STE WILLIAMS

Security researchers have discovered multiple vulnerabilities in Confide, the encrypted messaging app reportedly used by President Donald Trump’s aides to speak to each other in secret.

IOActive reported flaws it had discovered in Confide to the app’s developers, who responded promptly by patching the application, allowing IOActive to go public with a run-down of the recently resolved security weaknesses on Wednesday.

IOActive security researchers Mike Davis, Ryan O’Horo, and Nick Achatz said they uncovered the flaws after testing Confide version 1.4.2 for Windows and OS X, 4.0.4 for Android by reverse-engineering the published application, observing its behaviour, and interacting with the public API. Security problems identified in the app fell under four major areas, which they claimed included:

• HTTPS: The application’s notification system did not require a valid SSL server certificate to communicate, creating a possible mechanism for Man-in-the-Middle attacks.
• Messaging: Unencrypted messages could be transmitted, and the user interface made no indication when unencrypted messages were received, they said. The application uploaded file attachments before the user sent the intended message.
• Account Management: The unpatched application allowed an attacker to mine all Confide’s user accounts, including real names, email addresses, and phone numbers. The application failed to adequately prevent brute-force attacks on user account passwords. Users were permitted to choose short, easy-to-guess passwords.
• Website: The application’s website was vulnerable to arbitrary URL redirection, a weakness that might be abused to run social engineering attacks against its users.

These various vulnerabilities open the way up to all manner of malfeasance, including but not limited to impersonating another user by hijacking their account session, commandeering accounts after running a brute-force attack to guess passwords, harvesting the contact details of targeted users, eavesdropping on chats, and altering the contents of a message or attachment in transit without first decrypting it.

In response to queries from El Reg, Confide confirmed the now resolved vulnerabilities, adding that it had not uncovered any evidence that these flaws had been used to target users of the mobile messaging app.

As a confidential messenger, privacy and security is at the heart of everything we do. Our security team continuously monitors our systems to protect our users’ integrity, and we were able to detect anomalous behavior and remediate many of the issues in real time during IOActive’s testing starting on February 24.

We were able to quickly address the remaining issue after the initial contact and roll out client updates in less than 48 hours. Not only have these issues been addressed, but we also have no detection of them being exploited by any other party. Privacy and security is always an ongoing process. As vulnerabilities arise, we remain committed to addressing them quickly and efficiently, as we have done in this and every instance.

Confide releases an updated Windows client (1.4.3), which includes fixes for the critical issues identified by IOActive on 3 March. IOActive notified Confide on problems uncovered in its testing late last month, a prompt response praised by IOActive.

IOActive’s advisory on its research into vulnerabilities in Confide can be found here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/08/trump_aides_messaging_app_insecurities/

Newly discovered security flaws in popular printers remind us how networked devices continue to put users at risk.

Networked printers for years have left gaping holes in home and office network security. Today, experts continue to find flaws in popular laser printers, which are putting businesses at risk.

Experts at the University Alliance Ruhr recently announced vulnerabilities in laser printers from manufacturers including Dell, HP, Lexmark, Samsung, Brother, and Konica. The flaws could permit print docs to be captured, allow buffer overflow exploits, disclose passwords, or cause printer damage.

Up to 60,000 currently deployed printers could be vulnerable, they estimate.

When unprotected, printers expose users to several types of attacks, says Jeremiah Grossman, chief of security strategy at SentinelOne.

Hackers can use vulnerabilities to capture old printer logs, which may contain sensitive information. They may also use these flaws to establish their foothold in a networked device and move laterally throughout the organization to gather data.

Some attackers want to wreak havoc outside a single business. With networked printers under their control, a cybercriminal may use one company’s bandwidth to perform DDoS attacks on other organizations and individuals around the world.

These examples are among the many types of damage that will continue to threaten security as part of the growing Internet of Things, Grossman predicts.

“Most of the time, printers are not going to be terribly different from any IoT device,” he explains. Hackers who find vulnerabilities in the web interface can take over, as they could for any device connected to the network.

The difference, of course, is printers have been around far longer than most IoT products. So why is their security still a problem?

Part of the issue is lack of awareness. “Normally, the purchasers of network-connected printers aren’t concerned,” he says. “‘Why should I be concerned about a printer?’ they ask. “But it’s not just a printer; it’s a computer inside a printer and should be treated as such.”

Ownership is another factor, says Ed Wingate, vice president and general manager of JetAdvantage Solutions at HP. Printers are shared devices, and it’s often unclear whether they belong to IT, facilities, or the team responsible for purchasing them. “This leads to ambiguity over who should control the security of each device,” he says.

There is also the longstanding issue of vendors not supporting patches on older devices, a problem that relates to dysfunctionality in the market, says Grossman. Vendors are more relaxed about security because they aren’t liable when devices are not secure, he explains.

This presents a market failure that will be difficult to correct because patches won’t be made available. Even when they are, devices won’t be patched often. Grossman views printer security as less of a technical issue and more of a market problem. Businesses have the information they need to protect themselves, he says, but they won’t be secure due to lack of incentive in the system.

Wingate adds that implementing intrusion detection solutions is difficult on printers because most have proprietary operating systems, which used to be tougher to hack. “With the increased scale and professionalization of the hacking industry, now, embedded operating systems are equally interesting targets,” he says.

Users with printers running proprietary operating systems can’t rely on third parties to develop custom anti-virus solutions, he says. Print manufacturers need to build their own.

HP, he says, partnered with intrusion protection software providers to build JetAdvantage Security Manager, which uses a standards-based approach to protect data across enterprise printer fleets. This makes it easier to manage printer settings and switches.

There used to be an expectation that printers should be managed in the same way PCs are, but the print industry didn’t do enough to help users do it, Wingate continues. Part of the challenge is helping businesses figure out how to translate PC security into printer security.

Security managers must be alert as printer flaws continue to make headlines.

Printers will become more popular targets over time, Grossman predicts. Threat actors employ techniques that easily accomplish their goals. Right now the easiest vectors include web hacking and email attacks, but they will move to IoT as computers and operating systems get more secure. Printers are low-hanging fruit, he says, and easier to target.

For businesses working to improve their printer security, he advises regularly checking manufacturer websites to see if patches are available. He also recommends isolating printers on local networks, separate from PCs, and disabling out-of-network communication so even if they’re hacked, printers can’t interact with adversaries outside the organization.

Wingate suggests adopting the same baseline security practices businesses employ for computers; for example, periodically update passwords so sensitive content isn’t left in the open for people to steal. He also recommends intrusion detection, another practice people use for their PCs but don’t frequently employ on printers.

Related Content:

• Malware Kits, Advertising Trojans Drive Mobile Risk
• Hacked Robots Present a New Insider Threat
• Best Practices for Lowering Ransomware Risk

 

Kelly is an associate editor for InformationWeek. She most recently reported on financial tech for Insurance Technology, before which she was a staff writer for InformationWeek and InformationWeek Education. When she’s not catching up on the latest in tech, Kelly enjoys … View Full Bio

Article source: http://www.darkreading.com/endpoint/why-printers-still-pose-a-security-threat/d/d-id/1328316?_mc=RSS_DR_EDT

In the next year, we’re going to see a leap towards strategic, business-level objectives that can be resolved by simplifying infrastructure and greater visibility in real time.

With more businesses committed to the cloud, we all need to be asking questions about where our data is stored, how it’s accessed, how data is regulated as it crosses international borders, and how threats are detected, mitigated or (hopefully it doesn’t come to this) remediated.

Security is a business and needs to be treated like one. Instead of getting into the technical weeds and trying to solve security problems with tactics, businesses need a smart strategy. That starts with asking the right questions and up-leveling the conversation with the goal of getting to the heart of a problem to put an end to it.

As found in a recent study by Citrix and the Ponemon Institute:

• 64% of respondents said they do not believe their organization can effectively reduce the inherent risk of unmanaged data.
• 68% said their employee-owned devices might be allowing criminals access to corporate networks and data.
• 60% said that they’re not effective in protecting sensitive apps and data at rest, in use and in motion
• Only 37% of respondents said their organization is highly effective in using access control and multi-factor authentication solutions to protect information on devices, servers or in the cloud.

All of these statistics show the same thing – businesses are still trying to solve security business challenges with tactics, instead of looking at the big picture. The industry itself needs to adopt a more proactive, preventative mindset, and build security into solution architectures. Only by doing that can businesses get back to the core of their business and let IT companies worry about IT.

Prevention Trumps Detection
As businesses get smarter about security, we’re going to see them taking a closer look at prevention technologies rather than detection. This will move the industry to a more strategic level, versus tactical problem-solving through traditional detection and analysis services that merely confirm that you have a problem. (Not helpful!) Organizations need to know where to find the solution and what they can do about the problem. These are the business-level questions that need to be addressed first.

In the next couple of years, we’re going to see more adoption of prevention technologies that incorporate machine learning and predictive analytics that identify normal versus abnormal behaviors. The process of behavior analytics will be automated to proactively identify anomalous behaviors, flag them and require additional credentials to “pass go.” As more businesses adopt and become familiar with cloud security and emerging technology best practices, trust is going to become a measureable outcome.

Don’t Underestimate Trust
For the first time, we’re seeing that trust can be delivered across the hybrid infrastructure without ten layers of detection and “deterrents.” In the next year, we’re going to see a leap towards simplification of infrastructure, and removal of security technologies that aren’t adding value.

Going back to the Ponemon study, respondents said that the top two goals of a new security framework include a unified view of users across the enterprise (53%) and the ability to keep up with new or emerging attacks (48%). These are business-level strategic objectives that can be solved by simplifying infrastructure and creating more visibility.

This simplification is going to naturally lead to a more unified view across the enterprise. The goal is to give IT a glass wall where they can easily see what’s happening across the enterprise and address issues in real-time. The outcome of that will be a more strategic security organization that can stop threats before they become breaches.

Related Content:

• IaaS: The Next Chapter In Cloud Security
• National Security, Regulation, Identity Top Themes At Cloud Security Summit
• Why Dependence On Cloud Providers Could Come Back And Bite Us

 

Stan Black, CISSP, is CSO of Citrix where he is in charge of the secure delivery of applications and data to some of the world’s largest organizations in healthcare, financial services, public sector, and manufacturing. Black defines a converged cyber security posture … View Full Bio

Article source: http://www.darkreading.com/perimeter/trust-cloud-and-the-quest-for-a-glass-wall-around-security/a/d-id/1328343?_mc=RSS_DR_EDT

We’re still going through the 8,761 CIA documents published on Tuesday by WikiLeaks for political mischief, although here are some of the highlights.

First, though, a few general points: one, there’s very little here that should shock you. The CIA is a spying organization, after all, and, yes, it spies on people.

Two, unlike the NSA, the CIA isn’t mad keen on blanket surveillance: it targets particular people, and the hacking tools revealed by WikiLeaks are designed to monitor specific persons of interest. For example, you may have seen headlines about the CIA hacking Samsung TVs. As we previously mentioned, that involves breaking into someone’s house and physically reprogramming the telly with a USB stick. If the CIA wants to bug you, it will bug you one way or another, smart telly or no smart telly. You’ll probably be tricked into opening a dodgy attachment or download.

That’s actually a silver lining to all this: end-to-end encrypted apps, such as Signal and WhatsApp, are so strong, the CIA has to compromise your handset, TV or computer to read your messages and snoop on your webcam and microphones, if you’re unlucky enough to be a target. Hacking devices this way is fraught with risk and cost, so only highly valuable targets will be attacked. The vast, vast majority of us are not walking around with CIA malware lurking in our pockets, laptop bags, and living rooms.

Thirdly, if you’ve been following US politics and WikiLeaks’ mischievous role in the rise of Donald Trump, you may have clocked that Tuesday’s dump was engineered to help the President pin the hacking of his political opponents’ email server on the CIA. The leaked documents suggest the agency can disguise its operations as the work of a foreign government. Thus, it wasn’t the Russians who broke into the Democrats’ computers and, by leaking the emails, helped swing Donald the election – it was the CIA all along, Trump can now claim. That’ll shut the intelligence community up. The President’s pet news outlet Breitbart is already running that line.

Back to the leaked files. One amusing page gives details of discussions within the CIA on how to avoid having its secrets leak in the wake of the theft of the NSA Equation Group’s hacking tools. Along with a detailed report [PDF] on the Equation Group hack, there are suggestions on how to protect resources.

The CIA and the White House have yet to comment on the veracity of the leaked material and are unlikely to do so. But at least one former intelligence worker with knowledge of such matters seems convinced they are real.

Still working through the publication, but what @Wikileaks has here is genuinely a big deal. Looks authentic.

— Edward Snowden (@Snowden) March 7, 2017

So here’s a rundown of the highlights so far. With so much material to go through, some important things will have been missed. Feel free to add your own insights in the comments section. We note that a good number of these cyber-weapons were obtained from the NSA, GCHQ or private computer security researchers.

• Windows: The CIA’s UMBRAGE team has a modest collection of attack tools for systems powered by Microsoft’s widely used operating system, all listed here. These tools include keystroke loggers, sandbox escape ropes, and antivirus avoidance mechanisms. The CIA analysts found flaws in Control Panel, and the ability to add data streams to NTFS without detection to smuggle data onto storage drives. Windows library files are useful stepping stones to malicious code execution, as are Windows Theme files.

  DLL files [PDF] are a popular attack vector for the CIA PDF]. They are also handy for concealing malware in applications, and the documents show that common apps have been used for spying by exploiting DLL weaknesses.

  One DLL attack technique shows that someone at the agency is a bit of a Will Ferrell fan. The RickyBobby program, named after the character in the film Talladega Nights, uses several .NET DLLs and a Windows PowerShell script to implant a “listening post” on a target Windows PC.

  A version has been used in the field on USB drives, according to this document. The software, with attack tools dubbed Fight Club, was put onto six thumb drives and “inserted into the supply chain of a target network/group.”

  If you’re using Windows Exchange 2010, the CIA has a tool for that, dubbed ShoulderSurfer. This performs a code injection attack against the Exchange Datastore manager process that would allow an agent to collect emails and contacts at will and without the need for an individual’s credentials.

  Exchange 2007 is even easier to crack, according to the CIA. For a detailed rundown on Exchange and all its flaws, this document [PDF] should be helpful to Microsoft engineers looking to fix the problems.

• OS X: Users of Apple’s OS X shouldn’t look too smug, however. The CIA has tools for you too – pages of them.

  A lot of hacking tools cover OS X El Capitan, but presumably these have been updated to subvert new versions of the operating system. That said, it does seem through reading these files that Apple poses a significantly more difficult challenge for the CIA than Redmond’s code.

  Analysts note that the operating system can be resilient to applications that try to slip malware onto a Mac. But it’s still possible to whitelist spying software; subvert NetInstall images, creating zombie programs; and surreptitiously get at the kernel.

  One interesting project the files touch on is dubbed QuarkMatter. This is a technique for hiding spying software persistently on an OS X system by using an EFI driver stored on the EFI system partition. Another, dubbed SnowyOwl, uses a pthread in an OpenSSH client to potentially pull off remote monitoring of a target system.

  The documents also show a project called HarpyEagle that analyzed Apple’s Airport Extreme firmware for private keys, and also Time Capsule systems.

• iOS: The CIA files show an extensive list of iOS exploits. Some of these were developed in-house, some obtained from the NSA or Britain’s GCHQ, and others were purchased from private vendors. It looks as though at least some of the security bugs were fixed by Apple in recent iOS updates – versions 8 and later – or are otherwise no longer exploitable. For instance, the Redux sandbox workaround and Xiphos kernel exploit were both used to hack “iPhone 4S and later, iPod touch (5th generation) and later, iPad 2 and later,” but both flaws were fixed after being publicized by the Chinese jailbreaker Pangu.

  While it’s likely the exploit list is an old one, a lot of them may still work. iOS 8 appears to have killed off a few, but most of the exploits don’t have death dates listed.

  The Dyonedo exploit, developed by GCHQ, allows unsigned code to run on iOS devices, while the CIA’s homegrown Persistence tool allows “a symbolic link [to] be created (on iOS 7.x) or an existing file can be overwritten (iOS 8.x) that will run our bootstrapper, giving [users] initial execution on every boot.”

  While full root is a goal, the documents also detail an attack known as Captive Portal. This sets up the browser to route all web use through a server run by the CIA.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/08/cia_exploit_list_in_full/

One in five websites (21 per cent) are still using certificates signed with the vulnerable SHA-1 hash algorithm, according to a new survey.

Reliance on the obsolete hashing technology leaves companies at greater risk of security breaches and compliance problems, certificate management firm Venafi warns.

Venafi’s latest study shows there has been improvement since November 2016, when a third (35 per cent) of websites were still using SHA-1.

SHA-1 is an outdated encryption algorithm known to be potentially insecure since 2005. Last month researchers at Google worked with academics to demonstrate a successful collision attack on the algorithm, a practical (if difficult and resource intensive) attack that underlines the need for change.

Google, Microsoft and Mozilla set deadlines in early 2017 for websites to migrate, saying they would no longer trust sites otherwise.

Newly issued certificates using the SHA-2 family of hash functions solve these problems, but Venafi’s research shows that many companies have not replaced all their certificates with ones signed by SHA-2. This leaves organisations open to security breaches, compliance problems, and outages that can affect security, availability and reliability.

Web transactions and traffic may be disrupted in a variety of ways due to insecure SHA-1 certificates. Browsers will display warnings to users that the site is insecure, potentially prompting users to look for an alternative site.

In addition to the serious impact on user experience, websites that continue to use SHA-1 certificates are likely to experience a significant increase in help desk calls and a reduction in revenue from online transactions as users abandon websites due to security warnings.

Kevin Bocek, chief security strategist for Venafi, commented: “Even though most organisations have worked hard to migrate away from SHA-1, they don’t have the visibility and automation necessary to complete the transition. We’ve seen this problem before when organisations had a difficult time making co-ordinated changes to keys and certificates in response to Heartbleed, and unfortunately I’m sure we are going to see it again.”

Venafi’s research is based on analysis of data from more than 33 million publicly visible IPv4 websites using Venafi TrustNet, a proprietary database and realtime certificate intelligence service. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/08/sha1_certificate_survey/

Sysadmin blog Hardly a day passes without some kind of major security breach. The type of attack that was once considered staggering in scale has now become the norm.

When a Yahoo! breach was found to have lost a billion accounts, it seemed the only thing anyone found unusual about it was that Yahoo! had a billion accounts to lose.

Don’t become complacent. As the threats have evolved so the industry has coalesced around new product categories and definitions – next-generation security.

But go to any security conference and you’ll find the same vendors promising to save the world, only this time using some AI-enhanced machine-learning proxycondom replete with coloured charts presented in smell-o-vision will spend half their keynotes banging on about “preventative best practices”.

The truth is, that the next-generation security software that’s out there really isn’t that good and you’re not nuts because you look at it and see nothing but holes.

Forewarned is forearmed. Here, then, is a quick run through how the vendors and their products have coalesced around next-generation security.

IDaaS

One area where hype is giving way to usable solutions is ID as a Service (IDaaS). Identity management technology has been around for ages, with Microsoft’s Active Directory having dominated the identity and access control for more than 15 years. That’s changing as identify management grows to encompass public cloud solutions and integrates directly into applications.

Microsoft is still a major player with Azure Active Directory, but all the big names are represented here. Google, Facebook and even Twitter increasingly are increasingly providing individuals’ online identity and – in Google’s case at least – that of organizational employees.

Smaller organizations like Centrify are looking to take over, though some governments are rising to the challenge as well. Estonia’s electronic ID card is the canonical example.

It is right and proper that of all the categories of security hype in 2017 IDaaS is the furthest along. Everything else in IT security hangs off of identity. Without secure, reliable ID, everything else is suspect. With so many different services, platforms and applications to integrate, “as a Service” is the only sane way to do it.

While the majority of IDaaS deployments seem to be centred around enabling identity and authentication for or across multiple SaaS applications, it’s worth noting that this is slowly changing. Some organizations are using Google’s IDaaS (though not, to my knowledge, Facebook or Twitter) for internal directory authentication, via services such as Jumpcloud.

This is increasingly common in, for example, education. “Google Schools” are a really big thing in North America, and in many cases the Google-provided identity has more relevance than a Microsoft Active Directory provided one, leading some organizations to do away with it altogether.

Where Twitter, Facebook and the like are pushing outside of their traditional SaaS utilization is as customer-facing authentication services that then map back to an internal directory solution. This is used for situations where external-facing users (typically consumers) are to be granted limited access to internal resources.

CASB

Cloud Access Security Brokers (CASB) seek to prevent stupidity leaking from an organization’s premises onto the wider internet. In a perfect world, they would monitor everything from social media to cloud storage and have a tantrum whenever idiocy was afoot.

Some CASB vendors have primitive solutions to the problem of people putting things into Dropbox that they really shouldn’t. Others search Twitter for naughty words and most will sniff email for undesirables.

Despite there being huge feature gaps in these next-generation hybrid proxies, CASB startups sell for a lot of money. For example, veteran Symantec bought Bluecoat for $4.65bn last year.

CASB can reasonably be described as a must-have technology for businesses of all sizes at this point, but they should be consumed with a high dose of caveat emptor. It is likely that the CASB vendors will never truly catch up to the explosion of SaaS solutions, social media and cloud storage they must defend against, making this a category of solutions perpetually in development.

SIEM

Security Information and Event Management (SIEM) is the younger, hipper name for monitoring software. As with all monitoring software SIEM solutions are miserable to use, even more miserable to configure, integrate poorly with a reasonable chunk of the things you need to monitor and aren’t aware at all of the other things you want to monitor.

What sets SIEM apart from plain old monitoring is that some consideration has been given to concept of information overload. Apparently people with money cottoned on to the concept that simply flooding sysadmins with alerts about every minor hiccough from every subsystem of every application under management just leads to sysadmins ignoring their alerts inbox. Who knew?

SIEM ranges from Big Panda with Nagios to more full blown offerings from the likes of Solar Winds and from relative newcommers such as Splunk to more traditional enterprise players including HPE, IBM and Intel Security.

SIEM isn’t so much a new security category as an old one that’s being reborn. Everything here is about machine learning, newer more AI-enabled filters and analytics that come in flavours. As always, the solution you really want is three times the budget you actually have.

Malware, phishing and scams

Speaking of machine learning and AI, so-called Next Generation Anti-Virus (NGAV) promises to use the power of big data and slightly tweaked algorithms to usher in a new era in the battle against Malware, phishing and various email scams. Marking claims for this category illicit doubt.

NGAV solutions as a whole are better than signature-only based solutions. Of course, most of us haven’t really been using signature-only based solutions for some time now. Claims that NGAV is better than traditional heuristic systems are still awaiting large scale independent verification, but there’s no reason to think they won’t be.

Much of the scepticism stems from the hard fact that no endpoint security system is 100 per cent effective. Vendors moved on from signatures to heuristics to public-cloud based machine learning and AI. This was promptly responded to by black hats employing machine learning and AI to defeat the NGAV being deployed by the vendors. It’s the same cat-and-mouse game it’s always been, only the tools have changed.

The real threat is the same as it has always been with endpoint security: that end users and organizations might actually believe that NGAV makes them secure. We all want to believe that we can simply install a security package and never think about the bad guys again. It’s simply not true.

Ransomware

Technically a type of malware, ransomware has matured into its own category. Traditional malware tried simply to infect your computer in order to copy your data or turn your system into one of the millions of zombie bots clogging up the internet with spam. Ransomware, however, encrypts your data and holds it hostage until you pay a hefty fine to get it unlocked.

Peddlers of NGAV are trying to cash in on the ransomware with vague claims about being “better” than traditional antivirus systems. But even the best at detecting ransomware or its behaviours will eventually let some through. It’s the nature of the beast.

The bad guys are still iterating far faster than the antivirus companies can keep up, next-generation or not. The best defence against ransomware is still proper backup software. This is true today and it will be true for all the foreseeable tomorrows.

EDR

Next-generation security is all being rolled into a category called Endpoint Detection and Response (EDR), even though many elements of EDR don’t happen on the endpoint. According to Gartner, EDR consists of incident data search and investigation, suspicious activity detection, threat hunting or data exploration, stopping malicious activity and alert triage or suspicious activity validation. All of the various categories discussed above blur into EDR.

There are a lot of players seeking to claim a slice of the pie. A by-no-means comprehensive list includes Barracuda, Bit Defender, Carbon Black, Bromium, Cisco Systems, CounterTack, CrowdStrike, Cybereason, Cylance, enSilo, FireEye, ForeScout, Hexis, Invincea, Malwarebytes, Mandiant, McAfee, Microsoft, RSA Security, Palo Alto Networks, SentinelOne, Symantec, Tanium, Trend Micro, Triumfant, Webroot, and Ziften. Some are established players, many are startups.

EDR is about more than simply sending samples back to the mothership. It the latest buzzword for defence in depth. At the edge, at the endpoint, tracking odd authentication behaviour and yes, bringing as much data – including application behaviour and malware samples – into public cloud-based machine learning analysis tools as possible. Then spitting it all back out into logs, dashboards and alerts that humans can cope with.

Security approaches are evolving, and a lot of data is being collected by next-generation offerings. What remains to be seen is if these vendors will spend the next product cycle trying to convince us that they and they alone have the solution to all our ills, or whether they’ll poor their knowledge and resources for all our benefit. In the meantime, we have new tools to learn.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/08/next_generation_security_is_mostly_hype/

WikiLeaks’ release of 8,761 pages of internal CIA documents makes this much abundantly clear: the agency has built a monster hacking operation – possibly the biggest in the world – on the backs of the many internet-connected household gadgets we take for granted.

That’s the main takeaway among security experts Naked Security reached out to after the leak went public earlier Tuesday.

Recap of events

For those just hearing the news, here’s a review of the last several hours:

WikiLeaks Tuesday launched a new series of leaks on the US Central Intelligence Agency it calls “Vault 7”. It claims this will represent the largest dump of confidential documents on the agency in history. The first full part of the series is called “Year Zero” and includes documents and files from an isolated, high-security network inside CIA headquarters in Langley, Virginia.

Wikileaks said in its press release that Year Zero introduces the scope and direction of the CIA’s global covert hacking program, its malware arsenal and dozens of zero-day weaponized exploits against a wide range of US and European company products, include Apple’s iPhone, Google’s Android and Microsoft’s Windows and even Samsung TVs, which are apparently turned into covert microphones.

It’s that mastery of Internet-of-Things (IoT) technology that has caught the attention of experts.

Hacking anything, anywhere

Eric Cowperthwaite, former VP of strategy for Core Security and now director of managed risk services for Edgile, said the CIA has built a capability to hack pretty much anything, anywhere. The CIA potentially has more ability now to intrude into servers, computers, smartphones and electronic communications than even the NSA.

Unfortunately, he added:

This capability is now in the hands of people other than the CIA. All the things you’ve read that seem like science fiction movie plots are really true. Other people can listen to you via your smart TV, can read your email, turn on the webcam on your laptop, without you ever knowing.

Christian Renaud, a 451 Research director specializing in IoT, said there are three possible scenarios at play:

1. It’s all a smear campaign by the Russians, Chinese or others to raise concerns about the US intelligence community;
2. It’s not a smear campaign and the NSA helped leak CIA sensitive data to gain points on the CIA, their rival; or
3. A third party penetrated the CIA and leaked the information à la Snowden to raise awareness of what can only be described as a methodical security war against enemies and US citizens by an intelligence agency.

If the latter is true, he said:

Your government has been using your own devices to spy on you without warrant. If you’re not upset, you should be.

Sobering, but hardly surprising

Though the information certainly has a chilling effect among privacy rights advocates, security experts say the narrative should be of little surprise.

Nick Selby, CEO of the Secure Ideas Response Team, said that if anyone had been thinking that government agencies have avoided a full-scale embrace of the cyber-weapons arena or held out hope that “We don’t do that kind of thing,” then this should settle the score once and for all.

That does not mean that the CIA – or any other government agency – is spying on ordinary American citizens. It is evidence, though, that it has worked hard to maintain a stockpile of cross-platform cyberweapons that make both targeted and mass surveillance possible, despite a range of advances in cryptographic communications tools in the hands of the public. 

In the grand scheme of things, Selby said, this is something every government engages in, and the CIA would have been remiss in its duties had it not been engaged in these activities:

For anyone to suggest that there is something inherently shady or disagreeable about an intelligence agency developing tools with which it can conduct intelligence operations for the purpose of intelligence gathering is to misunderstand the purpose of intelligence agencies. 

Cowperthwaite added:

Is WikiLeaks helping or harming?

Of course, whenever WikiLeaks dumps a bunch of information this way, the question must be asked: is it helping us be a better society by making us more aware, or is it simply generating chaos?

Cowperthwaite is torn, and brings up the example of Chelsea Manning, a United States Army soldier convicted by court-martial in 2013 for violating the Espionage Act and other offenses, after giving WikiLeaks nearly three-quarters of a million classified and/or sensitive military and diplomatic documents.

There is good and bad in this. We know that some of the Manning leaks had impacts on military operations. That was part of Manning’s trial. I also found it interesting that Wikileaks alleges that the US Intelligence Community has a problem keeping its cyberwar tools off the black market. And if the CIA, NSA, etc. can’t keep these things under control, that is something that citizens should know.

The debate over the CIA’s capabilities and the pros and cons of WikiLeaks’ document dumps won’t be ending anytime soon. As those interviewed note, today’s release was just the first instalment.

Follow @NakedSecurity
Follow @BillBrenner70

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/OJlzFW2XR8g/

Prison authorities in Ohio, US, mistakenly provided the social security numbers of thousands of inmates to a man convicted of identity theft.

The Mansfield News Journal says it was directly contacted by Lonny Bristow, who said he was sent the social security numbers of more than 2,000 prisoners when he made a public records request for inmate rosters at the Chillicothe Correctional Institution.

Bristow, whose past convictions included identity theft, making bomb threats, and telephone harassment, was supplied with an unredacted copy of the roster, which included, in addition to SSNs, each inmate’s name, date of birth, Bureau of Criminal ID number, release date, and housing assignment.

The former inmate, who served time in state and federal prisons, told the paper he immediately sought to go to the press with the information for fear he would face criminal charges for possessing the numbers.

“I knew I had to turn it into the media,” Bristow was quoted as saying. “I actually am truly done with the criminal life. Life’s too short. I could’ve used those Social Security numbers to open a credit card account but I didn’t.”

The Ohio Department of Rehabilitation and Corrections did not return a Reg request for comment on the matter, but the News Journal reports the department is investigating and is looking to provide identity monitoring services for the inmates.

Ohio is not alone in making embarrassing errors of this sort. In 2013, a clerical foul-up at the UK’s Ministry of Justice was blamed when the personal details of the inmate population of a Welsh prison were inadvertently sent out in a mailer to three families. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/08/ohio_leaks_ssns_identity_thief/

Spiral Toys, makers of the insecure Bluetooth-connected stuffed animals dubbed CloudPets, is being grilled for information by a US Senator.

On Tuesday, Bill Nelson (D-FL), ranking member of the Senate’s Committee on Commerce, Science and Transportation, sent Spiral ten questions demanding answers about the security of its voice-messaging cuddly toys.

CloudPets was earlier caught running an unsecured MongoDB installation, completely open to the world. That exposed hundreds of thousands of user account records – including email addresses and easily crackable hashed passwords – along with links to as many as two million voice recordings children and parents had sent each other via the toys and their iOS and Android app.

Within a day, it also emerged that the toys’ microphones could be accessed by nearby snoops, via Spiral’s poorly secured implementation of the Web Bluetooth API.

Nelson wants Spiral to explain its database leak in step-by-step detail, whether there’s any identity theft protection in place, and what control people have over data collected by their CloudPets.

He also wants to know whether the Children’s Online Privacy Protection Act applies to Spiral Toys’ operation, details about its data collection and who data is shared with, whether any other breaches have happened in the past two years, whether consumers have the chance to delete their data, and more.

The letter came to light via Microsoft MVP Troy Hunt, who investigated the MongoDB leak:

CloudPets is now being asked some very hard questions by law makers (shared with permission): https://t.co/eaK5IpUi80

— Troy Hunt (@troyhunt) March 7, 2017

The letter may reveal some actual useful information from California-based Spiral Toys. The biz sent a disingenuous statement to journalists in February. Back then it wrongly claimed the user data was “password encrypted,” and it was only a staging server that was compromised (it just happened to hold 500,000-plus production records). ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/08/us_senate_snaps_on_glove_probes_cloudpets_insecurity_breach/

Chinese security camera/DVR company Dahua is pushing firmware patches after accusations by a security researcher that a swathe of its products carried a back door.

First notified to video surveillance publication IPVM and the Full Disclosure list, the vulnerability is described as a “damn Hollywood hack, click on one button and you’re in” by its discoverer.

Full Disclosure poster “bashis” writes the vulnerable devices – DVRs, network video recorders (NVRs) and IP cameras – have a “secret” URL accessible to the Internet that accesses the user database without authentication.

So the takeover is simple: download the user list, choose an admin login and password hash, and remotely log into a Dahua device exposed to the Internet.

Bashis originally published a proof-of-concept at GitHub, but at the request of the company he’s taken it down until April 5 to let them push out a patch.

Dahua has pushed new firmware for eleven products, and its statement attributes the problem to a “coding issue”. This is feasible, we suppose, since developers often leave sensitive accounts open to make their job easy, and forget to lock things up later.

Bashis told IPVM he still believes it was a backdoor because the user list was unprotected and in a Web-accessible folder.

He also points out the stored password hashes are generated client-side (Javascript in the Web browser). In other words, the hashing is ineffective, because that’s (not the raw password) what’s sent as the login credential.

IPVM notes that Dahua was caught by the Mirai botnet last year, and in 2015, its systems were among the targets of a botnet designed not compromise, but to harden device security. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/03/08/dahua_video_kit_left_user_credentials_in_plain_sight/