STE WILLIAMS

More than 2.3 billion files are exposed across misconfigured online file storage technologies, marking an increase of 750 million files – or a 50% jump – from 1.5 billion in March 2018.

Researchers with the Digital Shadows’ Photon Research Team thought last year’s 1.5B figure alone was “incredible,” they say in the aptly named “Too Much Information: The Sequel” report. Files with sensitive and insensitive data were found via SMB file shares, misconfigured network-attached storage (NAS) devices, FTP and rsync servers, and Amazon S3 buckets.

The United States exposed the most data (over 326 million files), though France (151 million) and Japan (77 million) each had the highest in their geographies. The United Kingdom exposed 98 million, and countries throughout Europe collectively exposed more than one billion files.

There’s “a lot of really good work” being done to try and contain this wealth of compromised information, says Harrison Van Riper, strategy and research analyst at Digital Shadows. “However, the fact is that businesses are continuing to expand their footprint online, beyond their own networks and, more importantly, their own storage devices,” Van Riper explains.

“The same kinds of access controls and safeguards that businesses put on their own data within their networks should be implemented on those systems existing outside as well,” he adds.

“The same kinds of access controls and safeguards that businesses put on their own data within their networks should be implemented on those systems existing outside as well,” he adds.

Server Message Block (SMB) protocol exposed the most data (46%) of all technologies analyzed. That’s more than one billion files exposed via SMB file shares, a 547.6 million jump from March 2018. FTP was next-highest at 457.4 million (20%), followed by rsync at 386.7 million (16%), Amazon S3 at 182.1 million (8%), webindex at 163.5 million (7%), and NAS at 65.4 million (3%). FTP-hosted files increased by over 54 million, cancelling out rsync’s decline of 53.7 million files.

The researchers aren’t entirely sure why SMB-enabled file shares nearly doubled in the past year, though they call the statistic troubling. One potential reason is in June 2018, Amazon AWS Storage Gateway added SMB support, giving file-based applications built for Microsoft Windows a means to store and access objects in Amazon S3. Another is in November 2018, Akamai discovered attackers were opening SMB ports 139 and 445 for malicious reasons.

SMB is one of the main ways Windows users can facilitate file shares, Van Riper notes, and Microsoft adoption of the protocol surely drove its popularity. It’s not a bad thing, he points out; technology is supposed to simplify the ways we live our lives and conduct business. However, he adds, the Internet has changed what we thought we knew about these systems and how they interact. It’s time to rethink new ways to implement old protocols, he says.

“As businesses continue to digitize older systems and [processes], and more and more Windows systems that have SMB installed get spun up, the more chances there are for these exposures to occur knowingly,” he explains.

In the report, researchers point out that in early 2018, Microsoft stopped preinstalling SMBv1 in Windows 10 and Windows Server. However, it’s hard to confirm the full impact of this as researchers included SMB v1, v2, and v3 in the study.

Amazon S3 bucket misconfigurations, which have inadvertently exposed data for years, may also slow thanks to “Amazon S3 Block Public Access,” introduced in Nov. 2018. The move locked down default security controls for S3 buckets so users can set global block rule for private data.

Ransomware Targets Exposed SMB

The standard advice for companies preparing for ransomware attacks is to back up their files. If they’re hit and their files are encrypted, they can use saved data to get back up and running.

But what happens if the same ransomware variant also encrypts backup files? The researchers at Digital Shadows notice this is a growing trend, with more than 17 million ransomware-encrypted files across file stores used for backups. They specifically note NamPoHyu ransomware, an update to the MegaLocker variant that targets Samba servers. Samba is the open-source implementation of the SMB protocol; it runs on Unix systems and allows for file communication to Windows. Since April 2019, more than two million files have been encrypted with the .NamPoHyu extension.

“Obviously, WannaCry is the other big ransomware variant that comes to mind when we think about SMB and we are still seeing new files be encrypted by it,” Van Riper says. “The trend has definitely picked up steam with the addition of a new variant in NamPoHyu.”

These days, data is not only kept internally and businesses should protect their information wherever it resides. Oftentimes that means working with third parties to ensure they have a security strategy in place: for example, researchers point to a small IT consulting company in the UK that exposed more than 212,000 files containing company and client information.

When it comes to third parties, Van Riper says businesses should be asking the same questions they ask of their own security teams. Where is data stored? How are we storing it? Is it encrypted? Who has access to it? “These questions shouldn’t only be asked internally, as these days data is not only kept internally,” he explains.

Related Content:

• 8 Ways to Authenticate Without Passwords
• Cybercrime: Looking Beyond the Dark Web
• Emotet Made Up 61% of Malicious Payloads in Q1
• WannaCry Lives On in 145K Infected Devices

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/23b-files-currently-exposed-via-online-storage/d/d-id/1334843?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Nearly one in five of the most popular containers available on the Docker store have no password for root access. That’s the finding of researcher Jerry Gamblin, building on work by researchers at Cisco Talos. The result could easily be hundreds of thousands of containers deployed with no functional password at all.

The finding is important because containers, most frequently with Docker as the container manager, are becoming popular for deploying virtualized applications (as opposed to completed virtualized servers deployed with products like VMware or Microsoft Hyper-V). As Docker puts it, “A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries, and settings.” 

In order to save time, developers will often put a container image into a repository for reuse, or they’ll look at a public repository, like GitHub or the Docker Store, to find containers built by others that they can download and use. If those publicly available containers have vulnerabilities, they can quickly spread across the Internet.

According to the original Cisco Talos report, the vulnerability began with “null” passwords for the root user in Docker images for Alpine Linux, a lightweight, container-specific Linux distribution very popular in container development.

The vulnerability, now designated CVE-2019-5021, was first discovered in 2015 and patched — but then eight days later someone replaced a patched file with another file that enabled the vulnerability. A series of testing errors allowed the vulnerable files to be retained and distributed until May of this year. The original Alpine Linux images have been repatched, but Gamblin found that many containers remain with the vulnerability intact.

Gamblin, who is principal security engineer at Kenna Security, says the need for development speed — a need that has made containers a more popular deployment option — also means best practices aren’t always followed.

“I think we’re at the point in containers where they’re becoming more useful locally and in small company situations, and you’re seeing fewer best practices used,” he says. “It’s developers, it’s system admins, and just people testing software and running it on their local machines that blow by best practices in the name of speed.”

The good news for developers and security professionals is that the technology issue around this vulnerability has been solved. It’s now up to processes and practices to ensure secure containers are pulled from repositories and deployed.

Gamblin says he sees this as an issue security teams should be aware of but not lose sleep over. “It’s a weakness, but it’s not a structural weakness,” he says.

As he pointed out in a blog post he wrote about the vulnerability: “Deploying containers that allow users to authenticate as root should be avoided at all costs, because authenticating as root is already outside the scope of ‘best practices’ for secure containers or generally in system.”

Related Content:

• 2.3B Files Currently Exposed via Online Storage
• Incident Response: 3 Easy Traps How to Avoid Them
• 6 Serverless and Containerization Trends CISOs Should Track
• Docker Vulnerability Opens Servers to Container Code

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/application-security/vulnerability-leaves-container-images-without-passwords/d/d-id/1334844?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Although ransomware took a backseat to other attack vectors in 2018, the threat has regained momentum this year. The most recent high-profile ransomware attack occurred 20 miles from my home, on the city government of Baltimore, on May 7. Baltimore was attacked by a ransomware strain known as RobinHood, and attackers demanded approximately $100,000 in exchange for the digital keys that would restore the city’s systems and access to data. To date, Baltimore has refused to pay the ransom. We are now three weeks into the attack; significant disruptions continue to occur and are costing the city dearly in financial and reputational damages.

Ransomware sets the stage for a great debate on moral versus practical dilemmas. This recent surge of ransomware attacks raises the question: Is your local government next? And if you are in a position of power, will you pay the ransom?

To Pay or Not to Pay — That Is the Question!
Whether a city pays ransomware demands depends on many factors. It’s not an easy question to answer, and whatever side you are on will have a sharp opposing view. Before making a decision, however, it’s vital to examine your response through both a moral and a practical lens.

Morally, the most common, quick, and easy answer is “no.” Don’t pay the ransom because it only serves to reinforce attacker behavior. I appreciate this angle. It generally has been the US view on ransom demands involving hostage captivity, though the government has paid a ransom to free hostages in some situations. OK, I know here we’re talking humans and not computers, but there must be some parallels — and in today’s world, computers affect humans on an extraordinary level. 

Practically, you’ll find that many people believe that paying a ransom is the right move. This is because the costs of paying the ransom ultimately dwarf the costs associated with not paying it. It’s hard to put an exact quantification on this, but the logic is clear.

For example, the government of Atlanta refused to pay $50,000 and ended up paying an estimated $17 million to recover from the attack. It’s not easy to determine what costs would have been avoided if the city had paid the ransom, but a quicker recovery time would have resulted in less business disruption and reduced spending on third-party consultants. This alone would have indicated a positive return on investment for paying the ransom.

Unfortunately, Baltimore is three weeks into the attack, and it’s still experiencing disruption. Email remains down. Real estate transactions have been disrupted. Online bill payment systems have not recovered, significantly affecting city revenue collection. These negative effects also result in the unavailability of services or the degradation of service delivery quality. For example, critical services such as emergency medical services, police, fire, and 311 have remained operational in the city. However, the quality of service and operations is being intensely affected — 911 alerts are now occurring via pagers rather than the normal manner of a computer-generated, automated alert.  

Of course, there is always risk of paying a ransom and the attackers don’t restore the system. A Trend Micro report from a three years ago indicated one in five companies never got their data back. However, this data is dated and it would be interesting to see a current look at where this issue stands. But decision-makers must ask themselves: What is the cost of disruption? How much has been paid to third-party consultants to restore systems? And how do these costs compare with the costs had the city paid the ransom initially?

Conclusion
The moral reaction to ransomware says to not pay the ransom because it reinforces bad behavior. However, I think the practical aspect of ransomware is that the cost of not paying the ransom is materially greater than the cost of paying it. I had a conversation recently with a savvy CISO that led me to believe that it’s more standard than not for organizations to pay the ransom. I suspect this is happening more frequently than we realize and that there are likely many ransomware attacks we don’t hear about because significant disruption was mitigated by paying the ransom.

And while there may be honor among thieves, the value of holding an entire city government under ransom is a tempting and interesting dilemma given the amount adversaries will pay for information on the Dark Web. All in all, where do you stand on the spectrum of practicality versus morality when it comes to ransomware? Let us know by commenting below.

Related Content:

• Baltimore City Network Struck with Ransomware Attack
• Baltimore Ransomware Attack Takes Strange Twist
• Satan Ransomware Adds More Evil Tricks
• When 911 Goes Down: Why Voice Network Security Must Be a Priority
• 3 Keys to Reducing the Threat of Ransomware

Todd Weller, Chief Strategy Officer at Bandura, works with large organizations in acting on their threat intelligence to prevent future attacks. He brings over 20 years of cybersecurity industry experience with a unique blend of operational and hands-on proficiency. He … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/the-ransomware-dilemma-what-if-your-local-government-is-next-/a/d-id/1334827?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Palo Alto Networks is on a cloud security shopping spree as it builds out its new Prisma cloud security strategy. This week the company confirmed acquisitions of PureSec and Twistlock.

PureSec, an Israeli startup founded in 2016, was created under the premise that serverless architecture demands a new approach to application security. Its serverless security tool aims to help its customers build, maintain, and secure serverless applications. PureSec co-founders Shaked Zin, Ory Segal, and Avi Shulman will join Palo Alto Networks as part of the acquisition.

The transaction value for the acquisition was not officially disclosed; however, Israeli business publication Globes reports the price tag is $60 million to $70 million. Meantime, Palo Alto Networks confirmed it will pay $410 million for container security firm Twistlock in an all-cash transaction.

Portland, Ore.-based Twistlock was founded in 2015 and most recently completed its Series C, bringing it to a total of $63 million in funding. It offers a container security platform and has 290 customers, 25% of which are in the Fortune 100. Palo Alto Networks reports Twistlock’s co-founders, Ben Bernstein and Dima Stopel, will also be joining the company following the close of the deal.

Technologies from PureSec and Twistlock are intended to bolster Palo Alto Networks’ cloud security suite, Prisma, also announced this week. The platform is designed to help businesses connect offices and employees to the cloud, and develop and deploy SaaS applications, with a combination of newly acquired tools and rebranded products from Palo Alto Networks.

Both transactions are expected to close during Palo Alto Networks’ fiscal fourth quarter.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/palo-alto-networks-confirms-puresec-acquisition/d/d-id/1334839?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The cyber insurance investigation into the loss potential of the recent ransomware attack on one of the world’s largest aluminum producers, Norsk Hydro, has begun. It is likely to generate increased interest in obtaining cyber insurance by manufacturers and other organizations driven by the attention raised by 2017’s NotPetya worm. While the cost for the Norsk Hydro “LockerGoga” attack is yet to be calculated in full, we have already seen, as with NotPetya, a dramatic loss of income and intense business disruption.

But can cyber insurance do enough to limit the fallout for the victims of ransomware attacks? If not, how can proactive businesses ensure they are financially protected after a breach?

Calculating the Costs
The effect on the IT and insurance industries from the most recent wave of cybercrime continues to grow as businesses disclose silent cyber impacts, as well as affirmative losses from WannaCry/NotPetya. The latest reports from Property Claim Services (PCS) put the loss from NotPetya at over $3.3 billion, and it’s still growing. The Norsk Hydro event is currently being evaluated by PCS to ascertain whether it meets the global cyber event designation, which would require the attack to generate a re/insured loss of at least $20 million. Recent estimates from the company suggest $40 million in losses.

Despite the payouts, for some businesses, reliance on insurance has proven inadequate. Consider US pharmaceutical company Merck. The company disclosed that the NotPetya cyberattacks have cost it as much as $580 million since June 2017, and predicted an additional $200 million in costs by the end of 2018. In contrast, experts estimated their insurance payout would be around $275 million, a huge number but under half of the amount it has incurred so far, let alone any silent costs that may continue to rise.

Other companies have been left even worse off, such as snack food company Mondelez International Inc., which is in a continuing battle with its property insurer, Zurich American Insurance Company. Mondelez filed a claim for the NotPetya attacks under a policy that included “all risks of physical loss or damage,” specifying “physical loss or damage to electronic data, programs, or software, including loss or damage caused by the malicious introduction of a machine code or instruction.”

Zurich disputed the claim, based on a clause that excludes insurance coverage for any “hostile or war-like act by any governmental or sovereign power” after US intelligence officials determined that the NotPetya malware originated as an attack by the Russian military against Ukraine. Zurich is fighting the claim by Mondelez that it is wrongfully denying coverage.

What an Act of War Might Mean for Coverage
As cybercrime continues to rise, cyber insurance has businesses reconsidering their coverage. Organizations faced with a decision to take out coverage need to find space in the budget for monthly costs and potentially large premiums. For this investment to be worthwhile, businesses want to be confident that they will recover their costs if a breach happens. Therefore, selecting the “right” form of coverage becomes critical.

The insurance payouts around the NotPetya cyberattacks, and in particular the Mondelez case, throw this into question. This is especially true considering the rise in cyberattacks that are nation-backed or could plausibly be claimed to be nation-backed by insurance companies in order to dispute a claim. As regulations change and the US military is given more freedom to launch preventative cyberattacks against foreign government hackers, any evidence that suggests governmental or military attribution could be confirmation of an act of cyberwar and be legitimately used against claimants looking to settle their losses.

Will the Fine Print Affect Public Research?
The ripple effect of this could go beyond the claims sector, and, in the long run, have a connected impact on security research, and potentially free press and journalism. Traditionally, researchers have had the freedom to comment and even speculate on the attribution of cyberattacks through information on the attackers’ behavior and the attack signatures they use. If insurance companies and claims handlers begin using public research as a reason to deny coverage to victims, research teams could be put in an ethical bind when faced with the realization that the results of their investigative work could exacerbate victims’ woes. They may be reluctant to share their findings, due to fear of being pulled into legal proceedings by giving insurers a possible reason to withhold coverage. The net effect might end up reducing the amount of public research and the transparency of the industry overall.

Can Cybersecurity Vendors “Guarantee” Safety?
The issue of what claims to honor extends to financial guarantees from cybersecurity vendors too, not only to insurance handlers. It is becoming increasingly popular for vendors to offer warranties to customers that purchase cybersecurity products, giving real substance to their claims. However, many experts believe that cyber insurance policies have so many loopholes that they negate the benefit of any warranty. We’ve already addressed exclusion of coverage for the often cited “nation-state or act of God” exception. Other examples include portable devices, insider threats, or intentional acts. Even if you are widely covered for an event, does that extend to all employees? According to the latest Cyber Insurance Buying Guide, “most policies do not adequately provide for both first-party and third-party loss.”

Caveat Emptor
The reality for business owners and CISOs looking to protect their business is that cyber insurance is not a catchall for protecting against risk and loss, especially as cybercrime indiscriminately crosses new lines for inflicting damage. As we’ve seen, the cyber insurance industry is faced with unresolved challenges to ensure protection for victims. And cybersecurity companies making big promises that are ultimately undermined by the small print are neither a guarantee of safety or recourse. Until the industry resolves out some of these issues, it’s caveat emptor for businesses purchasing policies and cybersecurity solutions.

Related Content:

• Norsk Hydro Shuts Plants Amid Ransomware Attack
• 6 Things to Know About the Ransomware That Hit Norsk Hydro
• LockerGoga, MegaCortex Ransomware Share Unlikely Traits

Sharon is vice president of products at Guardicore, responsible for driving product strategy for the company. He is an accomplished data and network security expert with a successful track record combining deep technical hands-on excellence with market vision to incubate new … View Full Bio

Article source: https://www.darkreading.com/caveat-emptor-calculating-the-impact-of-global-attacks-on-cyber-insurance/a/d-id/1334794?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple