STE WILLIAMS

Google has removed malicious apps from the Google Play Store after discovering they were tricking users into downloading unwanted apps and plugins. These apps, which sent premium text messages and installed invisible apps in the background without users’ consent, were identified as part of the Chamois family.

Bernhard Grill, Megan Ruthven, and Xin Zhao, all Google security software engineers, found and removed the apps — which they described as one of the largest they have seen — using malware scanner Verify Apps. Researchers say Chamois apps can evade detection because they keep changing file formats – from .APK file to .JAR file and then to .ELF file.

“This multi-stage process makes it more complicated to immediately identify apps in this family as a PHA because the layers have to be peeled first to reach the malicious part,” they explain.

Though there is no official figure from Google about how many were victimized by Chamois botnet, an earlier study found that malware HummingBad made $300,000 per month through ad fraud.

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/mobile/google-removes-chamois-apps-botnet-from-play-store/d/d-id/1328414?_mc=RSS_DR_EDT

The personal data of more than 33 million employees from US-based organizations was found lying unprotected on the web, reports Help Net Security. The leaked information, available on Troy Hunt’s Have I Been Pwned service, had been compiled by US business service firm Dun Bradstreet (DB), which sells commercial data to businesses.

Security researcher Hunt got the data from a reportedly reliable source, and it is believed that it may have been stolen from the unprotected database of a DB customer. The information includes personal details such as email addresses and company information. Affected employees include those of the Department of Defense, US Postal Service, ATT, FedEx, Citigroup and others.

“In terms of where this data specifically came from, DB don’t believe it was directly from one of their systems and with thousands of customers purchasing this information, we may well never know who lost it,” says Hunt.

Although the leaked data was not classified, it carries the risk of misuse by cybercriminals who aim to impersonate employees and get their hands on more sensitive information.

Read more on Help Net Security.  

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/personal-data-leak-affects-33-million-us-employees/d/d-id/1328415?_mc=RSS_DR_EDT

Like other major data breaches, the one that allegedly exposed the CIA’s entire arsenal of malware tools has raised familiar concerns about vulnerability stockpiling, insider threats, and the importance of a robust breach detection and response capability.

The fact that many of these concerns are familiar and well-understood has only served to highlight the continuing challenges that organizations across the board still face.

Here are the four most important takeaways from the CIA leaks:

Insiders Are Hard to Catch

The sheer scope of the data theft from a supposedly super-secure network deep inside the CIA’s Center for Cyber Intelligence facility has prompted speculation that the heist was pulled off by a Snowden-like insider, or at least abetted by one.  

It hammered home once again how difficult it is, even for a technologically sophisticated organization like the CIA, to police the actions of insiders with privileged and legitimate access to enterprise systems and data.

The primary issue for organizations is that the insider threat represents a multi-competency problem, says Jeff Pollard, an analyst with Forrester Research. It is a multi-stakeholder issue that affects everyone from IT, security teams and app developers to business unit leaders, human resources and general counsel, he says.

“An [organization] has to know what their sensitive data is, who has access, how data is used and stored and how data flows through their own environment and partner environments,” Pollard says. In addition, there also must understand how data is used normally, so that they can begin to identify anomalies. “It’s a tremendously complicated endeavor to pull data from all those systems together, define a baseline, and then begin policing usage,” he says.

Insider breaches highlight the constant struggle within enterprises to choose between what is most secure and what is most productive, adds Tim Condello, technical account manager for Red Owl, a vendor of an insider threat platform.

Based on the fact that most of the leaked information involved mobile and hardware exploits, chances are that whoever stole the data worked for the group that collaboratively supported this effort or had access to systems used by the group, Condello says.

“Looking at the information available on the CIA data leak, it is apparent that either there were no proactive measures in place or the ones that existed could be circumvented,” he says. “The lessons that can be learned from this are to have a layered approach to controlling access and movement of data in their environment while also monitoring employee behavior.”

Don’t Get Too Fixated on the Zero-Days

As with the Shadow Brokers leak of NSA data last year, many of the CIA exploits that were leaked on WikiLeaks this month involved previously unknown zero-day flaws in technology products from major IT companies.

Zero-day flaws have the potential to cause big problems if attackers find a way to exploit them before a patch becomes available. Security researchers often urge organizations to prioritize patching of such vulnerabilities.

But instead of getting fixated on them, focus on the ones you do know about, says Ilia Kolochenko, CEO of Web security firm High-Tech Bridge.

Gartner predicts that 99% of all vulnerabilities exploited through 2020 will continue to be known security vulnerabilities for which patches are already available, for at least a year, Kolochenko points out.

“A 0-day is a sort of cherry on the cake, for very important targets that cannot be hacked by other means,” he says. “Otherwise, why spend on it, if a public exploit can bring the same results?”

What breaches such the CIA’s really highlight is the need for organizations to do a comprehensive and continuous inventory of all digital assets. Rather than worry about the potential for a zero-day exploit to be used against them, organizations are better off ensuring their assets are protected against the known ones. “By keeping all our devices and software up to date, we can avoid 99% of problems,” Kolochenko says.

Pay Attention to Those IoT Devices

Among the many CIA exploits that were leaked was one named Weeping Angel, which essentially turns a Samsung smart TV into a silent audio-recording device capable of listening in to conversations even after the device had supposedly been switched off. The exploit garnered attention not because it was particularly sophisticated, but because it demonstrated how trivially easy it is to hack many of the so-called smart “things” that are being connected to the Internet these days.

For enterprises, the exploit should serve as a warning of the potential for attackers to increasingly target vulnerabilities in industrial and commercial IoT products in order to then gain entry into the enterprise. Many IoT vulnerabilities stem from Web and Web-based interfaces that are riddled with issues like remote code execution bugs and hardcoded passwords, Kolochenko says.

The goal should be to try and secure the IoT environment as much as possible to prevent it from being a launching pad into the enterprise – or the source of data leaks and disruptions.

“Because an attacker has to get inside the network to accomplish any other goal including surveillance, IoT as an entry point is the place to start,” Pollard says. Obviously, not every firm has to worry about being snooped on via a rogue TV, he says, but some do.

“That’s why having a risk assessment that incorporates geopolitical threats or concerns is important,” Pollard says. Also important are practices like threat modeling: based on how the organization makes money, geographies in which it operates, sensitive intellectual property, and even potential clients that may make the organization a target.

Vulnerability Stockpiles Merit Another Look

The CIA’s stockpile of malware tools including several that take advantage of undisclosed flaws in widely used technology products once again stirred debate over responsible vulnerability disclosure by US intelligence agencies.

Some have argued that agencies like the CIA and NSA whose mission it is to develop offensive cyber-capabilities have a responsibility to disclose 0-day flaws to vendors so that the vulnerabilities get patched before adversaries use it against them.

In a report released after the CIA leaks, the RAND Corporation provided some perspective on this hot topic. RAND’s study of more than 200 zero-day flaws showed that the benefits of disclosing such flaws were not always as great as assumed. The report argues that most zero-days tend to remain hidden for years and the chances of two people finding same flaw are remote. So, sometimes it actually makes sense for agencies like the CIA to stockpile vulnerabilities.

But Daniel Castro, vice president at the Information Technology and Innovation Foundation, argues that such reasoning is dangerous. “Without comparing the actual stockpiled zero-day exploits of countries like China and Russia we do not know how much overlap exists here,” he says.

So the best approach is to disclose and patch zero-days as they are found. “Practically speaking, responsible disclosure is the only way to keep Americans secure,” he says.

Related Content:

• Stockpiling 0-Day Bugs Not So Dangerous After All, RAND Study Shows
• Reality Check: Getting Serious About IoT Security
• Dark Reading Radio: ‘Bug Bounties The Zero-Day Trade’
• 8 Surprising Statistics About Insider Threats

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/what-businesses-can-learn-from-the-cia-data-breach/d/d-id/1328413?_mc=RSS_DR_EDT

Great power comes with great responsibility, and all heroes face the decision of using their powers for good or evil. These heroes I speak of are called white hat hackers, legal hackers, or, most commonly, ethical hackers. All these labels mean the same thing: A hacker who helps organizations uncover security issues with the goal of preventing those security flaws from being exploited. If companies don’t have an ethical hacker working for them, they’re in a one-sided game, only playing defense against attackers.

Meet the Hackers
Companies house both developer and security teams to build out codes, but unfortunately, there often is little communication between the two teams until code is in its final stages. DevSecOps — developer and security teams — incorporates both sides throughout all of the coding process to catch vulnerabilities early on, as opposed to at the end, when making updates becomes harder for developers.

Although secure coding practices and code analysis should be automated-  and a standard step in the development process – hackers will always try to leverage other techniques if they can’t find code vulnerabilities. Ethical hackers, as part of the DevSecOps team, enhance the secure coding practices of the developers because of the knowledge sharing and testing for vulnerabilities that can be easily taken advantage of by someone outside the company.

Take, for example, Jared Demott. Microsoft hosts the BlueHat competition for ethical hackers to find bugs in its coding, and Demott found a way to bypass all of the company’s security measures. Let that sink in for a moment — he found a way to bypass all of Microsoft’s security measures. Can you imagine the repercussions if that flaw had been discovered by a malicious hacker?

Let the Hackers Hack
Security solutions (such as application security testing and intrusion detection and prevention systems) are a company’s first line of defense because they’re important for automatically cleaning out most risks, leaving the more unique attack techniques for the ethical hackers to expose. These could include things such as social engineering or logical flaws that expose a risk. Mature application security programs will use ethical hackers to ensure continuous security throughout the organization and its applications. Many organizations also use them to ensure compliance with regulatory standards such as PCI-DSS and HIPAA, alongside defensive techniques, including static application security testing.

You may be thinking, “What about security audits? Wouldn’t they do the trick?” No, not fully. Ethical hacking is used to build real-world potential attacks on an application or the organization as a whole, as opposed to the more analytical and risk-based analysis achieved through security audits. As an ethical hacker, the goal is to find as many vulnerabilities as possible, no matter the risk level, and report them back to the organization.

Another advantage is that once hackers detect a risk, vendors can add the detection capability to their products, thus enhancing detection quality in the long run. For example, David Sopas, security research team leader for Checkmarx, discovered a potentially malicious hack within a LinkedIn reflected filename download. This hack could have had a number of potential outcomes, including a full-blown hijacking of a victims’ computers if they had run the file. It’s probably safe to say that just the audit wouldn’t have identified this hidden flaw.

How to Hack
The good news for companies searching for someone to fill this role is that there are several resources for their own employees to learn more about ethical hacking and become a more-valuable asset.

The first step is to get certified. EC-Council has resources and certifications available, and if you want to continue brushing up on your ethical hacking skills, OWASP has you covered. While getting certified isn’t a requirement, I highly recommend this, because getting the basics down will help to provide a foundation on which to build. After you have the basics down, there are many tools and automated processes that can be utilized, but ethical hackers usually use penetration testing and other, mostly offensive, techniques to probe an organization’s networks, systems, and applications. In essence, ethical hackers use the same techniques, tools, and methods that malicious hackers use to find real vulnerabilities.

One Small Step for Companies, One Giant Leap for Hackers
What does this all mean for companies? Well, companies must first acknowledge how ethical hackers can help them. Strong application security programs need to focus both on the code security as it’s being developed, as well as in its running state — and that’s where ethical hacking comes into play. Nothing beats secure coding from the get-go, but mistakes do happen along the way, and that’s where ethical hacking experts can make a difference in an organization.

At the next meeting on staffing, ethical hackers should be right at the top of the list of priorities to keep your company, and its data, safe. 

Related Content:

• How I Would Hack Your Network (If I Woke Up Evil)
• Road Map To A $200,000 Cybersecurity Job
• The Industrial Revolution of Application Security

   

Amit Ashbel has been with the security community for over a decade and has taken on multiple tasks and responsibilities, including technical positions and senior product lead positions. Amit has experience with a wide range of security solutions, including network, endpoint, … View Full Bio

Article source: http://www.darkreading.com/perimeter/ethical-hacking-the-most-important-job-no-one-talks-about/a/d-id/1328400?_mc=RSS_DR_EDT

The increasingly blurred line between the Russian government and that nation’s notorious cybercrime underground was exposed in a very public way today as the US Department of Justice announced indictments of two FSB officers as well as two infamous Russian cybercriminals for their roles in the massive breach of Yahoo as well as other related hacks.

DoJ’s indictments charge that Russian nationals and agents of Russian intelligence agency FSB Dmitry Aleksandrovich Dokuchaev, 33, and Igor Anatolyevich Sushchin, 43, allegedly hired one of the FBI’s Most Wanted cybercriminals, Alexsey Alexseyevich Belan, aka “Magg,” 29, a Russian national and resident, as well as with Canadian and Kazakh national Karim Baratov, aka “Kay,” “Karim Taloverov” and “Karim Akehmet Tokbergenov,” 22 , to hack Yahoo systems and steal information from some 500 million Yahoo accounts.

They then used some of that stolen information to access accounts from Yahoo, Google, and other webmail services, as well as emails of Russian journalists, US and Russian government officials, and employees at a Russian investment banking firm, US financial services and private equity firms, a US airline, a Swiss bitcoin wallet firm, a US cloud storage company, the International Monetary Fund, and “employees of a prominent Russian cybersecurity company,” as well as other victims, the DoJ said. Many of the victims were high-level executives and officials.

The FSB agents worked for Russia’s Center for Information Security, aka Center 18, which is the FBI’s direct point of contact for cybercrime investigations and cases, which makes the indictments even more extraordinary than they already are. “The involvement and direction of FSB officers with law enforcement responsibilities makes this conduct that much more egregious. There are no free passes for foreign state-sponsored criminal behavior,” Acting Assistant Attorney General Mary McCord said in a press briefing today announcing the indictments.

While DoJ’s McCord said the indictments do not allege any connection to US investigations into Russia’s hacking and tampering in the US presidential election, the case ultimately could have wider tentacles than it appears on the surface. APT29 aka Cozy Bear is the cyber espionage arm of the FSB, and was named by the US intel community as a perpetrator – along with the Russian military (coined APT28/Fancy Bear) – in hacks and data dumps related to the 2016 US presidential election. APT28/Fancy Bear was behind the hack and ultimate dumping of Gmail messages of Clinton campaign manager John Podesta, for example.

“I don’t know if the Yahoo hack was a springboard per se” to the DNC and other election-related hacks, says John Bambenek, threat systems manager of Fidelis Cybersecurity, which assisted in the DNC breach investigation. “If the FSB has people hacking Yahoo, the same kind of people [with the same skillsets] are hacking other people’s emails. If it’s not the same guys, it’s people who work in the same office or next door,” he says. “At the end of the day, if these two FSB officials indicted weren’t involved in the DNC operation, they [likely] know who was.”

Then there’s the indictment of Dokuchaev, who was recently charged by Russian officials with cyber-treason, as was his supervisor, Sergei Mikhailov, for allegedly working with the CIA –  charges by Russian officials that came in the wake of the Obama administration and intelligence community going public with its findings that Russia had interfered with the 2016 presidential election with hacking, online leaks of stolen information, and fake news articles.

Security experts who investigate breaches and study cyber espionage and cybercrime gangs long have warned of a growing connection between nation-states and cybercriminals in their respective nations, especially in Russia, where the cyber underground can be a lucrative gig for a talented hacker.

Former US Attorney Ed McAndrew, who served for 10 years as a cybercrime prosecutor and National Security Cyber Specialist for the DoJ, says it’s the first publicly available indictment that confirms the Russian FSB’s collusion with Russian cybercriminals.

“They [the FSB] do it for plausible deniability and obfuscation, primarily,” says McAndrew, who is co-chair of law firm Ballard Spahr’s Privacy and Data Security Group. The intel agencies basically offer cover and protection to the cybercriminals and often allow them to make a little extra income on the side via the work, he says.

“They get a commission on behalf of FSB, but the FSB is also quite aware that these guys [cybercriminals] have multiple objectives,” he says. “They may do intel-gathering work of the FSB, but at the same time they will engage in their own financial gain, like spam campaigns or redirecting traffic to collect commissions, and theft of credit cards,” as in this case, he says.

Acting Assistant Attorney General McCord said federal investigators are seeing more nation-states working with cybercriminals, and not just with Russia. “We are certainly seeing more and more use by nation-states of criminal hackers to carry out some of their intentions.”

Former President Barack Obama in late December issued wide-ranging sanctions including some against the GRU and FSB, as well as against four GRU officers and three companies that allegedly supported the operations, in response to the Russian hacking and disinformation campaign during the US presidential election. The sanctions included Belan, who was already on the FBI’s Cyber Most Wanted list at the time, and the US formally ejected 35 Russian intelligence operatives from the United States and imposed sanctions on nine entities and individuals: Russia’s two leading intelligence services (the GRU and the FSB), four individual GRU officers, and three other organizations.

Today’s indictments aren’t the first by the US Department of Justice: the department in 2014 indicted five members of the Chinese military for allegedly hacking and stealing trade secrets of major American steel, solar energy, and other manufacturing companies, including Alcoa, Westinghouse Electric, and US Steel.

Spies Crooks

FSB officers Dokuchaev and Sushchin allegedly instructed and paid cybercriminals including Belan and Baratov to hack into systems and steal information from US and other targets. Belan and Baratov specifically were commissioned to steal email account access of thousands of people. Belan, who was indicted by the US in September of 2012 and again in June 2014 for various hacking crimes, was arrested in June 2013 but managed to escape to Russia before being extradited to the US. He was then harbored by the FSB officers to avoid detection by the US and other law enforcement entities.

Starting around November and December 2014, Belan, under the direction of the indicted FSB officials, pilfered a backup copy of some of Yahoo’s user database full of usernames, recovery email accounts, phone numbers, and other sensitive information needed to create account authentication Web browser cookies for some 500 million Yahoo user accounts. Belan also hacked into Yahoo’s Account Management Tool for the FSB: that’s Yahoo’s internal tool for updating and logging changes to user accounts. With the Yahoo database and account management tools at their disposal, Belan, Dokuchaev and Sushchin looked for Yahoo email “accounts of interest” and created cookies for them so they could access some 6,500 targeted email accounts.

Belan double-dipped as well, stealing credit card numbers and gift cards from Webmail accounts, and pilfered contacts from some 30 million exposed accounts in order to wage spam campaigns. He also engaged in search engine fraud via Yahoo to make money.

The FSB officers later hired Baratov to steal more than 80 email accounts they needed that were not Yahoo accounts. He was arrested in Canada on March 14 by local authorities.

Vitali Kremez, a senior intelligence analyst at Flashpoint, says another intriguing aspect to this case is how indicted FSB officer Dokuchaev had such close ties to the cyber underground in Russia.

“Dokuchaev was an active member in the underground, even after joining the FSB,” he notes, shining a light further on how Russian nation-states work closely with the cybercrime world. He even had a hacker nickname, “forb,” and had been arrested in 2012 in Greece for hacking an ecommerce site with health insurance information. He returned to Russia thereafter, according to Kremez.

Belan has a reputation for his Web hacking skills, while Karem is known for his email penetration hacking services, notes Kremez.

Like in the US, government jobs in Russia don’t pay as well as the private sector, and Russia’s well-established and entrenched cybercrime realm is especially lucrative. “They live a very lavish lifestyle,” so many are attracted to cybercrime rather than cyber espionage, he notes. “The lines are very blurry a this point” between state actors and cybercriminal activity, he says.

They also employ many of the same hacking tools, and access them from the same places, according to one source with knowledge of the attack groups. “There’s always been a lot of evidence that these FSB actors are working with criminal elements” and this case demonstrates that, according to the source, who requested anonymity.

This case likely is the tip of the iceberg in the Russian hacking machine’s activities against US interests. “This is the beginning of a true avalanche of information on PawnStorm/Fancy Bear that will be [revealed] in hearings soon,” says Tom Kellermann, CEO of Strategic Cyber Ventures.

But like the 2014 indictments by the DoJ of the Chinese military officers for cyber espionage activity – which were the first-ever such indictments of nation-state actors by the US – the Russian indictments aren’t likely to do much more than send a political message. Experts certainly don’t expect Russia to extradite any of the suspects.

“The whole indictment looks like a deterrent” or a warning, notes Flashpoint’s Kremez.

Even so, it’s a different approach by US officials. “It’s very unprecedented. We’ve never seen a Russian agent so publicly outed by the US government.”

Related Content:

• Clinton Campaign Tested Staffers With Fake Phishing Emails
• Kaspersky Lab Incident Investigations Head Arrested In Russia For ‘Treason’
• Putin Directed Cyberattack, Propaganda Operation To Influence US Election 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: http://www.darkreading.com/endpoint/doj-indicts-russian-fsb-officers-and-cybercriminals-in-yahoo-breach/d/d-id/1328412?_mc=RSS_DR_EDT