STE WILLIAMS

How information sharing and analysis centers provide contextual threat information by creating communities that helps security professionals and their organizations grow in maturity and capability.

The primary function of Information Sharing and Analysis Centers, or ISACs, as stated in their charters, is to reduce risk in member organizations through improvements to prevention, detection, and response. To do this effectively, they must serve as a trusted broker in the sharing of specific information on relevant threats. This definition is important because of their relationship with two critical factors: the quality of shared information and the active participation of members of the core groups. As a trusted broker, the ISAC is the steward of both quality and quantity.

Prior to ISACs, if you weren’t part of an “inner circle” of security professionals, you couldn’t benefit from information being exchanged. ISACs allow relative newcomers to become instantly trusted, to a degree, so that they can get insight into the threats and security issues their peers are seeing.

With respect to quality, one of the goals of ISACs is to create a community where everyone can learn from each other through the sharing of meaningful data. When one organization is hit with malware or targeted by an adversary, everyone else will know when someone else in the group has seen this threat. Because anonymity is provided by the trusted broker, specific information can be provided to allow others to look in their own networks to see if they have also been targeted.

Trusted Broker: Achieving Critical Mass
The role of trusted broker enables information-sharing groups to achieve critical mass, thus providing quantity. Previously, sharing was only done between individuals who knew each other and had an established relationship. But this model is naturally limited in scope. When tens and hundreds of organizations are brought together and people don’t know each other, the ISAC acts as the trusted broker to protect the anonymity of each organization that is sharing information, and provides a mechanism through which the information being shared is specific and relevant to the industry sector.

Ideally, ISACs are in a position to answer some of the biggest questions that nag security professionals: “What kinds of things are my peers and competitors seeing?” and “What are they doing to improve security that I may be missing and should be doing?” Many ISACs hold annual, semi-annual, or even quarterly events for their members to meet and discuss current leading practices related to security, cyber threat intelligence and sharing. Some of the best information shared takes place at live events where members can interact to discuss programs they have started, what they are doing, and how they are communicating and marketing themselves within their own organizations.

PII, Proprietary Cross-Sector Info
Outside of these in-person opportunities, digital sharing tends to be limited to indicators and rebroadcasts of general information. Even with a trusted broker in place, organizations can be hesitant to share specific information. For the most part, these restrictions are self-imposed by legal staff within companies. Concerns range from sharing personally identifiable information (PII) or corporate proprietary information, to sharing information that was part of a breach. In truth, the only legal restrictions to sharing cyber threat information are regulatory in nature when it comes to disclosing PII. A lot of value can be gained by sharing what you know about the external threat, how it operates, the tools it uses, and (if you’re bold enough) how it was able to subvert your security to be successful. None of those items involve PII and the data can be genericized enough so as not to give anyone a competitive advantage.

Another important, yet sometimes overlooked, source for specific and relevant information is cross-sector information. In the real world, threats are rarely limited to a single sector, and the way security professionals think about threats is not necessarily the way the bad guys think about targeting us. For example, an attack that targets the financial sector may very well be used to target oil and gas or energy or retail or government. ISACs have an opportunity to provide better cross-sector information so that members can proactively monitor and even prepare for these threats, depending on their risk profile and other priorities.

ISACs provide the culture, technology, and processes by which organizations can share information with other organizations. They are actively working to provide more contextual threat information by creating a community that helps individuals and their organizations grow in maturity and capability. It will be interesting to see where things stand next year. I’m optimistic that with an unwavering commitment to the role of “trusted broker,” information-sharing groups will be able to deliver value at scale.

Related Content:

• Understanding Solving the Information-Sharing Challenge
• How We Collectively Can Improve Cyber Resilience
• The 10 Essentials of Infosec Forensics

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Right to Be Patched: How Sentient Robots Will Change InfoSec Management.”

As Senior VP of Strategy of ThreatQuotient, Jonathan Couch utilizes his 20+ years of experience in information security, information warfare, and intelligence collection to focus on the development of people, process, and technology within client organizations to assist in … View Full Bio

Article source: https://www.darkreading.com/risk/isac-101-unlocking-the-power-of-information-/a/d-id/1335655?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Paige Thompson – a 33-year-old woman from Seattle and former software engineer who allegedly turned cyber mega-attacker – has been indicted for the huge Capital One data breach discovered last month.

Capital One was just one of more than 30 entities targeted by her alleged attacks, according to a federal grand jury indictment that was announced on 28 August by the US Attorney’s Office for the Western District of Washington.

Thompson, who allegedly used the username “erratic” on social media, was also indicted for allegedly ripping off data from a cloud computing provider and a host of customers that rented its servers, including an unnamed state agency; a non-US-based telecom that provides service to users in Europe, Asia, Africa and Oceania; and a public research university.

As of Wednesday, law enforcement was still working to inform all of the victims whose data was accessed.

When we wrote up the Capital One breach at the end of July, this is what we knew about who was affected by the breach:

• 100,000,000 users in the USA
• 6,000,000 users in Canada
• Any consumer or small business who applied for a credit card in the past 14 years (2005 to early 2019).
• Personal data including names, addresses, zip codes, phone numbers, email addresses, dates of birth, income.

Some customers also had the following information stolen:

• Credit scores, credit limits, balances, payment history, contact information and more.
• Social security numbers (SSNs).
• Bank account numbers linked to credit cards.

The silver lining is that the majority of customers didn’t lose SSNs in the breach – at the time, Capital One said that only 140,000 SSNs and 80,000 bank account numbers were acquired.

But the fact that any of those SSNs at all were available to be hacked away played into a class-action lawsuit that followed fast on the heels of the breach.

According to the lawsuit, both Capital One and GitHub – a code hosting platform for open-source software development version control that lets coders remotely collaborate on projects – broke the law by not keeping SSNs and other personal data offline.

GitHub was named because the attacker had posted details to the platform about stealing data from Capital One servers via a misconfigured firewall. The information was available on GitHub for over three months, until a bug hunter spotted it and notified Capital One.

When the lawsuit was filed in early August 2019, GitHub countered by saying that the file posted on GitHub didn’t contain any SSNs, bank account information, or any other reportedly stolen personal information. Capital One had asked GitHub to remove content containing information about the methods used to steal the data, which it says it promptly did.

Thompson is facing two charges: computer fraud and abuse, and wire fraud.

Attacker walked through holes in misconfigured firewalls

According to the indictment, Thompson allegedly created scanners to scan the publicly facing portion of servers rented or contracted through the unidentified cloud computer company. The scanners would pick out the servers whose companies had misconfigured their firewalls so as to allow outside commands to penetrate and get access.

That allegedly enabled Thompson to get security credentials for particular accounts and roles within the victimized organizations. From there, she allegedly got at folders or buckets of data in their storage space, and used the servers to mine cryptocurrency – a practice known as cryptojacking.

After spotting erratic’s post on GitHub, another GitHub user on 17 July 2019 alerted Capital One to the possibility that it had suffered a breach. Capital One notified the FBI, which traced the intrusion to Thompson. When agents executed a search warrant on 29 July, they seized electronic storage devices that were said to contain copies of the stolen data.

The DOJ says that investigators haven’t yet found evidence of Thompson having sold or disseminated any of the stolen data. If convicted, Thompson is facing a prison sentence of up to 25 years, though maximum penalties are rarely handed out.

To stay updated on the status of the Capital One breach, check in on the company’s breach notification site.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/au_7MSrus80/

Google’s going to throw more bug bounty money at the problem of nasty apps in its Play Store, it announced on Thursday.

In a post from the Android Security Privacy team’s Adam Bacchus, Sebastian Porst, and Patrick Mutchler , the company said that it’s throwing the security net over not just its own apps, but over all uber-popular third-party software – as in, apps that have more than 100 million installs.

The search king is fattening up its Google Play Security Reward Program (GPSRP), and it’s launching a new Developer Data Protection Reward Program (DDPRP).

Money from the enlarged pot in the GPSRP will go to Android app makers even if those makers are running their own bug bounty programs.

Google is encouraging app makers that don’t yet have bug bounty programs to start them up. If a given app developer doesn’t have a bug bounty program yet, though, Google will be helping bug hunters to responsibly disclose identified vulnerabilities to them.

Google’s sweetening of the pot should help stamp out all that many more bugs, the company said, though it would be nice if the app developers set up these programs themselves:

This opens the door for security researchers to help hundreds of organizations identify and fix vulnerabilities in their apps. If the developers already have their own programs, researchers can collect rewards directly from them on top of the rewards from Google. We encourage app developers to start their own vulnerability disclosure or bug bounty program to work directly with the security researcher community.

In July 2019, Google announced that it was tripling the maximum baseline reward amount from $5,000 to $15,000 for Chrome bugs, and doubling the maximum reward amount for high-quality reports from $15,000 to $30,000. It also doubled the additional bonus given to bugs found by fuzzers running under its Chrome Fuzzer Program to $1,000.

It also pumped up its standing reward to $150,000 for exploit chains that can compromise a Chromebook or Chromebox with persistence in guest mode.

At that time, Google said that rewards paid out under its Google Play Security Reward Program for remote code execution bugs was going way up: from $5,000 to $20,000. At the same time, rewards for bugs involving theft of insecure private data was increased from $1,000 to $3,000, and payment for bugs enabling access to protected app components was pushed from $1,000 to $3,000.

It’s all adding up: Google says that to date, GPSRP has paid out over $265,000 in bounties. Increasing the scope has resulted in $75,500 in rewards across July and August alone, Google says, and the more it adds, the more it expects the security research community is going to help it stamp out bugs.

Good to hear. It needs the help!

Playing rough in Google Play Store

There’s been a long string of rotten apples spoiling the Google Play store barrel. The most recent one cropped up in April 2019, when government spyware, named Exodus, was found hidden in apps.

Some months before that discovery, in February 2019, research found that 18,000 Play Store apps, many with hundreds of millions of installs, appeared to be sidestepping the Advertising ID system by quietly collecting additional identifiers from users’ smartphones in ways that couldn’t be blocked or reset.

Before that: in May 2018, SophosLabs found photo editor apps hiding malware on Google Play.

And before that? In February 2018, Google announced that just in the previous year alone, it had removed 700,000 bad apps and stopped 100,000 bad-app developers from sharing their nastyware on the Google Play store.

In short, it’s long been true that you don’t have to be much of an evil genius of an app developer to get past Google’s filters. As Motherboard reported back when Exodus was discovered lurking on the app store, more than 20 malicious apps in the Exodus family went unnoticed by Google over the course of roughly two years.

Teaming up with HackerOne on the DDPRP

Also on 28 August, Google announced the brand-new Developer Data Protection Reward Program (DDPRP): a bounty program it’s running in collaboration with HackerOne that’s meant to identify and mitigate data abuse issues in Android apps, OAuth projects, and Chrome extensions.

In separate news, HackerOne announced that six hackers have become the first in the world to earn over $1 million each on the bug bounty platform. It’s quite the disparate collection: One is an ex-convict living in the rural US, another a 20-something traveling the world on his bounty cash, and a third is an industry veteran coaching people like HackerOne’s first million-dollar hacker – a 19-year-old living in Argentina. Another’s a serial entrepreneur, and the last is a “hacking powerhouse” who made $75k in July alone.

At any rate, Google says the purpose of the new joint venture with HackerOne, the DDPRP, is to recognize the people who report apps that violate Google Play, Google API, or Google Chrome Web Store Extensions program policies.

That includes people who identify situations where user data is being abused, Google says, whether it’s being “used or sold unexpectedly, or repurposed in an illegitimate way without user consent.” Accurate reports can lead to apps or extensions getting yanked from Google Play or Google Chrome Web Store, or, in the case of app developers who are found to be up to no good, it can lead to those developers losing API access.

Google doesn’t have a reward table yet for this new program, but it says that payout could be as much as $50,000.

“Happy bug hunting!”

Thanks, Google said, and please do keep sending those reports on over – we’ll look forward to seeing what you find:

As 2019 continues, we look forward to seeing what researchers find next. Thank you to the entire community for contributing to keeping our platforms and ecosystems safe.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/bPMJRaBtj94/

The latest high-profile celebrity Twitter account to get hacked…

…was none other than @jack, which belongs to Jack Dorsey, the founder and CEO of Twitter itself.

Twitter’s corporate communications account has confirmed that the account got taken over, but says that @jack is “now secure, and there is no indication that Twitter’s systems have been compromised.”

@jack The account is now secure, and there is no indication that Twitter’s systems have been compromised.

—
Twitter Comms (@TwitterComms) August 30, 2019

Twitter Comms later confirmed that the attack was possible because “the phone number associated with the account was compromised”, suggesting that Dorsey May have been the victim of a SIM swap attack.

@jack The phone number associated with the account was compromised due to a security oversight by the mobile provid… twitter.com/i/web/status/1…

—
Twitter Comms (@TwitterComms) August 31, 2019

In a successful SIM swap attack, hackers persuade a mobile phone provider to transfer a victim’s phone number to the hacker’s SIM card, giving the hacker access to the victim’s calls and messages.

Dorsey is rumoured to use a service that allows him to tweet via SMS messages, and this may be what gave the hackers the ability to tweet in his name.

An alternative is that they first cracked his password and then used their access to his phone number to steal a 2FA code sent to it via SMS.

The good news for Twitter users is that this wasn’t a hack on Twitter’s infrastructure and possibly not even a full takeover of the @jack Twitter account (we don’t know if Dorsey was prevented from using his account, only that others gained some ability to abuse it).

We’re not going to reprint any of the tweets or reweets that were sent during the period that a hacking crew going by the nickname Chuckling Squad claimed to have access – if you really must see them, you can find them elsewhere – but they seem to have included a number of racist and anti-semitic taunts, as well as a bomb hoax.

Unsurprisingly, Dorsey is a popular and prolific tweeter himself, with more than 4,000,000 followers and 26,000 tweets, so Twitter’s quick response was commendable – reports suggest that the offensive tweets were removed within 15 minutes of being sighted.

Not everyone in the Twittersphere was complimentary about the response, however, with the very first reply to Twitter’s PR account saying that the company should:

ban him and make him appeal via email, then take a couple days to process it. [W]hy give him special treatment?

@TwitterComms @jack you should ban him and make him appeal via email, then take a couple days to process it. why give him special treatment

—
llama (@LlamaInaTux) August 30, 2019

Anyone who has lost control of any of their own social media accounts – for example due to phishing, a poorly-chosen password or an unlocked phone in the wrong hands – will know that it’s often a stressful exercise to reclaim the account.

To be fair to Twitter, however, establishing that Jack Dorsey was indeed the rightful user of the @jack account would not have been a difficult process, so the company’s super-fast response in this case can hardly be put down to favouritism.

What to do?

To avoid losing control of your Twitter account, read our guide to securing your Twitter account.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/vEvUc0ZSkTM/

Twitter CEO Jack Dorsey’s Twitter account was, apparently, hijacked for roughly 20 minutes and used for a racist rant.

The Twitter account of Twitter CEO Jack Dorsey, well known by his handle @jack, was apparently hijacked today.

Over the course of roughly 20 minutes, the account was used to tweet and retweet dozens of racist and incendiary posts, many tagged with the name #ChucklingSquad, a group that’s been credited with several account takeover attacks recently. 

One suspected method of the account takeover is a SIM swap, which enables an attacker to intercept any two-factor authentication that uses SMS as the second factor. In a SIM swap, the number associated with one SIM card is changed to be associated with a different device.

For more, see here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “‘It Saved Our Community’: 16 Realistic Ransomware Defenses for Cities.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/-jack-got-hacked-twitter-ceos-tweets-hijacked/d/d-id/1335703?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Google’s Project Zero says more than a dozen iOS flaws that Apple patched back in February had been under attack for years.

Zero team bug hunter Ian Beer explained how the collection of fourteen vulnerabilities in various components of the OS, ranging from the browser to the kernel, were chained together to covertly launch spyware on the machines of anyone who visited one of a group of “watering hole” sites.

Those exploits, designed to compromise new versions and models of the iPhone and iOS as they were released, from the iPhone 5s to the X, appeared in various combinations that were active on the sites for over two years prior to being discovered and patched.

“There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant,” Beer noted on Thursday.

“We estimate that these sites receive thousands of visitors per week.”

In total, Beer says, the 14 flaws were grouped into five separate chains. Each chain of vulnerabilities included combinations of sandbox escapes, elevation of privilege flaws, and kernel bugs that allowed the attacker to jump from loading a web page on the device to executing code as root.

The malware itself appears designed to monitor users, as it decrypts and siphons off messages from Telegram, WhatsApp, iMessage, and Hangouts, as well as harvesting authentication tokens and collecting user contacts, photos, email, and GPS data.

While the malware is wiped when the device reboots, Beer says the stolen authentication tokens and detailed device information the software nasty collects would allow attackers to effectively track the targets without the code running.

“To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group,” the Google security guru said.

“All that users can do is be conscious of the fact that mass exploitation still exists and behave accordingly; treating their mobile devices as both integral to their modern lives, yet also as devices which when compromised, can upload their every action into a database to potentially be used against them.”

Breaking news: Apple un-breaks break on jailbreak break

READ MORE

What is catching the attention of the security community is the longevity of the operation. At a time when zero-day exploits are highly sought-after and valuable, the attackers managed to quietly continue to collect and exploit bugs quietly for years.

As Beer notes, however, if the end result was the ability to track and stop a specific group, the operation would have been worth the cost.

“I shan’t get into a discussion of whether these exploits cost $1 million, $2 million, or $20 million,” he said.

“I will instead suggest that all of those price tags seem low for the capability to target and monitor the private activities of entire populations in real time.”

Anyone worried about infection will want to make sure they are running the latest version of iOS (or anything from after February, really). ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/30/google_iphone_exploit_chain/

Exclusive A coin-mining malware infection previously only seen on Arm-powered IoT devices has made the jump to Intel systems.

Akamai senior security researcher Larry Cashdollar says one of his honeypot systems recently turned up what appears to be an IoT malware that targets Intel machines running Linux.

“I suspect it’s probably a derivate of other IoT crypto mining botnets,” Cashdollar told The Register. “This one seems to target enterprise systems.”

In addition to being fine-tuned for Intel x86 and 686 processors, the malware looks to establish an SSH Port 22 connection and deliver itself as a gzip archive. From there, the malware checks to see if the machine has already been infected (at which point the installation stops) or if an earlier version is running and needs to be terminated. From there, three different directories are created with different versions of the same files.

“Each directory contains a variation of the XMrig v2.14.1 cryptocurrency miner in either x86 32bit or 64bit format,” the Akamai security ace explained. “Some of the binaries are named after common Unix utilities, like ps, in an attempt to blend into a normal process list.”

Cryptojacking isn’t a path to riches – payout is a lousy $5.80 a day

READ MORE

Following that step, the malware looks to install the cryptocurrency mining tool itself and modify the host system’s crontab file to make sure the malware runs even after a reboot. Additionally, the malware installs a shell script that allows it to communicate with the command and control server.

It seems that this attack was a matter of scumbags seeing an untapped market to expand their cryptocurrency mining operations into. In this case, when Arm and MIPS-powered devices with telnet connections dried up, the bad guys stepped up their game and began crawling for Intel systems that would accept files over SSH port 22.

In short, they pivoted from one type of low-hanging fruit to another.

“Criminals will continue to monetize unsecured resources in any way they can. System administrators need to employ security best practices with the systems they manage,” Cashdollar said.

“Unsecured services with unpatched vulnerabilities or weak passwords are prime targets for exploitation and abuse.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/30/coinmining_malware_intel/

Roundup This week ended with a bang, thanks to some Twitter hackers.

An (as yet) unknown group took over the account of Twitter co-founder and CEO Jack Dorsey for several hours on Friday, filling the billionaire’s feed with incoherent and occasionally profane rants.

Twitter says it is investigating what happened, but it appears the account was taken over via third-party service Cloudhopper, an app that allows users to send out Tweets via SMS messages. In that case, the hackers could have performed a SIM swap attack – convincing Dorsey’s phone carrier to assign his number to a different device – and then moved in.

According to security blogger Brian Krebs, the hackers may also be involved in a string of celebrity account takeovers conducted via SIM swapping tricks.

https://publish.twitter.com/?query=https%3A%2F%2Ftwitter.com%2Fbriankrebs%2Fstatus%2F1167540888228249600widget=Tweet

Cisco patches “10/10” security bug

A high-severity vulnerability has been reported and patched for Cisco’s IOS XE platform.

CVE-2019-12643 is an authentication bypass flaw in IOS XE’s REST API that, if exploited, would allow the attacker to send arbitrary commands to the device. The bug got a maximum CVSS score of 10.

There are a few mitigating factors for this flaw, however. Most notably, the REST API is not enabled by default – admins have the option to use it for management tasks but the flaw won’t be exposed out of the box. In fact, in IOS XE versions 16.7.1 and later, the vulnerable package is not even included, but rather it must be downloaded separately.

Additionally, Cisco notes, only four models, the Integrated Services Virtual Router, Cloud Services Router 1000V Series, ASR 1000 Series Aggregation Services Routers, and 4000 Series Integrated Services Routers support the vulnerable API.

Those who do use the REST API package will want to make sure they are running version 16.09.03 or later.

Ransomware bites down on US dentists

A serious ransomware outbreak at a service provider has left a number of dentists in the US unable to access patient records. DDS Safe confirmed media reports that its service had been hit by a ransomware infection that locked down user data. The decryption of the data is now underway, but DDS Safe is telling its customers not to type up any patient letters just yet.

“At this time, we caution against making any notifications because, as set forth above, we simply do not know the scope of the attack. We do not want to inform patients that their information has been compromised if it has not been,” the records service said.

“Likewise, we do not want to make any assurances that no data was compromised as we may learn it has been.”

Hardly reassuring.

Arxan hit with plagiarism claim in Magecart report

An otherwise normal report of a Magecart infection took a turn this week when security firm Arxan was accused of ripping off content from another company’s report.

The passages in question were used in Arxan’s disclosure of 80 new retail sites that were found to be infected. Rival security company RiskIQ noted that Arxan’s info looked a lot like one of its Magecart reports, almost identical in fact.

Dear @AiteGroup @Arxan, when you “write” a report on something don’t plagiarize. “Your” introduction from your report is a straight copy from our 2018 “Inside Magecart” report.

Thread 1/n pic.twitter.com/S6zPCFLgRy

— Yonathan Klijnsma (@ydklijnsma) August 29, 2019

Arxan would later acknowledge the issue and apologize, saying it “forgot” to cite RiskIQ.

We sincerely apologize for the lack of citation. We have tremendous respect for RiskIQ and have removed the report until we can address the issues.

— Arxan Technologies (@Arxan) August 29, 2019

France and Avast team up to tackle malware outbreak

Avast says it recently joined forces with the French police to take down a European malware outbreak.

According to the security firm, a cryptomining worm known as Retadup had managed to infect some 850,000 machines, largely in South America.

When Avast mapped out the malware’s network, they found that the command and control systems were operating out of France. That was when French police were called in to help break up the operation. Eventually, the two groups were able to seize the command and control servers and replace it with a cleaning tool that removes the malware from the infected machines.

“The cybercriminals behind Retadup had the ability to execute additional arbitrary malware on hundreds of thousands of computers worldwide,” Avast malware analyst Jan Vojtěšek said.

“Our main objectives were to prevent them from executing destructive malware on a large scale, and to stop the cybercriminals from further abusing infected computers.”

SafeBreach checks Check Point, uncovers security hole

Once again we have a report of vulnerabilities in a security product.

This week, SafeBreach says it uncovered and reported a privilege escalation flaw in Check Point Endpoint Security that would allow for attacks by way of unsigned DLLs.

Fortunately, the bug has been patched, and anyone running Endpoint Security can obtain the fix by updating to version E81.30 or later. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/31/security_roundup_300819/

Exclusive A coin-mining malware infection previously only seen on ARM IoT devices has made the jump to Intel systems.

Akamai senior security researcher Larry Cashdollar says one of his honeypot systems recently turned up what appears to be an IoT malware that targets Intel machines running Linux.

“I suspect it’s probably a derivate of other IoT crypto mining botnets,” Cashdollar told The Register. “This one seems to target enterprise systems.”

In addition to being fine-tuned for Intel x86 and 686 processors, the malware looks to establish an SSH Port 22 connection and deliver itself as a gzip archive. From there, the malware checks to see if the machine has already been infected (at which point the installation stops) or if an earlier version is running and needs to be terminated. From there, three different directories are created with different versions of the same files.

“Each directory contains a variation of the XMrig v2.14.1 cryptocurrency miner in either x86 32bit or 64bit format,” the Akamai security ace explained. “Some of the binaries are named after common Unix utilities, like ps, in an attempt to blend into a normal process list.”

Cryptojacking isn’t a path to riches – payout is a lousy $5.80 a day

READ MORE

Following that step, the malware looks to install the cryptocurrency mining tool itself and modify the host system’s crontab file to make sure the malware runs even after a reboot. Additionally, the malware installs a shell script that allows it to communicate with the command and control server.

It seems that this attack was a matter of scumbags seeing an untapped market to expand their cryptocurrency mining operations into. In this case, when ARM and MIPS-powered devices with telnet connections dried up, the bad guys stepped up their game and began crawling for Intel systems that would accept files over SSH port 22.

In short, they pivoted from one type of low-hanging fruit to another.

“Criminals will continue to monetize unsecured resources in any way they can. System administrators need to employ security best practices with the systems they manage,” Cashdollar said.

“Unsecured services with unpatched vulnerabilities or weak passwords are prime targets for exploitation and abuse.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/30/coinmining_malware_intel/

Google’s Project Zero says more than a dozen iOS flaws that Apple patched back in February had been under attack for years.

Zero team bug hunter Ian Beer explained how the collection of fourteen vulnerabilities in various components of the OS, ranging from the browser to the kernel, were chained together to covertly launch spyware on the machines of anyone who visited one of a group of “watering hole” sites.

Those exploits, designed to compromise new versions and models of the iPhone and iOS as they were released, from the iPhone 5s to the X, appeared in various combinations that were active on the sites for over two years prior to being discovered and patched.

“There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant,” Beer noted on Thursday.

“We estimate that these sites receive thousands of visitors per week.”

In total, Beer says, the 14 flaws were grouped into five separate chains. Each chain of vulnerabilities included combinations of sandbox escapes, elevation of privilege flaws, and kernel bugs that allowed the attacker to jump from loading a web page on the device to executing code as root.

The malware itself appears designed to monitor users, as it decrypts and siphons off messages from Telegram, WhatsApp, iMessage, and Hangouts, as well as harvesting authentication tokens and collecting user contacts, photos, email, and GPS data.

While the malware is wiped when the device reboots, Beer says the stolen authentication tokens and detailed device information the software nasty collects would allow attackers to effectively track the targets without the code running.

“To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group,” the Google security guru said.

“All that users can do is be conscious of the fact that mass exploitation still exists and behave accordingly; treating their mobile devices as both integral to their modern lives, yet also as devices which when compromised, can upload their every action into a database to potentially be used against them.”

Breaking news: Apple un-breaks break on jailbreak break

READ MORE

What is catching the attention of the security community is the longevity of the operation. At a time when zero-day exploits are highly sought-after and valuable, the attackers managed to quietly continue to collect and exploit bugs quietly for years.

As Beer notes, however, if the end result was the ability to track and stop a specific group, the operation would have been worth the cost.

“I shan’t get into a discussion of whether these exploits cost $1 million, $2 million, or $20 million,” he said.

“I will instead suggest that all of those price tags seem low for the capability to target and monitor the private activities of entire populations in real time.”

Anyone worried about infection will want to make sure they are running the latest version of iOS (or anything from after February, really). ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/30/google_iphone_hole/