STE WILLIAMS

News in brief: drone chiefs urge regulation; Microsoft drops SMB1; Virgin router warning

Jun
23

Your daily round-up of some of the other stories in the news

Drone chiefs call for regulations

Drone industry chiefs were due to meet President Trump at the White House this week – and were expected to call for more regulation.

The meetings, which were due to start on Thursday, are to focus on regulations for emerging technologies including 5G, artificial intelligence and drones. They include executives from organisations including ATT, drone-maker PrecisionHawk and venture capitalist firms.

Michael Chasen, chief executive of PrecisionHawk, told Recode that “the drone industry is one of the few industries where we need more regulations, not less”. That’s because the FAA hasn’t yet produced rules that would make it legal to carry out commercial activities such as delivering packages.

Greg McNeal of mapping software company AirMap told Recode: “We asked why autonomous cars weighing 3,500lb can drive next to hundreds of pedestrians, but a 3lb drone can’t fly over people. The FAA follows a legacy approach to regulating aviation that requires everyone to ask for permission.”

Microsoft to retire SMB1

The next version of Windows will not include SMB1, the protocol that facilitated the spread of the WannaCry ransomware outbreak in May.

The change is already rolling out to members of Microsoft’s Windows Insider programme – the shift will feature in Build 16226 of Windows 10.

In a Windows Insider blogpost, Dona Sarker said: “As part of a multi-year security plan, we are removing the SMB1 networking protocol from Windows by default. This build has this change, however the change only affects clean installations of Windows, not upgrades.”

Microsoft has been urging users to ditch that protocol since before the WannaCry outbreak: Ned Pyle said, loud and clear, back in September last year that “SMB1 isn’t safe”.

He added in his Technet post: “The original SMB1 protocol is nearly 30 years old, and like much of the software made in the 80s, it was designed for a world that no longer exists. A world without malicious actors, without vast sets of important data, without near-universal computer usage. Frankly, its naivete is staggering when viewed though modern eyes. I blame the West Coast hippy lifestyle.”

For users who aren’t early-adopter nerds on the Windows Insider programme, the change will come when the Redstone 3 – or Fall Creators’ Update – rolls out.

Virgin customers warned on routers

Are you a Virgin Media customer in the UK with the Super Hub 2 router? If so, you’re among the 800,000 or so users who probably needs to change both the Wi-Fi password and the password to access the router’s configuration pages.

The warning came after research by the consumer association Which? found that the router model’s default passwords were insecure: the Wi-Fi password is easily cracked, according to Which?, and once on the network, the default admin password is the same for all devices.

Which? criticised a number of devices that Naked Security has flagged up in the past, including the CloudPets teddy whose user accounts had been breached, and insecure IoT security cameras.

Virgin said it was offering affected customers the option to upgrade to a newer router – the Super Hub 3 – and added: “The security of our network and of our customers is of paramount importance to us.”

Catch up with all of today’s stories on Naked Security


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/1uLI5moX7l8/

Virgin Media router security flap follows weak password expose

Jun
23

Virgin Media has urged 800,000 customers to change their passwords to guard against possible hacking attack.

The move follows an investigation by consumer mag Which? that discovered hackers could access the UK cableco’s Super Hub 2 router, allowing access to IoT devices connected through the same home network. The issue stems from shortcomings in the default password Virgin Media prints on its routers than a recently discovered security vulnerability in routers it supplies.

Virgin Media stickered default router password is constrained to certain characters, lowering password entropy in the process and making it easier for hackers to mount successful brute force attacks.

“It appears to be that the default Wi-fi PSK is too short. 8 char a-z. Not exactly a new story though,” Pen Test Partners’ Ken Munro told El Reg. “[It] seems unfair for Which to finger just Virgin, as most ISPs have had weak default PSKs at some point,” he added.

Virgin Media pointed El Reg towards a customer forum post on the issue, adding: “I can reassure you the threat to our security is minimal”.

David Emm, principal security researcher, Kaspersky Lab, said: “Cybercriminals routinely make use of vulnerabilities, and the case of Virgin Media’s Super Hub 2 router highlights the fact that there are more connected devices than ever before, and therefore, more potential vulnerable devices that can be compromised.”

The issue highlights wider concerns about consumer router security, which has been a problem for years – long before the rise of the infamous Mirai botnet late last year prompted more ISPs to sit up and finally take notice. Mirai spread thanks to a mixture of open ports and weak default passwords. In some cases, simply changing passwords wasn’t enough and a firmware update would be needed.

Matthias Maier, security evangelist at Splunk, said: “Organisations that provide internet connected devices to consumers need to think carefully about how they will overcome the security challenge that will inevitably come with the devices they produce. Suppliers need to think about the responsibility they have for owning the maintenance of a device for its full lifecycle. They need to introduce monitoring for flaws and ensure over-the-air (OTA) updates are available so that their customers are better protected.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/06/23/virgin_media_router_security_flap/

Virgin Media router security flap follows weak password expose

Jun
23

Virgin Media has urged 800,000 customers to change their passwords to guard against possible hacking attack.

The move follows an investigation by consumer mag Which? that discovered hackers could access the UK cableco’s Super Hub 2 router, allowing access to IoT devices connected through the same home network. The issue stems from shortcomings in the default password Virgin Media prints on its routers than a recently discovered security vulnerability in routers it supplies.

Virgin Media stickered default router password is constrained to certain characters, lowering password entropy in the process and making it easier for hackers to mount successful brute force attacks.

“It appears to be that the default Wi-fi PSK is too short. 8 char a-z. Not exactly a new story though,” Pen Test Partners’ Ken Munro told El Reg. “[It] seems unfair for Which to finger just Virgin, as most ISPs have had weak default PSKs at some point,” he added.

Virgin Media pointed El Reg towards a customer forum post on the issue, adding: “I can reassure you the threat to our security is minimal”.

David Emm, principal security researcher, Kaspersky Lab, said: “Cybercriminals routinely make use of vulnerabilities, and the case of Virgin Media’s Super Hub 2 router highlights the fact that there are more connected devices than ever before, and therefore, more potential vulnerable devices that can be compromised.”

The issue highlights wider concerns about consumer router security, which has been a problem for years – long before the rise of the infamous Mirai botnet late last year prompted more ISPs to sit up and finally take notice. Mirai spread thanks to a mixture of open ports and weak default passwords. In some cases, simply changing passwords wasn’t enough and a firmware update would be needed.

Matthias Maier, security evangelist at Splunk, said: “Organisations that provide internet connected devices to consumers need to think carefully about how they will overcome the security challenge that will inevitably come with the devices they produce. Suppliers need to think about the responsibility they have for owning the maintenance of a device for its full lifecycle. They need to introduce monitoring for flaws and ensure over-the-air (OTA) updates are available so that their customers are better protected.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/06/23/virgin_media_router_security_flap/

Talking Cyber-Risk with Executives

Jun
23

What’s This?

Explaining risk can be difficult since CISOs and execs don’t speak the same language. The key is to tailor your message for the audience.

On March 7, a bipartisan bill was introduced to the Senate called the Cybersecurity Disclosure Act of 2017. The bill’s purpose is to “promote transparency in the oversight of cybersecurity risks at publicly traded companies.” It adds Securities and Exchange Commission (SEC) requirements for public companies to disclose what cybersecurity expertise is present within the board of directors.

If no expertise is present, then the company must disclose in its SEC report “what other cybersecurity steps” are being done by the board nominating committee. Whether this bill succeeds in becoming law or not, it is a shot across the bow to executives.

With all this going on, it’s likely that boards and executive leadership are going to be buttonholing their CISOs into cyber-risk conversations. Just a few years ago, security professionals struggled for executive interest (let alone support), but now we are in the hot seat for answers. And what a hot seat it is! A recent survey from Osterman Research reveals that 66% of fired IT professionals were terminated for reasons of security or compliance failures. That’s why we need to make sure leadership understands the relevant security issues and how to help mitigate them.

Explaining risk can be difficult since CISOs and execs don’t speak the same language. You need to tailor your message for your audience. We’ve talked about using operational risk to frame the conversation, but there is value in a straight-forward approach as well.

To do this, you focus on the top cyber risks and provide just the information the board needs to know. A good place to start is the state of company culture regarding security. You can produce metrics on alignment to desired security policy with numbers around security awareness training attendance, patching completeness, audit findings, vulnerabilities, incident counts, and backup coverage. You can even make a nice radar chart to show the percentages and quickly make the deficiencies apparent.

Image Source: f5

Beyond the overall status of the program, you need to explain cyber-risk. Keep it simple and remember this important nuance: many ordinary people don’t realize that risk has two components: likelihood and impact. For example, some people tend to react to catastrophic impacts (What are we doing about Pottsylvanian hacker-spies?) that are rare while overlooking more likely risks like ransomware.

It shouldn’t be hard for you find likelihood data. In addition to industry statistics and open source threat intelligence, you can gather information internally. Sources can include data used to create the radar chart above as well as firewall, intrusion detection, web and mail system logs.

Impacts are easier to talk about, but you need to explain the real potential impacts to your business. Talk in terms of tangible and intangible losses that resonate with them, including:

Tangible costs:

  • Breach disclosure costs (PII record count x disclosure cost/record)
  • Customer SLA fines
  • Revenue loss during system downtime and recovery
  • Compliance and audit fines
  • Potential litigation and fines down the road
  • Incident response costs, including internal resources (OpEx), third party breach experts, required remediation controls, and effectiveness testing

Intangible costs:

  • Impact to brand (the business puts a value to this—usually found as an asset line item in your financial books)
  • Current and future customer perception and loss
  • Loss of business value in acquisition discussions
  • Competitive advantage loss
  • The board’s personal reputation and/or job

When presenting likelihood and impact, stick to the simplified High/Med/Low model. Everyone is aware that there are more layers, and most execs would understand a more complex model, but their time is limited. In matters where the risk is high, they will probably press for details.

Lastly, you should never present a problem without a solution. Make sure you have a solid mitigation plan (with proposed budget numbers) to resolve anything rated high risk. Executives will also want clear lines of responsibility. They’ll want to know who’s responsible for remediation, and who is paying. The chances are likely the board has already dealt with high risk non-cybersecurity scenarios before. If you’ve done your job well in explaining, you can sit back and watch them decide. As you are the cybersecurity expert, you should still be prepared to give them guidance or validation.

This might seem like a lot of work but for effective CISOs, it is routine. Risk assessments and reporting with the board should be happening annually, at least. As cyber-risk is better understood and managed, you might need only to present updates if something significant or material happened. This is the ideal position—not only does it mean everyone is sleeping it at night, it means the board trusts you.

 

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/f5/talking-cyber-risk-with-executives/a/d-id/1329161?_mc=RSS_DR_EDT

Talking Cyber-Risk with Executives

Jun
23

What’s This?

Explaining risk can be difficult since CISOs and execs don’t speak the same language. The key is to tailor your message for the audience.

On March 7, a bipartisan bill was introduced to the Senate called the Cybersecurity Disclosure Act of 2017. The bill’s purpose is to “promote transparency in the oversight of cybersecurity risks at publicly traded companies.” It adds Securities and Exchange Commission (SEC) requirements for public companies to disclose what cybersecurity expertise is present within the board of directors.

If no expertise is present, then the company must disclose in its SEC report “what other cybersecurity steps” are being done by the board nominating committee. Whether this bill succeeds in becoming law or not, it is a shot across the bow to executives.

With all this going on, it’s likely that boards and executive leadership are going to be buttonholing their CISOs into cyber-risk conversations. Just a few years ago, security professionals struggled for executive interest (let alone support), but now we are in the hot seat for answers. And what a hot seat it is! A recent survey from Osterman Research reveals that 66% of fired IT professionals were terminated for reasons of security or compliance failures. That’s why we need to make sure leadership understands the relevant security issues and how to help mitigate them.

Explaining risk can be difficult since CISOs and execs don’t speak the same language. You need to tailor your message for your audience. We’ve talked about using operational risk to frame the conversation, but there is value in a straight-forward approach as well.

To do this, you focus on the top cyber risks and provide just the information the board needs to know. A good place to start is the state of company culture regarding security. You can produce metrics on alignment to desired security policy with numbers around security awareness training attendance, patching completeness, audit findings, vulnerabilities, incident counts, and backup coverage. You can even make a nice radar chart to show the percentages and quickly make the deficiencies apparent.

Image Source: f5

Beyond the overall status of the program, you need to explain cyber-risk. Keep it simple and remember this important nuance: many ordinary people don’t realize that risk has two components: likelihood and impact. For example, some people tend to react to catastrophic impacts (What are we doing about Pottsylvanian hacker-spies?) that are rare while overlooking more likely risks like ransomware.

It shouldn’t be hard for you find likelihood data. In addition to industry statistics and open source threat intelligence, you can gather information internally. Sources can include data used to create the radar chart above as well as firewall, intrusion detection, web and mail system logs.

Impacts are easier to talk about, but you need to explain the real potential impacts to your business. Talk in terms of tangible and intangible losses that resonate with them, including:

Tangible costs:

  • Breach disclosure costs (PII record count x disclosure cost/record)
  • Customer SLA fines
  • Revenue loss during system downtime and recovery
  • Compliance and audit fines
  • Potential litigation and fines down the road
  • Incident response costs, including internal resources (OpEx), third party breach experts, required remediation controls, and effectiveness testing

Intangible costs:

  • Impact to brand (the business puts a value to this—usually found as an asset line item in your financial books)
  • Current and future customer perception and loss
  • Loss of business value in acquisition discussions
  • Competitive advantage loss
  • The board’s personal reputation and/or job

When presenting likelihood and impact, stick to the simplified High/Med/Low model. Everyone is aware that there are more layers, and most execs would understand a more complex model, but their time is limited. In matters where the risk is high, they will probably press for details.

Lastly, you should never present a problem without a solution. Make sure you have a solid mitigation plan (with proposed budget numbers) to resolve anything rated high risk. Executives will also want clear lines of responsibility. They’ll want to know who’s responsible for remediation, and who is paying. The chances are likely the board has already dealt with high risk non-cybersecurity scenarios before. If you’ve done your job well in explaining, you can sit back and watch them decide. As you are the cybersecurity expert, you should still be prepared to give them guidance or validation.

This might seem like a lot of work but for effective CISOs, it is routine. Risk assessments and reporting with the board should be happening annually, at least. As cyber-risk is better understood and managed, you might need only to present updates if something significant or material happened. This is the ideal position—not only does it mean everyone is sleeping it at night, it means the board trusts you.

 

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/f5/talking-cyber-risk-with-executives/a/d-id/1329161?_mc=RSS_DR_EDT

Threat Intelligence Sharing: The New Normal?

Jun
23
The spirit of cooperation seems to be taking hold as demonstrated by the growing number of thriving services and organizations whose sole purpose is to analyze specific threats against specific communities.

“When bad men combine, the good must associate; else they will fall, one by one, an unpitied sacrifice in a contemptible struggle” – Edmund Burke.

This quote from Edmund Burke in Thoughts on the Cause of Present Discontents, was meant to be a political statement in 18th century England, when the Whigs and Tories were dominant. But many centuries later, it’s an appropriate call-to-action for those of us in the cybersecurity industry to collaborate and share.

The kind of sharing I mean is when you give the IT security community information about the attacks you’re seeing against your own organization. When you do that, that data becomes useful to everyone as threat intelligence.

Gartner describes threat intelligence as “evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.” In other words, threat intelligence is the stuff that informs the good guys about how the bad guys operate. It helps the IT security community learn how the hackers operate, and how they might attack a given organization. 

If all an organization knows about their adversary is what it has learned from its own experience, the organization will remain on the defensive. But if attack data from the collective experience of thousands of companies, associations, industries and governments is collected and aggregated, that creates a far richer tapestry, and allows companies to prepare for attacks in such a way as to anticipate and prevent them, rather than discover and react.

When you get your hands on the opposition’s game plan — the hacker’s playbook — it gives you an advantage. You can test your defenses and shore up weaknesses and you can take steps to disrupt the kill chain the hacker must follow to get to his or her objective. Such capabilities are only possible when threats, attack methods and industry-specific targets most likely to put your organization at risk are known.

The spirit of cooperation and sharing is what makes that possible and the reason why threat intelligence services and threat sharing are becoming vital to IT security. Using threat intelligence feeds to constantly inform a dynamic data protection strategy continuously tests the strength of your cybersecurity and challenges convention. The result: your organization gets up on its toes and the hackers are put back on their heels. That is a big advantage.

Share and Share Alike
The spirit of cooperation seems to be taking hold. Not only are threat intelligence services thriving, but there are organizations now that exist for the sole purpose of analyzing threats specific to specific communities.

VirusTotal is one of the legacy collaborative platforms, enabling security users and vendors alike to upload files and determine if a specific malware has been detected. By changing its business model, VirusTotal now ensures that all security vendors that are taking advantage of its data are also contributing data.

At a national level, CyberUSA is a nonprofit aiming to foster American leadership in cybersecurity by shaping education, innovation and policy at both the state and federal levels. Launching with seven charter members from California, Colorado, Louisiana, Maryland, Massachusetts, South Carolina and Texas, CyberUSA hopes to extend the value of shared intelligence to businesses that might not have resources on their own.

There’s also ample evidence of collaboration in the private sector. For example, the National Credit Union Information Sharing and Analysis Organization (NCU-ISAO) was recently founded to collect, analyze and disseminate threat intelligence targeting Credit Unions. NCU-ISAO is the first operational and threat intelligence sharing organization dedicated wholly to credit unions, NCU-ISAO executive director Gene Fredriksen told Credit Union Times, noting the group’s support for “innovative, member-driven initiatives around benchmarking, process improvement, and regulatory strategies.” It’s the latest addition to the parent Information Sharing and Analysis Organization (ISAO), which tracks other organizations that have industry-focused threat intel sharing operations.

Each day millions of security events hammer away at the defenses of U.S. companies. Individual organizations in high-risk sectors such as financial services, high tech, or government may endure hundreds of thousands of attacks. While the volume and persistence may be frustrating, each attack results in a greater understanding of the adversary — but only when it is shared and added to threat intelligence feeds, hacker playbooks and breach simulations.

When bad men combine, the good must associate. Together, we’re moving in the right direction.  

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Related Content:

Danelle is vice president of strategy at SafeBreach. She has more than 15 years of experience bringing new technologies to market. Prior to SafeBreach, Danelle led strategy and marketing at Adallom, a cloud security company acquired by Microsoft. She was also responsible for … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/threat-intelligence-sharing-the-new-normal/a/d-id/1329189?_mc=RSS_DR_EDT

Threat Intelligence Sharing: The New Normal?

Jun
23
The spirit of cooperation seems to be taking hold as demonstrated by the growing number of thriving services and organizations whose sole purpose is to analyze specific threats against specific communities.

“When bad men combine, the good must associate; else they will fall, one by one, an unpitied sacrifice in a contemptible struggle” – Edmund Burke.

This quote from Edmund Burke in Thoughts on the Cause of Present Discontents, was meant to be a political statement in 18th century England, when the Whigs and Tories were dominant. But many centuries later, it’s an appropriate call-to-action for those of us in the cybersecurity industry to collaborate and share.

The kind of sharing I mean is when you give the IT security community information about the attacks you’re seeing against your own organization. When you do that, that data becomes useful to everyone as threat intelligence.

Gartner describes threat intelligence as “evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.” In other words, threat intelligence is the stuff that informs the good guys about how the bad guys operate. It helps the IT security community learn how the hackers operate, and how they might attack a given organization. 

If all an organization knows about their adversary is what it has learned from its own experience, the organization will remain on the defensive. But if attack data from the collective experience of thousands of companies, associations, industries and governments is collected and aggregated, that creates a far richer tapestry, and allows companies to prepare for attacks in such a way as to anticipate and prevent them, rather than discover and react.

When you get your hands on the opposition’s game plan — the hacker’s playbook — it gives you an advantage. You can test your defenses and shore up weaknesses and you can take steps to disrupt the kill chain the hacker must follow to get to his or her objective. Such capabilities are only possible when threats, attack methods and industry-specific targets most likely to put your organization at risk are known.

The spirit of cooperation and sharing is what makes that possible and the reason why threat intelligence services and threat sharing are becoming vital to IT security. Using threat intelligence feeds to constantly inform a dynamic data protection strategy continuously tests the strength of your cybersecurity and challenges convention. The result: your organization gets up on its toes and the hackers are put back on their heels. That is a big advantage.

Share and Share Alike
The spirit of cooperation seems to be taking hold. Not only are threat intelligence services thriving, but there are organizations now that exist for the sole purpose of analyzing threats specific to specific communities.

VirusTotal is one of the legacy collaborative platforms, enabling security users and vendors alike to upload files and determine if a specific malware has been detected. By changing its business model, VirusTotal now ensures that all security vendors that are taking advantage of its data are also contributing data.

At a national level, CyberUSA is a nonprofit aiming to foster American leadership in cybersecurity by shaping education, innovation and policy at both the state and federal levels. Launching with seven charter members from California, Colorado, Louisiana, Maryland, Massachusetts, South Carolina and Texas, CyberUSA hopes to extend the value of shared intelligence to businesses that might not have resources on their own.

There’s also ample evidence of collaboration in the private sector. For example, the National Credit Union Information Sharing and Analysis Organization (NCU-ISAO) was recently founded to collect, analyze and disseminate threat intelligence targeting Credit Unions. NCU-ISAO is the first operational and threat intelligence sharing organization dedicated wholly to credit unions, NCU-ISAO executive director Gene Fredriksen told Credit Union Times, noting the group’s support for “innovative, member-driven initiatives around benchmarking, process improvement, and regulatory strategies.” It’s the latest addition to the parent Information Sharing and Analysis Organization (ISAO), which tracks other organizations that have industry-focused threat intel sharing operations.

Each day millions of security events hammer away at the defenses of U.S. companies. Individual organizations in high-risk sectors such as financial services, high tech, or government may endure hundreds of thousands of attacks. While the volume and persistence may be frustrating, each attack results in a greater understanding of the adversary — but only when it is shared and added to threat intelligence feeds, hacker playbooks and breach simulations.

When bad men combine, the good must associate. Together, we’re moving in the right direction.  

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Related Content:

Danelle is vice president of strategy at SafeBreach. She has more than 15 years of experience bringing new technologies to market. Prior to SafeBreach, Danelle led strategy and marketing at Adallom, a cloud security company acquired by Microsoft. She was also responsible for … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/threat-intelligence-sharing-the-new-normal/a/d-id/1329189?_mc=RSS_DR_EDT

RAT Vulnerabilities Turn Hackers into Victims

Jun
23
A small number of Remote Administration Tools have vulnerabilities which can enable attack targets to turn the tables on threat actors.

Threat actors using certain Remote Administration Tools (RATs) may find themselves on the receiving end of malware. Newly discovered vulnerabilities in these tools may enable cybercriminals’ targets to turn the tables on their attackers and deliver malware.

Targeted cyberattacks hit thousands of businesses each year. Oftentimes victims label these threats as “advanced and persistent” to suggest they were inevitable, as though attackers are too sophisticated for defenders to protect themselves.

In many cases this is far from the truth, argues Waylon Grange, senior threat researcher at Symantec. Vulnerabilities in multiple hacker tools can be used against threat actors.

In looking at APT reports over the years, he says, there is a pattern of common RATS used in multiple campaigns. Frequently cited tools include Gh0stRAT, Korplug/Plug-X, and XtremeRAT, among others. The command-and-control components of these tools have vulnerabilities that can be exploited by attacker targets, who can turn the tables on their assailants.

“The attacker who was the attacker is now the victim,” says Grange of the exploits’ capabilities, which could enable a target to remote into an attacker’s machine and browse it. “The tools can expose them to more vulnerabilities than the people they’re targeting in some ways.”

At this year’s Black Hat USA conference in Las Vegas, Grange will disclose several exploits that could allow for remote execution or remote information disclosure on machines running these common CC components. His talk is titled “Digital Vengeance: Exploiting the Most Notorious CC Toolkits.”

The idea is not to give a lesson in “hacking back” but to warn actors of the consequences of using these RATs. One of the tools he will discuss is Gh0stRAT, which has been around for at least 10 years and used in attacks believed to have been by Chinese nation-state actors.

Gh0stRAT allows an adversary access to the target’s machine. Once malware is downloaded they can monitor keystrokes, see the screen, capture audio, and view the webcam. It stays on the machine and will continue to run after rebooting.

“It’s fairly easy to recognize,” says Grange. “Most antivirus products pick it up right away because it has been around for so long.”

If a machine’s antivirus program discovers the Gh0stRAT component, he continues, people have developed a Python script to search the malware and pull out configuration information. This script can “call home” to the CC address and provide data on the adversary’s location.

Armed with the location of the attacker’s server, a victim can install malware back on the adversary’s machine and view their screen and files.

“I can see who the adversary has as their targets,” says Grange. “If they’re remote controlling someone else, I can see what connections they have to others; what files they may have gotten off other targets.”

It’s worth noting this is not currently legal and Grange conducted his research in a test environment and attacked his own machines. He anticipates if this is made legal in the future, many businesses will want to use it to retaliate against adversaries — a practice he thinks “won’t achieve much” in making real progress against cybercrime.

“Where I see this most useful is in terms of researching,” he continues. “Attribution is hard. If you can see where they are and what they target, that can provide a lot of valuable insight into attribution. It’s most useful for researchers as opposed to a revenge tool.”

Grange says these findings indicate modern attackers are not as untouchable as businesses think.

“The tools they use are sloppy, are broken,” he says. “It’s not an excuse to say ‘we were hit by a nation-state so we can’t be held accountable for what happened.’ They still play on the same playing field.”

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 


Related Content:

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/rat-vulnerabilities-turn-hackers-into-victims/d/d-id/1329209?_mc=RSS_DR_EDT

RAT Vulnerabilities Turn Hackers into Victims

Jun
23
A small number of Remote Administration Tools have vulnerabilities which can enable attack targets to turn the tables on threat actors.

Threat actors using certain Remote Administration Tools (RATs) may find themselves on the receiving end of malware. Newly discovered vulnerabilities in these tools may enable cybercriminals’ targets to turn the tables on their attackers and deliver malware.

Targeted cyberattacks hit thousands of businesses each year. Oftentimes victims label these threats as “advanced and persistent” to suggest they were inevitable, as though attackers are too sophisticated for defenders to protect themselves.

In many cases this is far from the truth, argues Waylon Grange, senior threat researcher at Symantec. Vulnerabilities in multiple hacker tools can be used against threat actors.

In looking at APT reports over the years, he says, there is a pattern of common RATS used in multiple campaigns. Frequently cited tools include Gh0stRAT, Korplug/Plug-X, and XtremeRAT, among others. The command-and-control components of these tools have vulnerabilities that can be exploited by attacker targets, who can turn the tables on their assailants.

“The attacker who was the attacker is now the victim,” says Grange of the exploits’ capabilities, which could enable a target to remote into an attacker’s machine and browse it. “The tools can expose them to more vulnerabilities than the people they’re targeting in some ways.”

At this year’s Black Hat USA conference in Las Vegas, Grange will disclose several exploits that could allow for remote execution or remote information disclosure on machines running these common CC components. His talk is titled “Digital Vengeance: Exploiting the Most Notorious CC Toolkits.”

The idea is not to give a lesson in “hacking back” but to warn actors of the consequences of using these RATs. One of the tools he will discuss is Gh0stRAT, which has been around for at least 10 years and used in attacks believed to have been by Chinese nation-state actors.

Gh0stRAT allows an adversary access to the target’s machine. Once malware is downloaded they can monitor keystrokes, see the screen, capture audio, and view the webcam. It stays on the machine and will continue to run after rebooting.

“It’s fairly easy to recognize,” says Grange. “Most antivirus products pick it up right away because it has been around for so long.”

If a machine’s antivirus program discovers the Gh0stRAT component, he continues, people have developed a Python script to search the malware and pull out configuration information. This script can “call home” to the CC address and provide data on the adversary’s location.

Armed with the location of the attacker’s server, a victim can install malware back on the adversary’s machine and view their screen and files.

“I can see who the adversary has as their targets,” says Grange. “If they’re remote controlling someone else, I can see what connections they have to others; what files they may have gotten off other targets.”

It’s worth noting this is not currently legal and Grange conducted his research in a test environment and attacked his own machines. He anticipates if this is made legal in the future, many businesses will want to use it to retaliate against adversaries — a practice he thinks “won’t achieve much” in making real progress against cybercrime.

“Where I see this most useful is in terms of researching,” he continues. “Attribution is hard. If you can see where they are and what they target, that can provide a lot of valuable insight into attribution. It’s most useful for researchers as opposed to a revenge tool.”

Grange says these findings indicate modern attackers are not as untouchable as businesses think.

“The tools they use are sloppy, are broken,” he says. “It’s not an excuse to say ‘we were hit by a nation-state so we can’t be held accountable for what happened.’ They still play on the same playing field.”

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 


Related Content:

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/rat-vulnerabilities-turn-hackers-into-victims/d/d-id/1329209?_mc=RSS_DR_EDT

$12B in Fraud Loss Came from Data Breach Victims in 2016

Jun
23
Three-quarters of the total fraud losses for 2016 arose from victims who had been victims of a data breach within the previous six years.

Data breach victims are likely to someday become victims of fraud. Of the $16 billion in total fraud loss for 2016, $8.3 billion came from victims who had experienced a breach in the past 12 months and $12 billion arose from victims who had breached in the previous six years.

These findings come from a Javelin Advisory Services report entitled “2017 Data Breach Fraud Impact Report: Going Undercover and Recovering Data.” Researchers discovered the proportion of breach victims who became fraud victims rose to 31.7%, the highest rate in six years.

Javelin claims its findings underscore the longevity of breached data and the interconnectedness between breaches and fraud. Increasingly smaller financial institutions are becoming aware of the Internet’s criminal underground and monitoring the dark Web for mentions of their brand and customers.

The companies with the most mature threat intelligence operations are those acknowledging criminal campaigns. Some operators have infiltrated online criminal groups, and some have paid for data claimed to be stolen. Some buy malware and crime kits directly from threat actors to analyze different malware strains for the purpose of defending against them.

Researchers found the most common type of breached data are credit and debit cards, which were compromised among 44% and 26% of breach victims, respectively, within the past 12 months. Thirteen percent of victims had their Social Security number compromised.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/$12b-in-fraud-loss-came-from-data-breach-victims-in-2016/d/d-id/1329211?_mc=RSS_DR_EDT