STE WILLIAMS

Crack open many of the appliances that populate network and content delivery stacks and you’ll find a lot of processing power — but few CPUs. Instead, you’re likely to find a field-programmable gate array (FPGA) providing the single-purpose processing required for the job. FPGAs will be part of IoT and infrastructure devices for a long time to come, because they are flexible, quickly redefined, and reasonably priced for the functions they deliver.

FPGAs are similar in some aspects to application-specific integrated circuits (ASICs), application-specific standard parts (ASSPs), and other components designed to perform a specific task with high performance and reliability. FPGAs are often used to deliver specific application functions, like encoding the video stream in a camera or editing deck, providing security functions that begin before applications begin running on an IoT device, or calculating mission-critical parameters for defense applications.

There’s a key difference, though, that makes FPGAs both a boon to security professionals and a component that adds to their burden of worry.

That difference is in their ability to be updated. ASICs and most ASSPs contain firmware that is “baked in” at the factory; once programmed, they’re frozen in development time. An FPGA, on the other hand, can be reprogrammed each time it’s re-booted. An FPGA is a blank slate that can be redefined over and over again. Security professionals should be aware of the unique capabilities and growing catalog of vulnerabilities these blanks slates sitting at the heart of so many of the devices in their midst bring to their orgnizations.

A Fresh Start

In a CPU, the configuration of the chip is established at the chip foundry. Programming governs the movement of bits through the pre-set architecture. In an FPGA, though, the configuration is defined by hardware-definition language (HDL) that’s loaded from storage — frequently static random access memory (SRAM) — at device boot time. This means that the architecture of the device can be optimized for a particular task — and updated or upgraded as vulnerabilities are discovered or new capabilities are licensed.

The ability to update the FPGA is seen as a positive security step, because vulnerabilities can be addressed with new definitions.

FPGAs are growing in popularity among device manufacturers because they fit more easily into an “agile” work process than do ASICs. While ASICs have to be defined in a manufacturing process that can take weeks or months in production quantities, FPGAs are defined by software that can be revised as frequently as releases can be dropped — many times a day during development.

As concerns about security and the ability to be updated have gained priority, FPGAs have become more important in production, as well as development. Analysts at Wiseguyreports.com have predicted that the global FPGA market will grow $63.05 billion in 2019 and is expected to reach $117.97 billion by 2026. 

Weakness in Strength

The boot process is also where security vulnerabilities can enter the process.

Earlier this year, Jatin Kataria, Richard Housley, and Ang Cui of Red Balloon Security discovered the Thrangrycat vulnerabilities in certain Cisco routers. In these vulnerabilities, which won the 2019 Pwnie Award for the most under-hyped research, an attacker can interrupt and hijack the “bitstream” — the sequence of HDL that defines the FPGA in the affected routers during boot.

In the case of the Cisco routers, the FPGA was responsible for the Trust Anchor module (TAm) — a piece of the router that is supposed to guard the device against boot-time exploits. If an attacker has gained root access to the device, they can modify the bitstream to disable the TAm and keep it disabled through subsequent reboots of the system.

On the now-unprotected system, a related code-injection vulnerability, discovered by James Chambers, also of Red Balloon Security, would allow the attacker to steal or redirect data at will, since there’s no immediately obvious way for a victim to know that the router is working against them.

Vulnerabilities and Opportunities

Many FPGAs can be partitioned among multiple users, just as CPUs can share workloads from many different users and operating systems. Dennis R. E. Gnad, Jonas Krautter, and Mehdi B. Tahoori of the Karlsruhe Institute of Technology (KIT) have demonstrated a side-channel attack in which one user of an FPGA can “spy” on another by monitoring the minute power fluctuations that occur during different operations on the chip.

One difference between the KIT and Thrangrycat vulnerabilities is that Thrangrycat was demonstrated on FPGAs from Xilinx, while the KIT vulnerabilities were not limited to devices from a single vendor. FPGAs are manufactured by a number of vendors, including Intel, Microsemi, Xilinx, Lattice Semiconductor, Cypress Semiconductor, Texas Instruments, and many more.

Related content:

• Thrangrycat Claws Cisco Customer Security
• New Botnet Targets Android Set-Top Boxes
• Unsecured IoT: 8 Ways Hackers Exploit Firmware Vulnerabilities
• 6 Security Considerations for Wrangling IoT
• Why the Network Is Central to IoT Security

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/edge/theedge/meet-fpga-the-tiny-powerful-hackable-bit-of-silicon-at-the-heart-of-iot/b/d-id/1335730?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

I sat down with Joshua Danielson (CISO at Copart), Ryan Fritts (vice president of product information and security, CISO, at ADT), Rob Geurtsen (deputy information security officer at Nike), and Sherry Ryan (vice president, CISO, at Juniper Networks) to talk about security budgets and evaluating vendor claims for solving mission-critical enterprise security problems. I heard many shared insights around their thought processes for protecting their organizations.

Building the Budget
Before a vendor meets with potential customers, they already possess security budgets with predetermined priorities. Copart’s Danielson notes that the NIST framework and others help organizations establish a shared understanding of risk and set common baselines. Using these baselines, CISOs manage risk registers, set priorities, and determine risk thresholds in their environments.

Armed with a basic understanding of the budgeting process, vendors must remember that, for CISOs, technology is a means rather than an end. According to Nike’s Geurtsen, “The technology is part of the decision, but not the decision. More important is a unified view of risk at that moment and how to mitigate it.” When customers evaluate solutions, they generally focus on gaps in their security programs and how vendor value propositions can fill those gaps. CISOs do not say “we need AI.” Rather, they say “we need to address a problem; if AI is the best way to do that, so be it.” This is a subtle but important distinction.

Think about ROI
Having identified customers’ view of risk, how can a vendor prove its value? Because security does not generate revenue, CISOs measure financial returns by asking the following:

• Does a solution address prioritized areas of risk?
• Does it provide returns by mitigating those risks?
• Will it replace incumbent products or augment an existing cybersecurity portfolio?
• Does this solution enable the business and streamline the corporate security program?

CISOs have increasingly prioritized these last two points as widely publicized human capital shortages in the cybersecurity industry force them to rally around solutions that mitigate operational management gaps.

Juniper’s Ryan sees great value in streamlined solutions. “We’re dealing with a lot of complexity already… so I’m looking for integration with other security tools with similar look and feel, and tools that easily integrate into my environment.” CISOs may want vendors to help justify investing time and resources in new products by ensuring that a solution is easily deployed and tested (reducing up-front investment) and can replace legacy tools (reducing overhead and demonstrating value).

Given today’s security talent deficit, CISOs must consider the cost of human capital, which vendors should keep in mind. A good starting position highlights optimizing return (risk reduction) and minimizes cost (deployment, integration, and maintenance).

Communicate Your Message
Ryan also insists that “if [vendors] do nothing else, provide clarity around the problem you’re solving and how it applies to me.” It sounds simple, but many pitches don’t succinctly articulate a core value proposition. In the noisy security marketplace, it’s easy for vendors to lose their audience. They must present a clear value proposition, differentiated from competitors chasing the same budget.

Generally, security solutions either focus on “blocking-and-tackling” to address prevalent risk, or “greenfield” solutions that speak to emerging risks. For legacy “blocking-and-tackling” functionality, vendors enjoy a significantly lighter burden of proof. Customers understand the problem, possess a level of comfort with their security postures, and want to hear how vendors provide incremental, differentiated value. In these situations, a top-down sales approach with a clear message is most likely to connect.

ADT’s Fritts, however, thinks the best sales approach for cutting-edge solutions is different. “For greenfield, vendors need passionate advocates downstream in the organization communicating upwards.” Ryan adds: “No one has pure greenfields anymore. Directly address where you’ll fit in, optimize across environments, and don’t add complexity.” The category of offering will determine how vendors mold their go-to-market tactics over time, with strategic messaging and tactical sales approaches.

Focus on What’s Important
When vendors finally get in the door, CISOs want pitches to get straight to the point. Fitts and Geurtsen were most impressed with presentations dispensing with filler. Fitts notes, “I could do without the headlines. Like logo slides — it’s great that they’re your customers, but tell me why I should be, too.” Geurtsen agrees. When a vendor “skips the five slides about their investment journey, I’m impressed. … Get to the conversation about how you’ll reduce or manage my problem quickly.”

I often hear from our advisory board that CISOs are well aware of headline-grabbing breaches like the recent incident at Capital One, and do not require lessons on what happened. Similarly, posing questions such as “does vulnerability management matter to you?” comes off as pedantic. Every CISO cares about security. Customers want vendors to focus on how their solution can address those concerns with minimal preamble.

Get CISOs’ Complete Attention
I hear two things from the Fortune 500 CISOs I interact with daily: 1) They want to see great technologies early to understand what is out there on the market, and 2) they are constantly filtering through the noise of 300+ vendor pings every day. CISOs are ready to hear great ideas if approached correctly. Vendors must start thinking like their customers and focus on mitigating risk instead of defining themselves with a technology. Before developing a “better” interface, consider what potential customers already use. When engaging, listen closely and focus on the prospect organization’s specific problems. Be concise and candid in every meeting. “Do that,” says Nike’s Geurtsen, “and you’ll have my complete attention.”

Related Content:

• The State of IT Operations and Cybersecurity Operations
• Where Businesses Waste Endpoint Security Budgets
• Who Gets Privileged Access How to Enforce It
• Capital One Breach: What Security Teams Can Do Now

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s story: “‘It Takes Restraint’: A Seasoned CISO’s Sage Advice for New CISOs.”

John Brennan, Partner at YL Ventures, specializes in seed-stage cybersecurity investing. Leveraging a deep focus on cybersecurity and his diverse background in venture capital, he takes a hands-on approach to supporting YL Ventures’ portfolio companies, especially those in … View Full Bio

Article source: https://www.darkreading.com/risk/an-inside-look-at-how-cisos-prioritize-budgets-and-evaluate-vendors/a/d-id/1335641?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New York’s Monroe-Woodbury Central School District has delayed the first day of school due to a “cyber security threat” affecting district operations, officials wrote in an email to parents Tuesday night. The district is investigating the attack and plans to reopen schools on Thursday.

Superintendent Elsie Rodriguez apologized to parents for the “unexpected schedule change” and said the extra time would allow the school to prepare for a smooth first day later in the week, NBC New York reports. District data is regularly backed up on and off-site, she noted.

The Orange County district does not know how long it will take to remediate the effects of the reported ransomware campaign, the full extent of which is unknown. An unplanned “Superintendent’s Conference Day” was held Tuesday, a day before school was slated to start.

Monroe-Woodbury is the fourth tri-state school district hit with a cyberattack this year, following campaigns against Rockville Center and Mineola in Long Island, and Wolcott in Connecticut.

Read more details here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “‘It Takes Restraint’: A Seasoned CISO’s Sage Advice for New CISOs.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/risk/back-to-school-not-so-fast-cybercriminals-say/d/d-id/1335728?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Using text messages with embedded links, security researchers from Check Point Software Technologies recently discovered that spoofing messages from a phone carrier could be used to configure certain features, including e-mail and the directory server, of several brands of Android phones.

The attack uses over-the-air (OTA) provisioning messages, a technique used by carriers to deploy certain configurations to phones for their network: but the malicious attack exploits design weaknesses on several brands of Android phones, including Samsung, Sony, LG, and Huawei.

While OTA provisioning has been used in the past to set up wireless access point proxies to hijack traffic, this is the first time that an attack has been shown to hijack email on mobile phones, says Slava Makaveev, a security researcher with Check Point. 

“The ability to configure email and directory servers is a vendor-specific extension for the protocol,” he says. “The email server provisioning is a design weakness.” 

The security flaw puts users of the phones at risk if they trust the source of any over-the-air update. On a Samsung phone, an attacker could, without any sort of authentication check, change the MMS message server, the proxy address for Internet traffic, the browser homepage and bookmarks, the email server, and any directory servers for synchronizing contacts and calendar.

Sony, LG, and Huawei phones, meanwhile, pose only slightly higher hurdles for an attacker — a valid IMSI (international mobile subscriber identity), which is specific to the phone, but could be retrieved by an application with the right permissions, according to Check Point.

Even without the IMSI, there is a way to fool the user. “For those potential victims whose IMSI could not be obtained, the attacker can send each victim two messages,” Makkaveev wrote in Check Point’s technical brief. “The first is a text message that purports to be from the victim’s network operator, asking him to accept a PIN-protected OMA CP, and specifying the PIN as an arbitrary four-digit number. Next, the attacker sends him an OMA CP message authenticated with the same PIN.”

The underlying design flaw is that while requiring the user to accept the changes, all of these provisioning methods appear with all the trappings of an official message from the phone carrier – with the specific dialog box labeled “New Settings.”

“When you first join a new carrier network, you’ll get a warm, welcome message from your carrier — do not trust it,” Check Point’s Makkaveev said in statement. “People naively think those messages are safe. Simply, we can’t trust those texts anymore.” 

OTA provisioning is not part of the basic Android distribution but many carriers implement their own, as specified in the Open Mobile Alliance Client Provisioning (OMA CP) standard. However, the standard includes only a few ways to authenticate messages and makes the security check optional. 

Weak Authentication

Check Point researchers found that Samsung phones don’t perfrom authentication checks on client-provisioning messages, and several other phone makers — including Huawei, LG, and Sony — have weak authentication using the IMSI, a semi-private identifier for the phone. Because of the weak authentication, the source of any over-the-air provisioning messages that come in cannot be verified, Check Point stated in its advisory.

“A recipient cannot verify whether the suggested settings originate from her network operator or from a dangerous imposter looking to read their emails,” the company said. 

Check Point notified each phone provider in March and gave them a chance to update their software. Samsung patched its software in May and LG released a fix in July, according to Check Point. Huawei plans to fix the next version of their phones, and Sony did not consider the issue to be a vulnerability, Check Point said. 

In the past, patching of firmware has been a laborious process for Android phones. The original software maker has to patch the issue, the hardware make has to approve the fix, as does the carrier, and then the use has to update. For that reason, Check Point does not know how widespread the issue currently is, says Makaveev.

“We don’t know how many people have downloaded the latest patches provided by Samsung and LG — we highly recommend they do that,” he says. “Holders of Huawei and Sony devices are not protected at all.”

Related Content:

• Android Malware ‘Triada’ Most Active on Telco Networks
• 47% of Android Anti-Malware Apps Are Flawed
• Malware Found in Android App with 100M Users
• New Android ‘Toast’ Vuln Makes Overlay Attacks Easier

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: ‘It Takes Restraint’: A Seasoned CISO’s Sage Advice for New CISOs

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/mobile/android-phone-flaw-allows-attackers-to-divert-email/d/d-id/1335729?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A newly discovered phishing campaign aims to slip past perimeter security tools by using SharePoint to send malicious documents to victims primarily in the UK financial services sector.

Researchers with Cofense who disclosed the attack say the initial email comes from a compromised account belonging to Independent Legal Assessors, a legitimate legal services firm based in London. Recipients are asked to review a proposal document by clicking a URL embedded in the email, which redirects them to a compromised SharePoint account.

SharePoint serves as the initial mechanism to deliver a second malicious URL. Victims who access the compromised SharePoint site will see a malicious OneNote document, which they are prompted to download. This secondary step takes them to the main credential phishing page, which is “a cheap imitation” of the OneDrive for Business portal, researchers explain. Victims have two options to authenticate: either by using Office 365 credentials or a username and password for another email provider. The second increases the chance someone will log in.

Many automated defensive tools only go one layer deep, explains Cofense CTO Aaron Higbee. Because the first embedded URL comes from SharePoint and the email doesn’t contain malware, it’s not flagged as a threat. In Cofense’s example, attackers wrapped the URL with Symantec Click-time URL Protection, but this tactic can be used to bypass many perimeter tools.

“A few years ago, we would’ve found it, but now the attackers use one layer to link you to another website,” Higbee says. Most of the attackers’ emails contain typically office communications. Some discuss legal summons or issues; others relate to billing and invoices.

OneDrive document is blurred until downloaded. Image: Cofense.

Researchers downloaded files from the compromised server and found that credentials from the phishing form are posted by login.php, which posts harvested credentials via email to [@]gmail[.]com. Researchers assume [@]gmail[.]com is a separate compromised account. Other files from the server could point to the origin of the attack. Researchers discovered a readme file providing the operator with instructions on how to configure and install the phishing page onto a compromised server. The phishing kit is built and sold by BlackShop Tools, researchers explain in a blog post on their findings.

This campaign is the latest instance of an increasingly popular trend. Attackers use services like SharePoint, OneDrive, and Windows.net as intermediaries to redirect people to phishing sites. It poses a tremendous challenge to defenders, who don’t have the option of blocking them.

“When your own business is on Office 365, you can’t necessarily block these cloud domain names,” Higbee says. “This one was SharePoint, but we are seeing the entirety of the Office 365 suite being abused quite frequently from attackers.” Microsoft’s Office 365 is used far more often in these types of phishing attacks compared with Google’s G Suite, he adds.

While these attacks may present a red flag in the form of an unusual URL on the OneDrive portal, Higbee points out these may not be noticed on smartphones, which unlike desktops don’t visibly show the URL bar. “You know how impractical that is on a mobile device,” he says, noting that it “would be very difficult for someone to key in on this.”

Related Content:

• 7 Biggest Cloud Security Blind Spots
• Multicloud Businesses Face Higher Breach Risk
• Upping the Ante on Anti-Analysis
• 3 Promising Technologies Making an Impact on Cybersecurity

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: ‘It Takes Restraint’: A Seasoned CISO’s Sage Advice for New CISOs

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/perimeter/phishing-campaign-uses-sharepoint-to-slip-past-defenses/d/d-id/1335731?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The standards body in charge of 5G wireless network security is drafting new requirements for addressing recently reported vulnerabilities in the technology that impact both end user devices and operator infrastructure.

The new requirements – which are expected to become available from the 3^rd Generation Partnership Project (3GPP) with the next release of the 5G standard – specify how certain device information should be handled on the network. 

Security researchers at the Technical University of Berlin and Kaitiaki Labs discovered the vulnerabilities earlier this year and presented details of their work at Black Hat USA.

The problem, according to the researchers, is that when a mobile device registers on a 5G network, details about the device and its technical capabilities are exchanged in an insecure manner. This gives attackers a way to intercept the device capability data and use it to identify specific devices, degrade performance, and drain batteries.

“The vulnerabilities are present in the 4G and 5G registration procedure that happens every time a device is turned on with SIM card,” says Altaf Shaik, principal security researcher at Kaitiaki Labs and PhD student at the Technical University of Berlin.

During this procedure the device conveys its capabilities — such as its throughput categories, app data, radio protocol support, security algorithms, and carrier info — to the network, either in plain text or prior to establishing over-the-air security. This opens the procedure to both passive attacks and man-in-the-middle attacks, Shaik says.  

“Attackers can obtain the capabilities and fingerprint specific devices or can modify the capabilities and cause downgrade or DoS [denial-of-service] attacks,” he says.

Potential dangers include attackers being able to track high-value devices such as those belonging to politicians or the military, or downgrading devices to less secure networks and causing poor quality of service overall.

4G LTE Affected as Well

Shaik identified the vulnerabilities in the current 3^rd Generation Partnership Project (3GPP) standards for mobile telephony. All devices supporting 4G LTE and upcoming 5G standards are impacted.

Shaik and fellow researcher Ravishankar Borgaonkar from Kaitiaki Labs built an experimental setup consisting of two i7 PCs running Linux and two software-defined radio modules to demonstrate how attackers could exploit the vulnerabilities.

Shaik says the task of fingerprinting mobile devices using the vulnerabilities is similar to using the Nmap network-scanning tool on the Internet. By intercepting and analyzing device capabilities, an attacker can identify device model, device type, manufacturer, applications, operating system version, and other details.

The two researchers used their experimental set up to similarly show how an attacker could use a man-in-the-middle attack to make a device appear less powerful than it really is to the network – thereby effectively neutralizing its high-speed capabilities. In experiments the researchers conducted with an iPhone 8 and a Nighthawk M1 mobile router, the researchers were able to degrade device performance from 27 Mbps to 3 Mbps. Of the 30 mobile networks that Shaik and Borgaonkar tested for the issue, 21 were impacted.

Similarly, attackers can cut down the effective battery life of narrowband IoT devices by a factor of five by disabling the IoT functionality in the devices and making them operate like a traditional smartphone, Shaik says.

The 3GPP standards body is currently working on introducing a requirement that device capability information is protected and will be sent to the network only after a secure session has been established, he adds.

High Impact on Unattended IoT

In a change request form on the 3GPP website, the organization described the vulnerabilities as exposing user equipment to attacks that can downgrade device throughput, or to trace specific devices.

“Since the [User Equipment] capabilities are persistently stored in the network, the impact of the attack can last for weeks, or until the UE is power cycled,” the standards body said. It added that such attacks could have a particularly high impact on unattended IoT devices.

Rolando Hernandez, vice president at Valid, a Brazilian provider of various mobile technology and data services, says the security issues surrounding 5G exist at both the network and the device level. “Protection of the subscriber’s identity is one of 5G’s biggest security challenges,” he notes.

“The easiest fix to this challenge is to implement the subscription concealed identifier (SUCI), which adds an additional layer of security,” he says. The SUCI prevents a malicious actor from tracking mobile subscribers because the subscriber identifier in a 5G SIM card is encrypted such that only the 5G network is able to match the real subscriber, he says.

“The standards bodies are a carrier’s best bet for mitigating the vulnerabilities associated with 5G networks,” he notes. “When any vulnerability is discovered and improvements are suggested, standardization entities launch a new version of the standards, indicating the changes that manufacturers will need to implement in their equipment or devices.”

Related Content:

• Security Top Concern as Mobile Providers Think 5G
• CISA Warns Public About the Risks of 5G
• Europol Head Fears 5G Will Give Criminals an Edge
• 7 Steps to Web App Security
  

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “‘It Takes Restraint’: A Seasoned CISO’s Sage Advice for New CISOs.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/mobile/5g-standard-to-get-new-security-specifications/d/d-id/1335735?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple