STE WILLIAMS

It’s difficult to believe that The Matrix celebrated its 20th anniversary in March. It’s equally hard to ignore how well the film has stood the test of time. With Oscar-winning innovations in stunt work and special effects such as “bullet time,” the sci-fi epic starring Keanu Reeves and Laurence Fishburne changed Hollywood, according to some film critics.

At least, I think so.

It’s not just the special effects and plot development that remain fresh. What’s relevant for security professionals is the similarities between the characters and plot and how we look at modern security practices and technology.

The film’s protagonist — the computer programmer Mr. Anderson, played by Reeves — is one of billions of humans unwittingly inhabiting a simulated reality, referred to as the “Matrix.” Through a process of self-realization and literal rebirth, he becomes the hero, Neo. The process has been triggered by his choice of swallowing a “red pill” of reality instead of the “blue pill” that will keep him ignorantly complacent in a contrived, alternative, and manipulative world.

Neo is analogous to present-day CISOs: security professionals who have taken the “red pill” and are awake to the reality of protecting a real-life business amid the frightening, shape-shifting threats from cybercriminals seeking to do harm. In The Matrix, this ever-present evil is determined to destroy Zion, the last human-inhabited city in the world.

How Neo Battled the ‘Advanced Persistent Threat’
Shape-shifting is core to the movie’s plot. “Agents,” Neo’s sinister enemies, take over the bodies of innocent bystanders in their relentless pursuit of Neo and his crew. The cybersecurity analogy here is an advanced persistent threat (APT) group utilizing stolen credentials to gain a foothold into an organization — one of the most pernicious elements facing today’s enterprise.

Modern breaches often involve malicious APT-like agents gaining access to an employee’s credentials in order to achieve their goal. This usually happens as a result of spearphishing attempts, enabling attackers to steal customer data, intellectual property, or financial and banking data.

Just as Neo stays vigilant in looking for constant threats, CISOs fight the epidemic of stolen credentials with proactive risk-based authentication techniques that stop attackers from even obtaining a foothold in the first place. The key in both situations is having visibility into attacker behavior.

The Battle Against Insider Threats, Matrix-style
As Neo begins his journey to the “real world,” a jaded crew member, Cypher (Joe Pantoliano), asks, “Why, oh why, didn’t I take the blue pill?” This was Cypher’s rhetorical regret for not choosing to accept an easy, stress-free life in the Matrix rather than remaining in his real-world existence. Cypher’s words actually foreshadow his true intentions when it’s revealed he has sold out the crew on their ship, the Nebuchadnezzar, to the Agents in order to be “reborn” as a rich celebrity in the Matrix — without any memory of his past life.

Cypher represents an insider threat, trading the whereabouts of his crew for his own gain. In cybersecurity terms, insider threats are often embodied by employees, temporary workers, or contractors who have access to an organization’s systems. Insider threats may either act alone or consort with the enemy. Tank — a computer operator comparable to a real-world security analyst — eventually kills Cypher. The security analyst defeats the insider threat.

For cybersecurity professionals, insider threats continue to plague organizations of all sizes. Consider these statistics:

• The average annual cost of an insider threat to organizations is $8.76 million, according to the Ponemon Institute.
• 25% of all security incidents involve insider threats, according to the 2017 Verizon Data Breach Investigations report.

Fortunately, malicious insiders who seek to steal data can be neutralized through a robust security program that includes network, endpoint and identity security, and pervasive vulnerability management, and focuses equally on protection, detection, and response.

Battling Cyber Villains Is Our Reality
There are several other parallels between the plot of The Matrix and the cybersecurity world:

• Zion can be compared with an organization that needs protection.
• The Nebuchadnezzar’s control center is analogous to the security operations center (SOC).
• Morpheus (Fishburne) is the security-aware CEO who recruits talented information security professionals to his team, ultimately enlisting Neo by offering the red pill (video) to wake him up to “the truth.”
• Trinity (Carrie-Anne Moss) is the “white hat” hacker friend of Neo who actually uses the Nmap scanning tool to help out her team in the second installment, The Matrix Reloaded.
• The ability of The Oracle (Gloria Foster) to understand the human psyche to create a better Matrix could be compared with user and entity behavior analytics, and her ability to see into the future could be compared with the predictive analytics branch of statistical analysis — a fledgling area in cybersecurity.

The Matrix ushered in a new generation of sci-fi movies and brought back complex, futuristic plotlines that featured a relentless, seemingly invulnerable set of villains. Twenty years later, that theme can feel all too real for security professionals.

The facts remain: Bad actors come in all shapes and sizes, deploying new, sophisticated techniques to penetrate enterprises for any number of malicious reasons. As security professionals, we’ve taken the “red pill,” which means we know how pervasive these threats are — and we’ve chosen to defend Zion against them.

Related Content:

• 10 Movies All Security Pros Should Watch
• Everything I Needed to Know About Third-Party Risk Management, I Learned from Meet the Parents
• Are You Prepared for a Zombie (Domain) Apocalypse?

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Stephen Cox is a technology veteran with nearly 20 years in the IT industry, including 10 years of experience leading software development teams in the security industry. A key player in some of the most influential IT security firms in the world, he is recognized as an … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/the-matrix-at-20-a-metaphor-for-todays-cybersecurity-challenges/a/d-id/1334304?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A threat group with possible connections to the operators of the notorious Necurs botnet has employed what security vendor Bromium this week described as an Amazon-style fulfillment model to host and distribute malware on behalf of other cybercriminals.

The group is using a collection of more than one dozen US-based servers to help attackers distribute a variety of ransomware, banking Trojans, and other malware to targets located mostly within the country.

The IP addresses of the hosting servers belong to a single autonomous system — or range of IP addresses — registered with a so-called “bulletproof” hosting company in the US. Eleven of the servers hosting malware are located in a single data center in Nevada belonging to the company.

Typically, malware hosting servers are located in jurisdictions known to be uncooperative with law enforcement. The fact that this particular group is operating from within the US using a highly consolidated set of servers is significant, says a malware researcher at Bromium, who did not wish to be identified.

“One benefit of the infrastructure being in the US is that the connections to download the malware are more likely to succeed inside organizations that block traffic to and from countries outside of their typical profile of network traffic.”

Bromium has been tracking the group’s operation for close to a year and says it has observed the US-based servers being used to host at least five families of banking Trojans, two ransomware families, and three information stealers. The malware includes the Dridex banking Trojan, GandCrab ransomware, and the Neutrino exploit kit.

Evidence suggests that a single group is hosting the malware and also distributing it via mass phishing campaigns on behalf of other threat actors. The use of the same servers to host multiple malware families, for instance, suggests that a single entity is behind the operation, Bromium said.

Similarly, all of the hosting servers have the same default Apache HTTP server and CentOS software builds, and the malicious files were also always hosted in the same root directory on each of the servers, the security vendor said. In each case, there is also no evidence that the servers were ever used for legitimate purposes, meaning they were provisioned purely to host and distribute malware.

The phishing emails that are being used to distribute the malware are also strikingly similar, indicating that the same threat group is sending them out. Many of the emails, for instance, have Microsoft Word documents with malicious VBA macros and contain links pointing back to the same set of servers. All of the macros also use a hard-coded IP address rather than a domain name for the server hosting the second-stage malware.

“Our research suggests that these campaigns are part of a highly organized ‘Amazon-style’ fulfilment operation,” the Bromium researcher says. A distinct threat actor is responsible for email and hosting, while others are charge of operating the malware, he notes. “The entity that controls the hosting infrastructure represents a ‘choke point’ in the operations of the groups behind these malware families.”

The separation of command and control from hosting and distribution suggests that any data stolen from victims is likely being stored elsewhere, the researcher says.

According to Bromium, the fact that Dridex was hosted on one of the web servers and similarities in the manner in which the malware is being distributed suggest the operators of the Necurs botnet are behind the latest operation as well.  

The operators of Dridex have been using Necurs to distribute the malware since 2016. So, it is possible that the collection of web servers being used to host and push out the 10 different malware families is part of the infrastructure used by the operators of Necurs, Bromium said.

Bromium has notified relevant authorities about the US-based company that is hosting the rogue servers. The company and its affiliates have legitimate customers, many of whom are likely attracted by the cheap web hosting rates offered. There are close to 53,000 IP addresses registered to the company, of which only a fraction were found to be hosting malicious content, the Bromium researcher says.

Related Content:

• Social Media Platforms Double as Major Malware Distribution Centers
• Attackers Compromise ASUS Software Update Servers to Distribute Malware
• Worst Malware and Threat Actors of 2018
• 7 Malware Families Ready to Ruin Your IoT’s Day

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/threat-group-employs-amazon-style-fulfillment-model-to-distribute-malware/d/d-id/1334345?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A new Python-based bot scanner is snaking its way through Internet resources, seeking out exposed Web services and default passwords on critical network resources. The information grab doesn’t yet appear to be weaponized, but researchers believe it’s forboding for administrators of misconfigured databases and servers.

“The general use and potential it holds can be damaging for networks around the globe,” warns Tom Hegel of ATT Alien Labs, which identified the malware his team dubbed Xwo. 

This new malware family looks to have some relation to malware families Xbash and MongoLock. But unlike the coinmining and ransomware capabilities of these previous malicious packages, this one is still laying low with a focus only on reconnaissance at the moment. 

“Both Xwo and MongoLock use similar Python-based code, command and control (C2) domain naming, and have an overlap in C2 infrastructure,” Hegel wrote in a blog post on the research. “Unlike MongoLock, Xwo does not have any ransomware or exploitation capabilities, but rather sends stolen credentials and service access back to the C2 infrastructure.”

Xwo prods scanned systems to pick up a wide range of information about them. This includes looking for default credentials in FTP, MySQL, PostgreSQL, MongoDB, Redis, Memcached, and Tomcat. It also includes seeking out misconfiguration and other details like default SVN and Git paths, www backup paths, and PhpMyAdmin details.

Even though Xwo backs off of the malicious features in Xbash and MongoLock, AlienVault researchers believe that the richness of information being dug up by the new malware indicates attackers are using it as step one in a “advancing capability” that could do a lot of harm to networks worldwide.  

“Since the attackers are collecting information about valid credentials to access systems, they could use this to launch attacks in the future,” says Jaime Blasco, chief scientist at ATT AlienLabs.

“These could include compromising the systems to mine cryptocurrency, install ransomware—(a) likely scenario since we have found a relationship with a previous piece of malware called MongoLock that was likely used by the same threat actors, steal data from those systems, or even sell the credentials in the black market,” Blasco says.

Related Content:

• What Your SecOps Team Can (and Should) Do
• Tackling Cybersecurity from the Inside Out
• A Shift from Cybersecurity to Cyber Resilience: 6 Steps
• 5 Expert Tips for Complying with the New PCI Software Security Framework

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/python-based-bot-scanner-gorging-on-recon-intel/d/d-id/1334346?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In Alex Gibney’s absorbing new HBO documentary, “The Inventor: Out for Blood in Silicon Valley,” we see the cautionary tale of Elizabeth Holmes, the now infamous entrepreneur who dropped out of Stanford at age 19 to start Theranos. The company promised to disrupt the $36 billion blood-testing market by testing for a wide range of diseases via a single drop of blood, but turned out to be a massive fraud that bilked investors out of billions of dollars and put the lives of consumers at risk.

As someone who has worked in the cybersecurity industry for more than two decades, I couldn’t help but think about some of the overarching themes related to how Holmes and her consiglieri, Sunny Balwani, operated Theranos and what security leaders might take away from their “worst practices.”

Know Your Silos
Countless business articles caution against the risk of operational silos, but you’d be hard pressed to find a more systemic and flagrant example than in the story of Theranos, in which the engineering team responsible for building the machine were quite literally segregated from the laboratory chemists who were responsible for its testing results. In the film, Theranos engineer Dave Philippides says, “If the people from the chemistry team could talk about what was coming next from the engineering team, they would have said, ‘that’s not going to solve the problem.’ But since everyone was working on it separately, they could all keep on working forever without solving anything.”

At Theranos, the silos were a feature, not a bug. Regardless, it should serve as a reminder for security leaders to be aware of their own silo blind spots and ask themselves how information, ideas, and vulnerabilities are shared — or not — across their organizations. How do problems get communicated up the chain of command? What incentives — or disincentives — are in place that might compromise the way information is exchanged?

Beware False Positives
One of the more interesting questions to emerge from the film was whether it was necessarily even a good idea for consumers to order their own blood tests without a doctor’s prescription. Theranos successfully lobbied the Arizona legislature to “democratize” blood testing, and while there are compelling arguments behind this effort, Dr. Stefanie Seitz makes the case in the film that without context, consumers ordering these tests would either be lulled into a false sense of complacency or convince themselves that they have cancer, saying: “You can’t just look at a lab; you have to look at the whole patient.”

In a similar vein, Katherine Hobson at fivethirtyeight.com makes the case that even most accurate diagnostic tests applied to a large population can yield a disproportionate share of false-positive results: “The wider the pool of people being tested, the greater the chance of false positives, which is why screening guidelines generally limit the population to be screened. The more independent tests you do at once, each with its own chance of error, the larger the chance that at least one of those tests produces an incorrect result.”  

There’s a tendency in the current business landscape to conflate the notion that having access to more data points will lead to better intelligence and more informed decisions. But as any seasoned security practitioner can attest, a multitude of security information and event management and network appliances can trigger so many alerts and false positives that it becomes essentially useless. This is why mature security operations centers are increasingly emphasizing the crucial role that context has in helping them separate the signal from the noise.

A Culture of Fear Stifles Accountability
Theranos shielded itself from external scrutiny for such a long time in large part because Holmes and Balwani built a corporate culture steeped in fear and retaliation, which ensured that the very real problems its engineering team was facing with building the company’s machine could not be adequately addressed. As reporter John Carreyou puts it in his book about Theranos, Bad Blood: “The biggest problem of all was the dysfunctional corporate culture in which it was being developed. Holmes and Balwani regarded anyone who raised a concern or an objection as a cynic and a nay-sayer. Employees who persisted in doing so were usually marginalized or fired, while sycophants were promoted.”

Security leaders would do well to ask themselves: Does our corporate culture allow and encourage dissent from the lower ranks? All too often you hear stories of network engineers who discover a serious vulnerability but are too afraid to voice his or her concern because they are afraid of the potential fallout. It’s challenging to instill a sense of accountability across an organization if it’s not being embodied by its leadership team.

Surely, Theranos won’t be the last tech company to burn up in such a spectacular fashion. But hopefully we as security leaders can take a more constructive approach that will help to identify our own organizational deficiencies.

Related Content:

• 7 Business Metrics Security Pros Need to Know
• Data Privacy Manifestos: Competitive Advantage or the Start of Something Bigger?
• Threat Hunting 101: Not Mission Impossible for the Resource-Challenged

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Chad Loeven has been involved in enterprise security for over 20 years. Prior to VMRay he managed technology alliances at RSA, the security division of EMC. He came on board RSA via its acquisition of Silicium Security and Silicium’s ECAT ETDR (Endpoint Threat Detection and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/3-lessons-security-leaders-can-learn-from-theranos/a/d-id/1334295?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A vulnerability in Apache HTTP Server has been found and patched, but the sheer number of servers still running older, unpatched versions of the software means hundreds of thousands of sites and servers could still be in danger.

CVE-2019-0211 is a privilege-escalation vulnerability that could allow users to execute arbitrary code with the privilege of the parent process, which is usually root. The vulnerability exists in Apache HTTP Server releases 2.4.17 to 2.4.38 and was patched with the release of Apache HTTP Server 2.4.39.

According to Rapid7 scans, more than 2,000,000 servers, many on public cloud platforms, are still running vulnerable versions of Apache. “This is especially problematic and prone to exploit in shared hosting providers that run multiple sites under one umbrella Apache process,” said Bob Rudis, chief data scientist at Rapid7. 

Rudis recommended those who use shared hosting providers contact them to ensure the software has been patched and that organizations running vulnerable versions on their own platforms do so as soon as possible, too, to avoid being used as a privilege escalation vector that can be leveraged on other applications.

Read more here.

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/patched-apache-vulnerability-could-still-cause-problems/d/d-id/1334341?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A wave of business email compromise (BEC) campaigns targeting direct-deposit payroll information demonstrate once again that sophisticated technical skills aren’t necessary when you can convince employees to simply hand you money.

Vade Secure recently discovered an ongoing direct-deposit spear-phishing campaign that used conversational email messages to make first contact with HR representatives in an attempt to enlist their help in re-directing direct deposit funds into the criminals’ accounts.

Adrien Gendre, chief solution architect for Vade Secure, says BEC-type attacks are popular because the cost is cheap and when successful, the results are rapid. Vade Secure has seen this type of spear phishing attack across multiple customers in recent months. “It’s not isolated, that’s for sure,” he says.

The widespread nature of the problem is amplified in a new report by Agari Data on London Blue, a multinational gang conducting BEC campaigns first revealed in December. London Blue harvests the names and addresses of targets from legitimate sources, buying access to executives from companies paid to provide contact information (typically for legitimate marketing operations).

In the attacks originally reported by Agari Data, the London Blue group used a typical business email compromise (BEC) subterfuge in which the attacker pretends to be a vendor owed money by the victim. In the most recent campaign, the group has switched cover stories and is now pretending that urgent MA activity requires a rapid down-payment to an account which (because of the secret nature of the negotiations) is not in the victim’s accounting system.

With BEC scams, attackers often use common public email services, such as AOL, Gmail, or HotMail, as the source of their spear-phishing messages. Agari Data notes that, in February, London Blue switched to spoofing the company email address of the CEO in order to add urgency and authenticity to their attack messages.

The campaign Vade Secure reports on doesn’t use address spoofing: instead, they conduct a multi-phase campaign in which step one is to obtain email account credentials from a high-level employee. After that, the employee’s legitimate account is used to send illegitimate spear-phishing email messages to the finance department seeking payment to a throwaway criminal account.

“At its core, it’s a fraud issue,” says Phil Reitinger, president and CEO of Global Cyber Alliance. “It’s a different way to do an attack that is the same basic fraud that you could do with a phone or by sending a fake invoice,” he explains. And that’s why protection against these attacks involves both process and technology.

“If it’s possible for someone to request a check to be cut for $5 million to someone not in the system, you’ve got a problem,” Reitinger says. And the culture of many companies is set up to provide just that problem.

It’s basically a form of social engineering. “Criminals are often using people’s fear of authority or responsiveness to authority,” says Colin Bastable, CEO of Lucy Security. “But you’re also targeting people who want to get things done you know and they’re empowered. So it is really about behavior.”

Both Reitinger and Bastable say that robust financial-control systems can play a huge role in protecting against campaigns like these, as can technology that identifies and protects against spoofed email addresses and highly suspect email contents.

Related Content:

• Sentence Handed Down in $4.2 Million BEC Scheme
• Cybercriminals Exploit Gmail Feature to Scale Up Attacks
• 6 Ways to Beat Back BEC Attacks
• Microsoft, Amazon Top BEC’s Favorite Brands

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/new-improved-bec-campaigns-target-hr-and-finance/d/d-id/1334343?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple