hacking – Page 1402 – STE WILLIAMS

The 10 Most Cyber-Exposed Cities In The US

library
crime | hacking | security

At RSAC, Trend Micro researchers showcase municipalities with the highest percentage of discoverable devices and systems connected via the public Internet.

New research released today at the RSA Conference confirms conventional wisdom that unprotected Internet-facing devices are making things a lot less safe for all of us. In this case, an investigation by the Trend Micro Forward-Looking Threat Research Team found tens of thousands of webcams, network attached storage devices, routers, printers, phones, media players among those devices discoverable on the Internet like sitting ducks.

The team took a look at how these exposures are distributed across the biggest US cities and put both their owners and others online at risk of data theft and exposure, lateral movement to more valuable network assets, and DDoS attacks perpetrated by their forced participation.

The researchers will be diving into the specifics of their report, US Cities Exposed: A Shodan-Based Security Study on Exposed Assets in the US, later today at RSAC. The report details the study they did of a month’s worth of Shodan search results looking for discoverable Internet-connected devices and systems that can be accessed via the public Internet, and which are located within the 10 US cities with the largest populations, according to the most recent census data.

The findings show that distributions of exposed cyber assets were disproportionate according to population size. The US’ second-most populous city, Los Angeles, topped the list of US cities with approximately 4 million exposed devices online. Meanwhile, the most populous city in the country by a landslide – New York – was a respectable seventh place when ranking these ten cities by overall exposed cyber assets. Even though New York has nearly four times the population of Houston, for example, it has 3.78 times fewer exposed cyber assets.

In terms of the types of devices and services found, firewalls were the number one exposure located within the cities assessed. In these instances, the administrative interface of the firewall is exposed, making it possible for attackers to attempt brute-force attacks to gain entry into the interface and, once inside, change firewall rules to allow malicious traffic into the network. The next most frequently found devices were webcams, routers and wireless access points, printers and PBX phones.

Researchers noted that the exposures likely come as a result of one or more factors, including poor configuration, required connectivity to make Internet of Things (IoT) function correctly, and remote access enabled to make remote troubleshooting or remote operations possible.

Cities examined in the research had different concentrations in the types of devices exposed. For example, Houston and Chicago came in first and second, respectively, for total exposed webcams. San Jose led the pack in terms of exposed PBX phones, as well as exposed devices using SNMP, and exposed devices using Telnet. Phoenix came in first for exposed NAS devices.

Perhaps most troubling to the researchers conducting this study was the number of exposed databases across all cities.

“Databases are a huge gap in security for companies where, if an attacker gets into the database, then you’re basically looking at them consuming everything without too much effort,” says Numaan Huq, senior threat researcher for Trend Micro. In particular, he notes that there were a significant number of medical databases exposed on the Internet.

The study showed that Chicago led the list of cities with the most medical databases exposed. Another common exposure was the number of Mongo DB and other non-relational databases lacking any kind of authentication – a finding that hackers discovered before this study could be published, to the detriment of many organizations last month.

“We quickly saw that, since these are more or less unauthenticated databases, that the data could be stolen or even yet, it could be encrypted and held for ransom,” says Stephen Hilt, senor threat researcher for Trend Micro. “And, as we know, in the last few months, that’s actually been happening.”

Related RSAC-Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

Article source: http://www.darkreading.com/vulnerabilities---threats/the-10-most-cyber-exposed-cities-in-the-us/d/d-id/1328149?_mc=RSS_DR_EDT

Microsoft Delays February Security Fixes

library
crime | hacking | security

The company delayed its monthly Patch Tuesday update, which was supposed to replace detailed security bulletins with the “Security Updates Guide.”

Microsoft delayed the release of its new Security Updates Guide, which was supposed to replace its web-based security bulletins, a patch disclosure policy feature since 1998, PCWorld reports. The delay may have been caused by the launch, or because the company bundles all its patches together; as a result, a problem with one would delay the release of all.

The new process was set to be release on February 14, this month’s Patch Tuesday. This is when Microsoft comes out with its monthly round of security updates.

“We discovered a last-minute issue that could impact some customers and was not resolved in time for our planned updates today,” Microsoft explained. “After considering all options, we made the decision to delay this month’s updates.”

Microsoft’s old update structure allowed each patch to be accessed separately. In August of last year, it switched to a cumulative update model, meaning it cannot release updates unless they’re all ready. If there’s a problem with one patch, none can be shared.

The company did not say when it would release its February security updates.

For more, check out PCWorld.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/microsoft-delays-february-security-fixes/d/d-id/1328160?_mc=RSS_DR_EDT

FBI’s N-DEx System Helps Unearth Credit Card Fraud Ring

library
crime | hacking | security

An intelligence analyst used the N-DEx system to discover a 16-member gang cheating liquor and cigarette stores across eight states.

An intelligence analyst (IA) with the New York State Intelligence Center has uncovered a major 16-member credit card fraud ring responsible for 32 incidents in eight US states. She was able to find the gang with the help of the FBI’s National Data Exchange (N-DEx) System, says a release on the agency’s website.

In early 2015, the IA was responding to an “Attempt to Identify” alert from Virginia pertaining to an incident in which two people were found using cloned credit cards at a liquor store. The IA could identify one and dug up the N-DEx System for information on the other. This led her to find data that linked one incident to another until she eventually unearthed an extensive credit card fraud scheme originating from Far Rockaway, New York, targeting liquor and cigarette stores.

The IA was able to put together detailed information in a 22-page dossier that benefited 21 law enforcement agencies all over the country.

“I developed this case [almost] exclusively with N-DEx, and without the system, this case would not have been nearly as successful,” she says.

IoT Security: A Ways To Go, But Some Interim Steps For Safety

library
crime | hacking | security

The Internet of Things remains vulnerable to botnets and malware, but Cisco’s Anthony Grieco offers some tips to keep networks and users more secure

RSA CONFERENCE – San Francisco – It’s pretty much impossible to tune out the attention paid to the Internet of Things here at the security industry’s largest gathering. While the IoT wins plenty of renown for its granularity, flexibility, and ability to generate lost of useful data, it’s also getting dinged for its porous security, if it has any security at all.

End-users and security vendors got a preview of the IoT’s vulnerability in October when Dyn Corp.’s network suffered a massive distributed denial-of-service (DDoS) attack, with the Mirai IoT botnet marshaling more than 100,000 infected devices to overwhelm Dyn servers with bogus traffic. And in a Mirai encore, researchers this week revealed the IoT botnet is tapping a new, Windows-based Trojan that helps find potential Mirai victims, and amplifies the Mirai bots distribution, according to a report from TrendLabs, the research arm of Trend Micro.

A conversation at RSA with Anthony Grieco, senior director and trust strategy officer at Cisco, helped shed some additional light on the state of IoT security, and what end-user organizations can do to protect themselves. Cisco, a vocal champion of IoT technologies and capabilities, also taps the IoT for internal applications and services, so Grieco spoke with Dark Reading as much as a user as a vendor of IoT products.

“We have IoT all over our enterprise and we think about how we defend against risks,” Grieco says, referring to printers, thermostats and even some building management apps that use IoT technology. “We think a lot about resilience, but IoT drives that conversation.”

Not surprisingly, Cisco views the enterprise network as the centerpiece (think backbone switches, routers, and workgroup gear); the network is the place for control, access, and administration that allows customers to enforce policies that govern IoT use and other services. “As the IoT grows, the network becomes the place that drives the policy, connectivity, and capability,” Grieco explains. “Something you’ll see is the network becoming more aware and able to protect the IoT devices.”

More immediately, Grieco suggests implementing 802.1X, a port-based Network Access Control (PNAC) standard that handles authentication of devices trying to connect to a LAN or Wi-Fi network as an IoT security measure.

He’s also a fan of virtual segmentation technologies that allow for secure compartmentalization of virtual and network elements to reduce overall vulnerability. Segmentation also helps turn up anomalies more efficiently. “A wireless video camera should not be ordering a book from Amazon, for example,” Grieco says with a grin.

There are tangible steps users can take to protect their IoT assets and infrastructure. Grieco encourages having defined policies for each segmented element that details its access and communication rights as thoroughly as possible. He also suggests having a unique identifier for each individual IoT device, “a non-trivial challenge, depending on the deployment,” Grieco adds.

Many customers either lack the infrastructure IoT defense and protection, or haven’t made capital improvements in a while. And that’s to the detriment of their individual businesses; Grieco cites a Cisco survey showing 39% of customers had to suspend a major strategic initiative because of the state of their security. If customers aren’t ready from a cybersecurity perspective, it will impede them competitively, he says.

Those recommendations are a good start, given that IoT continues to have security gaps, but there are other areas that need to be considered too, says Merritt Maxim, senior analyst at Forrester. He likes the idea of going beyond device identification to identity identification of the user of the device.

Connected home and connected car environments have a single device but multiple potential users with potentially different levels of authorization, Maxim says. While not required in every device, many still support multiple user profiles. “This could go further and also improve the customer experience as well in a multi-user, single-device home environment,” he adds.

Another challenge with managing identity occurs when devices have multiple connected partners or tenants. “You have a hardware vendor, software vendors, and maybe even a services company that need to run some code on a specific device,” Maxim says, wondering how the industry can formulate an approach that allows regular, automated software updates in the same way. “Right now, it requires a lot of coordination and manual effort.”

If nothing else, the advent of the IoT is helping to push the security conversation across the entire enterprise and not just in the IT department Cisco’s Grieco says. “It’s gratifying to see security’s emergence from a back-office function to security all across your business and something everyone has to be concerned with,” he says. “That’s the most exciting thing and I see evidence of it here and at other conferences.”

Related Content:

Save

Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain’s New York Business, Red Herring, … View Full Bio

Article source: http://www.darkreading.com/iot/iot-security-a-ways-to-go-but-some-interim-steps-for-safety/d/d-id/1328156?_mc=RSS_DR_EDT

Google claims ‘massive’ Stagefright Android bug had ‘sod all effect’

library
crime | hacking | security

RSA USA Despite shrill wailings by computer security experts over vulnerabilities in Android, Google claims very, very few of people have ever suffered at the hands of its bugs.

Speaking at the RSA security conference in San Francisco on Tuesday, Adrian Ludwig, director of Android security, said the Stagefright hole – which prompted the Chocolate Factory to start emitting low-level security patches on a monthly basis – did put 95 per cent of Android devices at risk of attack. However, there have been no “confirmed” cases of infections via the bug, Ludwig claimed.

It was a similar story for the MasterKey vulnerability that was spotted in 2013, he said. In that case, 99 per cent of Android devices were vulnerable, but exploits abusing the security blunder peaked at less than eight infections per million users. And there were no exploits for the hole before details of the flaw were made public.

He also cited the 2014 FakeID flaw, disclosed at Black Hat that year. This affected 82 per cent of Android users but exploits peaked at one infection per million users after the details were released, and none before that.

Ludwig said he was sure of his figures, thanks to malware-detection routines, dubbed Verify Apps, in Google Play services, which is installed on more than 1.4 billion Android handhelds. So, basically, Ludwig’s claims and figures cover devices with Google Play services installed – Chinese and Amazon Android-based gadgets don’t include this software and thus aren’t part of the Googler’s numbers.

It also fitted a pattern he had noticed, that there isn’t really any complex malware out there in the wild infecting Android devices. Software nasties tend to be sleazy apps, installed by punters, that do unpleasant things in the background, rather than malicious code that silently infects devices via webpages, text messages, and so on.

“Most of the abuse we get isn’t interesting from a security perspective,” he said. “We see spamming ads for fake antivirus stuff but it’s really basic social engineering. Even if malware is installed it seldom involved privilege escalation, it primarily just downloads other apps.”

The same thing seems to be happening in Apple’s iOS world, too, he said. One reason could be that mobile operating systems are fairly well locked down, and present a restrictive environment to applications, benefiting from lessons learned from the PC industry.

Basically, mobile OSes are too much of a PITA to develop exploits for. They have hardened kernels, app marketplaces patrolled or vetted by full-time staff, and mechanisms such as ASLR and strict sandboxing that hackers struggle to defeat.

With more than a billion Android users out there, Ludwig’s happy that Android’s various security slip-ups seem to be getting headed off at the pass. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/15/google_stagefright_android_bug_zero_success/

Forget quantum and AI security hype, just write bug-free code, dammit

library
crime | hacking | security

RSA USA Every year, the RSA Conference in San Francisco brings out the best and the brightest for its crypto panel, and the view from the floor was simple. Ignore the fads and hyped technology, and concentrate on the basics: good, clean, secure programming.

The panelists were unimpressed with recent moves to build artificially intelligent security systems – despite the success of programs like the DARPA Cyber challenge – saying it was too early to consider such systems reliable and warning that some may never be.

“I’m skeptical of AI on security,” said Ronald Rivest, MIT Institute professor and the ‘R’ in RSA. “Where we are seeing it becoming a wedge issue with the recent election is with AI bots in chat rooms. In 10 or 15 years you’ll be competing to find a real human in a sea of chat bots.”

His former colleague at RSA, Adi Shamir, currently the Borman professor of computer science at the Weizmann Institute, was similarly skeptical about AI systems in security. Attempting to train such a device could lead to interesting problems.

“Fifteen years from now we will give all data to AI systems, it will think, and [then] say that in order to save the internet I’ll have to kill it,” he semi-joked. “The internet is beyond salvaging; we need to start over with something better.”

Some AI systems might be useful for IT defense, Shamir said, given the ability for computers to handle large volumes of data and check for anomalies. But you need a human touch to find zero-day flaws and attack using them, he opined.

Shamir was equally as dismissive of quantum computing systems and quantum cryptography, saying it was “not on my list of worries.” He was far more concerned about using large-scale computing to hack existing encryption algorithms.

Susan Landau, professor of cybersecurity policy at Worcester Polytechnic Institute, said she was worried about quantum systems. There hasn’t been enough research into building quantum computing-proof algorithms and the industry was missing a tick, she insisted.

Meanwhile Whitfield Diffie, one of the inventors of public key encryption, said that the issues facing the industry weren’t going to be fixed by a magic AI or quantum bullet. Instead the industry needs to go back to fundamentals, he suggested.

“If the resources spent on interactive security, such as firewalls and antivirus and the like, were spent on improvements in the logical functioning of devices and a big improvement in quality of programming, we would get much better results,” Diffie said. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/15/rsa_crypto_panel/

RSA 2017 – Day 1 – Roving Report [PODCAST]

library
crime | hacking | security

If you didn’t get to go to San Francisco yourself to attend the RSA Conference 2017, don’t worry…

…our roving reporter and man-on-the-spot, Bill Brenner, has agreed to call home each day.

Bill will give us a feel for what’s happening in the conference, on the trade show floor and around the corridors of the giant-sized Moscone Center in downtown San Francisco.

In this first podcast from RSA 2017, Paul Ducklin talks to Bill about the vibe of this year’s event, where the trade show part opened with a splash on Monday evening:

If you enjoy the podcast, please share it with other people interested in security and privacy and give us a vote on iTunes and other podcasting directories.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/5qT96I6xQhQ/

Bruce Schneier: The US government is coming for YOUR code, techies

library
crime | hacking | security

OSLS The Open Source Leadership Summit began on Tuesday amid roads closed by a landslide: held in The Resort at Squaw Creek near Lake Tahoe, California, it was not easily accessible to attendees traveling Highway 80 from the San Francisco Bay Area.

During his opening keynote, Jim Zemlin, executive director of the Linux Foundation, made light of the mudslides that brought traffic to a crawl near Donner Pass on Monday evening. The trip at least was less arduous than it was last year, he said.

Zemlin’s remarks amounted to an open-source victory lap. Some 99.4 per cent of the world’s high performance computing systems, 90 per cent of the world’s stock exchanges, and 64 per cent of mobile devices run on Linux, he said, adding that the foundation’s projects have created $14.5 billion worth of value, as measured in cost per line of code.

The foundation’s mission, to create the largest shared technology resource in the world, is accomplished, more or less. Open source has won.

But the road ahead for open source, and for software development in general, looks much like it was for conference attendees: if not closed then littered with obstacles.

Security expert and doomsayer Bruce Schneier – speaking by video owing to RSA Conference commitments in San Francisco and perhaps prescience with regard to seasonal travel challenges – predicted that the government is coming to handcuff coders.

“We all had this special right to code the world as we saw fit,” said Schneier. “My guess is we’re going to lose that right, because it’s too dangerous to give to a bunch of techies.”

‘What we’re going to see is increased government involvement’

Schneier’s argument follows from accepting Marc Andreessen’s observation in 2011 that software is eating the world. “As everything turns into a computer, computer security becomes everything security,” said Schneier.

Schneier likened the internet to a giant robot, one capable of affecting not just the virtual world but the physical world, too. “As our internet affects the world, the threats become much more real,” he said.

Software flaws that may once have been capable of crashing applications have the potential to crash cars, planes, medical devices, appliances, and other connected infrastructure. As a result, Schneier contends, the restrictions and regulations that attempt to defend against real world risks will be placed on the tech world.

“What we’re going to see is increased government involvement,” Schneier said. “Because that’s what happens in the world of dangerous things.”

The physical threats arising from connected things will spur regulators to act, not to mention actual robots walking down the street, Schneier said. “Nothing motivates the US government like fear,” he added, pointing to 9/11 and creation of the Department of Homeland Security.

Schneier said at the RSA Conference he plans to call for the creation of a new US government agency to sort through the issues arising from putting software in everything. It’s not good enough to leave these decisions to the Federal Trade Commission, or those regulating cars or medicine, he said.

The choice is between smart and stupid government involvement, Schneier insisted, warning that it would be easy to imagine a liability regime that would kill open source software.

“We’re in the process of screwing a lot of this up,” said Schneier, who urged technologists to get involved in government and the legislative process in order to shape the debate. “We need to start making more ethical and political decisions about how technology should work.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/14/the_government_is_coming_for_your_code/

‘We need a new Geneva Convention to protect all citizens from snoops’

library
crime | hacking | security

RSA USA In 1949, the world’s nations came together to sign the Geneva Conventions, according respect in times of war to civilians, soldiers incapable of fighting, and prisoners of war. Now we need to go back and do the same for civilians caught up in online conflict, according to Microsoft.

In a keynote at this year’s RSA USA Conference, Redmond’s president Brad Smith called on the technology industry to cooperate and form a “Digital Switzerland” for the world. That doesn’t mean fondue for all or caching Nazi gold, but rather that the tech industry needs to insist on being an impartial operator that shields its users from unwarranted state spying and attack.

Protecting people online is good for business, after all, we note. It’s not a great advert for your software and online services when the Feds can just siphon off your customers’ emails seemingly at will. Trust equals money, and Microsoft wants your trust and money.

“We will not aid attacking customers anywhere, regardless of whether governments ask us to do so,” Smith told the RSA audience in San Francisco today. “We need to make the case that the world needs to retain its trust in technology; we need to maintain the world’s trust.”

Smith suggested new Geneva conventions that require governments to not attack technology companies; to disclose to developers all security vulnerabilities so they can be fixed rather than hoarding them to use to attack; to defend the tech sector when dealing with hackers running amok; to sign up to the non-proliferation of weaponized exploits; and “exercising restraint” when using them.

The technology backbone of the world is privately owned and run, and the world’s governments need to commit to using it responsibly, he said. If they can’t, the technology community needs to stand up and ensure that no one runs wild online. Apropos of nothing, have you checked your Windows 10 privacy settings recently?

Smith’s rules for online life – but don’t hold your breath for them

The technology industry is an international one, Smith said, and Microsoft employs people from 157 nations. More than any other sector, the technology field is all about bringing in people from around the world to get the best solutions, rather than falling into petty nationalism.

Smith said that the recent US election should act as a warning sign of how bad things can get. The claimed Russian hacking of the Democrats’ computers, and subsequent email leaks, had an unprecedented effect on American democracy, Smith opined.

That’s not that unusual though, said Adi Shamir, Borman professor of computer science at the Weizmann Institute in Israel and co-inventor of the RSA algorithm. He said political meddling is an old-school practice, and the Russians are used to being screwed around with in this way.

In 1956, US and UK intelligence agencies recorded a speech given in private by the Soviet premier Nikita Khrushchev which decried the excesses of Stalin’s regime. They leaked the speech to “the WikiLeaks of its day,” The New York Times, he said, and the news led directly to the Hungarian uprising that year.

“While I’m shocked, shocked, by these attacks,” he joked, “they are not alone in history.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/14/microsoft_president_calls_for_new_geneva_convention_to_protect_citizens_online/

Apple: Don’t panic, but your Mac can be pwned via GarageBand .bands

library
crime | hacking | security

Apple says a newly patched hole in its GarageBand music tool could allow for remote code execution on the Mac.

The GarageBand 10.1.6 update is being pushed out to all Macs running OS X Yosemite and later. Because GarageBand is installed by default on OS X systems, all Mac owners should install the patch, but those who regularly use the music composing software should pay particular attention.

The lone flaw addressed in the update, CVE-2017-2374, allows an attack to remotely execute simply by running a malformed .band file. Apple uses the .band format for all GarageBand project files.

In theory, a crook could exploit the bug by convincing the user to run the specially crafted .band file that would target the bug.

CVE-2017-2374 was one of two GarageBand flaws discovered by Cisco Talos researcher Tyler Bohan. Apple addressed the other vulnerability, CVE-2017-2372, with an earlier update.

“This particular vulnerability is the result of the way the application parses the proprietary file format used for GarageBand files, .band,” explains Talos.

“The format is broken into chunks with a specific length field for each. This length is controlled by the user and can be leveraged to expose an exploitable condition.”

Neither Apple nor Talos reported any attacks on the vulnerability in the wild.

Apple users should already be looking to update their Macs today, thanks to this morning’s monthly patch release by Adobe for Flash Player on OS X. That update addresses a total of 13 security holes in the internet’s screen door, all of which can be exploited for remote code execution. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/14/macs_can_get_pwned_thru_garageband/