STE WILLIAMS

How to determine what an MSSP can do for your organization, and the questions to ask before signing a contract.

Managed security service providers (MSSPs) are critical elements of a cybersecurity infrastructure for many organizations large and small. So what are some best practices for working with MSSPs?

As with the rest of the security industry, MSSPs are constantly evolving the services they offer and the way they work with their customers.

The first step in working with an MSSP is understanding what you need from the partnership. Maxine Holt, research director of security at Ovum, says the three basic steps in cybersecurity — prevent, detect, and respond — are where the discussion begins. In a presentation during the Cybersecurity Crash Course at Interop last week in Las Vegas, she recommended applying those three security processes to the seven stages of the Mitre ATTCK kill chain to answer a critical question: Where do I have gaps in my coverage?

When it comes to filling those gaps, MSSPs tend to promise a lot, according to Fred Kwong, CISO at Delta Dental Plans Association, who also discussed MSSPs in a presentation at the Interop Cybersecurity Crash Course. Among the features an MSSP might offer to potential customers, he said, are 24 x 7 monitoring, qualified security pros watching your network full-time, advanced correlation between behaviors and incidents, and reduced time to detect intrusions — all at a lower cost to organizations than performing those tasks in-house.

When those features are broken into their individual functional components, the result is a significant laundry list of possible services. Kwong said that figuring out which of those tasks to contract out, and how deliverables on each are defined, are critical for defining the customer/MSSP partnership and who “owns” which part of the total cybersecurity process.

Holt said that two words should be at the top of the list during the discussion over ownership: integrate and automate. Integration is critical, she said, because even in those cases in which an MSSP will take over essentially all of a company’s security functions, effective cybersecurity has to be integrated into the overall IT infrastructure.

And when a company looks for an MSSP to take over a portion of the cybersecurity function, then task can’t have any functional or visibility gaps between it and the customer-owned parts of the infrastructure if it’s to remain effective.

Ensure there are no functional or visibility gaps between the MSSP’s duties and the customer-owned, on-premise infrastructure to ensure the outsourced function is doing the job required with the necessary level of integration with other security functions — and at the price agreed upon in the contract.

No matter how the MSSP’s services are integrated into the customer infrastructure, you can’t outsource accountability, Kwong said. Regardless of the the contract language, the MSSP customer is ultimately responsible for making sure that their IT infrastructure is secure, both Kwong and Holt warned.

Related Content:

• The SOC Gets a Makeover
• Artificial Intelligence the Security Market
• Missing in Action: Cybersecurity Professionals
• GoT Guide to Cybersecurity: Preparing for Battle During a Staffing Shortage
• A ‘Cloudy’ Future for OSSEC

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/cloud/keys-for-working-with-modern-mssps/d/d-id/1334816?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Fighting cybercrime requires visibility into much more than just the Dark Web. Here’s where to look and a glimpse of what you’ll find.

The now-shuttered DeepDotWeb, which was a uniquely centralized and trusted repository of Dark Web links and information, had long made it easier for threat actors — and consequently, law enforcement and other defenders — to keep track of which Dark Web sites are active, and where. The repository’s takedown left a void that no comparable alternative seems to be able to fill, at least for the near future.

There are other sites, known as hidden wikis, that can appear to be comprehensive directories and are often referred to as such by defenders. In reality, they tend to be little more than human-assembled catalogs that harken back to the early days of the Internet. All this volatility is largely why threat actors who operate on the Dark Web also typically frequent a number of other channels.

It’s also why fighting cybercrime requires visibility into much more than just the Dark Web. Contrary to popular belief, the Dark Web accounts for just a minor subset of the many online venues that facilitate cybercrime. Even if the Dark Web were somehow to be eliminated, its absence would simply cause threat actors to rely more heavily on the various other online venues in which many, if not most, already operate.

Encrypted chat platforms are one such venue — and in fact, they support far more illicit activity than any other, including the Dark Web. Threat actors are increasingly using platforms such as Telegram and Discord, among many others, to communicate more securely and to share mirrors, which are sites that contain nearly identical information but are hosted on different URLs. If one URL faces downtime for any reason, the secondary URL acts as a backup to help minimize operational disruption and consequential profit losses.

Mirrors, Services, and Uptime
It’s important to note that threat actors generally aren’t using mirrors to attract new clients but to provide services and additional uptime to existing clients in the event that the original site is down for reasons such as a distributed denial-of-service (DDoS) attack or law enforcement action through the often-enhanced security and privacy afforded by encrypted chat platforms. In most cases, mirrors are only distributed to select clients or groups. While this practice doesn’t typically present material issues for more-tenured threat actors, it does — and is intended to — make it more difficult for law enforcement and other defenders to locate and monitor these sites.

Another venue popular among attackers is the Deep Web, which refers to the broad swath of sites conventional search engines cannot access, including, but not limited to, the entirety of the Dark Web. But unlike much of the Dark Web, the myriad illicit communities that exist elsewhere on the Deep Web are password-protected and highly exclusive. A number of these communities, including popular platforms for fraud, are located on Deep Web forums supported by bulletproof hosting services in countries unlikely to respond to law enforcement subpoenas.

Other online venues for cybercrime include decentralized marketplaces such as Joker’s Stash, a longtime fixture of the stolen payment card ecosystem. Rather than using the Dark Web’s Tor network, these types of marketplaces rely on blockchain-DNS (BDNS), which is a peer-to-peer network that helps administrators keep their sites online during attempted takedowns or DDoS attacks. And because there are technical barriers to entry that may deter novice threat actors, BDNS-hosted sites tend to be more popular among tenured threat actors.

The Geography Factor
The online venues in which threat actors operate are also heavily influenced by geography. Cybercrime is global and while the Dark Web is viable for most threat actors based in Western countries, Internet infrastructure in certain other regions is less conducive to accessing the Dark Web. For example, mobile networking has a high adoption rate in countries such as Brazil, largely because of the relatively low costs of mobile phones compared with computers. Usage of mobile applications for daily communication is also high throughout the region, as is the availability and uptime of major applications, including encrypted chat platforms frequented by threat actors around the world.

For defenders, an obvious challenge in combating cybercrime is figuring out where, if not solely the Dark Web, threat actors are operating. But just as most people, in general, use different communication channels for different interactions, so do threat actors. Much of it comes down to what a threat actor is seeking to accomplish. For example, threat actors who operate decentralized marketplaces outside the Dark Web often run targeted advertisements on the Dark Web in order to attract new customers. Threat actors seeking guidance on carrying out fraud, meanwhile, may be more likely to visit the various Deep Web forums that offer fraud tutorials.

Above all else, it’s important to recognize that while the Dark Web is integral to facilitating cybercrime and other illicit activity, much more of the threat landscape exists elsewhere on the Internet. While the recent Dark Web takedowns shine additional light on threat actor behavior and will likely have a sizable impact on the underground drug trade, they are unlikely to curb the plethora of other illicit activities that occur online — particularly the development of new malware. Combating such activity requires defenders to be agile and realistic about the many ways and venues in which threat actors operate.

Related Content:

• Demystifying the Dark Web: What You Need to Know
• The Dark Web Is Smaller Than You Think
• The Big E-Crime Pivot

Ian W. Gray is Director of Americas, Research and Analysis, at Flashpoint, where he focuses on producing strategic and business risk intelligence reports on emerging cybercrime and hacktivist threats. Ian is also a military reservist with extensive knowledge of the maritime … View Full Bio

Article source: https://www.darkreading.com/perimeter/cybercrime-looking-beyond-the-dark-web/a/d-id/1334774?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A penetration tester shows how low-severity Web application bugs can have a greater effect than businesses realize.

Organizations could face big problems from seemingly small Web application vulnerabilities. The problem is, many of these bugs fly under the radar because they’re not considered severe.

Shandon Lewis, senior Web application penetration tester at Backward Logic, discussed a few of these bugs in his presentation “Vulnerabilities in Web Applications That Are Often Overlooked” at last week’s Interop conference. Lewis emphasized the importance of focusing on the bugs attackers are likely to use beyond the zero days that typically make headlines.

In his early days as a red team member, Lewis said he learned “zero days were not the way we get in.” The media often focuses on zero-day and stack attacks, he explained, but the most credible threats against a business usually don’t come from cybercriminals writing their own bugs. He cited three key ways to “virtually guaranteeing” success when breaking into a target: phishing attacks, physical intrusion (walking into a building and planting a device), and weak passwords.

The latter is easier, more cost-effective, and safer for the adversary, Lewis said. In a typical red team operation, he would first identify the attack surface, locate authentication protocols, password spray, and access the enterprise with discovered credentials. “If you have an authentication portal on the edge and somebody logs in with valid credentials, how do you know they’re not the user?” he said, adding he had yet to see a business that could verify this.

There are two components to weak credentials: passwords and usernames. If an attacker doesn’t know which format a business uses (firstname.lastname, for example), his first step is to create a list of popular usernames and passwords. Lewis has found the most common passwords are time-based. Because employees are prompted to change their passwords every few months, they tend to choose time-based options. Spring2018 and Spring18 were popular.

“Laziness has gotten a little bit smarter about how it’s supposed to be lazy,” Lewis joked.

User enumeration, a facilitator vulnerability, enables attackers to guess or confirm valid users on a system. It’s typically a Web application vulnerability but can exist on any system that requires people to log in, Rapid7 researchers explain. Attackers hunt for differences in a server’s response based on whether the credentials they entered were legitimate. Once they know how the system responds to invalid credentials, they can brute-force usernames and passwords until they unlock the combination that will grant them access to the business.

“Just because it’s informational doesn’t mean it has zero impact,” Lewis said. Informational vulnerabilities, which fall low on the severity scale, provide some information to users that wasn’t designed to be released but doesn’t have a specific impact. As Venafi researchers put it, informational bugs “can provide attackers with additional information about the operational environment, but rarely result in additional compromise of information or resources.”

This wasn’t the only bug Lewis discussed in his presentation. Other examples of Web application vulnerabilities included rate limiting, which he said was “a fairly unknown bug” among those who haven’t been in the industry a long time. This happens when an app performs a function but fails to realize it has already done it, or performs it repeatedly. This is “a very prevalent problem,” he explained, but one that most businesses don’t care much about.

Related Content:

• 7 Recent Wins Against Cybercrime
  
• NSS Labs Admits Its Test of CrowdStrike Falcon Was ‘Inaccurate’
• How Security Vendors Can Address the Cybersecurity Talent Shortage
• Researcher Publishes Four Zero-Day Exploits in Three Days

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/application-security/web-app-vulnerabilities-flying-under-your-radar/d/d-id/1334819?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A portal has been partially opened that may, just maybe, eventually, lead the country out of its robocaller misery.

The endangered species known as a bipartisan bill sailed through the US Senate on Thursday. The bill, designed to fight illegal robocalling, passed with an overwhelming 97-1 vote, and now it’s headed to the House of Representatives. From there, it’s on to the desk of President Trump.

Senators John Thune and Ed Markey introduced the bill, which is titled the Telephone Robocall Abuse Criminal Enforcement and Deterrence Act, or the TRACED Act, in January.

Markey told reporters that robocalls are driving people nuts on both sides of the aisle:

There are no red robocalls, there are no blue robocalls. There are only robocalls that drive every family in America crazy every single day.

If the bill makes it through the House and is signed into law, it will empower the Federal Communications Commission (FCC) to inflict hefty new fines – as much as $10,000 per call – for illegal robocalls. The legislation would also increase the statute of limitations for bringing such cases, thereby giving FCC regulators more time to track down offenders.

The act would also create an interagency task force to address the problem, and it would push carriers like ATT and Verizon to deploy call authentication systems, such as the pending STIR/SHAKEN call identification protocols, into their networks.

That’s now in the works: in September 2018, the Alliance for Telecommunications Industry Solutions (ATIS) announced the launch of the Secure Telephone Identity Governance Authority (STI-GA), designed to ensure the integrity of the STIR/SHAKEN protocols.

That move paved the way for the remaining protocols to be established. Verizon announced in March that it had begun deploying STIR/SHAKEN technology: an authentication standard designed to fight call spoofing by verifying that the number on caller ID is the number that actually placed the call. Verizon said at the time that in coming months it would begin deploying STIR/SHAKEN on interconnections with other major carriers, as well.

Around the same time, ATT and Comcast said that they had exchanged calls using the protocols.

Finally…?

There’s been a bumper crop of legislation introduced to fight the scourge of illegal robocalls. According to The Hill, there were three hearings held during the previous Congress, and 13 bills were passed to curtail illegal robocalls.

The politics-focused media outlet called the TRACED Act the most significant one so far. It’s got the backing of all 50 state attorneys general, 35 of whom told the FCC in October 2018 that they were pulling their hair out over the enormous problem and that it was beyond the scope of what their states’ law enforcement agencies could cope with.

In February 2019, FCC Chairman Ajit Pai reiterated his call for a robust caller ID authentication system to be implemented this year. Earlier this month, Pai announced a new FCC initiative to fight illegal robocalls that would assure carriers that they’re able to automatically register customers for call-blocking service. At this point, customers have to do it themselves.

The proposed rule will be taken up for a vote next month.

Yes, it is getting worse

It’s not our imaginations: the robocaller plague is indeed getting worse. According to a report from YouMail, a company that makes robocalling technology for cellphones, there were 48 billion robocalls placed in the US last year. That’s an increase of about 57% from the 2017 estimate. Scams are taking up an enormous share of that, be they health/health insurance scams, interest rate scams, student loans scams, easy-money scams, search listing scams, home-related scams, travel scams, tax scams, business-related scams, or warranty scams.

Will STIR/SHAKEN save us?

Don’t count on it. At least, the protocols won’t do it all by themselves. STIR/SHAKEN – short for Secure Telephone Identity Revisited and Signature-Based Handling of Asserted Information Using Tokens – is a pair of network protocols that use digital certificates to ensure that the calls aren’t coming from spoofed numbers.

It doesn’t actually block spoofed numbers, though. The protocol doesn’t identify bad actors. Rather, it enables carriers to authenticate calls, after which consumers will be able to tell if a number is likely to be a robocall, and it gives the FCC a head start in tracking down the callers.

Back in November, Pai slammed carriers for dragging their feet on implementing SHAKEN/STIR. Some of those carriers, however, have reservations about the protocols.

Sprint, for one, told the FCC in October that the protocols will be helpful in fighting illegal robocalls, but it’s not a “complete solution.” Nor is it cheap. From its letter to the FCC:

Sprint is also concerned about the costs of implementing the certificate management requirements of SHAKEN and encourages the Commission and industry to explore more cost-effective alternatives to the central repository process originally contemplated in the development of SHAKEN.

Carriers have also complained that SHAKEN doesn’t tell them anything about the content of a call or whether it’s legal. From Sprint’s letter:

It just authenticates origination of the call path and the Caller ID information of individual calls.

Nor will it be useful without universal adoption, Sprint wrote:

Without universal adoption of SHAKEN from originating carrier to completing carrier, call authentication will not be passed to the terminating carrier.

T-Mobile concurred, among other carriers.

Regardless, legislation marches on

Senator Thune said that he hopes the House will take up the TRACED Act soon:

It will make life a lot more difficult for scam artists and help ensure that more scammers face punishment for their crimes.

The House, however, is working on its own bill, the Stopping Bad Robocalls Act (HR 946), which was introduced by Rep. Frank Pallone Jr., the chairman of the Energy and Commerce Committee.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/bqtZJEAWQkU/

One of the US’s most widely used vehicle license plate reader (LPR) companies, Perceptics, is reportedly investigating a data breach after news site The Register was sent files stolen from it last week.

The company is probably best known for designing the licence plate imaging systems used at the US border crossings with Mexico and Canada.

According to the site, a hacker using the identity “Boris Bullet-Dodger” claimed to have compromised the company, providing a list of 34 compressed directories amounting to hundreds of gigabytes and almost 65,000 files as evidence.

Some of them look like software development directories, covering file types such as .htm, .html, .txt, .doc, .asp, .tdb, .mdb, .json, .rtf, .xls, and .tif.

More concerning are the directories such as Platedatabase.rar and Plateworkbench.rar and image files the site speculates could be license plates captures.

Also among the files were MP3 files of songs by Stevie Wonder, the Spice Girls, AC/DC and Cat Stevens, which hints at the possibility that the data was taken from an individual’s computer rather than an exposed share.

The most recent directory has a data stamp of 17 May 2019, which not only underlines how recently data appears to have been pilfered but potentially makes it more up-to-date and therefore valuable.

According to The Register, Perceptics confirmed to it that some kind of data compromise had happened without offering further details.

What’s the concern?

The Register connects the Perceptics compromise and the Boris Bullet Dodger identity to the hack of CityComp earlier in May, which had its data released into the public domain after it refused to pay a ransom demand.

For Perceptics, the concern that some or all of this company data, including financial information, is now said to be circulating on the dark web.

For the public, the concern is that license plate or other sensitive data might have been compromised, although that possibility is speculation at this stage.

Unless some of this data relates to members of the public or customers, the company is unlikely to have to issue a wider alert and the incident will remain a private matter.

Breaches aren’t the only way such data can enter the public domain. In 2015 the Electronic Frontier Foundation (EFF) discovered that automated license plate readers used by police patrol cars in a list of US states were streaming live on the web.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/gon9q9O_kw8/

The Electronic Frontier Foundation (EFF) is claiming a win for free speech after it prevailed in a court battle to protect a Redditor from having his anonymity stripped.

Court documents use the male pronoun for the Redditor, who goes by the alias “Darkspilver,” so we’ll follow suit.

As those documents describe it, Darkspilver is a lifelong member of the Jehovah’s Witness community and considers himself a practicing Jehovah’s Witness. Many of his friends and family belong to the community, as well.

There are aspects of the organization’s teachings and practices that he questions. Given that he didn’t feel he could raise those concerns openly in the community – which, he said, tends to shun those who express disagreement or doubts – he turned to discussion platform Reddit. As of March 2019, Reddit had 542 million monthly visitors (234 million unique users), ranking as the No. 6 most visited website in the US. As of Friday, it ranked at No. 19 in the world, according to Alexa Internet.

Starting a few years ago, seeking to discuss his concerns about the religious organization and its collection, and handling, of members’ data, Darkspilver took to a Reddit forum for ex-Jehovah’s Witnesses and posted material including a copy of an ad asking for donations that had appeared on the back of a Watch Tower magazine, and a chart to show the kinds of data that the Jehovah’s Witness organization collects and processes.

The community was not pleased. In January, the Watch Tower Bible Tract Society of Pennsylvania – which publishes the religion’s bibles and publications – asked the US District Court in the Northern District of California to issue a subpoena pursuant to the Digital Millennium Copyright Act (DMCA) to Reddit, in an effort to discover Darkspilver’s identity. The Watch Tower claimed that both the advertisement and the chart were copyrighted.

Reddit declined to unmask Darkspilver. The platform also joined Darkspilver’s motion to quash that subpoena, filed by the EFF in March.

The EFF called the Watch Tower’s copyright claims “absurd.” As far as Darkspilver could tell, the materials were all freely available online. To boot, he wasn’t making any money off of publishing them, which puts it in the realm of fair use.

Disclosing his identity would cause Darkspilver to be disfellowshipped by his community, he feared. That brings to bear a well-established test, the “Doe” test, which allows a party to use the courts to pierce anonymity only where they can show that their claims are valid and also that the balance of harms favors disclosure, the EFF explained in an announcement on Tuesday.

The Doe test is designed to balance the constitutional right to share and access information anonymously with the right to seek redress for legitimate complaints.

The Watch Tower’s comeback: What constitutional rights? He doesn’t live in the US. How does the First Amendment come into play?

On Friday 17 May 2019, Magistrate Judge Sallie Kim rejected that argument, holding that the First Amendment can apply even if a “Doe” isn’t in the US. Darkspilver’s speech took place on a US company’s platform, the court noted, with a US audience. Silencing him would inevitably have ripple effects in the country at large, and besides, the First Amendment protects both speaker and audience.

Judge Kim:

The subpoena here was issued by a court in the United States, on behalf of a United States company (Watch Tower) and was directed against another United States company (Reddit). Moreover, the First Amendment protects the audience as well as the speaker.

The court order granting the quashing of the subpoena isn’t keeping Darkspilver completely anonymous, however. The court conceded that the Watch Tower might be justified in saying that it’s suffered harm by having its copyrights infringed upon, in that people could be directed away from its website. Therefore, in order to give the publisher a chance to demonstrate that fewer people visited its website after Darkspilver’s posting, the court decided to allow Watch Tower’s lawyers to see Darkspilver’s identifying information, which is required in order for Watch Tower to pursue copyright claims.

Based on that approach, the Doe standard “offers weak protections for fair users,” the EFF maintains. Still, the disclosure of Darkspilver’s identity is subject to strict limits: Watch Tower’s attorneys are prohibited from sharing the information with anyone, including their client, without a separate court order. If they violate that order, they’ll be “sanctioned,” the court warned.

It’s a complicated case, involving intellectual property, free speech and privacy, the EFF said, but for now, it’s still a “crucial win for the First Amendment and access to anonymous speech for internet users everywhere.”

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/gKGF7ar2vRY/

Did you think your mobile browser protected you from phishing attacks?

A research project called PhishFarm suggests otherwise, claiming that mobile browsers protected by Google’s anti-phishing mechanism failed to detect any phishing sites between mid-2017 and late 2018.

The study came from the Laboratory of Security Engineering for Future Computing (SEFCOM) (part of the Center for Cybersecurity and Digital Forensics at Arizona State University). The Anti-Phishing Working Group and PayPal also supported the work.

Browser vendors identify phishing sites and typically add them to a blocklist, which the browsers will then use to stop you getting onto those sites. Google Safe Browsing (GSB) is one such blocklist, and it protects not only Google’s Chrome browser but also Safari and Firefox. Microsoft has its own blocklist, called SmartScreen, protecting its IE and Edge browsers.

Cloaking

Using cloaking techniques to hide their sites from certain viewers, phishing scammers hope to prevent their sites from falling onto these blocklists. The academic study shows that these cloaking techniques have been working. It also revealed a massive hole in GSB’s mobile browser protection that existed for over a year.

The researchers created 2,380 phishing sites on new .com domains. They used one of five cloaking techniques for each site, based on the techniques used by real phishing kits, along with a control group using no cloaking.

The techniques used would restrict everyone other than the following groups:

• A – Control group. No cloaking.
• B – Android or iOS devices.
• C – US users running GSB-protected browsers (Chrome, Firefox, or Safari) on Windows, Mac, or Linux.
• D – Non-US users running GSB-protected browsers (Chrome, Firefox, or Safari) on Windows, Mac, or Linux.
• E – Non-security entities (IP addresses and hostnames not associated with a security entity).
• F – Web browsers using JavaScript (an attempt to filter out web crawlers).

They tested these techniques against 10 anti-phishing mechanisms offered by major companies and found them wanting. Only 23% of the phishing URLs crawled were blocked by at least one browser, the researchers said.

They also found a worrying gap in mobile browser protection:

We identified a gaping hole in the protection of top mobile web browsers: shockingly, mobile Chrome, Safari, and Firefox failed to show any blacklist warnings between mid-2017 and late 2018 despite the presence of security settings that implied blacklist protection.

Mobile versions of Chrome, Firefox and Safari failed to identify any of the test phishing sites protected with filters E and F, and wouldn’t even identify the same sites when uncloaked (group A), they explain. The problem was down to a new mobile application programming interface (API) in the Google Safe Browser that was supposed to optimize data usage but, in fact, broke protection for mobile browsers.

The researchers are especially concerned about this given the increasing proportion of mobile traffic on the web.

Microsoft’s Edge, protected by the company’s SmartScreen technology, was the best-performing browser in the PhishFarm tests, according to the paper. This is because it was the only native anti-phishing blocklist that used heuristics to evaluate new URLs on the fly, looking for telltale signs such as deceptive domain names.

What would be great is if each browser blocklist shared information with the other, the researchers added. GSB and SmartScreen don’t currently share data with each other, according to the report Third-party clearing houses like the Anti-Phishing Working Group (APWG) and PhishTank provided more standardized protection across all browsers, but their timeliness and accuracy wasn’t as good as the blocklists controlled directly by the browser vendors:

Closer cooperation could thus not only speed up [blocklisting], but also ensure that malicious sites are blocked universally.

The researchers have since worked with Google to fix the problem so that now mobile browsers are better protected. Still, this shows that for the best protection of all you might want to use a combination of systems from multiple vendors – along with good old-fashioned common sense. Always think twice before clicking on a link, and ideally use bookmarks or enter the link manually when visiting online services.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ILXuqQr8ajs/

Promo IT security training specialist SANS Institute is bringing a major event to London this summer, offering a bumper programme of intensive courses designed to arm security professionals with the skills they need to defend against database breaches and malicious attacks.

Attendees have the chance to prepare for valuable GIAC certification and will be able to put their newfound knowledge to good use immediately. The event takes place from 3 to 8 June at the Grand Connaught Rooms, offering a range of ten courses for all levels. Attendees will also be able to test their competitive skills in the SANS CORE NetWars tournament.

Course topics include:

• Advanced penetration testing, exploit writing, and ethical hacking
• Designed for those with some penetration testing knowledge, the course takes students through dozens of real-world attacks. Discussion of given attacks is followed by exercises in a hands-on lab.
• Intrusion Detection In-Depth
• Mostly but not solely for security analysts. Learn to determine whether an intrusion detection system alert is noteworthy or a false indication. Daily hands-on exercises reinforce the material.
• Windows Forensic Analysis
• How to recover and analyse forensic data on Windows systems, track user activity on your network and organise findings for incident response, investigations or litigation.

Plus much more besides.

Check out the full agenda here.

In addition, SANS Institute has launched a new campaign in EMEA called Level Up to encourage people to test their cyber security knowledge and to help highlight the cyber security skills gap.

Starting with a short, fun test covering topics such as encryption, two-factor authentication, hashing, penetration testing, and incident response, Level Up aims to attract potential new cyber security professionals into the industry. It also aims to give existing industry professionals an idea of what skills they should look to develop next, and why it’s so important to keep them up to date.

The Level Up website also features videos and case studies of some of SANS’s instructors and top industry experts, talking about how they got into cyber security as a career, why it’s so important, and how they have developed their careers.

The next Level Up event takes place on 4 June at SANS London. That Tuesday night event isn’t just open to students attending the SANS event that week, it’s also open separately to interested parties who can sign up for free here.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/28/sans_london/

If crooks want to sneak into your system, they have quite a few choices.

They could do some serious hacking, using vulnerabilities and exploits to bypass the security checks you already have in place and tricking your servers into running software they’re not supposed to.

Or they could find out how to get in without any low-level jiggery-pokery, using an official entrance and using official system commands.

That’s a bit like taking a taxi to a bank robbery instead of using a stolen car – it’s not a very gangster thing to do, but you won’t trigger any licence plate cameras on the way.

As regular readers will know, one of the popular vehicles for malware crooks at the moment is Windows RDP, short for Remote Desktop Protocol.

Sadly, we’ve written many times in recent years about RDP security lapses that allow crooks to come into your network as if they were real sysadmins…

…except that instead of fixing things, they break them instead, and then demand money to make good the damage.

But RDP isn’t the only popular way in for crooks.

We recently published honeypot research looking at SSH attacks, where SSH stands for Secure Shell, a remote access system that’s even more widely used on Linux and Unix than RDP is on Windows.

(SSH is also popular on Windows servers, but doesn’t have the close-to-100% adoption that it does on their Unixy cousins.)

That research painted an equally bleak picture about just how much rinse-and-repeat energy cybercrooks are prepared to expend to get into your network using unexceptionable methods.

Using otherwise legitimate tools for illegal entry not only opens up cybercrookery to a much wider set of attackers, but also sidesteps the risk of triggering exploit detections or causing a server crash.

Unfortunately, the crooks aren’t satisfied just using SSH and RDP as general-purpose attack tools.

There are many other online services – including some you might not expect – that are as good as a command prompt, if only you can connect to them in the first place.

For example, an insecure MySQL server isn’t just the road to a data breach.

It’s also a highly effective, if unorthodox, alternative to RDP or SSH for running software remotely.

Here’s a fascinating example captured recently by a SophosLabs honeypot that was listening out on TCP port 3306, the default access port for MySQL.

The mocked-up server pretended to be an insecure instance of MySQL that hackers could find, probe and connect to.

Honeypots deliberately attract hackers in order to keep track of the attack techniques that crooks are currently using – within limits, of course, because the honeypot mustn’t allow the crooks to do any actual harm.

Honeypot operators have to be careful to be part of the solution without becoming part of the problem. For example, if you’re trying to lure in spammers with what looks like a zombie computer that’s ready and waiting to blast out unwanted emails, you need to go far enough to let the crooks construct the messages they want to send, to add the attachments they want to distribute, and to reveal how many people they want to spam. But you mustn’t allow any of the dodgy messages to get out, or else you’re giving the crooks a free spamming service.

In the SQL-based attack captured by SophosLabs, the crooks tried to turn the honeypot’s MySQL server into a remote code execution robot, using a sequence like this:

1. Connect to the server.
2. Guess the credentials of an authorised user and log in.
3. Create an innocent-looking database table and add a text record consisting of text that’s actually a Windows executable file in hexadecimal.
4. Decode the hexadecimal data and save it as a local file called cna12.dll. (A DLL is a special sort of Windows program designed to be loaded by an application that’s already running to add extra features.)
5. Instruct the server to load the new DLL as a MySQL plugin known as a User Defined Function (UDF),
6. Call a function in the new plugin to fetch and run malware using HTTP.

Simply put, the crooks used MySQL as a general-purpose remote code execution zombie, thanks to MySQL’s official UDF plugin system that allows additional features be sucked into the server at runtime.

The attack wasn’t partciularly sophisticated because the crooks failed to notice that the honeypot was running Linux, and uploaded executable code specific to the Windows version of MySQL.

Nevertheless, if the server had been running Windows then the HTTP download (step 6 above)…

…would have unleashed ransomware known as GandCrab.

For a detailed breakdown of the techniques used in this attack, and for IoCs (indicators of compromise) you can use to check for similar probes on your own servers, please read the technical analysis on our sister site, Sophos News.

What to do?

Received wisdom says you shouldn’t be vulnerable to this sort of attack.

The massive global outbreak of the SQL Slammer virus back in 2003 should have taught us all to keep our SQL servers insulated from the internet, and the abuse potential of MySQL’s UDF feature has been well-documented for about as long.

But the fact that we’re still capturing unsophisticated, automated attempts to break in via internet-facing SQL ports is a reminder that we’re still making old mistakes.

So here’s what to do:

• Make sure your SQL servers aren’t directly accessible from the internet. If they are, that’s almost certainly a mistake. If it isn’t a mistake, it’s such a bad idea that you need to find another way to access them remotely. Consider using a VPN or SSH as the first point of entry instead, and insist on 2FA for all your users.
• Pick proper passwords. The attack described here can’t be pulled off by an unauthenticated user, so don’t take chances with weak passwords. Even if your SQL server is only accessible internally, you don’t want just anyone to be able to login easily, especially as a privileged user.
• Check your MySQL access control settings. Only users with INSERT rights into the core mysql database can load new UDFs, so anyone who could mount this attack already has enough power to do plenty of other bad things. (It would be nice to have the option to turn UDFs off if you never use them, but we can’t find a way to do that. The only trick we can find to inhibit UDF loading is to build your own statically-linked version of mysqld from source code.)
• Consider penetration testing. You probably know all the defensive strategies listed above, and try to follow them, but it’s worth checking that you have applied them correctly. Mistakes happen, and if you don’t look out for them, someone else certainly will.

Stay secure – batten down the hatches, and then check that the battens were fitted correctly.

---

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-tLBT1FLaok/

Roundup It’s a bumper three-day weekend in the US and UK, so we won’t keep you long. Here’s a rapid summary of information security news from the past week beyond what El Reg has already covered.

Baltimore ransomware misery deepens: The US city of Baltimore’s government websites and online services remain offline, and its computer systems are still knackered, after ransomware scrambled its files two weeks ago. Officials’ voicemail and email boxes are down, along with a parking fines database, and a system used by residents to pay water bills, property taxes, and vehicle law citations.

In a further blow, Gmail accounts set up by the mayor, city council members, and mandarins to communicate during the malware-inflicted outage were frozen out by Google’s software, which informed them they had to buy business subscriptions to continue. This was triggered by the officials setting up the personal accounts from the same public IP address, it seems. In the end, they were given back the accounts by the online ad giant.

“We have restored access to the Gmail accounts for the Baltimore City officials,” a Google spokesperson said on Thursday. “Our automated security systems disabled the accounts due to the bulk creation of multiple consumer Gmail accounts from the same network.”

Huawei to the danger zone: Not directly security related, but is kinda due to this all kicking off over fears of backdoors-to-Beijing: Huawei was this week snubbed by the Wi-Fi Alliance, which sets global wireless networking standards.

The industry body said it has “temporarily restricted” Huawei’s participation in the group, which includes Apple, Qualcomm, Broadcom, and Intel. Meanwhile, Huawei voluntarily withdrew its membership of JEDEC, which defines semiconductor standards. The Chinese goliath is right now cut off from the pair of standards-setting bodies, as a result of America’s crackdown on exports of US tech to the manufacturer.

Hundreds of millions of personal documents exposed online: First American Financial, a US real-estate insurance biz, was caught accidentally leaking customers’ highly personal files online.

The corp’s website apparently hosts some 885 million insurance-related documents – including details of wire transfers, and property records – going back 16 years, which could be accessed using sequential ID numbers in a URL. Stepping from 000000075 onwards revealed each file one by one, investigative blogger Brian Krebs and real-estate developer Ben Shoval revealed Friday.

Around 1400 Eastern Time (1800 UTC) that day, First American Financial’s website was updated to disable the file serving. “We are currently evaluating what effect, if any, this had on the security of customer information,” a spokesperson said. “We will have no further comment until our internal review is completed.”

TalkTalk NaughtyNaughty: Account information and bank account details of approximately 4,500 subscribers of calamity British ISP TalkTalk were available through a Google search, BBC Watchdog reported this week. This information made its way onto the web from the 2015 mega-hack of the internet provider, we’re told.

Contain thyself, Chrome and Firefox, says Microsoft: Windows 10’s software containment tech, used by Microsoft Edge to isolate malicious browser-based code and exploits from the rest of your PC, is now available for Google Chrome and Mozilla Firefox on the Redmond operating system via a new plugin.

Phisher folk reel in Computacenter security vetting mailbox packed with sensitive staff data

READ MORE

Graphic design web biz mega-hacked: The hacker who swiped 620 million account details from 16 websites, and millions more in subsequent server intrusions, and dumped them on the dark web for sale, has struck again. This time the miscreant has hit Australia-based Canva, which offers logo and other online graphic design services, and siphoned off 139 million user records, ZDNet reported Friday.

These records, stolen on Friday, cover usernames, email addresses, real names, city and country information, and individually salted bcrypt-hashed passwords or Google-issued per-app login tokens, where available.

“Canva was today made aware of a security breach which enabled access to a number of usernames and email addresses,” a spokesperson told The Register Friday.

“We securely store all of our passwords using the highest standards (individually salted and hashed with bcrypt) and have no evidence that any of our users’ credentials have been compromised. As a safeguard, we are encouraging our community to change their passwords as a precaution. We will continue to communicate with our community as we learn more about the situation.”

T-Mobile USA web leak: T-Mob USA this month closed up a vulnerability in its website that leaked customers’ names and account numbers when asked nicely in HTTP requests, after the hole was spotted and reported by developer and hacker Daley Bee.

In brief…

• A Metasploit-based scanner to check networks for PCs and servers vulnerable to the so-called Bluekeep (CVE-2019-0708) RDP hole in Windows is now available. Everyone’s encouraged to patch this security bug as soon as possible as various teams, from white to black hat, are developing exploits to achieve remote-code execution without any authentication via the blunder. The scanner should make identifying at-risk machines to prioritize much easier.
• Some 194 of the most popular 1,000 Docker containers on Docker Hub have no root password set. That’s a problem if a miscreant or malware gets into one of your running containers as they may be able to gain root privileges. To be exploitable, the container must be using PAM, or something else that uses the shadow file, for authentication. A similar issue was found in Alpine Linux Docker images, now patched.
• Facebook‘s face-recognition privacy settings were found missing for some users, weirdly enough.
• Equifax this week became the first company to have its rating outlook downgraded, in this case from stable to negative, by Moody’s as a result of a cyber-attack – specifically, the mega-hack it suffered in 2017. Equifax set aside $690m in the first quarter of 2019 to cover class-action lawsuit settlements, and any regulatory fines, as well as pledging to spend hundreds of millions on cyber-security defenses, which spooked financial analysts.
• A 33-year-old Australian government worker was accused of mining cryptocurrency for personal gain on his agency’s computer systems.
• Snapchat‘s internal tool for administrating user accounts and providing information to law enforcement is called SnapLion, and yes, a few employees apparently abused it in the past to snoop on others. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/25/security_news_summary/