s testimony:

People who expressed negative feelings or posted negative content toward Donald Trump were called derogatory or obscene names.

Liberals calling foul things to those who support Trump. Using profane language calling supporters ‘racists, bigots and f****** conservatives.’

I got into a political debate and the person did not agree with me. They threatened to find information about me and make it go viral. After I called them a troll they threatened to physically harm me.

I made a comment regarding the recent presidential election and was called many names and stereotypes regarding my race.

Non-Caucasians are also common targets. One in four of all black adults and 10% of Hispanics have experienced harassment online as a result of their race or ethnicity; just 3% of whites say it’s happened to them.

Their voices:

A talk about police killings of unarmed black people turned into a full-on verbal assault with racial slurs being hurled at the people who opposed the police killings.

My friend is a reporter for a major publication, and I have seen the racist threats made both in the comments section and DMs [direct messages] (she’s Jewish, so stuff about gas chambers and concentration camps). I’ve seen people be doxxed in public forums, violent threats in the comment sections and forums like Reddit, etc., etc.

I told a group discussion that I thought that the group should have more compassion for the immigrant children. A woman went off about my background and my father’s background, and she made references to finding me and ‘taking care’ of me, which I took as a threat.

Men have a tendency to shrug these things off. While half of women say offensive content online is too often excused as not being a big deal, 64% of men – and 73% of men aged between 18 and 29 – say that many people take offensive content online too seriously. Further, 70% of women – and 83% of women aged 18 to 29 – view online harassment as a major problem, while 54% of men and 55% of young men feel that way.

Political views, physical appearance, gender and race are among the top reasons people say they’re harassed online. The young are particularly vulnerable: 67% of young adults have been harassed, with 41% having experienced severe harassment.

What can we do?

As the report points out, the Communications Decency Act of 1996 holds that online hosts aren’t legally responsible for the content users post on their platforms. Americans still expect them to take care of the problem of online harrassment, though: 79% feel that online services have a responsibility to step in when harassing behavior occurs on their sites.

Twitter, for one, has been trying, over the course of years, to do just that. Back in February 2015, Twitter’s then-CEO Dick Costolo didn’t mince words: he said flat-out in internal memos that the company sucked at dealing with trolls and abuse, that it had sucked at it for years, and that it was about time that it changed.

Twitter’s most recent move, announced earlier this week: new tools to silence the trolls who barge into people’s notifications with seething replies or obnoxious user names. The options enable you to mute notifications from newly registered accounts, people you don’t follow, and people who don’t follow you. The advanced filters can be configured in the Notifications – Settings – Advanced Filters section of Twitter.

As one Twitter user noted, the advanced filters won’t erase trollery or abusive behavior, but they’ll at least turn down the volume.

Twitter isn’t the only one with a troll problem, and it’s far from the only online platform trying to flush out vitriol while simultaneously expressing fealty to the notion that users have a right to freely express themselves.

And as we reported in May, there are plenty of governments who’d be happy to step in and help the platforms figure it all out.

The European Union is on the brink of forcing Facebook, YouTube, Twitter and other social media companies to block videos with hate speech.

The European Council – which sets the EU’s political direction and priorities – in May approved a set of proposals that would require such companies to block videos that promote terrorism, incite hatred, or contain toxic, violent content.

Granted, hate speech is a specific type of content. Targeting individuals, in contrast, is a behavior, and harassing behavior might best be addressed by laws tailored to penalize the specific behaviors involved, be it the posting of nonconsensual/revenge porn, threats of rape or other physical harm, racist slurs, stalking or any of the other myriad illegal threats posed by online abusers.

Readers, your thoughts? Do you think we should all grow a thicker hide and just accept that the internet will never be a welcome, safe place for all?

Or do you expect, and demand, that platforms, police and individuals do more to stop online abuse? If so, what should they do that they’re not already doing?

Please share your suggestions in the comments section below.

Follow @NakedSecurity
Follow @LisaVaas

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/EbzmroZBypQ/

Since launching its Vault 7 project in March, WikiLeaks has dumped documents outlining the CIA’s efforts to exploit Microsoft and Apple technology. In this week’s latest release, it focuses on malware called HighRise, which the agency used to target Android devices.

WikiLeaks describes HighRise this way on its website:

HighRise is an Android application designed for mobile devices running Android 4.0 to 4.3. It provides a redirector function for SMS messaging that could be used by a number of IOC tools that use SMS messages for communication between implants and listening posts. HighRise acts as a SMS proxy that provides greater separation between devices in the field (“targets”) and the listening post (LP) by proxying “incoming” and “outgoing” SMS messages to an internet LP. Highrise provides a communications channel between the HighRise field operator and the LP with a TLS/SSL secured internet communication.

HighRise has to be installed manually on a target’s phone, and it has to be set up manually, according to the 12-page HighRise user guide – dated December 16 2013. Once the apk is installed on the targeted device, an application named TideCheck appears in the list of apps on the device.

TideCheck houses HighRise, and the agent must open the app to start the process. It then runs a special code once the word “inshallah” (“God willing” in Arabic) is entered into a text box disguised to look like it’s asking for an activation code for the app. Once the code is entered, the agent taps into the app’s settings.

After initial installation, HighRise runs in the background and automatically activates whenever the phone is turned on. The app continuously intercepts texts.

It’s a powerful spying tool but it has limits. For one thing, it must be installed onto a device manually and not remotely. The agent must have physical contact with the victim’s device to infect it.

It’s unclear if the CIA still uses HighRise.

On the heels of Cherry Blossom

This latest leak comes nearly a month after WikiLeaks’ last dump, from a project dubbed “Cherry Blossom” (WikiLeaks variously writes both Cherry Blossom and CherryBlossom, but the leaked documents routinely refer to Cherry Blossom, or CB for short, if you’re a stickler for precision).

In the words of its own Quick Start Guide, the CB project focused on internet surveillance:

The Cherry Blossom (CB) system provides a means of monitoring the internet activity of and performing software exploits on targets of interest. In particular, CB is focused on compromising wireless networking devices, such as wireless (802.11) routers and access points (APs), to achieve these goals.

Is there a silver lining in these leaks?

Such leaks raise concerns that other attackers will use the tools for their own campaigns. We’ve already seen that happen with the recent WannaCry and Petya outbreaks, which made use of NSA tools dumped by the Shadow Brokers hacking group. When the Vault 7 dumps began, we asked security experts if there were any silver linings for the good guys.

Eric Cowperthwaite, former VP of strategy for Core Security and now director of managed risk services for Edgile, said at the time that he was conflicted on that question.

He brought up the case of Chelsea Manning, a United States Army soldier convicted by court-martial in 2013 for violating the Espionage Act and other offenses, after giving WikiLeaks thousands of  classified and/or sensitive military and diplomatic documents:

There is good and bad in this. We know that some of the Manning leaks had impacts on military operations. That was part of Manning’s trial. I also found it interesting that Wikileaks alleges that the US intelligence community has a problem keeping its cyberwar tools off the black market. And if the CIA, NSA, etc. can’t keep these things under control, that is something that citizens should know.

It’s worth noting that this is an exploit for older, outdated versions of Android, and there’s no way of knowing if there’s a more current version that works with updated iterations of the mobile operating system. At Naked Security, we’ll be keeping our ear to the ground.

Follow @NakedSecurity
Follow @BillBrenner70

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/sfOivNQncoI/

Yesterday, we wrote about a rather large data breach at UK private healthcare company BUPA.

BUPA has already published an explanation of what it knows so far – and the company is to be commended for its plain-talking approach that avoids the sort of confusing language that we’ve often heard in the past.

Apparently, only customers who are covered by one of BUPA’s Global’s international plans (extra medical cover for when you work or travel overseas) were affected.

If you have a local BUPA health plan – that’s local to you, not just local to the UK, where BUPA is headquartered – then it seems that you don’t have to worry.

According to BUPA, this incident was an insider breach of the Chelsea Manning or Ed Snowden sort, rather than the work of hackers who got in from outside and managed to wander around until they found something of value.

This was an insider attack caused by an employee who deliberately copied (and then tried to delete) data from about 108,000 insurance policies providing cover for 547,000 people.

One silver lining in this story is that the deletion part of the crime didn’t work out, because BUPA is, or has already, contacted affected customers, which it couldn’t have done if it no longer knew who they were.

(You will have heard us urging you to keep proper backups many times – and this gives you one more good reason why!)

A second silver lining is that the employee concerned has been sacked – not that it’s pleasant for anyone to lose their job, but it’s reassuring to know that the person is no longer in any sort of insider position, and therefore can’t easily repeat the attack.

Whether or not that ex-employee will face further civil or criminal charges we don’t yet know.

A third silver lining is that only core customer data was taken – in database terms, it sounds as though customer records were copied, but not any financial or medical records to which the main customer database was linked.

What next?

When data gets stolen in a breach of this sort, you know it’s already in the hands of at least one crook, so you need to assume that any number of other criminals have access to it as well.

In this case, BUPA’s own Questions and Answers document suggests that the stolen data has already shown up for sale in the cyberunderground – but even if it hadn’t shown up, who can say how securely the original thief stashed it, whether they showed it to anyone else , and what they planned to do with it next?

Remember that the more personal data that crooks have about you, the more believably they can attack.

In particular, if you’re one of those people who backs yourself to spot any and all phishing emails “because they always start with a dead giveaway such as Dear Sir/Madam/Other or Attention Customer“…

…then please think again.

We’ve recently seen phishing campaigns in the UK that were much more believable than usual because they included name and home address details.

Accurate personal details make phishing cover stories – such as allegedly unpaid household bills – sound perfectly reasonable.

Even if you are sure that you don’t owe anything, a realistic fake invoice phish might make you think you are dealing with an honest mistake, rather than realising that you are in the middle of an utterly dishonest attempt to trick you.

As far as we can tell, the address data in the abovementioned attacks, both of which happened in the past year, probably came from an eBay data breach more than three years ago – a reminder that data breaches can have long-lasting consequences even if they sound mostly harmless at first.

What to do?

Whether you’re a BUPA customer or not, keep in mind that crooks regularly share, sell or steal already-breached data with, to and from each other.

Unfortunately, even a smattering of personal data in an email or phone call makes social engineering and phishing attacks more likely to succeed.

Remember:

• Don’t open unsolicited or unexpected attachments, or click unexpected links, especially not on the say-so of an unknown sender.

Even if the document claims to be an invoice you don’t owe, or threatens you in some way, don’t let fear or uncertainty get the better of you. If the document seems to know who you are – for example, because it contains your full name, your address, your place of work or your bank’s name – don’t assume you can trust it for that reason alone.

• If you’re unsure what to do, ask someone you actually know and trust, such as a friend or family member.

Never ask the sender of the email or the voice on the other end of the phone for advice, no matter how much personal information they trot out to make you think they’re genuine. They will simply tell you what they want you to hear, not what you need to know.

• Keep an eye on your financial statements.

Just in case. Because you can.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Obld8NGTR2M/

Your daily round-up of some of the other stories in the news

Australian laws override laws of maths, says PM

Australian laws override the laws of mathematics, according to Malcolm Turnbull, the country’s prime minister. Speaking in Sydney on Friday as he announced a new law that would require big internet companies to allow law enforcement access to encrypted messages sent via their platforms, Turnbull told a reporter: “The laws of Australia prevail in Australia. The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia.”

The reporter had asked how the new law, based on the UK’s Investigatory Powers Act – also known as the “Snoopers’ Charter” – would stop people simply moving on to other platforms.

Facebook and Apple pushed back, with the social media platform telling the Sydney Morning Herald: “We appreciate the important work that law enforcement does and we understand their need to carry out investigations. That’s why we already have a protocol in place to respond to requests where we can.”

Facebook added: “At the same time, weakening encrypted systems for them would mean weakening it for everyone.”

Apple told the Sydney Morning Herald: “We believe security shouldn’t come at the expense of individual privacy.”

We at Naked Security agree: weakening security with backdoors for undermines security for all of us.

Border officials can’t search cloud data on phones

Good news for travellers arriving at the US border: officials are not allowed to search data held in the cloud when they look at people’s mobile phones, according to a letter sent by Customs and Border Protection to a senator.

The letter from CBP acting commissioner Kevin McAleenan to Senator Ron Wyden, obtained by NBC News, says that while “CBP’s authority to conduct border searches extends to all merchandise entering or departing the United States, including information that is physically resident on an electronic device … border searches … do not extend to information that is located solely on remote servers”.

The letter goes on to say that border officials do “not access information found only on remote servers through an electronic device presented for examination”.

However, civil liberties groups remain unimpressed by the broad powers available to border officials, which have meant that even US citizens returning home from an exhibition have been subject to extensive searches, so it’s worth bearing in mind those powers if you’re heading for the US with anything sensitive on your phone.

Lawyer warning over police drone unit

Two UK police forces have got together to launch the first dedicated drone unit in the UK, the BBC reported on Friday.

Devon and Cornwall Police have been working with the neighbouring county, Dorset, to test drones since November 2015, and, according to Chief Superintendent Jim Nye, the head of the unit, the drones will “aid officers as part of missing person searches, crime scene photography, responding to major road traffic collisions, coastal and woodland searches and to combat wildlife crime”.

However, privacy lawyer Charlotte Harris told Sky News that the drones are “the start of a slippery slope”. She added: “Will people know if they’re being watched, will a drone be something you can identify, will it be something which is going to be in a public space, how many individuals who aren’t part of an investigation will be affected by this?”

Catch up with all of today’s stories on Naked Security

Follow @NakedSecurity
Follow @katebevan

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/BOkLhr45Yfs/

+Comment Devon and Cornwall Police is launching its drone-equipped aerial surveillance team today.

The flying spy team was first established two years ago on a trial basis and has now been made a permanent unit within DC Police. Its remit is to provide the same sort of aerial surveillance that the force helicopter provided but at a cheaper cost.

The squad is equipped with six DJI Inspire 1 drones fitted with HD zoom cameras capable of beaming thermal imaging data back to ground-based cops. Its operators are all trained to Civil Aviation Authority standards.

DC Police hopes to have 40 trained operators and 18 drones on strength by the start of 2018, according to the BBC.

Each of the unmanned aerial vehicles costs around £2,000 each, according to the police.

“Drones will aid officers as part of missing person searches; crime scene photography; responding to major road traffic collisions; coastal and woodland searches and to combat wildlife crime,” said Chief Superintendent Jim Nye, who is responsible for the drone squad, in a canned statement. “Drones can even help police track and monitor suspects during a firearm or terrorist incident, as it will allow officers to gain vital information, quickly, safely, and allow us to respond effectively at the scene.”

+Comment

Sky News quoted privacy lawyer Charlotte Harris asking, rhetorically: “How many individuals who aren’t part of an investigation will be affected by this?”

The answer, inevitably, will be “lots”. Police forces in general are delighted at the explosion in surveillance capabilities that modern technology affords them, adopting the “snoop on them all, the courts can sort the innocent from the guilty later” approach. Legal controls on police use of images, including those gathered from drones, are so weak and poorly enforced as to be meaningless in practice.

For example, while the High Court ruled in 2012 that the Metropolitan Police’s policy of never deleting anything from its ever-enlarging custody mugshot database was illegal, the capital’s finest just blew a raspberry at Lord Justice Richards and ignored him – with the Home Office happily egging them on over a period of years and even making excuses for police defiance of the court.

This is not to suggest that Devon and Cornwall Police takes the same cavalier attitude towards obeying the law that their colleagues in the Big Smoke do. A force press release from 2015 reveals the sort of everyday images and video that their drones collect, while carefully omitting any zoomed-in or thermal images of the sort that would infringe the privacy of the innocent.

Sussex Police also has a drone unit, complete with a commendably clear QA page on what they are, what kit is fitted to them, how they are used and a privacy impact assessment. The force has, it says, worked with the Surveillance Commissioner in developing its policy and processes for using drones and footage obtained from them. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/14/devon_cornwall_police_drone_unit/

How digitally savvy organizations can take cyber resilience to a whole new dimension.

Organizations these days are in full swing “going digital,” with bold visions of a bright and shiny future. But too often in their quest for the holy grail of capturing market share, management tends to focus solely upon the digital opportunities without adequately addressing the parallel issue of improving cybersecurity to combat current and emerging threats.

Ernst Young recently published the findings of their 2016 Global Information Security Survey, after polling some 1,735 CIOs, CISOs, and other senior executives. Their research reveals seven common pitfalls, and shows why digital-savvy organizations need to strengthen their cyber resilience:

Missing Strategic Alignment
The changing threat landscape and an organization’s strategy and planning seems to be almost entirely decoupled. Only 5% percent of executives polled have recently made a significant change to their organization’s strategy and plans, even after acknowledging they were exposed to too much risk. The overwhelming majority feel no need to make adjustments. A mere 22% say that they have thoroughly assessed the information security implications of their organization’s current strategy and plans.

Taking Threats too Lightly
Despite an ever-increasing dependency on technology, cyberthreats are still taken far too lightly. No one thinks it’s going to be them until it’s too late and they’re thunderstruck. A total of 62% percent of respondents would not increase their cybersecurity investments after experiencing a breach that did not appear to do any harm. Meanwhile, 68% say they would not increase their information security spending even if a supplier was experiencing a breach, and another 58% would not boost their spending if a major competitor was attacked.

Misclassification of Digital Assets
Most organizations over-protect some digital assets and under-protect others. Some 51% rank customer personal identifiable data as the first or second information most valuable to cybercriminals in the organization. Only 11% percent rate intellectual property (IP) rights as the first or second most valuable category. Strangely enough, personal information from board members or other senior executives is viewed as more valuable than RD information, patented IP and non-patented IP, and broadly on the same level with corporate strategic plans.

Organizations Don’t Consider a What-if Scenario
Of the executives polled, 42% do not have an agreed-upon communications strategy or plan in place in case of a significant breach causing a crisis. Within the first seven days after an attack, 39% say they would make a public announcement to the media. Some 70% would notify their regulator and compliance organizations. A scary 46% would not notify customers, even if customer data had been compromised, and 56% would not notify suppliers, even when supplier data had been compromised.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Overconfidence Self-reliance
Many organizations rely upon a do-it-yourself approach to test or manage their resilience but often lack the skills and capabilities to do so. A whopping 79% do their own self-phishing, and 64% perform their own penetration tests. Incident investigation is carried out internally by 81%, and another 83% conduct their own threat intelligence analysis. None of that is wrong per se, if the organization is indeed big enough to possess all the necessary capabilities, know-how, and experience. Unfortunately, that is very rarely the case. Many companies do not have in-depth expertise internally and, as a result, lull themselves into a false sense of security.

Too Much Delegation, Too Little Awareness in the Boardroom
Despite fancy corporate titles, only a few security executives are fully empowered and an integral part of the organization’s leadership structure. In three out of four cases, those in charge of information security do not have a seat in the boardroom. Consequently, the board has to rely on reports instead. Yet, most reports provide little insight. Only 25% percent of reporting provides an overall threat level, according to report findings, and just 35% of reporting discloses weaknesses in the organization’s security landscape.

Operating Blindfolded
Although a successful breach can have severe implications, 89% of respondents do not evaluate the financial impact of every significant breach. Moreover, of those that have witnessed an incident in the past 12 months, nearly half (49%) say they have no clue what the financial damage is or might be. Thus, it is perhaps not surprising that 52% think their boards are not fully knowledgeable about the risks the organization is taking and the measures put in place.

In the digital era, technology builds the backbone not just for supporting processes, but is the basis for entire business models and revenue streams. To become a digital champion and not end up in the snake pit, savvy organizations are well-advised to rethink their agenda along the seven fields of action outlined above. Good news: It is not rocket science. With determination and a reasonable set of measures, an organization can make a major difference and take their cyber resilience to a whole new dimension.

Related Content:

• 8 Most Overlooked Security Threats
• KPMG: Cybersecurity Has Reached a ‘Tipping Point’ from Tech to CEO Business Issue
• In the Cloud, Evolving Infrastructure Means Evolving Alliances

Marc Wilczek is an entrepreneur and senior executive with more than 20 years of leadership experience within the ICT space. He’s passionate about all things #digital with emphasis on cloud, big data and IoT services. Before serving as VP portfolio, innovation … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/7-deadly-sins-to-avoid-when-mitigating-cyberthreats/a/d-id/1329346?_mc=RSS_DR_EDT

AsTech expands its warranty program with a guarantee it will find Internet application vulnerabilities or it will pay up to $5 million if there is a breach.

Customers who encounter a breach due to a vulnerability that application security vendor AsTech has overlooked will be eligible to seek up to a $5 million warranty, the company announced this week.

AsTech is expanding its Paragon Security Program warranty to $5 million from $1 million. The application security vendor will make good on the warranty if it misses a vulnerability that later leads to a security breach for its customer. Under the breach, the attacker would have to gain unauthorized access to non-public information, AsTech stated.

“We will pay up to $5 million in breach-related costs for remediation, customer notification, legal fees or anything else,” says Andrew McDonnell, AsTech president, in a statement.

AsTech is the latest company to join the warranty movement. End-point security firm SentinelOne, for example, offers a warranty of up to $1 million, and other industry players offering warranties include WhiteHat Security, and Cymmetria.

Read more about AsTech’s warranty here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/astech-offers-a-$5-million-security-breach-warranty-/d/d-id/1329360?_mc=RSS_DR_EDT

Researcher’s free scanner tool finds many systems remain at risk of EternalBlue-based attacks like WannaCry and NotPetya.

Some 50,000 machines are still vulnerable to the EternalBlue exploit that fueled the recent massive cyberattacks NotPetya and WannaCry.

The exposed machines were discovered via the so-called Eternal Blues vulnerability scanner, a free tool built by a researcher with Imperva. that checks for exposure to EternalBlue. Elad Erez, director of innovation at Imperva, began constructing the tool after WannaCry hit global systems in May.

People were still talking about how to mitigate its effects when NotPeya hit, making the latter “a bigger shock.” He worried people weren’t patching their systems. “I started the tool a few days after WannaCry but didn’t release it [right away],” he says. “But after NotPetya, it was very clear to me that I needed to release it as soon as possible, to help people mitigate problems and prevent the next attack.” 

EternalBlue is an exploit allegedly created by the NSA and leaked by ShadowBrokers. It was used in both NotPetya and WannaCry to quickly infect thousands of machines. EternalBlue enables the spread of malware through a flaw in Windows’ Server Message Block (SMB) protocol; attackers needed to infect only one computer to attack a network.

The Eternal Blues scanner is geared towards administrators who lack full security teams, or may not know if they’re exposed to potentially devastating cyberattacks.

Erez has scanned more than 8 million IPs with the tool and as of July 12, Eternal Blues detected vulnerable machines in 130 countries around the world, with more than 30,000 vulnerable computers in the top three countries.

More than half (53.82%) of hosts still have SMB version 1 enabled, and one in every nine hosts on a network is vulnerable to EternalBlue. The tool has discovered about 50,000 vulnerable systems. Erez warns the actual number is much higher.

“Unfortunately, exploitation of EternalBlue is still a very good method of invoking remote code execution,” Erez reports. “Yes, even after all the latest attacks by WannaCry and NotPetya. I’m here to remind you, sometimes it takes just one vulnerable machine to take you down. 

Erez says among non-security industry people, “some don’t even know what ransomware is or how to mitigate it, and their businesses are going down because of it.”

As a result, he prioritized ease-of-use in his one-click scanner. Users download the tool, run it, and click “scan.” Eternal Blues sends messages over the SMB protocol and checks whether a machine responds as a vulnerable host. It stops when it detects computers are vulnerable; users must update machines on their own.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Erez says many users come to him with privacy concerns and emphasizes there is no way for him to reverse the statistics and figure out the individual, business, or network involved with each scan. He says he designed it this way on purpose.

“There is no privacy issue,” he saus. “I explicitly avoided that from day one so people would feel safe to use it.”

Following the tool’s release, Erez says individuals and organizations have used it to find blind spots in their network. One network with nearly 10,000 hosts used it to discover only two were vulnerable, which he calls “finding a needle in a haystack.”

Erez advises security admins to apply patches, regularly scan their networks for EternalBlue vulnerabilities, and disable the SMBv1 protocol. “I’m pretty sure there are many more vulnerabilities in this protocol – zero-days we don’t know about,” he warns of SMBv1. “I’d recommend to just stop using it.”

Related Content:

• 7 Deadly Sins to Avoid When Mitigating Cyberthreats
  
• How Security Pros Can Help Protect Patients from Medical Data Theft
• How Active Intrusion Detection Can Seek and Block Attacks
• New SQL Injection Tool Makes Attacks Possible from a Smartphone

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/50000-machines-remain-vulnerable-to-eternalblue-attacks/d/d-id/1329361?_mc=RSS_DR_EDT

Black Hat USA researchers show how bad guys can use cloud AV connections to bypass air-gaps and extremely segmented networks to keep stolen data flowing.

Over the past few years, security researchers have been drawing increasing attention to the fact that under the right circumstances security products could potentially be used to attack the very machines they’re meant to protect. For the most part, the body of work on this front tends to fixate on authentication bypasses and attack techniques early in the attack lifecycle. 

Later this month at Black Hat USA in Las Vegas, a pair of researchers will show that security product vulnerabilities can be leveraged late in an attack as well. Vulnerable cloud antivirus products can not only be used to get attackers in to a target network, they can also be used to get stolen data out. In their The Adventures of AV and the Leaky Sandbox talk, the researchers will demonstrate how cloud-enhanced AV agents can be used as a vehicle for exfiltration on very secure and isolated endpoints.

Amit Klein, vice president of security research for SafeBreach, and Itzik Kotler, co-founder and CTO, dug into their research to challenge the assumption that there’s no downside to moving to AV systems that leverages the cloud to incorporate up-to-date intelligence from multiple sources. They found that it’s possible to subvert the Internet connection of AV products that use in-the-cloud sandbox technology to turn it into a rogue connection for getting stolen data off the target’s network and onto the criminal’s server.  

This can be a very powerful attack tool against enterprises that have enforced strong controls through egress filtering, whitelisting, and even airgaps with no other Internet connections.

Klein and Kotler plan to also release at Black Hat a tool to carry out their new technique, and they’ll offer evidence about how a number of prominent AV products fared against the new attack. Klein says that even before digging into the troubling issues of insecure security products opening new lines of attack, the even more important lesson is to consider every possible angle of attack when it comes to the bad guys filching data from systems.

“Exflitration from the enterprise can take some very surprising and unexpected forms. With that in mind, security personnel should consider all possible ways of data to leave the enterprise and analyze them as potential exfiltration vectors,” he says. ” In our particular case it was the connection between AV agents and their cloud servers, but there are many other ways, to be sure.”

As Klein explains, security product vulnerabilities are hardly a new phenomenon. For example, just last year at Black Hat, two researchers from enSilo presented techniques that leverage flaws in AV hooking engines to start an attack by bypassing ASLR protections in 32-bit and 64-bit systems.

In addition to Klein and Kotler’s presentation, there will be a couple other new findings presented at Black Hat that show how attackers can break the mathematical engines that govern machine-learning based detection models. In one presentation, researchers at the Intel Science Technology Center for Adversary-Resilient Security Analytics (ITSC-ARSA) at Georgia Tech will demo a tool they call AVPASS that can effectively spy on Android anti-malware detection models and manipulate malicious apps’ APKs in such a way that it can disguise Android malware from the security software

Klein says all of this research should get practitioners to keep in mind that security products are very appealing attack targets.

“They usually have high privileges in the operating system on which they run – typically they run with administrator rights – and visibility access to enterprise network traffic,” he says. “They also employ complex logic, interacting with a lot of file formats, protocols, and operating system features. This complexity translates into a broad attack surface.”

As such, it’s incumbent upon CISOs and other practitioners to stay on top of new research about this field and keep the pressure up on their vendors to keep their security tools hardened from attack. 

“I’m pretty sure that once vendors feel the pressure from major customers, their response time will improve, and they will also invest more time in internal research to predict and circumvent yet-unknown attacks,” he says.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Related Content:

• New SQL Injection Tool Makes Attacks Possible from a Smartphone
• Microsoft Patches Critical Zero-Day Flaw in Windows Security Protocol
• Desperately Seeking Security: 6 Skills Most in Demand
• How Code Vulnerabilities Can Lead to Bad Accidents

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/cloud-av-can-serve-as-an-avenue-for-exfiltration/d/d-id/1329362?_mc=RSS_DR_EDT