STE WILLIAMS

It’s increasingly easy for someone to build and launch ransomware, regardless of skill. All you need is ill intent and access to the dark web.

Sophos global security research head James Lyne outlined the threat in an interview with NBC’s Today show. [The full report is available on the Sophos Blog.] Lyne told NBC reporter Tom Costello:

Anyone with intent can buy a kit. This is ransomware as a service.

The existence of do-it-yourself malware kits is certainly not new. We can go all the way back to the early 1990s for examples, including DOS-based tools such as VCL (Virus Creation Laboratory) and PS-MPC (Phalcon-Skism Mass Produced Code Generator). Back then, the main purpose of malware creation tools was to give non-techies entry into the virus-writing counterculture. Today, the game is to make tons of money.

In two recent examples:

• SophosLabs released a paper last month on one such kit, AKBuilder, which malicious actors can use to package malware samples into booby-trapped documents they can then spam out.
• Also last month, SophosLabs warned that another builder – Microsoft Word Intruder (MWI) – has been continuously tweaked to expand the target range. Traditionally, MWI has used popular Microsoft Office exploits to get at its victims. But the latest updates add a new twist: for the first time in the history of MWI, a non-Office exploit was added.

Lyne brought the dangers into clearer focus during his interview, describing the dark web as a marketplace where malware kits are advertised the same way a traditional retailer might advertise products on their online stores. Lyne told Costello:

It’s astonishingly overt. The kits available on the dark web come with [simple instructions] on how to configure your blackmail software.

To put it all another way, people don’t need much skill to do serious damage. All they need is a hunger for money, especially the bitcoins that are typically their top want. Lyne said:

Your entire digital life can be theirs. It can cost a lot of money. This is real business impact.

How to protect yourself

Lyne’s advice is consistent with what we’ve been saying all along: back up data continuously, and keep all software security up to date.

We regularly offer advice on preventing (and recovering from) attacks by ransomware and other malware.

Here are some links we think you’ll find useful:

• To defend against ransomware in general, see our article How to stay protected against ransomware.
• To protect against JavaScript attachments, tell Explorer to open .JS files with Notepad.
• To protect against misleading filenames, tell Explorer to show file extensions.
• To learn more about ransomware, listen to our Techknow podcast.
• To protect your friends and family against ransomware, try our free Sophos Home for Windows and Mac.

---

Techknow podcast — Dealing with Ransomware:

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/rSMwEVPk2WI/

The thieves are at it again: this time, they have published stolen images of actors Emma Watson and Amanda Seyfried.

Those who claim to have seen the photos say that more celebrities’ photos are due to be exposed, and those who have no qualms about trampling on other people’s privacy are once again viewing, sharing and e-tittering over the images.

The Telegraph reported last week that Watson is taking legal action.

The alleged hack came to the attention of social media last week, with many tweeting that they had seen the pictures.

Watson’s spokesman had this to say:

Photos from a clothes fitting Emma had with a stylist a couple of years ago have been stolen.

They are not nude photographs. Lawyers have been instructed and we are not commenting further.

TMZ reports that Amanda Seyfried’s legal team is also taking action, demanding that nude images and those that depict “intimate moments” with an ex-boyfriend be taken down from a site called Celeb Jihad.

TMZ posted a redacted version of the letter (PDF) Seyfried’s lawyers sent to Celeb Jihad on Wednesday.

According to the letter, the images were “wrongfully obtained by a third party or parties without Ms Seyfried’s knowledge or consent.” Her lawyers demanded that the images be taken down “immediately and permanently”, and that the site preserve any paper or electronic evidence relating to the images, including “all emails, text messages, chat logs, screenshots or other electronic or paper documents stored on the work or home computers or mobile devices of your employees or on the cloud.”

It’s being called The Fappening 2.0, although adults are more likely to refer to the thefts as Celebgate 2.0.

The original Celebgate began in September 2014, with the gang-mugging of celebrities that resulted in intimate images of Jennifer Lawrence, Kate Upton, Kirsten Dunst, Selena Gomez, Kim Kardashian, Vanessa Hudgens, Lea Michele and Hillary Duff, among others, being stolen and disseminated online in places such as Reddit.

We’ve seen multiple arrests, convictions and imprisonments stemming from Celebgate 1.0.

One of the most recent cases was that of Edward Majerczyk, 29, who pleaded guilty in September to prying open more than 300 iCloud and Gmail accounts – at least 30 of them belonging to Hollywood glitterati – and ripping off what the US Attorney’s Office demurely referred to as his victims’ “sensitive and private photographs and videos”.

In January, Majerczyk was sentenced to nine months in federal prison.

The modus operandi of Celebgate 1.0 – phishing – might well also turn out to be behind this most recent round of celebrity nude photo thefts: both Majerczyk and fellow Celebgate convict Ryan Collins – sentenced in October to 18 months in jail – got to their victims with phishing scams.

Majerczyk sent messages doctored to look like security notices from ISPs, while Collins chose to spoof his to look like they came from Apple or Google.

Both tricked victims into handing over their usernames and the passwords for their Google or iCloud accounts.

With credentials in hand, both hackers were free to romp through victims’ accounts and grab whatever photos and videos they could find.

And just as in Celebgate 1.0, it’s looking like this might be just the first of a series of stolen celebrity photo postings. The Telegraph reports that whoever originated a Reddit threat on the reported hack wrote that there could be more in store:

There may be a few more names added to that list but these are the big two.

Don’t want to break any Reddit rules so no links right now but there should be some really good drama over the next few days.

And if Celebgate 1.0 continues to be a blueprint that’s used once again in this round, that means we can expect at least one more round of arrest/conviction/sentencing, if not a series of such, as the law hunts these muggers down and the courts lock them up.

Follow @NakedSecurity
Follow @LisaVaas

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/bh4oqHYhVow/

As Naked Security readers will be aware, tech support fraudsters have recently taken a real shine to customers of TalkTalk, a British internet service provider.

As many attest, they just won’t leave TalkTalk customers alone, cold-calling them on a scale the BBC recently described as “industrial”. Needless to say, this is not good.

The phone spiel always unfolds in the same way. The caller claims to be a TalkTalk engineer and to have detected a router or malware issue on the user’s computer that requires immediate intervention.

The customer is persuaded to turn on their computer and run the Windows Event Viewer to perform bogus diagnostics before being asked to install one of a range of remote desktop support tools.

This type of application gives the scammers complete remote control over the victim’s PC, at which point they are free to steal data, install malware and, in some cases, engineer the user into logging into online banking or transferring money.

A popular choice with the fraudsters since at least 2015 has been TeamViewer, so much so that on March 8, TalkTalk abruptly started blocking the application from functioning on its network in a desperate effort to stem a tide of abuse customers had started complaining about.

TeamViewer’s block was removed on Thursday after complaints by the company, but that didn’t stop TalkTalk  from quietly blocking equivalents such as AnyDesk, whose users started noticing unexpected connection issues around the same time.

Tech support fraud, or “vishing”, has been around for years, so is there much new to be worried about here?

The unsettling aspect of the TalkTalk attacks is that the fraudsters allegedly accessed stolen data, which means they immediately sounded more convincing to their victims. If confirmed, this means that fraudsters have been able to synthesise old-fashioned tech support social engineering with data breach cybercrime to create something novel and perhaps unstoppable.

It also seems to be easy to abuse remote support applications, which have flourished on the back of untraceable freemium accounts. It’s not clear how these companies detect misuse but clearly more needs to be done. In other cases, genuine accounts have also been hijacked to execute remote fraud.

Clearly, nobody should hand over a full password, bank details or agree to transfer money on the basis of a cold call but the fact that people are still doing this suggests the message is not being heard.

The traditional advice for dealing with cold calls runs as follows:

• Hang up and dial that company’s advertised number to check its authenticity.
• Never respond to a web pop-up asking you to call a number or visit a website
• Never install a remote support application on the basis of a cold call
• Report all tech support cold calls to Action Fraud, where it stands a chance of becoming useful intelligence.
• TalkTalk offers a way for customers to report fraud direct

Rejecting all cold calls would be a simpler option but that might be hard to keep to as occasionally companies do need to call their customers out of the blue often, ironically, because they’ve detected fraud.

This is a bit of a mess. Cold calling, once a useful marketing tool for industries keen to make use of their databases, has been turned against them. Companies could introduce better authentication but this wouldn’t easily defend against fraudsters armed with personal data from a breach.

We urgently need to know more about what has happened at TalkTalk because this could be the tech support scam on steroids, a poisoning of the well that has done long-term damage to the whole concept of helping people down a phone line.  It would be a shame if this marks the moment a once-useful facility started to wither for good.

Follow @NakedSecurity
Follow @JohnEDunn

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/gpda12i7B9E/

It looks like Cisco won’t be chasing up a partnership with WikiLeaks: it’s combing the “Vault7” documents itself, and has turned up an IOS / IOS XE bug in more than 300 of its switch models.

The vulnerability is in the Cisco Cluster Management Protocol (CMP) in IOS and IOS XE. The protocol passes around information about switch clusters using either Telnet or SSH.

The bug is in the default configuration of affected devices, even if the user doesn’t have switch clusters configured, and can be exploited over either IPv4 or IPv6.

It’s a two-fold bug: first, the protocol doesn’t restrict CMP-specific Telnet to local communications, instead processing commands over “any Telnet connection to an affected device”; and second, malformed CMP-specific Telnet options are incorrectly processed.

“An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device”, Cisco’s advisory states.

The bug affects 264 Catalyst switches, as well as 51 industrial Ethernet switches and three other devices, if they’re running IOS and configured to accept Telnet connections.

Until fixes are available, Cisco says Telnet should be disabled in favour of SSH.

Cisco’s advisory doesn’t tell us if it’s aware of exploits using the flaw. If they are discovered, this is very substantial news because The Reg expects there are tens of thousands, if not hundreds of thousands, of these devices installed around the world. And all look to have been at the CIA’s mercy for an unknown period of time. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/19/cisco_goes_public_with_its_first_vault7_response/

Updated Norfolk County Council left files containing sensitive information about children in a cabinet which was dispatched to a second hand shop.

In return for the data gaffe, the council has been issued a £60,000 monetary penalty notice [PDF] by the Information Commissioner’s Office (ICO)

The cockup occurred when the children’s social work team at the council had a third party collect some unneeded furniture from an office in Norfolk as part of a relocation. These went to a second-hand shop, where a member of the public purchased the cabinet and found sensitive information relating to seven children.

Steve Eckersley, ICO Head of Enforcement, said: “The council had disposed of some furniture as part of an office move but had failed to ensure that the cabinets were empty before disposal.

“Councils have a duty to look after any personal information they hold, all the more so when highly sensitive information is concerned – in particular about adults and children in vulnerable circumstances.

“For no good reason Norfolk County Council appears to have overlooked the need to ensure it had robust measures in place to protect this information. It should have had a written procedure in place which made it clear that any storage items removed from the office which may have contained personal were thoroughly checked before disposal.”

Simon George, Executive Director for Finance and Commercial Services, said: “We want to reassure residents that we have robust data protection procedures and have tightened practice in the light of the case published today. As a council we take data protection very seriously and we are very sorry that our practice fell short on this occasion. We accept the ruling and the fine. There is no evidence that this information has been misused in any way and we are grateful to the member of public that quickly brought this to our attention. We voluntarily reported ourselves to the Information Commissioner and we undertook a careful review to ensure that we could learn from what happened.

“In the three years since this occurred, we have taken strong and effective action to ensure it is not repeated. This has included introducing robust procedures for office moves and training to ensure that our staff are aware of these procedures. Staff also receive mandatory rolling training to ensure they understand their overall data protection responsibilities. A recent voluntary ICO audit gave use the second highest rating for records management and training and awareness.

“We handle a huge amount of personal data every day and incidents such as this are rare but we will continue to monitor and review practice to ensure that the personal data we hold is kept safe.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/20/norfolk_county_council_sent_a_filing_cabinet_with_childrens_information_to_a_secondhand_shop/

Interview Sure, algorithms are insanely useful, but we need to watch we don’t become complacent and unable to question them, University College London’s Dr Hannah Fry warned in an interview with The Register.

Dr Fry is a lecturer in the mathematics of cities at the Centre for Advanced Spatial Analysis at UCL, where her research “revolves around the study of complex social and economic systems at various scales, from the individual to the urban, regional and the global, and particularly those with a spatial element.”

While not engaged in research, however, Dr Fry is quickly becoming one of the UK’s favourite mathematicians, known for her work on BBC 4’s The Joy of Data, as well as her popular TED talk, ‘The Mathematics of Love’, which applied statistical and data-scientific models to dating, sex and marriage.

Youtube Video

Chatting to The Register ahead of DataFest2017, the inaugural week-long data science festival in Edinburgh, Dr Fry said she thought the event was going to be “a lot of fun”.

“It’s perfectly positioned time-wise. It’s something people really need to address, and having so many excellent people together in a room at once; it’s going to be a great few days.”

“Data science as a field has exploded over the past five years,” because there’s “much more access to data now” said Dr Fry, noting that with “sensors, IoT, with us living more of our lives online” there’s now “very little that is untouched by data”.

We “realised a few years ago how much data there was,” Dr Fry said. “I think the whole thing is very exciting. We have these wonderful opportunities to stand back and rethink how we design our societies, our businesses, almost everything we encounter on a daily basis.”

That said, it’s still necessary for people to be “paying attention to how biases you have in data can end up feeding through to the analyses you’re doing”.

Algorithms behind closed doors

Last week, a paper by Julia Powles, an academic at the University of Cambridge – though soon departing for Cornell University in New York – and Hal Hodson, a journalist, described a deal between Google DeepMind and the Royal Free London NHS trust to use patient data without explicit consent as “inexcusable” and potentially in breach of data protection laws.

Dr Fry hadn’t read the paper, but believed it was “a conversation that needs to be addressed” especially when it came to ownership of data, access to data, and most importantly, “transparency in terms of the algorithms”.

Proprietary software is built with an incentive that might not align with the interests of individual people, who are just data points within it, said Dr Fry. This can be a casual issue or a serious problem, she added, because these algorithms can be used in various situations, from encouraging consumers to purchase particular products, through to establishing whether individuals get loans or decent insurance rates, and have even been used in the US criminal justice system too.

“Algorithms that sit behind closed doors, we need to open those up a bit,” said Dr Fry. The issue is that without access to seeing how they function, “you can’t argue against them. If their assumptions and biases aren’t made open to scrutiny then you’re putting a system in the hands of a few programmers who have no accountability for the decisions that they’re making.”

“In some situations, this doesn’t matter,” Dr Fry acknowledged. “Netflix is not fundamentally important to the structure of society; but then, some algorithms about predicting reoffending rates for individuals in US are used in sentencing, and the analysis of the data has very serious consequences there.

“An example I use in my talk is of a young man who was convicted of the statutory rape of a young girl – it was a consensual act, but still a statutory crime – and his data was put into this recidivism algorithm and that was used in his sentencing. Because he was so young and it was a sex crime, it judged him to have a higher rate of offending and so he got a custodial sentence. But if he had been 36 instead of 19, he would have received a more lenient sentence, though by any reasonable metric,” one might expect a 36-year-old to receive a more punitive sentence.

Collaboration and interest

Dr Fry said the stuff she tends to do “thinks about things from the perspective of the individual in society, rather than as a customer. When designing algorithms as a business owner, your incentive is your profit, something for your business, it’s not an incentive to maximise something for the individual. If the two things align then that’s great, but generally you’re taking care of your business.”

The issue is where these two things diverge, when algorithms protect the business rather than individuals, she added. “Classic examples are insurance rates, or banks giving loans, where people from particular backgrounds are very unfairly disadvantaged because of the data category that they’re in. You could argue that unfairness extends out to other types of commercial software – there was LinkedIn showing higher paid job advertisements more often to men than women,” which was based on dodgy analysis too.

Inevitably there are biases in data because you can’t capture the completeness of the real world. Not matter how rich your data sources are, you can’t capture the vast richness of reality, and as a result anything you leave out will bias how the world looks through your data. And that’s fine, but we have to be aware that that’s happening.

“And anytime a programmer makes a decision about how to deal with data, how to average it or clean it, you’re imparting more of your own bias on it. Even professionals making their data as impartial as possible, they are expecting the representation of reality that it gives them.

“Sometimes these assumptions and biases can be really hidden, and that can be dangerous,” she added, “but at the same time, though, it’s not as if live biases don’t exist in systems without algorithms and data,” noting studies showing that judges have passed harsher sentences just before lunch, or when local football teams have recently lost a game.

It could be sweet

There’s a possibility – as with the work of startup Numerai, as covered by Wired – to use algorithms within a social system that is “much more open source and collaborative,” said Dr Fry. “That’s one way to guard against these biases and unintended consequences that can end up having a damaging effect.

“I work in an interdisciplinary department. When you’re looking into the data of social systems or how society’s structures, the silos that were created a couple of hundred years ago don’t apply. It has to be a collaborative effort.

“Imagine life without any algorithms at all, you wouldn’t be able to do anything. This is already completely encompassing. We have a habit of over-trusting what mathematics or computer scientists tell us to do, without questioning it, too much faith in the magical power of analysis.

“I would like people to know more that there are limitations. Algorithms and data should support the human decision, not replace it.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/20/dr_hannah_fry_even_in_the_nhs_we_need_to_beware_of_algorithms_behind_closed_doors/

The laptop, taken from Brooklyn, also contains information on Trump Tower floor and evacuation plans.

A US Secret Service agent had her laptop and some sensitive documents stolen from her car parked in the driveway of her home in Brooklyn, reports CBS2 quoting sources. Although it is believed the laptop does not contain sensitive data on the White House, it has Trump Tower floor and evacuation plans, and details of the Hillary Clinton campaign email hack probe.

Sources say surveillance camera footage does not show the actual theft but shows a man exiting a car on the agent’s street and later walking down another street with the laptop bag. NYPD found and recovered the bag sans the laptop from the location where another video footage shows the man throwing it. The bag stolen also contained “lapel assignment pins.”

The investigation is ongoing and authorities are treating this theft as a compromise of national security, says CBS News.

More on CBS New York.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/secret-service-agents-laptop-with-clinton-hack-probe-details-stolen/d/d-id/1328437?_mc=RSS_DR_EDT

The IRS, along with state tax agencies and the tax industry, urge people to be wary of phishing email scams.

The Internal Revenue Service (IRS) joins state tax agencies, and the tax industry, in warning tax professionals and taxpayers of phishing email scams as the 2017 filing season comes to a close.

Tax-related scams are popular as the April 18 deadline approaches. Phishing emails with tax themes, which may request last-minute deposit changes for refunds or account updates, are common. One scam, posing as the taxpayer, asks tax preparers to change refund destinations. Taxpayers could also receive fake emails from tax software providers to update account information.

To better protect themselves, the IRS urges taxpayers to recognize phishing emails, calls, or text messages pretending to be from software companies or banks. Tax professionals should strengthen their account passwords and verbally confirm last-minute changes with clients.

Taxpayers who receive suspicious messages claiming to be from the IRS, or from tax software providers, should forward them to [email protected].

Read more details from the IRS here.  

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/irs-warns-taxpayers-of-email-scams/d/d-id/1328438?_mc=RSS_DR_EDT

As more organizations crowdsource the vulnerability-hunting of their software, the process itself has become more formal, as well as more lucrative for researchers.

Recent news about Google and Microsoft substantially increasing their rewards for certain vulnerability disclosures and Intel launching a new bounty program signal the surging popularity of crowd-sourced bug hunting.

Google earlier this month announced that it had increased the maximum reward for remote code execution bugs to over $31,000 from $20,000 previously. Bugs involving unrestricted file system or database access now fetch $13,337, compared with the $10,000 Google used to pay for them. Google security program manager Josh Armour described the move as recognition of how much harder it has become for security researchers to find high-severity bugs.

Microsoft, meanwhile, announced that bug hunters who find flaws in its Exchange Online and Office 365 Admin Portal between March and May this year can earn up to $30,000, or double the usual reward for such finds.

Intel also has launched a program under which it will offer up to $30,000 for critical flaws in its hardware, $10,000 for similar flaws in its firmware, and $7,500 for software bugs.

The announcements come against the backdrop of the Zero Day Initiative’s Pwn2Own hacking contest last week in Vancouver, and reflect what several say is the growing and quickly evolving nature of bug bounty programs.

Here are some of the biggest shifts in these vulnerability programs:

Organizations Offering Bug Bounties Have Become More Diverse

There’s been a rapid growth in the adoption of bug bounty programs over the past year, says Jason Haddix, head of trust and security at Bugcrowd, one of the pioneers in the managed bug bounty program space.

Haddix says he has seen a big uptick both in the number of organizations launching bug bounties as well as the kind of organizations launching them.

“Today, bug bounties are no longer just for the early adopter tech giants,” Haddix says. “They’re for organizations of any size and level of security maturity.”

Over the last year, Bugcrowd has launched programs for financial companies, automakers, retail companies, and consumer electronics firms, among others. “Today, the industry has accepted the value of bringing the crowdsourced testing model to custom web applications, IoT devices, and basically any other type of software,” Haddix says.

The Number of Bug Hunters and Vulnerability Submissions is Going Through the Roof

Bug bounty programs have given security researchers of all skill levels and from around the world a legitimate way to monetize their bug discoveries. Not surprisingly, the programs have proved to be a magnet for the community.

HackerOne, which like Bugcrowd manages bug bounty programs for other organizations, has over 100,000 hackers registered with it. Over 4,700 of them have been rewarded for bugs reported, says Michiel Prins, co-founder of HackerOne.

The platform has helped some 750 organizations across multiple industries resolve a combined total of more than 40,000 bugs so far and paid out $15 million for it. Over 75% of the companies that sign up with HackerOne get a bug report in less than 24 hours.

“We’ve seen a marked increase in the number of researchers signing up for these programs,” adds Bugcrowd’s Haddix. The number of vulnerability researchers signed up with Bugcrowd has doubled in the past 12 months, and until relatively recently, a majority of them used to be based in India. Now researchers from the US nearly equal those from India.

“During the last year, we’ve seen a surge in the number of submissions as well as in the number of payouts with a 287% increase in researcher payouts and a 66% increase in the size of the average payouts,” Haddix says.

Payouts Get Bigger – But Harder to Get

As Microsoft and Google’s announcements this week showed, organizations are willing to pay out bigger bounties for vulnerability disclosures than ever before. But getting them has become harder. The biggest rewards are reserved for bugs that are the hardest to find, the toughest to fix, or cause the most harm.

“The harder a vulnerability is to mitigate, the more we pay” is how Intel described payment  under its new bug bounty program.

That trend is reflected at the Pwn2Own contest. In 2007, all it took was a single bug to win a category, says Dustin Childs, director of communications for Zero Day Initiative, the organizer of the Pwn2Own hacking competition. “Today, complete exploit chains are required to fully win a category,” he says. “Teams need to put in hundreds of hours of preparation time to be successful during the contest.”

The increased effort required to succeed is mirrored in the prize increases, as well. While a total of $10,000 and a laptop were awarded in 2007 at Pwn2Own, contest winners in 2016 received some $450,000 in cash and prizes over multiple categories during the contest. This year, organizers expect to pay out at least $1 million.

“The contest has proven year after year to be the root of the research community. Bugs disclosed during the event inspire the broader community to seek out other similar vulnerabilities,” Childs says.

Vulnerability Pricing Models Get a Lot More Formal

As bug bounties have become more formal, so have the methods used to price them. When advising organizations how much they should pay for a bug, HackerOne considers the severity of a flaw; the scarcity or not of similar bugs; the potential impact; and the maturity of the program itself, says Prins.

Typically, the goal in setting bug bounties is not to compete with the black market on payout levels, but to encourage researchers to disclose flaws they discover in a responsible manner. “The better our ethical community is at finding vulnerabilities and our customers are at fixing them, the more scarce they become elsewhere,” he says.

Bugcrowd even offers a so-called Defensive Vulnerability Pricing Model to help organizations determine how much a disclosed flaw is worth. The guide is based on information gathered from tens of thousands of vulnerability submissions and sets rates for bugs based on their criticality, Haddix says. It offers guidelines on how much money an organization might want to allocate for its bug bounty program and what reward ranges attract the best talent, he says. “The majority of our programs are scoped in accordance with these guidelines,” Haddix says.

Bug Bounties aren’t for Everyone

“Bug bounty programs are an emerging way to discover vulnerabilities in software,” says Peter Kaloroumakis, chief technology officer at threat hunting and detection firm BluVector.

Companies are extracting value out of these programs and updating their software to address newly discovered vulnerabilities. At the same time, such programs make most sense for enterprise that are developing software products and not enterprises that are just using them.

[Hear Acuity Solutions President Kris Lovejoy discuss the rise of cyber-hunting to better defend against breaches during her session at Interop ITX on Thursday, May 18, at the MGM Grand in Las Vegas. To learn more about other Interop Security tracks, or to register, visit the live links.]

“An enterprise, which is using products, not creating them, is less likely to benefit from a bug bounty program,” Kaloroumakis says. “They should focus on applying standard controls, network security monitoring and consider traditional penetration tests” by third parties, he says.

Related Content:

• A Bug Bounty Reality Check
• Profiles Of The Top 7 Bug Hunters From Around the Globe
• The Bug Bounty Model: 21 Years Counting
  
• Portrait Of A Bug Bounty Hacker

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: http://www.darkreading.com/vulnerabilities---threats/bug-bounty-programs-are-growing-up-fast-and-paying-more/d/d-id/1328428?_mc=RSS_DR_EDT

Kirk ransomware comes in guise of stress-testing tool and demands 50 Monero ($1,100) to unlock.

A new kind of ransomware is doing the rounds these days with a Star Trek-themed decoder and a new ransom payment unit, Monero, according to a report by Cluley Associates. Called Kirk, the ransomware comes in the guise of a legitimate Low Orbital Ion Cannon (LOIC) tool used for testing a website’s capacity to deal with traffic load.

First noticed by Jakub Kroustek of Avast, Kirk appears on the victim’s website as “loic_win32.exe” which quietly creates an AES key that encrypts the files. Then a RSA-4096 public key converts the AES key into “pwd.” After encryption, Captain Kirk and Mr. Spock appear with the ransom demand.

Interestingly, Kirk moves away from the popular bitcoin crypto-currency and demands Monero. It first starts with 50 units of Monero ($1,100) and moves up to 500 units after two weeks ($11,000). Failure to pay up within a month results in the key being deleted.

If the victim agrees to pay the ransom, Spock appears on the screen to unlock the files.

Experts say pwd should not be deleted if victim will pay ransom because it contains the key.

Read details on Cluley Associates.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/endpoint/star-trek-themed-ransomware-demands-new-crypto-currency/d/d-id/1328436?_mc=RSS_DR_EDT