STE WILLIAMS

With “Philadelphia,” a slick ransomware-as-a-service interface that enables almost anyone to launch a sophisticated ransomware campaign, suddenly, deploying ransomware is easy as ordering a pizza. The criminal developers behind Philadelphia even had the heart to offer a “mercy” feature should a victim plead for access to ransomed family photos of lost family and friends.

Welcome to the new world of commodity malware!

As the co-founder of a threat intelligence exchange platform, I see of lot of trending campaigns before they reach mainstream, and Philadelphia typifies many of the new age indicators we’re starting to see in incident data from companies across the cloud, finance, and healthcare sectors.

Below are some key insights about this new era of commodity malware so that you can spot patterns within your own data.

Insight #1 – The Exploit Kit Playbook: Many incident reports show multiple ransomware campaigns relying on an easy-to-buy RIG exploit kit, and then combining it with commoditized ransomware like Cerber and Locky. The playbook for creating new ransomware campaigns has been written and everyone is following it.

Insight #2 – Block and Tackle: Blocking a specific exploit kit or ransomware software will lead to short-term disruption of some campaigns but bad actors will find a different exploit kit or ransomware to weaponize and evolve into a new campaign.

For example, from January to June of 2016, Angler was the predominant exploit kit being seen in reports submitted to the wider security community until it was disrupted due to arrests of a criminal hacking gang in Russia. When the Angler exploit kit went down, cybercriminals began searching for a new go-to exploit kit, and in early September 2016 the RIG exploit kit became the predominant cybercriminals exploit kit. 

Insight #3 – Low-Effort, High-Efficacy: Malware usually requires additional steps to monetize a successful exploit. Whether it is pulling exfiltrated data from the first level C2 or stolen passwords, the bad guys have to do the work of posting that information for sale after packaging the data in a specific size and/or format. On the other hand, ransomware is fire and forget. As soon as it hits a system the payoff is instantaneous.

In previous malware models there was usually a way for the user to remove or mitigate the issue. If the user gets a keylogger, RAT, or rootkit on their system there is almost always a way to remove the offending malware. Sometimes the steps to remove the malware can be tedious, or special tools are needed, but there is a path to a solution. This is not the case with ransomware. Pretty much all ransomware utilizes asynchronous encryption, making reversal extremely difficult.

It’s Not Just You
Ransomware campaigns bar access to critical data but they can also be used to disrupt system operations. Recall the Hollywood Presbyterian ransomware attack just over a year ago. The attack disrupted emergency room operations and patients had to be diverted to other hospitals.

The trend of commoditized ransomware raises an even larger issue within the security community: companies need to stop assuming they are being singled out for attacks. The truth is, you’re not that special. In fact, according to our latest platform analysis, 65% of our threat reports are correlating across companies regardless of sector.

There is absolutely no reason that after one victim has been hit by a particular ransomware attack others must fall victim to the same attack. What we’re seeing in the media and from our own platform data insights underscore the fact that commoditized ransomware campaigns will become increasingly opportunistic, and will not be as targeted.

As hacks continue to be replicated with more ease, the private sector must not fight alone. Exchanging threat intelligence to identify trending campaigns and provide context to mitigate against these campaigns is the only path forward.

Related Content:

• Interop ITX: How To Stop Ransomware in its Tracks (and When You Can’t) 
• Ransomware: How A Security Inconvenience Became The Industry’s Most-Feared Vulnerability
• What To Watch For With Ransomware: 2017 Edition
• Why Ransomware Is Only Going To Get Worse

Paul Kurtz is the CEO and cofounder of TruSTAR Technology. Prior to TruSTAR, Paul was the CISO and chief strategy officer for CyberPoint International LLC where he built the US government and international business verticals. Prior to CyberPoint, Paul was the managing partner … View Full Bio

Article source: http://www.darkreading.com/threat-intelligence/commodity-ransomware-is-here/a/d-id/1328578?_mc=RSS_DR_EDT

(Image: Bluebay via Shutterstock)

Cybercriminals are testing the strength of your organization’s defensive wall, looking for the one crack they need to launch their attacks. Oftentimes that flaw isn’t a “what,” but a “who.”

Employees only need to download a bad attachment, click a malicious link, or give attackers one piece of information they need to break in. Security is a business-wide responsibility.

“Companies need to realize if their employees are picking up the phone and answering emails, they are making security decisions every day that can affect the company,” says Michele Fincher, COO for Social-Engineer, Inc. “They don’t realize how many good decisions employees need to make to be secure.”

Addressing the importance of security during annual training sessions isn’t enough, says Fincher. “If you only talk about it once a year, you’re doing the staff a grave disservice.”

Social engineering attacks also make it harder to differentiate legitimate from malicious activity. In the past, cybercriminals needed more technical skills to launch attacks. These days, they can wreak havoc with social network browsing, phone calls, and emails. They can conduct surveillance without raising red flags.

As Social-Engineer, Inc. CEO Chris Hadnagy explains, “There’s no bar for entry for an attacker.”

Here are seven common strategies attackers use to target employees. Share these with your teams to inform them of today’s dangers and where hackers may be hiding.

Kelly is an associate editor for InformationWeek. She most recently reported on financial tech for Insurance Technology, before which she was a staff writer for InformationWeek and InformationWeek Education. When she’s not catching up on the latest in tech, Kelly enjoys … View Full Bio

Article source: http://www.darkreading.com/vulnerabilities---threats/7-ways-hackers-target-your-employees/d/d-id/1328580?_mc=RSS_DR_EDT

Does the “glass ceiling” still exist? On the one hand, a woman was almost elected president of the United States, and government statistics show that women constitute about half the US high-tech workforce. On the other hand, US Census data shows that of the women in the workforce, more work at lower-paying jobs than at higher-paying ones. And when it comes to the cybersecurity industry, women represent quite a slim margin, representing 11% of the world industry’s workforce, making me somewhat of a unique creature.  

I’m the CTO of a cybersecurity startup called Secret Double Octopus (an odd name, but one people tend to remember), and it’s my job to oversee the company’s RD operations and conduct the tech deep dive at client meetings. My immersion into a male-dominated environment dates back to my days as a soldier in the Israel Defense Forces, where I served as a sabotage and mines instructor.

My professional career in cybersecurity began as part of my academic research as a PhD student at Hebrew University, where I focused on anomaly detection for zero-day attacks, fast pattern matching for deep packet inspection and software-defined networks (SDN), and then continued as a postdoctoral researcher at Ben-Gurion University in Beer Sheba with Professor Shlomi Dolev. It was there that JVP, one of Israel’s leading venture capital firms, approached me because of my research and proposed practically applying my research, matching me with our CEO, Raz Rafaeli.

I wouldn’t say I’m a women’s rights activist by choice, but being in an executive position within the IT industry automatically makes me one, whether I like it or not. As a result, I’ve become a de facto spokesperson of sorts, advising young women professionals on how to make it in an industry where the glass ceiling is still pretty thick. My advice: Get a pair of earplugs, and put them in when you hear words like “can’t” or “don’t.” It worked for me.

Fortunately for me, the path of STEM has been clear to me since I was a little girl. Thankfully, I do not experience the “thick glass ceiling” on a daily basis within my own team, but intentional or not, the fact of the matter is that cybersecurity is indeed a male-dominated field and, although we do live in a heightened gender-aware generation, gender biases still exist.

There are numerous reasons for this lingering sexism. According to a 2015 National Bureau of Economic Research study, teacher (both male and female) gender biases turn girls off from studying STEM subjects. These biases “have an asymmetric effect by gender — positive effect on boys’ achievements and negative effect on girls. Such gender biases also impact students’ enrollment in advanced level math courses in high school — boys positively and girls negatively,” the study noted.

Others blame it on parents: According to the UK’s Institution of Engineering and Technology, only half as many parents had tech aspirations for their daughters as they had for their sons while only 1% saw engineering as a career path for their daughters. Still others blamed the “geeky environment” in tech, with “girls’ lower sense of belonging could be traced to lower feelings of fit with computer science stereotypes.”

All this may be true, but there is a way to fight it: Determination. If the glass ceiling for deep tech is still thick, the good news is that there is a lot more support for girls in school today than there was when I was a student. High schools, universities, and the business world are much more sensitive to the glass ceiling than ever, and there is a plethora of organizations and programs that help girls get involved in math, science, and tech. I know some people are uncomfortable with preferential programs of this type, but they exist for a reason — and when there is an employment imbalance as in cybersecurity, such programs are more than justified.

In the end, it’s about motivating yourself, believing in yourself. Don’t let others’ attitudes put you off from your goal. I know it sounds like a cliché, but it’s still true: You have to believe in yourself, and believe that you are just as good as men — and maybe better because we’re blessed with women’s intuition, and that’s one thing they will never have.

Related Content:

• Is Mentorship the Key to Recruiting Women to Cybersecurity?
• It’s Time To Address The Cybersecurity Gender Gap Before It’s Too Late
• Internet Of Things The Platform Of Parenthood

Shimrit Tzur-David is the chief technology officer and co-founder of Secret Double Octopus, the world’s only keyless multi-shield authentication technology that protects identity and data across cloud, mobile and IoT environments. Shimrit has over 10 years of research … View Full Bio

Article source: http://www.darkreading.com/careers-and-people/how-to-crack-cybersecuritys-glass-ceiling/a/d-id/1328581?_mc=RSS_DR_EDT

A research on data breaches at hospitals has revealed that those with major teaching facilities and more beds were at greater breach risk, says a Johns Hopkins University report. Conducted by Ge Bai of John Hopkins Carey Business School, the study examined federal Department of Health and Human Services’ data breach statistics of health facilities between 2009 and 2016.

“It is very challenging for hospitals to eliminate data breaches, since data access and sharing are crucial to improve the quality of care and advance research and education,” explains Bai. “To understand the risk of data breaches is the first step to manage it,” she believes.

The study found 15% of the affected hospitals were breached twice and in all the breaches health information of millions were compromised. Data of over 60,000 were exposed in six hospitals while Illinois’ Advocate Health and Hospitals Corporation reported 4,031,767 impacted by two breaches.

Read details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/teaching-hospitals-at-greater-data-breach-risk/d/d-id/1328576?_mc=RSS_DR_EDT

Last year when security firm Lookout and the University of Toronto’s Citizen Lab disclosed details of a particularly pernicious iOS spyware product called Pegasus, one unanswered question was whether an Android version of the software was available.

The answer, it turns out somewhat unsurprisingly, is a resounding ‘Yes.’

Lookout and Google this week released details of an Android version of Pegasus, which like the original appears to have been designed for highly targeted surveillance operations and lawful intercepts.

As with the iOS version, Pegasus for Android packs a boatload of nasty capabilities – including the ability to log keystrokes, capture screenshots and live audio, and read messages sent via apps like WhatsApp, Skype, and Facebook. It can also steal email from Android’s native email client and pilfer browser histories, text messages and contact details from infected devices.

One of the software’s more sinister features is its ability to use an infected device’s microphone and camera to spy on activities in the immediate vicinity.

Among the many features that make it one of the most lethal mobile endpoint threats ever is a self-destruct capability that causes the malware to obliterate itself under certain conditions.

For example, the malware self-destructs if it lands on a device with an invalid SIM Mobile Country Code ID, or on one in which an antidote file exists, Lookout said. Similarly, the malware commits suicide if it is unable to connect with a command-and-control server for a period of 60 days or if it is commanded to do so by the server.

Android for Pegasus is another indication that mobile devices have become the surveillance tool of choice for nation state-level attackers in sophisticated, targeted attacks, says Kristy Edwards, director of security product management at Lookout. The iOS version of the spyware for instance was used to spy on human rights activists and journalists in at least two countries.

“Users should be aware that their mobile devices [could] be turned into a tool for espionage,” she says. “It’s extremely important to install security patches as they become available, be careful about clicking on links like those delivered in email, SMS, Whatsapp, Facebook messages or any messaging app.”

The author of the malware is NSO Group, the same Israel-based maker of mobile surveillance software that was responsible for creating the iOS version of Pegasus as well.

Google, which calls the threat Chrysaor, this week described it as malware that was used in targeted attacks against a small number of Android users.

In an alert, security researchers from Google said they discovered the malware installed on less than three-dozen Android devices after Lookout warned the company about the malware last year.

A Google chart of the countries where the infected devices were discovered shows that Pegasus for Android so far at least has been used mostly to spy on individuals based in Israel. Other countries where infected devices surfaced include Georgia, Mexico, and Turkey. All Android users are currently protected against the threat.

[Check out the two-day Dark Reading Cybersecurity Crash Course at Interop ITX, May 15 16, where Dark Reading editors and some of the industry’s top cybersecurity experts will share the latest data security trends and best practices.]

One major difference between the Pegasus version for iOS and the one for Android is that the latter does not use any zero-day flaws to root an Android device. Pegasus for iOS exploited a trio of zero-day vulnerabilities collectively dubbed “Trident” to jailbreak iOS devices. Pegasus for Android instead uses a known rooting technique dubbed Framaroot to break into a system.

It’s unclear how exactly devices get infected. “We speculate that users are phished or social engineered and convinced to download a malicious APK without their knowledge,” says Edwards. “We saw this before with Pegasus for iOS and have seen it more recently in ViperRat and related attacks.”

According to Google, once Chrysaor is installed on a device it can spy on all user activities on the device and also within the immediate vicinity using the device microphone and camera and via logging and tracking applications. Chrysaor is even capable of answering phone calls silently and staying connected in the background so the caller can hear conversations that are taking place nearby and of quickly resetting everything back to normal if the user picks up the phone to interact with it, the Google researchers noted.

The software is capable of escalating privileges on an infected device and breaking out the application sandbox. Once it gains elevated privileges it takes multiple measures to gain persistence, for instance by installing itself in such a way as to resist factory resets or by disabling auto-updates.

Related stories:

• Multiple Apple iOS Zero-Days Enabled Firm To Spy On Targeted iPhone Users For Years
• Apple Releases Patch For ‘Trident,’ A Trio Of iOS 0-Days
• Eavesdropping Trojans Used In Cell Phone Spying Case

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: http://www.darkreading.com/mobile/pegasus-for-android-spyware-just-as-lethal-as-ios-version/d/d-id/1328574?_mc=RSS_DR_EDT