hacking – Page 375 – STE WILLIAMS

CIA traitor spy thrown in the clink for selling secrets to China. Stack Overflow, TeamViewer admit: We were hacked…

library
crime | hacking | security

Roundup Here’s a quick catch-up of all things infosec beyond what we’ve already reported this week.

Stack Overflow becomes Hack, oh no, no! Popular programmer watering-hole Stack Overflow revealed on Friday it was hacked by a miscreant on May 5. The cyber-intruder was discovered six days later when they tried to gain more privileges on SO’s network, and was booted out.

We’re told the hacker broke into production systems via an insecure development build of the website. The site’s bosses claim no user information was stolen or altered, except…

“While our overall user database was not compromised, we have identified privileged web requests that the attacker made that could have returned IP address, names, or emails for a very small number of Stack Exchange users,” said engineering veep Mary Ferguson, and by small number, she means roughly 250. “Affected users will be notified by us,” Ferguson added.

The biz said it will comb its logs for any other suspicious activity, and shore up its defenses. It added it will be “engaging a third party forensics and incident response firm to assist us with both remediation and learnings,” and “taking precautionary measures such as cycling secrets, resetting company passwords, and evaluating systems and security levels.”

TeamViewer hacked: Remote-desktop and web conferencing software maker TeamViewer confirmed on Friday it was hacked in autumn 2016, though said nothing about it at the time. Details of the break-in emerged this week in German mag Der Spiegel.

The biz kept quiet because no customer data nor computer systems were, it is believed, compromised, and it didn’t want us to worry our pretty little heads about it all.

“Our systems detected the suspicious activities in time to prevent any major damage,” TeamViewer’s comms director Martina Dier claimed in an email to The Register.

“An expert team of internal and external cyber security researchers, working together closely with the responsible authorities, successfully fended off the attack and with all available means of IT forensics found no evidence that customer data or other sensitive information had been stolen, that customer computer systems had been infected or that the TeamViewer source code had been manipulated, stolen or misused in any other way.

“We came to the joint conclusion that informing our users was not necessary and would have been counterproductive to the effective prosecution of the attackers. Against this backdrop, we decided not to disclose the incident publicly in the interest of the global fight against cybercrime and thus also in the interest of our users.”

How thoughtful.

Ex-CIA guy jailed for 20 years for China leak: Former CIA intelligence officer Kevin Patrick Mallory, 62, of Leesburg, Virginia, was sent down for two decades on Friday for selling American national defense secrets to a Chinese spy. Some of that leaked information included “unique identifiers for human sources who had helped the United States government,” according to prosecutors.

The traitor was given a Samsung Galaxy smartphone by his Middle Kingdom handler Michael Yang for covert communications: Mallory, who is fluent in Mandarin, discussed Uncle Sam’s hush-hush information with Yang using the mobe, and used it to securely transmit at least five classified US government documents to Chinese intelligence. He was also spotted scanning secret and top-secret materials onto a microSD card in a FedEx store near where he lived.

“Former US intelligence officer Kevin Patrick Mallory will spend the next 20 years of his life in prison for conspiring to pass national defense information to a Chinese intelligence officer,” said Assistant Attorney General John Demers. “This case is one in an alarming trend of former US intelligence officers being targeted by China and betraying their country and colleagues.”

US cybersecurity officials urged to guard border: The US Department of Homeland Security’s cybersecurity officials, who are supposed to keep hackers out of Uncle Sam’s systems, have been reportedly pressured to set their day jobs aside and go defend the US-Mexico border – after not enough folks agreed to sign up.

Uncle Sam drone leak suspect pleads not guilty: Former US Air Force intelligence analyst Daniel Hale, 31, who is accused of leaking Pentagon drone program secrets to the press, has pleaded not guilty. He told his Virginia federal judge he wants a full-blown lengthy trial. His next hearing is set to take place on July 12.

Chat app Slack security whack: Slack for Windows was patched this week to close a security hole, found by Tenable, that could be exploited by miscreants to steal copies of people’s downloaded documents. Make sure you’re running version 3.4.0 or higher to avoid this vulnerability.

Database leak hits eight million US peeps: An insecure Elasticsearch database containing the personal details – think names, dates of birth, addresses, genders, etc – of eight million US folks was discovered facing the public internet. The data store – built from info submitted by people taking part in online sweepstakes and prize giveaways – ultimately belonged to aptly named Ifficient, which secured its system after being alerted to the blunder by security researcher Sanyam Jain.

In brief…

A Windows backdoor nasty dubbed Plead was found on systems seemingly distributed via software bundled with Asus computers. It’s not quite clear whether the malware was installed from a compromised Asus backend server, or in a man-in-the-middle attack. Asus did not respond to a request for comment.
Sophos says computers running this month’s Patch Tuesday Microsoft Windows updates and Sophos Endpoint Security and Control or Sophos Central Endpoint Standard/Advanced may hang during boot.
A hard-to-exploit Linux kernel bug (CVE-2019-11815) that can be exploited to elevate privileges in certain circumstances – for one thing, the rds_tcp module needs to be loaded – has been patched. If you stay up to date with security fixes, you’ve probably already picked it up.
More than 25,000 Linksys Smart Wi-Fi routers are facing the internet and vulnerable to a hijacking attack that’s been spotted sweeping the public ‘net.
Russian hackers successfully broke into systems storing voting registration files of two Florida counties in 2016, it emerged this week.
Nine people were formally accused by the US government of belonging to a SIM swapping gang dubbed The Community that hijacked victims’ cellphone numbers, typically by porting them to new SIM cards, and using the commandeered numbers to reset webmail and other account passwords to ultimately steal cryptocurrencies from online wallets. Three of them are employees of mobile networks, believed to be ATT and Verizon.
Remember the Russian hacking gang Fxmsp that claimed to have pwned various antivirus makers, and is apparently selling data stolen from those software houses as a result? Symantec was said to be among though it denies this. Trend Micro said one of its test labs had been accessed by miscreants, though insisted no customer data nor any of its source code had been swiped, well, at least as far as its internal probe had uncovered.
If you’ve shopped from UNIQLO Japan and GU Japan‘s online stores, then we have some bad news for you: they’ve been hacked and customer information was stolen.
HackerRank, a website for hiring software developers based on their skill, suffered a file-leaking vulnerability. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/18/security_roundup/

Giga-hurts radio: Terrorists build Wi-Fi bombs to dodge cops’ cellphone jammers

library
crime | hacking | security

Terrorists have been caught strapping Wi-Fi-activated backup triggers to bombs in Indonesia, police claimed this week.

The explosives were discovered in a raid earlier this month, and included a switching mechanism that enabled them to be detonated using a signal sent via Wi-Fi if the main trigger, which uses a SIM card and waits for a mobile phone message to detonate, was blocked by radio-frequency jammers.

“With that, he can put [the bombs] in some backpacks, and later he would just detonate them from a distance of 1km, for example,” said Brigadier-General Dedi Prasetyo at a press conference, according to The Strait Times. Yes, we know Wi-Fi doesn’t normally have a range of 1km. We’ll get to that in a moment.

Indonesia is on high alert ahead of the release of its presidential election results next week. The polls closed in April, and in the past few days Prabowo Subianto, the main challenger to the current presidency, has held rallies asking for the elections watchdog to look into allegations, made by him, of electoral fraud.

It is expected that incumbent president Joko Widodo will be reelected when the results are announced on May 22, and in the lead-up, the cops have been swooping on suspected terrorists: it’s feared extremists will set off explosives during street protests over the poll results.

You JAD, bro?

In one such raid on the island of Java, members of militant group JAD (Jamaah Ansharut Daulah), who are aligned with the Islamic State, were cuffed, and the plod found significant quantities of the same explosive that has been used by the Islamic State in bombs in Paris, Brussels, and Sri Lanka.

One of those arrested, according to police, is a professional bomb-maker who was working on the Wi-Fi trigger mechanism. It is not unheard of for bombs to use Wi-Fi signals – there have been several instances in the Middle East – but it is believed to be the first outside the region.

More details about the bombs were given by Dedi in Jakarta on Thursday. While Indonesian police now routinely used signal jammers at large public gatherings, thanks to a spate of bombs in recent years, they only disrupt cellphone communications, leaving wireless networking frequencies untouched.

Even though Wi-Fi will not travel as far as some cellphone signals, the police said that a careful construction of routers and amplifiers can extend the range as far as one kilometer. Which, while it may be news to people that deal with dead spots in their own house, is alarming to security forces trying to secure large areas full of people.

Dedi also complained it’s more difficult to jam Wi-Fi signals than cellular, making these Wi-Fi-activated bombs most undesirable, though the spokesman did not go into more detail.

It may be that the Indonesian cops don’t have the equipment to flood all the various wireless networking channels with noise effectively enough to disrupt communications. Standard Wi-Fi uses a healthy number of frequency bands, such as 900MHz, 2.4GHz, 3.6GHz, 4.9GHz, 5GHz, 5.9GHz, and 60GHz.

Perhaps the cops resort to turning off phone masts to block messages getting through, and can’t do that with rogue Wi-Fi base stations and repeaters. Perhaps the extended Wi-Fi signals are highly directional, or use non-standard radio frequencies, thus evading the Southeast Asian nation’s jammers.

Knowledgeable Reg readers are welcome to chip in. If Wi-Fi-activated bombs become a regular threat, we can imagine folks stepping up their efforts to build and deploy more effective Wi-Fi jammers. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/17/wifi_bomb_trigger/

Q1 2019 Smashes Record For Most Reported Vulnerabilities in a Quarter

library
crime | hacking | security

Once again, a high-proportion of the reported flaws have no current fix, according to Risk Based Security.

More security vulnerabilities were publicly disclosed in the first quarter of this year than in any previous three-month period.

Troublingly, nearly four-in-10 (38.2%) of them currently have no known fixes, according to Risk Based Security, which recently analyzed vulnerability data for the firts quarter of 2019 collected from its own proprietary search engine and from various security vulnerability-reporting sites.

The analysis showed a total of 5,501 vulnerabilities were disclosed via coordinated and uncoordinated disclosures during the first three months of this year. Nearly 38% of the vulnerabilities currently have publicly available exploits.

The total number vulnerabilities in Q1 2019 was about 1% higher than the 5,375 recorded in the same period last year, and is the highest ever in a quarter since Risk Based Security began conducting these studies. Web-related vulnerabilities as usual accounted for most (56.8%) of the reported vulnerabilities last quarter—an almost 10% increase from Q1 of 2018.

“Vulnerability disclosures continue to rise, and will continue to rise every year,” says Brian Martin, vice president of vulnerability intelligence at Risk Based Security. The trend highlights the need for organizations to have vulnerability mitigation plans and processes that go beyond just patching, he says.

“With some days seeing hundreds of disclosures, IT simply cannot patch all the vulnerabilities right away,” Martin notes. They need to triage that process and prioritize the high-impact vulnerabilities using more than just the risk rating provided by vendors and others. “They need to make more informed decisions based on their own deployment, availability of exploits, and more,” he notes.

Product Integrity

Sixty-three percent of the security vulnerabilities disclosed last quarter affected product integrity. Bugs that fall into this category include those that enable data manipulation, SQL injection, and code execution. Over half could be attacked remotely and one-third were user-assisted or context-dependent, meaning the ability for attackers to exploit these flaws depended on user actions and specific context.

Risk Based Security’s analysis showed that some 14% of the vulnerabilities that were disclosed last quarter were critical, with severity ratings of 9 or higher on the CVSS scale. Typically, these are bugs that are remotely exploitable, provide unauthenticated access, or give attackers a way to gain root access to a critical system or data. Thirteen percent of the reported flaws last quarter could only be exploited if attackers had local access to a system or a device.

Somewhat ominously for organizations, a higher-than-usual proportion of the vulnerabilities that were disclosed last quarter (38.2%) have no current fixes. In fact, only 60.8%–or 3,275—of the disclosed vulnerabilities have either an updated software version or a patch available. The number of vulnerabilities with available fixes last quarter was some 13.5% lower compared to Q1, 2018.

Martin says many of the vulnerabilities for which there are no fixes were disclosed by security researchers through channels outside the vendor’s purview.

“If they release via an exploit site, their own blog, or anywhere else that a vendor doesn’t know to look, they wouldn’t be aware of it and know to start working on a fix,” Martin says.

In addition to such uncoordinated disclosures, researchers sometimes release vulnerability details publicly if they perceive the vendor as being too slow to issue a fix for it.

Also, there are some security vulnerabilities reported in projects that are abandoned and will not be updated and therefore no fix is available, Martin says.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/application-security/q1-2019-smashes-record-for-most-reported-vulnerabilities-in-a-quarter/d/d-id/1334757?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Artist Uses Malware in Installation

library
crime | hacking | security

A piece of ‘art’ currently up for auction features six separate types of malware running on a vulnerable computer.

A malware infection on a laptop can be troublesome or devastating: But is it art? Yes, according to artist Guo O Dong. The Persistence of Chaos, an art installation currently being auctioned (with a high bid, as of press time, of more than $763,000), features a laptop computer infected with a half-dozen pieces of malware: ILoveYou, MyDoom, SoBig, WannaCry, DarkTequila, and BlackEnergy.

According to the website for the piece, the malware included is responsible for at least $95 billion worth of damage worldwide. The intent of the piece, according to Dong, is to “…see how the world responds to and values the impact of malware.”

The installation features a Samsung laptop running Windows XP. The machine is physically isolated and air-gapped so that there is no risk of the malware being spread outside the installation to the Internet as a whole, according to security firm Deep Instinct, the firm assisting the artist with the installation.

Get out of Huawei, it’s an avalanche of news from everyone’s favourite Chinese bogeyman

library
crime | hacking | security

Roundup Huawei has been kicked by a US national emergency proclamation hitting “foreign” gear, spent some cash in France, claimed it’s worth billions to Britain and was described as “a potential security risk” by a former head of MI6. And that’s just the last five days.

With all the news-related activity around Huawei, some of which is even actual news, we’ve decided to stop chronicling each minute twist and turn around the Chinese telco kitmaker and its security woes as they happen, and instead slice and dice them for your delight and delectation.

So far this week we have had…

Machine learning database thingy that isn’t new

An Arm-compatible database, predictably enough including the marketing buzzword of machine learning, was squeezed out of Huawei on Monday. We had a look at GaussDB and concluded that not only is the product not new (it forms part of Huawei’s Openstack distro, Fusionstack) but the only novel thing in this latest edition is its claimed integration of machine learning.

Nonetheless, any well-funded company launching a database product is likely to make Oracle’s Larry Ellison stop bathing in banknotes for five minutes and start looking at the competition.

Huawei ‘worth £1.7bn’ to UK economy

Huawei paid consulting outfit Oxford Economics to write a report saying the company’s British activities are worth £1.7bn to the UK GDP. We are breathlessly informed that 26,000 jobs, £470m in taxes, the salaries of 16,900 nurses, the smile on Mary Poppins’ face and the odds of snow on Christmas Day all emanate from Huawei in Britain, directly and indirectly.

Apparently this spending spree includes 35 higher education institutions around the UK, which will probably come as a surprise to Oxford University, which stopped accepting the Chinese company’s cash in January.

Trump bans Huawei from America and US MA

US prez Donald Trump (for it is he) declared an American national emergency in his drive to boot Huawei, and China more generally, out of US markets.

The missive, which could ultimately become a blanket ban, will “prohibit transactions posing an unacceptable risk to the national security of the United States or the security and safety of United States persons”, according to a White House statement. Placing Huawei on the US’s entity list also bans it from acquiring American companies without politicians’ approval, which both thwarts IP transfer to China and allows Trump and pals the ability to directly disrupt Huawei’s business growth plans.

Huawei hit back by promising to “fight to the end” of the ongoing trade war.

Huawei threatens security, says man whose job was to threaten others’ security

Sir Richard Dearlove, one-time head of spy-on-foreigners agency MI6, wrote, in his foreword to a Henry Jackson Society paper (PDF) criticising Huawei, that “if Australia can blackball Huawei as its 5G provider the UK can certainly do so the same without undue concern about the consequences”.

This comes not long after Britain’s National Security Council, a secretive body made up of senior civil servants and cabinet ministers, voted to keep the status quo on Huawei and use its equipment in non-core settings within 5G. Once leaked to world+dog, the news of the decision cost defence secretary Gavin Williamson his government job on the grounds he was the culprit, though nobody from the British establishment denied that the news was true.

The retired spy chief isn’t alone; Sky News’ Tom Cheshire, once its tech correspondent and now the telly network’s Man in Beijing, made much the same observation earlier this week. He drew a compelling parallel between British companies building telegraph networks all over the world in the late 19th century and Huawei today, arguing that while neither commercial enterprise was set up as an arm of their nation’s government, circumstances pushed them into doing the home country spies’ bidding for them.

Doubtless there’ll be more to come in the Huawei kerfuffle, and El Reg will dish up another pile of it next week if this pace continues. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/17/huawei_roundup/

It’s not chicken feed: Million-dollar meal deal for livestock sabotaged by hackers… and, er, exchange rates

library
crime | hacking | security

A $1.2m shipment of livestock feed went awry when “hackers” intercepted and tweaked emails with payment details, eventually costing the cheeky buyers an extra $161,000 after exchange rates moved during the legal fallout.

The sunflower meal traders ended up in dispute when the buyers refused to pay a shortfall caused by forex rates moving after unnamed hackers allegedly forged vital payment emails. The amount of time it took to figure out what had happened – less than a month – was enough to leave the sellers with a 13 per cent shortfall on the purchase price, which had been unintentionally converted from dollars to sterling and back again thanks to the email forgery.

Although neither firm was named, arguments about payment for the $1,167,900 of meal ended up being dragged through both private arbitration and the public court. Company “K”, the buyer, cheekily claimed it had fulfilled its end of the sale contract by sending payment to the buyers’ bank – even though it actually landed in the hackers’ account.

A strange tale, this shows the effects of a business email compromise attack. The facts stated below are all from Mr Justice Popplewell’s High Court judgment.

Emailed plaintext invoices? Well, it was a few years ago

Firm “A”, the sellers, agreed to sell K the $1.2m meal cargo in 2015, loading it aboard the Palau-flagged general cargo ship MV Sea Commander (IMO number 8203660; not the Polish-registered bulk carrier of the same name).

All seemed to be going routinely: A invoiced K on 2 November 2015, telling the buyers to send their cash payment to a Citibank account in New York, complete with a SWIFT number and a payment reference. That invoice was forwarded through agricultural goods broker Vicorus at 15:05 CST the same day.

K, however, denied in court that it received the email forwarded by Vicorus. Instead, said K, it received a forwarded invoice at 15:50 CST, appearing to come from Vicorus, with payment details for a London branch of Citibank. This, it was said, was the hackers’ doing.

Some routine to-ing and fro-ing was intercepted as well, with a second invoice in which the date had been corrected and “contained payment instructions for remittance via Citibank NA’s New York branch in favour of Citibank NA at its London branch”, ruled Mr Justice Popplewell, who added that the new reference number included the string “sheikmancons”.

Having been hoodwinked by whoever was tampering with the emails, K paid the fake account. A SWIFT confirmation was, it was said, also intercepted and tampered with (sent at 20:16 CST on 5 November 2015 with one set of details; received at 20:28 CST with another set of details) to falsely show that the money had gone to the right account.

Exchange rate malarkey

The London account was held in the name of Ecobank, which the judge emphasised had not committed any “fraud or wrongdoing” itself. Being received into a London bank account, albeit the wrong one, the USD sum had been converted into sterling on arrival. This turned the $1,167,900 into £768,372.45.

A and K eventually agreed to ask the various banks to move the fraudulently obtained cash into A’s rightful account. Ecobank, however, “approved the debit from their account of £674,831.46”, which Citibank explained was a smaller sum because the pound-dollar exchange rate had moved in the 20 days that passed while everyone figured out what had happened. The money was withdrawn from Ecobank’s account on 24 November and eventually made its way into A’s account on 18 December. What landed was $1,006,253.07, around $161,000 short of the original payment for the sunflower meal, which the bank put down to exchange rates again. Aggrieved at the shortfall, A took K to arbitration, demanding the remainder of its $1.2m.

Having lost both the arbitration and an appeal, all heard in private, K appealed again to the High Court, arguing that under their contract “the obligation was only to pay the price to the seller’s bank, who were the seller’s agent to receive payment”.

“Of course,” said Mr Justice Popplewell, “a payment to a bank account is not strictly speaking a payment to the payee. The relationship between a bank and its customer is that of debtor and creditor, and the payment itself is to the bank not the customer as such.”

The judge added, however: “It is commercially impossible to transfer funds to a bank which are intended for the benefit of a customer without identifying the beneficiary and the destination account by branch and account name and number.”

K lost its appeal, though Mr Justice Popplewell sent one legal point of argument back to the arbitrators to sort out. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/17/forex_rates_cost_livestock_feed_buyers_161k_after_hacker_tamper_with_invoices/

A Trustworthy Digital Foundation Is Essential to Digital Government

library
crime | hacking | security

Agencies must take steps to ensure that citizens trust in the security of government’s digital channels.

The age of digital government is upon us. Consider the following:

Roughly 92% of American taxpayers filed their tax returns electronically in 2017 — that adds up to more than 126 million Americans. These are impressive numbers considering that only 67% of taxpayers e-filed a decade ago and 31% in 2001.
More than 34 million Americans conduct their business with the Social Security Administration online.
About 8.5 million people enrolled in individual health plans for 2019 through the HealthCare.gov website.
More than 702,000 patients received healthcare through Veterans Affairs Department telehealth programs in 2016. That number appears to be rising steadily.
Grants.gov processes roughly a quarter-million federal grant submissions to distribute more than $100 billion in grants annually.
The US Census will conduct its first online decennial census next year. The outcome will be used to reapportion representation in Congress and distribute more than $675 billion per year in federal funds to support schools, hospitals, roads, public works, and other vital programs.

It’s clear that we finally have a digital government, and the government will continue to increase its use of digital services. Therefore, agencies must take steps to ensure that citizens’ trust and confidence in the security and reliability of those digital channels is high.

However, surveys show that the public remains skeptical. A 2017 survey by the Pew Research Center showed that half of the respondents lacked confidence in the federal government’s ability to protect their data. So, although millions of Americans are conducting online transactions with the government every day, many are still uneasy about it.

Even CEOs are concerned. According to an Accenture survey, 90% say a trustworthy digital economy is critical to their organization’s future growth, but only 30% are very confident in the security of the Internet. And this is forecast to decline to 25% slowly over the next five years.

As a nation, we are investing billions of modernization dollars to deliver and execute more government services digitally. We must be sure that these digital services are resilient, enabling trust, by building security into those services from the ground up. Citizens must trust that their digital interactions with government are secure, safe, and authentic. Without that trust, basic government functions will be questioned, and the effectiveness and efficiencies that modern, digital capabilities promise to deliver will be put at risk.

The following steps can help ensure that federal IT modernization efforts result in platforms and systems that are highly secure and resilient to cyberattacks:

Bake security into the design, architecture, and application of modernization efforts.
Design assets to be cyber resilient and therefore difficult to attack, minimizing the impact and potential loss when an event happens and continuously delivering the intended capability — no matter what.
Leverage software-defined networking, which makes network pathways harder to find and attack.

Another important consideration is the governance, strategies, operating models, and policies that drive our cyber behaviors and activities. Some of those include:

Providing governance and standards for the global community’s approaches and responses to security threats.
Establishing minimum security standards for Internet of Things-related devices in the global marketplace.
Leading international conversations over how individuals, organizations, and nations should be expected to behave on the Internet and decide on the appropriate response protocols when codes of conduct are violated.

By pursuing and aligning the right investments, decisions, and actions today, federal leaders can not only better protect federal digital operations, they can also help drive a trust turnaround for American citizens that will power the next phase of digital government.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Gus Hunt is Managing Director and Cyber Strategy Lead for Accenture Federal Services. He is responsible for developing differentiated approaches to dealing with the cyber threat environment and growing AFS’s cyber practice. Before joining AFS, Hunt was chief architect and the … View Full Bio

Article source: https://www.darkreading.com/endpoint/a-trustworthy-digital-foundation-is-essential-to-digital-government/a/d-id/1334680?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Exposed Elasticsearch Database Compromises Data on 8M People

library
crime | hacking | security

Personal data exposed includes full names, physical and email addresses, birthdates, phone numbers, and IP addresses.

Another day, another unsecured database. An unprotected Elasticsearch database exposed information belonging to eight million people in the United States who submitted their personal details as part of online sweepstakes entries, surveys, and free product sample requests.

Survey websites typically offer samples, prizes, or contest entries in exchange for personal data that’s later used in marketing campaigns, BleepingComputer reports. The information collected by one organization was kept in an Elasticsearch database, which was found unprotected by security researcher Sanyam Jain. It contained data including the full names, physical and email addresses, phone numbers, birthdates, gender, and IP addresses of individuals who entered their info on survey sites.

Further investigation by Jain showed the site belonged to PathEvolution, an online marketing firm owned by Ifficient, another marketing company. Ifficient secured the database when contacted by Amazon, which Jain reached out to when contacting PathEvolution proved difficult. The business says it doesn’t capture or store social security numbers, drivers license numbers, state ID numbers, or financial account or payment card numbers in its database.

Ifficient also reports that due to a high number of duplicate records, the amount of records affected is lower than the 130 million that Jain saw in the Elasticsearch database.

When Older Windows Systems Won’t Die

library
crime | hacking | security

Microsoft’s decision to patch unsupported machines for the critical CVE-2019-0708 flaw is a reminder that XP, 2003, and other older versions of Windows still run in some enterprises.

In a week when multiple vulnerabilities made headlines, a standout was CVE-2019-0708: a critical remote code execution (RCE) bug in Windows’ Remote Desktop Services (RDS), formerly Terminal Services, affecting several in-support and out-of-support versions of Windows.

Microsoft reports that the RCE flaw, which has not yet been seen exploited in the wild, could be weaponized as a worm if exploited. The vulnerability is pre-authentication and requires no user interaction. Any future malware could propagate from vulnerable computer to vulnerable computer, similar to the way WannaCry spread to machines around the world in 2017.

How it works: once authenticated, attackers could connect to a target system via Remote Desktop Protocol (RDP) and send specially crafted requests. RDP is not vulnerable but it is part of the attack chain. If successful, the attacker could execute malicious code on the target system; install programs; view, edit, or delete data; or create new accounts with full user rights.

The fear of cybercriminals writing exploits for the bug prompted Microsoft to release security fixes and workarounds for older versions of Windows: Windows 2003 and XP in addition to still-supported Windows 7, Server 2008, and Server 2008 R2. In a blog post on the update, Simon Pope, director of the Microsoft Security Response Center (MSRC), called the out-of-band patch “unusual” and emphasized businesses to patch all affected systems as quickly as possible to prevent an attack.

But while a legacy patch may be rare for Microsoft, it’s with good reason: many companies still run older versions of Windows due to the complications and challenges of system upgrades. And leaving those systems without a patch for the new, wormable RCE flaw would leave them exposed to possible such attacks.

After Microsoft disclosed the flaw, Alert Logic researchers scanned more than 4,000 customer sites to determine which were vulnerable. Of those, they found 61% of workloads run Windows 7 and Windows 2008, and 2.4% run Windows XP and 2003 – meaning nearly two-thirds of all businesses included are using older or unsupported versions of the operating system.

“One of the reasons that small and medium sized businesses were particularly affected is due to the fact that these organizations are more likely to run older systems, as their budgets and staffing constraints make it harder to upgrade,” says Rohit Dhamankar, vice president of threat intelligence products at Alert Logic, adding that constant monitoring for them is “essential.”

Kelly White, founder and CEO at RiskRecon, says it’s “highly likely” cybercriminals are developing an exploit for this particular bug. Similar to the flaw exploited in the WannaCry campaign, CVE-2019-0708 has several traits to motivate attackers: exploitation yields remote system compromise, the service is commonly exposed online, it is remotely exploitable, and it doesn’t require authentication to execute. A RiskRecon analysis of 10,000 companies showed 13% operate RDP on Internet-facing systems, putting them at higher risk for attack.

“Due to those factors, it’s the perfect combination that motivates security researchers and exploit writers to write the exploit code for this, because a lot can be gained,” he explains. “For the hackers, it’s gold.”

As we saw with WannaCry, thousands of legacy systems remain unpatched because they’re running fragile software stacks nobody wants to touch, notes, Satya Gupta, cofounder and CTO at Virsec. But patching is always slower and more difficult than organizations want to admit because it’s a disruptive process and can cause unintended problems. While businesses should act on Microsoft’s alerts as soon as possible, there remain issues for “unpatchable” systems.

For Industrial Control Systems, Patching is Perilous

“Microsoft used a few key words in their advisory that should get everyone’s attention: WannaCry, worm, pre-authentication, and remote code execution,” says David Atch, vice president of security research at CyberX, a Boston-based IoT and ICS security company. In a recent analysis of traffic from more than 850 production OT networks, CyberX found 53% of websites were still running outdated versions of Windows, including Windows XP and 2000. Forty percent of industrial sites have at least one direct connection to the Internet.

Industrial firms will remember the damage caused by WannaCry, which “spread like wildfire” and disrupted production at Boeing, Honda, Nissan, Renault, FedEx, and Telefonica, he adds. CVE-2019-0708 gives attackers the ability to install backdoors, ransomware, and cryptomining malware on ICS/SCADA systems to disable safety controllers or shut down manufacturing lines. Many industrial companies rely on RDS to give remote operators and engineers access to control system environments. An attacker could target one machine to install code that could wreak havoc across the network.

“ICS environments are at greater risk of attackers exploiting this vulnerability due to such environments operating older Windows systems and systems that receive less frequent updates,” explain Dragos intelligence analyst Selena Larson, and vulnerability analyst K. Reid Wightman, in a blog post on the bug. Engineering workstations, human machine interfaces, data historians, and OPC servers all run Windows, they point out.

Unlike most IT systems where “just patch” is frequent advice, Atch notes that patching ICS systems is a challenge because the process causes downtime and may being instabilities to production processes. “Upgrading to newer versions of Windows is also challenging because many of these systems are still running applications that were developed 10 or 15 years ago – especially in manufacturing environments – and upgrading them may cause applications to stop working, requiring access to developers that may no longer be available,” he says.

Atch recommends a risk-based approach, and to prioritize patching for Internet-facing systems and corporate jumpbox systems that provide secure remote access from the IT network to the ICS network. He also advises network segmentation of the OT network, and isolating the OT network from IT network, to prevent the spread of malware in the event of an attack.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/perimeter/when-older-windows-systems-wont-die/d/d-id/1334749?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

DevOps Repository Firms Establish Shared Analysis Capability

library
crime | hacking | security

Following an attack on their users, and their shared response, Atlassian, GitHub, and GitLab decide to make the sharing of attack information a permanent facet of their operations.

During the May 2 ransomware attack on their users, popular repository-service providers Atlassian, GitHub, and GitLab all rushed to analyze the origins of the incident and help their users recover.

As part of the response, the security teams at the three companies began to share data on the attacks and how the attackers operated. The collaboration worked so well, in fact, that the companies plan to make it permanent, says Kathy Wang, director of security at GitLab. Among the ongoing collaboration, the companies will explicitly search for files stored in their users’ repositories that may contain credentials to the other services, she says.

“We realized that it was so much better for us to work together for the common good of the Git user community than stay siloed,” Wang says. “If we can work with them to report these types of things, we can do better security hygiene for our users.”

Sharing information on threats between competitors has increasingly become the norm, rather than the exception. Other industries have created information sharing and analysis centers (ISACs), and several subsectors of technology companies regularly share information — especially among groups of security firms — but this is the first time a group of developer-focused companies have banded together.

This week, Atlassian, GitHub, and GitLab posted to each of their sites the results of a joint analysis created through collaboration among the companies security teams.

“The security and support teams of all three companies have taken and continue to take steps to notify, protect, and help affected users recover from these events,” the joint blog post stated. “Further, the security teams of all three companies are also collaborating closely to further investigate these events in the interest of the greater Git community.”

On May 2, Atlassian, GitHub, and GitLab had to scramble to figure out whether the ransomware attack on their users meant that attackers had somehow breached their services. The repositories of approximately 1,000 users had been wiped and replaced with a ransom note, stating:

“To recover your lost data and avoid leaking it: Send us 0.1 Bitcoin (BTC) to our Bitcoin address [deleted] and contact us by Email at [email protected] with your Git login and a Proof of Payment. If you are unsure if we have your data, contact us and we will send you a proof. Your code is downloaded and backed up on our servers. If we dont receive your payment in the next 10 Days, we will make your code public or use them otherwise.”

The three companies confirmed independently that in every case, the attackers compromised accounts using a variety of legitimate credentials. In addition to usernames and passwords, the attackers used application passwords, API keys, and personal access tokens, they said. Rather than reused credentials stolen in other breaches, the collection of passwords and keys likely came from repositories that inadvertently published files containing the secrets.

“Subsequently, the bad actor performed command-line Git pushes to repositories accessible to these accounts at very high rates, indicating automated methods,” the analysis stated.

Working together, the companies identified a file containing the collected credentials for about a third of the targeted developers. The so-called “credential dump” was hosted on the same online provider that was identified as the source of the attacks, the three companies discovered.

As late as May 10, the attackers continued to systematically scan for credentials mistakenly stored in the configuration files for Git, the program that acts as the conduit between developers and the various repository services. The scan came from the same IP address as the account compromises, the analysis stated.

The attacks continue a trend among cybercriminals and nation-state actors in targeting developers. From compromising their systems, as in the case of the malware inserted into an update for Piriform’s CCleaner, to a series of attempts to poison open source projects, attackers are attempting to insert their code into the software supply chain, says Danny Grander, co-founder and chief security officer of software-security service Snyk.

“This is just one of the many ways that developers are the target,” he says. “There is a rise in open source packages that are malicious and the targeting of developers with simple spray-and-pray types of attacks.”

Developers should take their defense more seriously, Grander says. He and the three repository firms all say that would have prevented the ransomware attack.

Meanwhile, Atlassian, GitHub, and GitLab will continue to share information with each other on attacks targeting repositories. The benefits of the collaboration became apparent during the response to the attack.

“As that whole initial exercise dissolved, we decided to permanently have a threat-intelligence sharing initiative between us,” GitLab’s Wang says.

Currently, the companies just have a shared Slack channel, and that is working well for now, she said.

Related Content

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/devops-repository-firms-establish-shared-analysis-capability/d/d-id/1334756?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple