STE WILLIAMS

Transport for London Oyster system pulled offline after miscreants enter customers’ accounts

Exclusive Transport for London’s online Oyster travel smartcard system has been accessed by miscreants using customer credentials, The Reg can reveal, as the transport authority keeps the website offline for a second day.

Some Oyster customers have had their accounts broken into, and the transport authority has blamed users who recycled their login creds with other websites.

A TfL spokesperson told us: “We believe that a small number of customers have had their Oyster online account accessed after their login credentials were compromised when using non-TfL websites. No customer payment details have been accessed, but as a precautionary measure and to protect our customers’ data, we have temporarily closed online contactless and Oyster accounts while we put additional security measures in place.”

In fiscal year 2018/19 nearly a billion rail, tram and bus journeys were made using Oyster cards, netting TfL a cool £2.3bn in revenue, according to its own statistics.

Over the past couple of days, increasing numbers of users noticed that they could not log in online and check their smartcards’ balances or top them up with cash.

In tweets from Londoners asking why they can’t access their online accounts and do things like cancel standing orders or change card details, TfL repeatedly insisted that the problem was “performance issues impacting users”.

TfL’s response to the attack on the accounts included taking down staff access to Oyster systems as well, though Londoners using ticket machines to top up at stations seem unaffected so far.

TfL also told us: “We will contact those customers who we have identified as being affected and we encourage all customers not to use the same password for multiple sites.”

The transport authority did not say how many users had been affected. ®

Sponsored:
Balancing consumerization and corporate control

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/08/tfl_oyster_card_outage_online_topup/

  • 08/08/2019
  • adm

How powerful are Russian hackers? One new law could transform global crime operations

Black Hat The introduction of Russia’s Sovereign Internet rules is having an impact on the way criminal hackers around the world do business.

This is according to security house IntSights, which says that the law, set to become official in a few months, will force many hacking groups to change the way they operate both in Russia and in other countries.

The rule would lead to Russia developing its own standalone network that could be cut off from all connections outside of the country if need be and continue to function.

“It creates this infrastructure that kind of isolates Russia a little bit,” Charity Wright, a threat intelligence analyst with IntSights, told The Register.

“A lot of outsiders feel threatened because they feel they may not have access to the Russian internet, but really Russia’s intention is to become sovereign over their own infrastructure so if there is an attack to cut them off, they can go on with business as usual.”

While the Russian government is notorious for turning a blind eye to criminal hackers (and in some cases even enlisting them for official activities), the new law will still have a major impact on how cybercrime is conducted both within and outside the country.

In particular, hackers operating within Russia will have to make sure that the services they use to conduct attacks, such as VPNs, are either Russian or operate in compliance with the strict sovereign internet requirements that have lead many VPN providers to already pull out of the country.

“Although Russia is not known for cracking down on crime, this is really going to create a new culture for darkweb usage,” Wright said.

“They will really have to consider the VPNs they are using and make sure they comply or stop using them.”

Those sentiments were echoed by fellow IntSights security pro Andrey Yakovlev, who said that while Russia is tightening its grip on the internet and becoming more insular, it also gives its domestic hackers more motivation to launch attacks outside their borders.

“The sovereign internet will make it much easier for Russian law enforcement to crack down on hackers that target Russian entities,” Yakovlev explained in the IntSights Dark Side of Russia report.

“But the government will still likely turn a blind eye to threat actors that target foreign entities – particularly those operating in enemy states, like the United States.”

In other words, as hacking within Russia becomes more difficult and dangerous, expect to see Russian hacking groups focus even more of their attention on western countries, where the attacks will not draw a police response.

This is particularly bad news given the technological advantage many Russian hacking crews enjoy. The IntSights team noted that many of the major attacks and exploits to arise in recent months, such as the Windows RDP BlueKeep flaw, were weaponised in Russia long before hackers in other countries were able to get working attack code launched in the wild.

“The Russian underground covers virtually any known type or method of malicious activity,” noted Yakovlev.

“If news outlets are talking about it, it is likely Russian cybercriminals have already had it for some time.”

Combine that with the stronger motivation to hack outside of Russian borders, and it is shaping up to be a long year for foreign companies in the crosshairs of Russian hacking crews. ®

Sponsored:
Balancing consumerization and corporate control

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/08/blackhat_russian_internet_law/

  • 08/08/2019
  • adm

Enterprises Must Be Wary of Ransomware Targeting Network File Shares & Cloud Assets

New research shows that criminals are evolving ransomware attacks against servers, network hosts, and IaaS cloud assets in search of bigger payoffs from businesses.

Ransomware attacks against individual endpoints are so passé. According to reports out this week from two security research teams, financially motivated cybercriminals are updating their ransomware playbooks in search of bigger payoffs from their victims. Increasingly, they’re making more money by putting bigger game in the crosshairs, namely networked business assets such as file shares, servers, network hosts, and infrastructure-as-a-service cloud infrastructure.

A new study from researchers at Vectra shows that the biggest threat to enterprises from ransomware today is malicious encryption of shared network files. Whereas ransomware attacks against isolated endpoints should be no big deal to recover from with any modicum of backup procedures, ransomware targeting of file shares is much more likely to trigger “all-hands-on-deck” emergencies. First of all, attackers are able to do a lot more damage with minimal action by taking advantage of the scale of share volume availability to numerous local systems. It takes only a single access point to lock access to documents across numerous departments or divisions at a targeted organization.

“In a volume-sharing system, a single infected host could encrypt an entire networked volume, resulting in a global impact on the target organization’s business and systems,” the report explains.

What’s more, in many instances, these shared volumes are themselves used as a part of backup procedures for other systems so recovery can become quite tricky without offline backups.

“The files must be recovered from the most recent cold backup if the ransom is not paid,” the report says. “Backup systems attached to a network are also at risk, which is why cold offline backups are critical for recovery.”

The potential risk — and payout for extortionary criminals — increases tremendously when ransomware attackers can successfully target cloud provider infrastructure and storage shares. The Vectra report points to several high-profile attacks against cloud hosting firms DataResolution.net and iNSYNQ as examples of the dynamic at play.

“The fallout from ransomware attacks against cloud service providers is far more devastating when the business systems of every cloud-hosted customer are encrypted,” says Chris Morales, head of security analytics at Vectra. “Today’s targeted ransomware attacks are an efficient, premeditated criminal threat with a rapid close and no middleman.”

According to Vectra’s study, the volume of these attacks is on the decline, but that could simply be a factor of criminals getting more discriminating and more effective with ransomware targeting. There are plenty of new and effective ransomware techniques and malware families deluging enterprises with these network-centric attacks. For example, in the past month, there have been two waves of attacks specifically targeted against enterprise storage devices from QNAP Network and Iomega.

And just this Monday, the industry saw more evidence of the evolution of the ransomware strain MegaCortex, which targets important files on servers and network hosts and is tied to attacks that have asked for as much as $5.8 million from large organizations. New analysis out from researchers with Accenture iDefense shows a version 2 of MegaCortex floating around that shifts this from a very manual ransomware tool to something with automated self-execution features.

“The authors of MegaCortex v2 have redesigned the ransomware to self-execute and removed the password requirement for installation. The changes suggest that the malware authors traded some security for ease of use and automation,” writes Leo Fernandes, senior manager for malware analysis and countermeasures at Accenture iDefense. “Potentially, there could be an increase in the number of MegaCortex incidents if actors decide to start delivering it through email campaigns or dropped as a secondary stage by other malware families.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/enterprises-must-be-wary-of-ransomware-targeting-network-file-shares-and-cloud-assets/d/d-id/1335466?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 08/08/2019
  • adm

Slow Your Roll Before Disclosing a Security Incident

Transparency rules, but taking the right amount of time to figure out what happened will go a long way toward setting the record straight.

Security incidents happen all the time, but when one actually strikes an organization, security professionals often find themselves uncertain whether it needs to be disclosed to the public or shared with law enforcement right away.

For example, back in 2006, an unknown user gained unauthorized access to a large number of electronic records on the McCombs School of Business computers at the University of Texas in Austin. But before disclosing what happened, it took the time to determine what information was accessed, lost, or possibly modified, as well as how long the issue had been going on. UT-Austin also needed to understand exactly what information about the security incident it was able to share with the public. 

“UT-Austin said what happened, who it affected, what the potential impact was to the people involved, and what they were going to do to help these people,” says Greg White, director of the Center for Infrastructure Assurance and Security at The University of Texas at San Antonio (UTSA).

Clearly the university understood that planning and preparation was critical for security teams to know what to do in the event of an incident. Planning should start when an application is first architected or when features are added, according to Tim Mackey, principal security strategist at Synopsys CyRC (Cybersecurity Research Center).

“It is at this point that decisions surrounding the type of data being collected and processed are made,” Mackey says.

Once an application is architected, the incident response plan should be updated — at least in an ideal world. In reality, though, it might be time for organizations to dust off the old playbooks.

Do You Really Have a Breach?
Sometimes organizations will make efforts to keep security incidents tightly under wraps; however, that can backfire if the news gets out, as was the case for Uber in 2017 when it came out the company had paid $100,000 to conceal a 2016 data breach.

“What makes this one stand out is absolutely the time duration,” McAfee Labs vice president Vincent Weafer told Dark Reading in 2017. “It’s almost a year ago that the actual event occurred; we’re just finding out about it now.”

If a company is evasive and only discloses a little at a time, it could potentially come across as an effort to hide something or an indication that they don’t really know what they are doing. “Neither of these are good from a public relations standpoint,” UTSA’s White says.

On the other hand, last last month Capital One announced that an unauthorized user had accessed customer data. The announcement went public only 10 days after the security incident was detected.

When companies haven’t been transparent about potential compromises, the public is less inclined to be forgiving. That said, a lack of disclosure isn’t always an indication that organizations are withholding information. According to Benjamin Wright, attorney and SANS senior instructor, it is very common for people to misinterpret evidence. In order to avoid damage to brand, he says, companies need to analyze with great vigor.

“In a modern enterprise, you can get thousands of alerts in a day, all giving some piece of information that there could be a problem. All of these little pieces of information are forms of evidence, which can be very hard to interpret,” Wright says.

Often the tendency is to leap to conclusions, says Wright, who cautions companies to do their homework before reaching any legal conclusions. “They have to get the appropriate kinds of experts to really look at what happened and interpret them in a realistic way,” he says.

Though it may feel frustrating to stakeholders who are anxious to know whether something happened and to what extent the business has been impacted, security teams must be thorough, UTSA’s White says. 

He also agrees that thorough analysis is critical. “It will take some time to get an accurate picture to be able to fully disclose what has happened,” he says. “In some cases you can make a quick guess, but to get accurate information out it will take more time.”

White adds: “Another thing [is to consider] how you might be enhancing security in the future to ensure this doesn’t happen again.”

We Know the What, but How Do We Disclose?
In the US, data breach reporting requirements vary by state and the type of data exfiltrated. For instance, the state of Connecticut mandates that breaches “based on harm” are disclosed within 90 days and require government notification. In South Carolina, though, breaches causing harm must be disclosed within the “most expedient time possible and without unreasonable delay.” Law enforcement only needs to be notified if more than 1,000 residents have been affected.

According to Synopsys’ Mackey and “The Summary of US State Data Breach Notification Statutes” published by Davis Wright Tremaine, the reporting process is based on where the user resides, not where the organization’s primary locations are.

“For national or global organizations, this significantly complicates any incident response as even US-based companies may do business with EU residents and thus potentially trigger GDPR requirements,” Mackey explains. 

Law enforcement can be called on to support an investigation, but Mackey says it’s not reasonable to expect they’ll be in a position to guide your full response.

Related Content:

Image Source: rnl via Adobe Stock

 

Kacy Zurkus is a cybersecurity and InfoSec freelance writer as well as a content producer for Reed Exhibition’s security portfolio. Zurkus is a regular contributor to Security Boulevard and IBM’s Security Intelligence. She has also contributed to several publications, … View Full Bio

Article source: https://www.darkreading.com/edge/theedge/slow-your-roll-before-disclosing-a-security-incident/b/d-id/1335428?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 08/08/2019
  • adm

WhatsApp Messages Can Be Intercepted, Manipulated

Check Point security researchers demonstrate how a dangerous security weakness in the messaging application can be abused to spread fake news and carry out online scams.

BLACK HAT USA 2019 – Las Vegas – Researchers from Check Point Software Technologies are once again warning about what they describe as a dangerous security weakness in the WhatsApp messaging application that can be abused to spread fake news and carry out various online scams.

In a technical presentation here yesterday, Check Point researchers Roman Zaikin and Oded Vanunu explained how an attacker could exploit the issue to alter the text of someone else’s reply, change the identity of a message sender, or trick a user into sharing something publicly in a group that they might not have intended to share.

The researchers first surfaced the same issues in August 2018 in a report that described how attackers could intercept and manipulate WhatsApp messages in private and group chat settings. In a blog and in comments at the time to Dark Reading, Vanunu identified the issue as having to do with WhatsApp’s failure to validate certain message parameters before encrypting and sending messages to the intended recipient.

Since then, Facebook-owned WhatsApp has fixed the issue that allowed attackers to trick users in a group chat into thinking they were sharing something in private when, in fact, it was visible to everyone else, he said.

However, the other two issues remain unmitigated and continue to give attackers a way to abuse WhatsApp in dangerous ways, Vanunu said. From Check Point’s perspective, the vulnerabilities present a major threat and need to be addressed urgently, he noted.

“WhatsApp is not just an application. It is an infrastructure of more than 1.5 billion users with more than 56 billion messages per day,” Vanunu said.  

WhatsApp’s massive footprint makes it a big target for criminals attempting to spread fake news and carry out other malicious activities, he said. In some countries, including India and Brazil, rumors spread via WhatsApp have even resulted in the deaths of innocent people, Vanunu said.  In many countries, WhatsApp is also used for business application, so it is important that the issue gets resolved, he added.

According to Vanunu and Zaikin, WhatsApp’s end-to-end encryption is strong and not the problem. Rather, the issue lies in the communication that happens between an individual’s WhatsApp mobile app and its Web version when a user logs in.

Vanunu and Zaikin reverse-engineered the communication and identified several message parameters being exchanged between WhatsApp’s mobile version and Web version. Among them were parameters pertaining to the content of the message, and those that identified the message sender and the contact or the group to which the message was intended.

The researchers found they could intercept the communication and manipulate the data associated with each parameter before any of it was encrypted. For instance, an attacker could use the “quote” feature in WhatsApp that references a previous message to change the identity of the original sender or alter the original message entirely. WhatsApp does not validate the data and instead just accepts the altered content, encrypts it, and forwards it to the intended recipient.

WhatsApp did not respond to a request for comment. But in a statement responding to Check Point’s original report last year, the company denied any security issue. It likened the issue to someone altering the contents of an email to put words into the mouth of the sender.

A lot of it also has to do with how WhatsApp works. WhatsApp has noted that when someone replies to a message, the WhatsApp client copies the text available within the app and creates a kind of graphical representation that helps people follow the conversation. The reason for providing a sort of “quick reply” option is to help identify the source within the user’s chat log if one exists.

WhatsApp has stressed that with its end-to-encryption, it does not store any messages on its own servers and therefore has no single reference point of any messages that is off the device itself. As a result, the only way to validate any data in messages being sent would be to log all messages, which would undermine privacy protections. It would also make it impossible to deliver messages to groups when a single person is not connected to it and undermine the ability for users to quote a message prior to a new group member, WhatApp said.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/whatsapp-messages-can-be-intercepted-manipulated/d/d-id/1335473?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 08/08/2019
  • adm

Yes, FaceApp Really Could Be Sending Your Data to Russia

FaceApp has an unprecedented level of access to data from 150 million users. What could its endgame be? We unpack three potential risks.

FaceApp, an app that offers special effects for photographs, has been downloaded and installed by more than 150 million people worldwide, according to consumer tech journalist John Koetsier, writing in Forbes. Koetsier writes that the most popular of these special effects is an artificial intelligence (AI)-enhanced photo filter that ages any faces in the photograph. This feature has gotten even more popular lately, leading to the app’s privacy being called into question on a global scale.

FaceApp is developed and published by Wireless Lab, a company with headquarters in St. Petersburg, Russia. While Wireless Lab and its staff are based in Russia, company founder Yaroslav Goncharov told Forbes that all the app’s storage and cloud resources are in the US and that the data collected by the app is hosted in the US, not Russia. Because FaceApp has such close ties to Russia, American political officials have raised concerns about the overall security of the app. But the potential issues go beyond where the data is hosted.

Here are three risks to unpack before deciding to use FaceApp:

Risk 1: Terms and Conditions
As with any social media app, the terms are the bulk of your contract and the primary mechanism that is supposed to protect you (the user). But terms are also a way for many companies to indicate what they anticipate they’ll do with your information in the future, often long before actually acting on these plans.

I’ve been in the security space for nearly 30 years, but FaceApp’s set of terms are among the worst I have seen, for example:

● You assign FaceApp irrevocable global rights to use your images or data as it sees fit without any need to compensate or inform you.
● FaceApp can continue to hold your images and data even after you have requested your information be deleted.
● The company reserves the right to share the data with any third party it chooses without any need to inform you.
● It reserves the right to host the data in any country it chooses.

As shocking as some of the terms are, you will find very similar language in many well-known social media apps, including Facebook, according to Dalvin Brown, in USA TODAY. This approach is almost certainly incompatible with legislation such as GDPR, which means Wireless Lab is ignoring international privacy regulations.

In response to widespread criticism, Goncharov is quoted in Forbes suggesting that the company might consider updating its terms. However, the company still hasn’t made any concrete promises. For now, FaceApp’s terms make it seem as if the company is absolutely collecting your data, has long-term plans for it, and is not obligated to listen to any request or demand you may have about the future of that data.

Risk 2: Murky international legal regulations around data privacy
It’s not just the terms and conditions that are problematic. Wireless Lab is operating in a country that has very different legal processes and privacy legislation than the US, and this should be a significant red flag. If it does something you don’t like, you likely have very little or no legal recourse.

As this story has developed, it has become clear to me that Wireless Lab’s statement that the app is wholly hosted in the US may not be the complete picture. Host records indicate that one of the hosts the app communicates with is, in fact, in Russia. While it’s not clear what data is being sent to this Russian host, the fact that it’s there — even after the developer stated everything is in the US — is concerning.

Risk 3: FaceApp’s Endgame
FaceApp has an unprecedented level of access to data from 150 million users. What could the company’s endgame be? This is where we have to speculate. To start, we should first look at what it is harvesting:

● Your photos and contextual personal information.
● Your phone information (browser, serial number, IP address, configuration information, some location information).
● Details about your other apps, the OS on your phone, social media accounts and apps.
● Cookies, sign-in tokens, and any authentication information you share with it (for example, if you choose to log in with Facebook, it gets access to your Facebook access tokens and profile information).
● If the app is downloaded on Android, it can access your call history, contacts, logs, more-detailed location information, messages, and more.

This list is certainly not exhaustive; it merely encompasses the most obvious data to which the app has immediate access.

What could the company be doing with this data? On the obvious end of the spectrum, detailed information about more than 150 million people is something advertisers would pay good money for. But from an intelligence perspective, this is a highly useful and current database of people all over the world and their connections.

For example, a current, AI-enhanced database like this is something that people developing facial recognition need. One of the biggest flaws in current facial recognition technology is that it is only as good as the data used to train it. As a result, most models are skewed toward faces from the region where the technology was developed. A database like this could provide an extremely diverse catalog of real faces to train facial recognition technology.

Whatever the company’s endgame is, one thing is very clear: As consumers, we need to get better at policing those with whom we share our data. The fact that almost all social media applications and services have consumer-unfriendly terms should be of great concern. As the saying goes: “If you’re not paying for it, you’re not the customer; you’re the product being sold.” It’s never been more important to heed this warning.

Related Content:

Marc Rogers is the executive director of cybersecurity at Okta. With a career that spans more than 20 years, Marc has been hacking since the 80’s and is now a white-hat hacker. Prior to Okta, Marc served as the head of security for Cloudflare and spent a decade managing … View Full Bio

Article source: https://www.darkreading.com/endpoint/yes-faceapp-really-could-be-sending-your-data-to-russia/a/d-id/1335429?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 08/08/2019
  • adm

FBI, NSA to hackers: Let us be blunt. Weed need your help. We’ll hire you even if you’ve smoked a little pot in the past

Black Hat America’s crime-fighters, desperate to recruit white-hat hackers to collar spies and cyber-crooks, have been quietly and slightly relaxing the ban on hiring anyone who has used illegal drugs.

Generally speaking, dabbling in any kind of substance abuse will rule you out of the running for a job at the NSA, Homeland Security, the FBI, and so forth. It should, therefore, be no surprise that the Feds have been unable to recruit talented hacker folks, due to their past experimentation with chemicals.

What with marijuana now legal in various US states, including California, and it being 2019 and all, and recruitment of infosec bods is still somewhat of a struggle, it appears Uncle Sam is easing up. So, if you haven’t done anything bonkers, like injected mephedrone into your eyeballs over breakfast, and can pass, and continue to pass, a drug test, and you have the infosec skillz needed, Uncle Sam may well want you… to apply, at least.

FBI badge and gun

‘White hats don’t want to work for us’ moans understaffed FBI

READ MORE

“Look, I used to smoke weed in high school,” an NSA representative, who spoke on condition of anonymity, told The Register this week. “Now, so long as you can pass a drug test and don’t do them any more, then it won’t hurt your application.”

While certain US states have approved the use of the devil’s lettuce, under federal law, it’s still rather illegal, and the Feds want to make sure none of their agents are on the wacky baccy. Nevertheless, even the FBI has relaxed its stance somewhat.

“Basically, if you haven’t smoked marijuana in the past three years then it won’t be an issue,” an FBI agent told The Register. “Any use of certain other hard drugs will bar you from joining; the three-year rule does apply to marijuana.”

Quite how they’d check that far back is a mystery, seeing as drug tests for weed typically detect whether you’ve had a joint in the past three months, not three years. And the Feds aren’t fools, they know this.

“I got an email about this, and it’s down to one year since you smoked,” a Department of Homeland Security rep clarified, somewhat, to El Reg. “Staff are still liable to have random drug tests, though the past is the past. Even if weed is legal in your state, you can’t work at Homeland Security and smoke it.”

Obviously, having a drug conviction on your record almost certainly bars you from a federal security-related job, and failing a drugs test while employed is grounds for instant dismissal. however, the Feds are chilling out on past potheads joining their ranks, and that can only help them swell their ranks with patriotic infosec talent. ®

Sponsored:
Balancing consumerization and corporate control

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/08/hackers_feds_weed/

  • 08/08/2019
  • adm

WTF is Boeing on? Not just customer databases lying around on the web. 787 jetliner code, too, security bugs and all

Black Hat A Black Hat presentation on how to potentially hijack a 787 – by exploiting bugs found in internal code left lying around on a public-facing server – was last night slammed as “irresponsible and misleading” by Boeing.

At the hacking conference in Las Vegas on Wednesday, Ruben Santamarta, principal security consultant at pen-testing biz IOActive, told attendees he had found bugs in software used aboard the jetliners.

It is important to note that there are essentially three electronic networks on a 787: the first is home to non-critical stuff like the in-flight entertainment system; the second is used by slightly more important applications reserved for crew and maintenance teams; and the third is used by the vital avionics gear that controls the airplane’s flight and reads its sensors.

The software Santamarta probed – a crew information service – lives on the second network. He suggested it may be possible to exploit holes in, say, the in-flight entertainment system on the first network to access the adjoining second network where one could abuse the flaws he found in the crew information software to then reach into the adjoining third network. Once there, one could tap into the avionics equipment to hijack the 787, in theory.

Boeing, however, insists the software on the second network cannot be exploited as IOActive described, nor can a miscreant direct the avionics from other networks, due to restrictions in place, such as hardware filters that only allow data to flow between networks rather than instructions or commands. El Reg quietly hopes the avionics can’t be taken over by malformed data that triggers vulnerabilities within the flight control systems on the third network.

‘Limited’

During his talk, Santamarta acknowledged he had no way of proving he could actually commandeer the flight control systems via the holes he found in the crew-facing software. For one thing, he couldn’t persuade Boeing to let him loose on a real passenger jet.

“We have confirmed the vulnerabilities, but not that they are exploitable, so we are presenting why we think they are,” he said. “We have got very limited data, so it’s impossible to say if the mitigation factors Boeing say they have work. We offer them our assistance.”

The Register spoke to Boeing engineers to get their side of the story. They told us work-in-progress software destined for the 787 was stored on a server belonging to the aircraft manufacturer’s research and development labs. This box had been, like so many databases and other systems recently, accidentally left open to the internet, which isn’t particularly wise. Boeing’s eggheads were alerted to the exposed machine by someone who wasn’t from IOActive, we’re told, suggesting God-only-knows how many people found the thing.

Boeing 737-Max 9 on Shutterstock

Another rewrite for 737 Max software as cosmic bit-flipping tests glitch out systems – report

READ MORE

According to IOActive, in September, Santamarta stumbled upon the software on the server, while it was exposed to the web, using a Google search. He set to work studying the materials, eventually finding a bunch of bugs that could be exploited to achieve arbitrary code execution in the crew information application.

Boeing’s engineers claimed to us they first knew of IOActive’s investigation into the leaked code when Black Hat’s organizers published the conference schedule some months ago, revealing that a talk was due to take place on hacking 787 aircraft. According to the techies, IOActive had contacted the crew information software’s external developer, Honeywell, about its findings, and not Boeing. IOActive categorically denied this to us, and said it spoke to the Dreamliner maker directly about its discoveries.

In any case, a Boeing engineer told us the bugs in the software have been ironed out, and even if they were present, it would not be possible to hijack the avionics network from another network anyway. Once Boeing was aware of the nature of the programming blunders in the Honeywell software found by Santamarta, the manufacturer verified in the lab and then on an actual 787 that it was not possible to seize control of a $150-million-ish jetliner via the holes Santamarta discovered.

And yes, it’s all very vague because no one wants to spill too many beans about the cyber-security of a passenger jet. And Boeing’s having none of it.

“IOActive’s scenarios cannot affect any critical or essential airplane system and do not describe a way for remote attackers to access important 787 systems like the avionics system,” a spokesperson for the airliner maker said.

“IOActive reviewed only one part of the 787 network using rudimentary tools, and had no access to the larger system or working environments. IOActive chose to ignore our verified results and limitations in its research, and instead made provocative statements as if they had access to and analyzed the working system. While we appreciate responsible engagement from independent cybersecurity researchers, we’re disappointed in IOActive’s irresponsible and misleading presentation.” ®

Sponsored:
Balancing consumerization and corporate control

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/08/boeing_787_software_bug_hack/

  • 08/08/2019
  • adm

North Korean Cyber Ops Reportedly Stole $2B to Fund Weapons Programs

Unlike many nations, North Korea often engages in cyber operations to generate much-needed cash for the country’s coffers. In that respect, its hackers have been extremely successful.

North Korean state-sponsored hackers have stolen a reported $2 billion from banks and cryptocurrency exchanges over the past three years, using the cash to fund nuclear weapons research, according to a Reuters report published this week.

North Korea, officially known as the Democratic People’s Republic of Korea (DPRK), has developed significant and sophisticated cyber capabilities over the past decade. While other nations have occasionally conducted cyberattacks for financial gain, the DPRK’s intelligence arm, the Reconnaissance General Bureau, has focused much of its effort on stealing money to fund the national economy and, specifically, the nation’s nuclear aspirations.

A report by a Panel of Experts to the United Nations Security Council, published in March, pointed to a series of attacks in 2018 as a demonstration of North Korean actors sophistication and persistence. In those heists, the attackers transferred tens of millions of dollars from banks to accounts in 30 different countries and Hong Kong, where the funds were immediately withdrawn almost simultaneously in tens of thousands of transactions. 

“These more recent attacks show how the Democratic People’s Republic of Korea has become an increasingly sophisticated actor in cyberattacks for financial gain, with tools and tactics steadily improving,” states the report by the Panel of Experts.

The Reuters article, published on August 5, puts a number on the level of disruption caused by North Korean hackers and cites an unnamed United Nations report that seems close in content to the previously released Panel of Experts report. While the cumulative sum of $2 billion will likely raise collective eyebrows in the security community, given the nation’s past activities and known successes, it should come as little surprise. 

North Korea continues to double down on its financial heists, including the recent targeting of banks in attacks using mass withdrawals from ATMs, says Vikram Thakur, a researcher with Symantec’s security response team. North Korea’s state-sponsored activities have been linked to the $81 million stolen from the Central Bank of Bangladesh and at least $571 million stolen from three cryptocurrency exchanges. 

“They have learned so much quickly,” he says. “For the past two years, their sole focus has been money, money, money. … We don’t see other nation-state mandated groups going after money.”

The nation-state hacking teams are focused mainly on targets in developing countries in Southeast Asia and the Middle East, he says. 

The most well-known group attributed to North Korea is the Lazarus Group, which has conducted operations since at least 2009. Initial attacks mainly focused on political objectives: The MyDoom worm, which took down US and South Korean sites in 2009, has been linked to North Korea and the Lazarus Group, as has the 2014 compromise of Sony Pictures and the subsequent release of the company’s private information.

In 2016, however, the Lazarus Group started focusing on cyber operations that would transfer large sums of money to North Korea using the world’s banking infrastructure. The theft of $81 million from the Central Bank of Bangladesh and a second stymied attack on a commercial bank in Vietnam were both blamed on the North Korean cyber operations group. The destructive 2017 WannaCry ransomware attacks, which failed to generate much revenue, has also been linked to North Korea state-sponsored hackers.

“North Korea’s engagement in a wide range of criminal and terrorist activities is part of its broad national strategy, which employs asymmetric operations and surprise attacks to overcome North Korea’s conventional national power deficit,” stated open-source intelligence firm Recorded Future in a July report on North Korean Cyber Activity.

The UN Panel of Expert report is part of the UN Security Council’s Resolution 1874, passed in 2009, which implements sanctions against North Korea for violating nuclear non-proliferation accords. A report, issued in March, cited North Korea’s cyber operations as a significant factor that should be considered in future sanctions against the nation.

Ironically, the Panel of Experts was the focus of the DPRK’s cyber operations as well.

“Cyberattacks against the Panel continued to hamper its ability to report on the implementation of sanctions according to its mandate,” the group stated in the report. “In addition, the Panel notes that unauthorized disclosures of Committee proceedings and Panel internal reports and activities are damaging.”

North Korea’s Lazarus Group continues to focus on cryptocurrency. A March 2019 report by security firm Kaspersky Lab found that the group had launched a new operation that has command-and-control servers capable of control malware on both Windows and Mac operating systems.

“Financial gain remains one of the main goals for Lazarus, with its tactics, techniques, and procedures constantly evolving to avoid detection,” the company said.

With additional reporting by Kelly Jackson Higgins.

Related Content:

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/north-korean-cyber-ops-reportedly-stole-$2b-to-fund-weapons-programs/d/d-id/1335467?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 08/08/2019
  • adm

Buttigieg Campaign Adds a CISO

Democratic presidential hopeful Pete Buttigieg’s campaign reportedly may be the first to bring a security exec on board.

Former Obama administration cybersecurity official Mick Baccio has been hired as the chief information security officer (CISO) for Pete Buttigieg’s presidential campaign.

According to Politico, which broke the news, this appears to be the first time a 2020 presidential campaign has brought in a staff CISO. Concerns in the wake of Russian meddling in the 2016 presidential election has caused some campaign officials and security experts to examine how candidates can better lock down their campaign systems’ security.

“Our campaign is committed to digital security, and hiring a full-time CISO is one way we’re protecting against cyberattacks,” a Buttigieg campaign spokesperson told Politico. 

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/analytics/buttigieg-campaign-adds-a-ciso-/d/d-id/1335470?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 08/08/2019
  • adm