STE WILLIAMS

Losing your home in a hurricane or wildfire is bad enough, but to add insult to injury, the US agency that helps survivors get temporary housing set millions of them up for identity theft and fraud by needlessly sharing their personal data with a contractor.

The Department of Homeland Security Office of the Inspector General (DHS OIG), which administers FEMA, said in a management alert dated 15 March that the US Federal Emergency Management Agency (FEMA) spilled highly sensitive personal data belonging to 2.3 million people who needed hotel lodging because of the 2017 wildfires in California and because of that year’s trio of hurricanes: Harvey, Irma and Maria.

In order for the contractor to administer FEMA’s Transitional Sheltering Assistance (TSA) program, there are 13 types of Personal Identifying Information (PII) it needs, and there are these six types of Sensitive PII (SPII) that it doesn’t need but which FEMA gave it anyway: street address, city name, postal code, the name of the applicant’s financial institution, applicants’ electronic funds transfer numbers, and their bank transit numbers.

SPII is defined as a subset of PII which if lost, compromised, or disclosed without authorization could result in what the DHS OIG called “substantial harm, embarrassment, inconvenience, or unfairness to an individual.” SPII, which includes the financial information that FEMA fumbled, requires stricter handling guidelines because if it’s compromised, it can bring serious hurt to people.

On Friday, FEMA called the data disclosure a “major privacy incident” in a press release.

Press secretary Lizzie Litzow said in the release that FEMA has taken “aggressive measures” to close the leak and that the agency is no longer sharing unnecessary data with the contractor.

No sign of data abuse… yet

FEMA has also conducted a “detailed review” of the contractor’s information system, she said. As of Friday, FEMA hadn’t found evidence that the survivors’ data had been compromised… although a lack of evidence doesn’t mean that it didn’t happen, as an anonymous DHS official told the Washington Post.

FEMA has also worked with the contractor to scrub the sensitive data off its system and has updated its contract to ensure compliance with DHS cybersecurity and information-sharing standards, Litzow said. Also, FEMA has told the contractor to complete additional DHS privacy training for its staff.

The DHS official told the Post that of the 2.3 million survivors affected, 1.8 million had both their banking information and addresses revealed, while about 725,000 people had just their addresses shared – a total that’s slightly more than that mentioned in the OIG’s report.

Fix this!

The DHS OIG’s report had two recommendations for FEMA, both of which FEMA agreed to: first, the agency needs to put in controls that keep it from sharing unnecessary SPII with contractors. Second, the report recommended that FEMA assess the extent of the incident and put in a process to ensure that the leaked data is properly destroyed.

FEMA responded by saying that it had already implemented the first recommendation: in December, it installed a data filter to keep unnecessary personal data of survivors from leaving its system. Since implementing the new procedures, it’s also sent internal security experts to conduct on-site checks of its network – twice.

FEMA also began an on-site assessment of the contractor’s network, expected to be completed by 30 June 2020.

How to fend off data devastation

As the report said, those whose details were exposed in this breach are at risk of identity theft and identity fraud if their SPII at any point leaked out of the contractor’s network and into the hands of attackers. Though that doesn’t seem to have happened, it’s as good an excuse as any to keep an eye out for unexpected emails that may try to phish account logins from you and to turn on two-factor authentication (2FA or MFA) whenever it’s available.

Here’s an article about a recent phishing campaign that gives you an idea of what to look out for, and here’s an informative podcast that tells you all about 2FA, if you’d like to learn more:

LISTEN NOW

(Audio player above not working? Download MP3 or listen on Soundcloud.)

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Tu_LcNIfyiA/

Exclusive A senior exec within DXC Technology’s global security practice has acknowledged his staff’s “puzzlement” at the company’s reluctance to fund examinations for infosec certifications.

Dean Clemons, global SCC services leader at DXC’s Offering division who reports to Mark Hughes, jumped on a conference call with staff on 19 March to inform them there will be no let-up on the expense purge: $60m worth of costs are to be squeezed out of the Security division in fiscal ’20 from 1 April. He also fielded questions from staff on the wider impact of cost reductions on buying new work kit and on keeping up their qualifications.

Even if you are impacted [by redundancies] months down the road, you will know in your heart of hearts that it wasn’t for want of jobbing: keep working hard…

Company insiders estimate some 400 heads will roll in the Security business unit during the course of the coming financial year, equating to 8 per cent of the 5,000-strong workforce employed in it.

In a Security, Consulting, Interrogation and Compliance Town Hall meeting, attended by thousands of people in the division – and The Register – Clemons began by reading a disclaimer that “will keep me out of trouble with Work Councils if I misspeak here because a lot of this is fluid. [There are] a lot of dynamics around performance ratings, business alignment, business success or aspirational success.”

He said CEO Mike Lawrie and CFO Paul Saleh had decided the Offering division – one of three in DXC, the others being Build and Deliver – needs to jettison $200m worth of costs.

“We (Security) are the largest group, you can imagine we have a big chunk of that, and our cost takeout intent or objective here is $60m of cost takeout for the Security Offering Group. To do that there will be a lot of structural changes,” said Clemons.

Former DXC Technology veep accuses ‘toxic’ CEO Lawrie of bullying staff in lawsuit

READ MORE

I know I said cost-cutting was over, but…

This was a bit of a climbdown for the exec, who admitted that during one of the previous town hall sessions he had told Security personnel he thought much of the cost-cutting actions were done.

“I was simply wrong,” he said. “I didn’t have the view for FY20, nor what the Wall Street analysts were expecting from us for market share. If you are tracking our market share, I think the market share is up slightly but the price of share has gone up fairly consistently now. The analysts see that we are making the right moves in their mind for the business.”

Wall Street seemingly loves businesses cutting costs to maximise profits.

A general reorg at DXC Security has already taken place, with one source telling us it was “precipitated primarily by a thinning of middle management”, and juggling people into different spots. More sweeping changes are on the cards to reach that $60m target.

“What’s weird is that the emphasis is all on cost reduction. We hardly ever hear any talk about increasing revenue, but maybe they beat the sales folks with a stick,” said one of our legions of DXC insiders.

Staff in the Security division told us the performance review is under way – staff get told of their scores on 31 March – and all the talk of cutting costs cast those discussions in a certain light.

Many employees have not had pay rises for three to four years, either at CSC, HPE ES, or since those companies merged and started trading at DXC in April 2017, sources claimed.

On the conference call, Clemons highlighted four priorities for DXC Security in the soon-to-start financial year: the first is to create “Integrated Solutions” rather than operating in silos, a structure that is “not resonating with the market”.

Other include moving from a “practice specific” setup to one based around “broader industry verticals”, plans to “re-emphasise” the areas of Security that are more profitable (no details on this yet); and make a bigger push around Platform DXC, a methodology of how services are delivered.

Clemons said DXC Security is a “great business to be in” and that it is “very dynamic”. He then launched a tub-thumping rhetoric designed to rouse the troops and make everyone feel like they are in control of their own destiny.

“We make decisions on lower-cost centres,” he said. “We make decisions on the labour pyramid index, who we hire consistent with our org structure and objectives. We make decisions on who to submit for promotion because of their ability to handle more responsibility. We control the message to the accounts and the clients, that is all on us. Our success is dependent on ourselves and I find that exciting.”

Redundancy fears

Clemons further added he was aware of the “elephant in the room” – the “sense of vulnerability” staff feel due to the planned redundancies.

“And I get it’s an elephant in the room because we are seeing some of the labour war-room activity around cost takeout; it is a little unsettling. It is a little nerve-wracking in part because we’ve been doing this Q over Q since the end of Q2 now.

“Remember I joined this organisation in August, so literally every day since I’ve been here, we’ve been in some activity around the sense of this elephant in the room of cost takeout,” said Clemons.

The advice he gave to staff to counter this nervousness? “Just keep on jobbing,” said Clemons.

“We know if we stop and we are reluctant to explore, innovate, then we are dead in this business. If one is not changing and grows intolerant of the dynamic then we are dead. We just won’t survive in this innovative world, so here is my answer: just keep on jobbing.

“Even if you are impacted months down the road, you will know in your heart of hearts that it wasn’t for want of jobbing: keep working hard, innovate, bring solutions, bring recommendations, how do we improve our business.”

Three-quarters of the way into the hour-long conference call, Clemons started to field questions from staff, one of the early ones specifically on training for consultants as it relates to professional qualifications and security certifications.

He admitted DXC had been “really slow” to get its act together by forcing staff to seek “RTA (Request for Travel Authorisation) support” for conferences and to attend exams.

DXC Technology utters words ‘hiring’ and ‘digital’ 105 times in Q3 earnings car-crash

READ MORE

“I think we have the language specific for RTA [to] exams and certifications, now we have that more clear but it isn’t as robust as some of our competitors. Some of our competitors are grandly – even if it is a secondary or tertiary certification, they will pay for it outright. I think DXC, we recognise the importance of it and we encourage self study.

“I found it surprising in that we were not paying carte blanche for certs that are fundamental to our business – CISSP, CISM, ISO 27000. We are revisiting that.”

Clemons said more investment was being funnelled into security certs around IoT and the cloud “to look after the priorities”.

“But I fully recognise the puzzlement of people in our business cocking their head sideways and going ‘What the heck?’, because our competitors do it much more grandly than we do. My view, and I’m an old guy, most of you can tell, so we’ve got to do better there,” he added.

Training? We’ve heard of it…

Historically, both CSC and HPE paid for workers to attain and maintain certs – including CISSP and CISM.

“The trend over the past few years has been on offloading those expenses to employees,” said a person familiar with the setup at DXC. “The whole situation is not clear – I hear some people are paying out-of-pocket, and others have managed to get it through the expense systems.”

He claimed that with the exception of training from the DXC University (aka Skillsport), “paid training is virtually impossible to obtain, and employees are expected to upgrade skills on their own time”.

Staff at DXC’s Security practice are ill-equipped in other ways too, it seems, judging by a question on the conference call that centred on laptop refreshes.

“We cannot do this more poorly,” said Clemons.

He told how Peter Usherwood, director of security consultancy for the UK, Ireland India and the Middle East, had requested a new laptop because his model is five years old, doesn’t run newer apps and has “latency in it”.

“What I would say is don’t wait. Keep raising those [purchase orders],” said Clemons. “There is some delay, some hesitation, but in the end game, people end up with the right equipment. It might take longer than it used to. Those of you who were in HPE and CSC, there was a different strategy. Cost takeout and cost awareness does add interesting behaviour for things like that but don’t stop doing it, just keep pushing them. And Peter, I approved yours yesterday.”

The process to get a new PC at DXC is to file a request via the ServiceNow platform, which needs to be signed off by a line manager or Clemons himself, otherwise the request is immediately rejected.

CSC, years before it merged to become one-half of DXC, halted its regular refresh cycles, a source claimed. Some staff are still being upgraded to Windows 10, we also heard.

Most Security staff are not given work mobiles or printer and some “employees gave up” on DXC’s internal procurement department to provide equipment and “use their own PC”, a DXCer said.

“DXC has no idea where confidential customer information is stored,” our contact claimed.

DXC axes Americas boss amid latest deck chair musical

READ MORE

It is understandable why some folk within DXC’s ranks are disillusioned with senior management. One told us: “It’s all about stock prices. Spend on marketing, send execs to the RSA show and keep putting lipstick on the pig, while gutting delivery to cover for lack of revenue.

“Employees and customers suffer. Executives put more money in their pockets. The sad part is that this could be an awesome company. There are still some bright, hardworking people left. But not for long.”

DXC continues to struggle to offset declines in its legacy outsourcing business with newer revenue streams, including cloud and application services.

The company started out with 170,000 employees in April 2017 but at last count, several months ago, this was down to 130,000. This included the departure of a great many former HPE execs. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/26/dxc_security_spending/

Ret. Admiral Michael Rogers – who served as head of the NSA and the US Cyber Command from 2014 to 2018 – on how to handle the risk of insiders exposing an organization’s sensitive data.

The Edward Snowden case in 2013 ushered in a new era of the insider threat that left many businesses wondering how they could prevent a determined user or contractor hell-bent on stealing or leaking secrets from doing so if the National Security Agency (NSA) could not.

Snowden – who pilfered and leaked troves of spy agency secrets and elite hacking tools to select media outlets in what he considered a whistle-blowing act to expose government overreach – became an instant cautionary tale on how to prevent and detect rogue or careless user activity. Yet many organizations today still continue to struggle with insider threat strategies and managing user privileges and access to data.

In an interview with Dark Reading earlier this month in San Francisco, (Ret.) Admiral Michael Rogers, who served as director of the NSA and commander of the US Cyber Command after the 2013 retirement of Gen. Keith Alexander in the wake of the Snowden storm, shared his vision for the best approach to thwarting insider mistakes and attacks. 

A major lesson for government and industry from the Snowden incident was that you have to get ahead of careless or malicious insider behavior, according to Rogers, who left his government posts last year and currently serves as an adviser to cybersecurity think-tank Team8.

“No. 1: Who has access to what data; what [access do they] need? That’s very important,” Rogers said. “And No. 2, understanding your population. For us in the government – at the NSA – it was uniform military, [civilians], and contractors. We had to build a strategy for three distinct populations in the workforce that sometimes operate with slightly different rules, slightly different responsibilities. What works for one doesn’t necessarily work for the other.”

Another lesson from the Snowden case was it’s not simply a matter of limiting your contractors’ access to data but, rather, all users, he said. “If you look at the history of insider challenges, it really reaches every demographic,” Rogers said.

The key is to understand user behavior on and off your network that could signal potential for stress or risk, he explained. Stressed users can become security risks.

That doesn’t mean monitoring users’ activities outside of work. But there are some red flags that could signal trouble for insider threat activity. For example, if the user has engaged in actions that indicate higher risks or problems, such as a criminal act, Rogers said, that could raise the risk of that user leaking or mishandling organization data.  

It’s about getting ahead of careless or malicious insider behavior. “We need to get better at predicting behavior,” Rogers said.

Even some of the more obvious signs often get overlooked or dismissed. An employee looking over another’s shoulder at work or asking for his logins or passwords should be a red flag, for instance, he said. “These are all things I’ve actually seen happen, but no one said anything” at the time, Rogers said.

However, subjecting users to overly intense scrutiny can backfire, he noted. It’s a balance: “It’s not security for security’s sake,” Rogers said. “And it should be in a way that does not violate employees’ rights.”

Organizations must protect the data they consider their competitive advantage. “Or like in our case [at NSA], it was the responsibility to make sure it didn’t fall into the wrong hands,” he said. “That control was also central. Not everybody in NSA had access to all the data; we had control for only those who needed it.”

Giving users access only to the data they actually need to do their jobs is one of the key best practices to data protection and insider threat protection. But that’s still not currently a widely adopted practice.

“That takes work,” Rogers said. “A good, effective insider threat strategy requires a commitment on the part of the organization as a whole.”

Emerging technologies like artificial intelligence (AI) and machine learning can help. “AI and machine learning have great applicability here. In my experience, most organizations have actually access to more data then they truly understand, and they’re not optimized to use it,” he said.

Users will make mistakes, Rogers said. The key is to incentivize them to avoid security missteps. “It’s not about hammering them [for their missteps], but ‘it’s we work as a team to maximize security and efficiency … and we respect you as an individual'” that also plays a key role in protecting the organization’s valuable information, Rogers explained.

Rogers dismisses heavy-handed or onerous security and user policies that don’t bring in the users as part of the discussion. “How do we engage in an insider threat strategy that doesn’t drive people away?” he said. “We want [users] to know what we’re doing. And we want to learn from them: What would be effective and resonate for you as a user? What, on the other hand, would be a disincentive?'”  

This gives users a stake in the security of the organization and its data. “I also believe in having a really frank discussion. There is a level of responsibility here – we acknowledge that. That responsibility can vary, but fundamentally if we’re giving [the user] access … there’s a responsibility to ensure [its security],” Rogers said. “It’s like a contract.”

And that requires buy-in. “It takes time, it takes resources, and it’s about [establishing a] culture,” added Rogers, who later headlined an insider threat event held by Dtex Systems.

Related Content:

• NSA’s Rogers: No White House Request for Action Against Russian Hacking
• Cyber Lessons From NSA’s Admiral Michael Rogers
• NSA Chief Says DNC Email Leak Was Deliberate Act
• Inside Incident Response: 6 Key Tips to Keep in Mind

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/risk/ex-nsa-director-rogers-insider-threat-prevention-a-contract/d/d-id/1334243?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In addition to teasing the world with a glimpse of subscriptions services for newspapers and magazines, gaming, and video entertainment, Apple on Monday released iOS 12.2, which patches 51 security vulnerabilities.

The fruit-themed company’s fixes cover some serious flaws and should be applied as soon as possible.

Apple fixed some really serious bugs in iOS 12.2. Update now!

Once again, this raises the question of whether Apple should tie their security patch schedule to major media events. This isn’t “Patch Tuesday”, it’s “Patch Keynote”. pic.twitter.com/F8fCoJmh2v

— Alex Stamos (@alexstamos) March 25, 2019

Among the most troubling vulnerabilities is a ReplayKit API flaw (CVE-2019-8566) that allows a malicious application to access the microphone on an iPhone, iPad or iPod touch without the authorization or awareness of the user.

“An API issue existed in the handling of microphone data,” Apple explains in its security update. “This issue was addressed with improved validation.”

Apple watchers may recall in January that the glass ring kingdom scrambled to fix a thematically-related FaceTime flaw that enabled a miscreant to force a FaceTime recipient’s phone to answer a call, turning the Apple kit into a conduit for potential eavesdropping. That issue was fixed last month.

A related issue affects WebKit (CVE-2019-6222), the heart of mobile Safari, allowing a website to potentially access an iOS device microphone without any indication being shown. A separate Safari bug (CVE-2019-8554) allows a website to access device sensor information without consent.

Reached via Twitter, security researcher Patrick Wardle, chief research officer at Digita Security and founder of Objective-See, said in addition to the Replay Kit flaw, which could be used to spy on people, there’s a noteworthy Geo Services bug (CVE-2019-8553) that permits remote code execution.

Bad news: Google drops macOS zero-day after Apple misses bug deadline. Good news: It’s fiddly to exploit

READ MORE

According to Apple, the flaw could be used to construct a malicious SMS link that triggers arbitrary remote code.

“These are the types of bugs that advanced (nation-state) adversaries exploit to remotely infect targets,” said Wardle, who lamented that Apple’s iOS platform rules disallow security tools that could thwart or at least detect this sort of attack.

The 12.2 update also fixes an iOS kernel bug (CVE-2019-8527) that a remote attacker could use to crash the system or corrupt kernel memory.

WebKit meanwhile received multiple bandages to prevent maliciously crafted web content from messing with memory in order to achieve arbitrary code execution: CVE-2019-8536, CVE-2019-8544, CVE-2019-7285, CVE-2019-8556, and CVE-2019-8506.

“To me the takeaway is that, iOS is, and always will be a hackable device,” said Wardle. “Yes it’s very secure, but as is the case with any computing system it’s hackable.” ®

But wait, there’s more…

macOS Mojave 10.14.4 also saw its share of bugs patched – with 38 CVEs. There were a few significant flaws: the AppleGraphicsControl kext suffers from a buffer overflow bug (CVE-2019-8555) that could allow a malicious app to execute arbitrary code with kernel privileges. Also, the Disk Arbitration framework suffers from a logic issue (CVE-2019-8522) that allows an encrypted volume to be unmounted and remounted by a different user without prompting.

The desktop OS also shared some bugs with iOS. The Feedback Assistant allows a malicious app to overwrite arbitrary files (CVE-2019-8521). The XPC Services API meanwhile allows files to be overwritten (CVE-2019-8530). Siri on both iOS and macOS have an hole that allows a malicious application to initiate a Dictation request without user authorization. And macOS is subject to the same kernel bug (CVE-2019-8527) as iOS.

Get updating.

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/26/apple_patches_bugs/

ShadowHammer campaign latest to highlight dangers of supply chain attacks.

Taiwanese computer maker ASUS may have inadvertently distributed malware to over 1 million users of its systems worldwide after attackers compromised software update servers at the company last year, Kaspersky Lab said in a report Monday.

Available telemetry shows the attackers planted the malware, disguised as legitimate software, on servers that ASUS uses to automatically push out software and firmware updates to users of its systems. The poisoned updates were hard to spot and block because they were digitally signed using legitimate ASUS certificates, Kaspersky Lab said.

The attacks happened between June and November 2018 and impacted ASUS customers that had enabled the ASUS Live Update utility on their systems. The utility is preinstalled on most ASUS computers and is used to automatically update applications, software drivers, firmware, and other components.

Though the rogue updates were likely installed on a large number of ASUS systems, the attackers themselves appear to have been interested in only a select few, based on a list of unique MAC addresses hard-coded into the malware, Kaspersky Lab said. “For now the real targets of this attack, surgically selected by 600-plus MAC addresses, remain unknown,” says Costin Raiu, director of Kaspersky Lab’s Global Research and Analysis Team. “We continue to investigate this attack and hopefully will be able to answer this question soon.”

ASUS did not respond to a request for comment via its general media inquiry email address.

The attacks, which Kaspersky Lab has dubbed Operation ShadowHammer, is not the first time threat actors have attempted to distribute malware tools by embedding them into legitimate software products and updates.

In 2017 a threat group managed to install a multistage data-stealer into a version of Avast’s CCleaner software that hundreds of thousands of users later downloaded to their systems. Then, as now, the malware impacted a large number of people, though one of the main goals of the campaign was to steal sensitive data from a handful of targeted technology companies, including Cisco, Microsoft, Google, Sony, and HTC.

In another incident, a Chinese threat group quietly embedded a backdoor Trojan, dubbed ShadowPad, into a server management software product from NetSarang Computer that was used by many large organizations.

Supply Chain Attack Challenges
“Catching supply chain attacks is extremely difficult [and is] possibly one of the biggest problems in IT security at the moment,” Raiu says. Kaspersky has been working on new technologies for spotting such attacks based on code anomalies, code similarity, and traffic checking. “One of these technologies allowed us to catch the ShadowHammer attacker, as well as several attacks that we suspect are related,” he says.

According to Kaspersky Lab, its investigation suggests that the group behind the attacks on ASUS systems is Barium, a threat actor that Microsoft recently identified as being responsible for embedding ShadowPad in NetSarang’s software. Barium is also believed to be behind several attacks on developers of gaming applications, Kaspersky Lab said, pointing to a report from ESET.

One aspect of the ShadowHammer attacks that remains unclear is how exactly the attackers obtained the unique MAC addresses of the intended victims. “Although we do not know for sure, we believe these may have been obtained through previous supply chain attacks, such as ShadowPad and CCleaner,” Raiu notes.

Mark Orlando, CTO of cyber protection solutions at Raytheon Intelligence, Information and Services, says the presence of MAC addresses indicates the wide-ranging ShadowHammer attack was launched for the purpose of targeting a relatively small number of very specific devices.

Detecting ShadowHammer-like attacks can be extremely challenging for organizations, he says. Even those taking the extra precaution of comparing new software update files to the “official” update using hash values wouldn’t have uncovered anything suspicious since the attackers replaced legitimate updates on the server with their own, Orlando notes.

Also, in this particular instance, the malware is designed to sit dormant if the victim machine’s hardware address doesn’t match with the MAC number of one of the 600 intended targets. Only defenders that know what to look for in advance have much of a chance to detect and stop such attacks, Orlando says.

“The best protection against this threat is a skilled defender who can quickly assess the malicious files or review available reporting and hunt for matching behaviors,” he notes. Monitoring for suspicious network traffic to domain lookalike sites might also help detect second-stage downloads of additional malicious code.

“Overall, organizations must update their threat models to include signed updates from trusted sources, and avoid excluding those updates from security monitoring and other detection mechanisms,” Orlando says.

Related Content:

• CCleaner Malware Targeted Tech Giants Cisco, Google, Microsoft
• Chinese APT Backdoor Found in CCleaner Supply Chain Attack
• Avast CCleaner Compromised Amid Rise in Supply Chain Threats
• 10 Security Product Flaw Scares

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/attackers-compromise-asus-software-update-servers-to-distribute-malware/d/d-id/1334244?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In the latest Pwn2Own vulnerability throwdown at the CanSecWest conference, two researchers walk away with the lion’s share of rewards-just like the real marketplace.

A pair of security researchers dominated the annual Pwn2Own contest at the CanSecWest conference in Vancouver last week, driving away with $375,000 in bounties for their six successful hacks—including that of a Tesla Model 3’s infotainment system, a feat that earned them the car itself as a prize.

The out-of-balance results are not a fluke. The contest comes only months after vulnerability researchers and security professionals debated the skewed economics of the bug bounty marketplace, where a few researchers win big, hundreds more may make enough to live, and the vast majority often never place. 

In a chapter for the book “New Solutions for Cybersecurity,” security professionals teamed up with experts from Harvard University and the Massachussetts of Technology to analyze the economics of the bug bounty market. The research, based on data from a Facebook bounty program and 61 programs run by bug-bounty services firm HackerOne, found that the distribution of rewards was in no way equal. A small portion of researchers were big winners, while the vast majority only found a single issue.

“We were looking at the system dynamics of the bug hunting space and the labor market in particular,” says Katie Moussouris, one of the authors of the chapter and founder and CEO of Luta Security, a security services firm. “There were very few individuals at the top.” 

The Pwn2Own competition demonstrated the effect quite well. Team Fluoroacetate showed off six different attacks at the conference. All other teams only accounted for four other hacks, and one of those was only a partial success. (One team withdrew from an attempt to hack the Tesla.)

Without a doubt, the two researchers—Richard Zhu and Amat Cama—deserve to win: This is not the first Pwn2Own competition that Team Fluoroacetate has swept. In November 2018, the duo—whose team name likely comes from a combination of their Twitter handles, RZ_flourescence and Acez—also won $215,000 in the mobile-focused Pwn2Own Tokyo contest. Zhu had previously also won last year’s Pwn2Own competition, taking home $120,000. 

The Vulnerability Lottery

Bug-bounty programs are a big gamble for researchers, says Moussouris. Researchers invest time and if they are not the first to submit their bug, they will likely not see any reward for their effort. The process rewards those researchers who can find a lot of bugs, fast, she says.

“In bug bounties, if you are not the first one to report it, your work is not compensated—you do not get paid at all,” Moussouris says. “Either you are first in, or you wasted your time.”

Yet, while the vulnerability-reward economy has only a very thin strata of “middle class” researchers, who make a living wage, the depth of that middle class also depends on where the researcher lives and whether vulnerability research is their only source of income, stresses Dustin Childs, communications manager for Trend Micro’s Zero-Day Initiative, which sponsors the competition.

“Maybe you are in a part of the world. where you don’t need to make $100,000 a year to live well,” he says. “While I know that we do have people who report vulnerabilities to our program who are full-time bug finders, others do it as a side hustle.”

The benefits of the programs, however, are real. While the Tesla hack garnered the most attention, some of the best research had a lot less flash, says Childs. Team Fluoroacetate showed a combination of three vulnerabilities that broke out of Microsoft’s Edge browser, through the virtual client, and executed code on the host operating system. 

“Within in the VMWare client, they opened up an Edge browser, and browsed to a Web page, and that was the only interaction that they had with the machine,” Childs says “The potential impact of executing code on the underlying hyper visor is—wow—it was really a great set of bugs.”

The exploit chain earned the duo the top prize of the competition: $130,000.

Another contestant used an exploit to break out of Oracle’s VirtualBox and attack the underlying operating system.

Just-in-Time 

In addition, the contest demonstrated that researchers are focusing on new areas of code to exploit. 

Half the vulnerabilities exploited by contestants occurred in the just-in-time (JIT) JavaScript compilers common in browsers. Team Fluoroacetate, for example, exploited Apple’s Safari browser by using a JIT vulnerability paired with a heap overflow to escape the protected runtime area known as a sandbox.

Another contestant, Niklas Baumstark, used a vulnerability in Mozilla Firefox’s JIT compiler along with a logic bug to escape that browser’s sandbox. And, the hack of the Tesla’s infotainment system used a bug in the just-in-time compiler for the user-interface rendering component.

The reliance on JIT to run code inside browsers—and browser-like components—is not surprising, says Trend Micro’s Childs.

“JIT is now pretty much the new use-after-free bug for us,” he says. “Once use-after-free bugs were all over the place. Now, we are finding JIT bugs all over the place, primarily within Javascript. It is this unintended giant.”

Related Content:

• Bug Bounty Awards Climb as Software Security Improves
• Crowdsourced vs. Traditional Pen Testing
• White-Hat Bug Bounty Programs Draw Inspiration from the Old West
• Bug Bounty Programs are Growing Up Fast and Paying More

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/pwn2own-tesla-hack-broken-vms-and-skewed-economics/d/d-id/1334247?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The US Food and Drug Administration (FDA) has issued a warning about two dangerous security flaws affecting a number of implantable heart defibrillators and home monitoring systems manufactured by medical device giant Medtronic.

According to an alert put out last week, the flaws affect all models from 20 product families of Implantable Cardioverter Defibrillators (ICDs), which are placed inside patients’ bodies to automatically counteract life-threatening cardiac arrhythmias.

Discovered by a team of researchers in the Netherlands and the UK, the problem is with the inhouse wireless technology, Conexus, which the ICDs use for telemetry, configuration and to retrieve device info.

The vulnerabilities

The first flaw, identified as CVE-2019-6538, is that Conexus wireless protocol has no authentication or authorization, which means that when the device’s radio is turned on, attackers can take control of the communication.

Having done so, there is nothing to stop them from reconfiguring an ICD device with potentially life-threatening settings.

The second flaw, CVE-2019-6540, is that the Conexus protocol doesn’t use any form of wireless encryption, so that attackers nearby can sniff out sensitive data going to and from the device.

The silver lining is that attackers would have to be close to the target device at precisely the right moment.

According to Medtronic, ICD communications are only activated in a hospital setting, so patients are not vulnerable when they are at home or out and about. In its notification, the company also pointed out:

Taking advantage of these vulnerabilities in order to cause harm to a patient would require detailed knowledge of medical devices, wireless telemetry and electrophysiology.

Medtronic hasn’t said when software updates will be made available to address the vulnerabilities. (The updates themselves will require medical approval.)

Meantime, mitigations include: only connecting to the devices in medical facilities, and reporting “concerning behaviour” .

It unlikely that these flaws have been exploited by attackers. As the company says, targeting them would still require advanced knowledge of their operation as well as knowledge of the flaws themselves. However, just to be on the safe side:

Medtronic is conducting security checks to look for unauthorized or unusual activity that could be related to these vulnerabilities.

What the flaws underline, however, is how medical devices are dogged by the problem of weak security, much of it relating to devices designed in the past.

A decade or more ago, adding wireless capability to huge amount of medical equipment looked like an easy win for convenience.

Unfortunately, security was low on the priority list and based on too many assumptions about likelihood and motive. We now see regular medical device security alerts, including one affecting Medtronic’s pacemakers last August.

Mitigations

These are the affected Medtronic devices:

• MyCareLink Monitor, Versions 24950 and 24952,
• CareLink Monitor, Version 2490C,
• CareLink 2090 Programmer,
• Amplia CRT-D (all models),
• Claria CRT-D (all models),
• Compia CRT-D (all models),
• Concerto CRT-D (all models),
• Concerto II CRT-D (all models),
• Consulta CRT-D (all models),
• Evera ICD (all models),
• Maximo II CRT-D and ICD (all models),
• Mirro ICD (all models),
• Nayamed ND ICD (all models),
• Primo ICD (all models),
• Protecta ICD and CRT-D (all models),
• Secura ICD (all models),
• Virtuoso ICD (all models),
• Virtuoso II ICD (all models),
• Visia AF ICD (all models), and
• Viva CRT-D (all models)

Medtronic has released patient-focused information in this security bulletin, which includes recommendations from the company to mitigate the risks to patients.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/gO7IgZB2R3s/

Promo Organisations can no longer afford to rely on prevention systems alone to protect them from increasingly numerous and determined adversaries who can find their way round most of today’s monitoring tools.

If you are a security professional working as part of an incident response and prevention team, the SANS Institute’s training event in Bucharest, Romania from 6 to 11 May promises to deliver two immersive courses that will deepen the knowledge you need to keep your organisation safe from data breaches.

Students have the chance to gain GIAC certification, and SANS pledges that they will be able to apply their new skills immediately.

The courses are as follows:

Advanced incident response, threat hunting, and digital forensics

Once an attack gets past your security systems, the key is to catch the intrusion in progress rather than wait till the attackers have achieved their aim and wrought havoc on your data.

Today’s fast-developing threat hunting techniques use known adversary behaviours to examine an organisation’s network and endpoints. This course will show you how to recognise malware indicators and patterns of activity that enable you to spot potential intrusions.

Topics include detecting when a breach has occurred, identifying compromised systems, performing damage assessments, containing and remedying incidents, and building up accurate threat intelligence on malicious actors.

Instructor Francesco Picasso is co-founder of Reality Net System Solutions, an Italian company specialising in digital forensics.

Hacker tools, techniques, exploits and incident handling

The internet is full of powerful hacking tools and bad guys only too eager to use them so defenders need to understand their methods to keep their organisations safe from data breaches.

This course will give you hands-on experience in finding vulnerabilities, discovering and responding to intrusions, and laying out a comprehensive incident handling plan. It addresses the latest cutting-edge insidious attack vectors as well as older, tried and tested forms of attack.

In addition you will explore the legal issues associated with responding to computer attacks, including employee monitoring, working with law enforcement and handling evidence.

Particularly suited to incident handling teams the course will also help general security practitioners, administrators and security architects understand how to design and operate safer systems.

More information and registration details are here.

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/25/train_to_turn_the_tables_on_your_computer_adversaries_at_sans_bucharest/

A million or so Asus personal computers may have downloaded spyware from the computer maker’s update servers and installed it, Kaspersky Lab claims.

Someone was able to modify a copy of the Asus Live Update Utility, hosted on the Taiwanese manufacturer’s backend systems, and sign it using the company’s security certificate, even keeping the file length the same as the legit version, to make everything seem above board. The update utility ships with every machine, and routinely upgrades the motherboard firmware and related software with any available updates from Asus.

When it checked in with Asus’s servers for the latest updates, the utility would fetch and install a backdoored version of the Asus Live Update Utility, we’re told. The dodgy version was offered between June and November 2018, according to Kaspersky.

That infected build of the utility was designed to spy on roughly 600 machines, identified by their network MAC addresses. So, roughly a million Asus-built computers may have been running a trojanized update utility, with a few hundred actively spied on via the backdoor.

The software nasty, discovered by Kaspersky in January this year and dubbed ShadowHammer, because they’ve all got to have a sexy name these days, was apparently found on 57,000 machines running the Russian security shop’s antivirus tools. Extrapolating that figure, there are a million or so computers running this backdoor, it is claimed: Asus is the world’s fifth largest computer manufacturer. Kaspersky claims it has found similar exploit code in the firmware of three other, as yet unnamed, vendors.

“We believe this to be a very sophisticated supply chain attack, which matches or even surpasses the Shadowpad and the CCleaner incidents in complexity and techniques,” said the Russian bughunters in a preliminary report.

Downloaded CCleaner lately? Oo, awks… it was stuffed with malware

READ MORE

“The reason that it stayed undetected for so long is partly due to the fact that the trojanized updaters were signed with legitimate certificates (eg: “ASUSTeK Computer Inc.”). The malicious updaters were hosted on the official liveupdate01s.asus[.]com and liveupdate01.asus[.]com ASUS update servers.”

Kaspserky said its staff first informed Asus about the mass infection on January 31, and met them two weeks later, according to Motherboard. But since then the manufacturer hasn’t seemingly made progress on a fix, and hasn’t warned customers. It also did not respond to our request for comment.

Symantec also said its antivirus tools detected the backdoored update utility on 13,000 or more machines.

It goes without saying that you shouldn’t be put off installing security updates and patches because of this snafu.

“This is the worst kind of supply chain attack,” said Matt Blaze, adjunct computer science prof and crypto-guru, in response to the revelations. “It threatens to poison faith in the integrity of update mechanisms that have become essential for security today. But in spite of this one attack, you are still WAY better off keeping things updated. Really.

“Everything ships with vulnerabilities. They get discovered (and exploited) over time. If you patch, there’s a small chance you’ll fall prey to a malicious update injected through the vendor. But if you don’t patch, there’s a close to 100% chance you’ll be attacked over time.”

If you want to check if you’re one of the recipients of malware on the MAC address list, there’s a free tool to do just that right here. Kaspersky said its investigation into this supply chain attack is ongoing, and will release a full report into the debacle at its annual security jamboree in Singapore on April 8. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/25/asus_software_update_utility_backdoor/

According to a new study, female professionals in the US privacy profession outnumber males 53% to 47%.

The past few years have seen an explosion of data-related crises, from the Snowden revelations about government surveillance to the Cambridge Analytica scandal at Facebook to the constant drumbeat of data breaches at leading global companies, including Marriott, Equifax, and Under Armour. This in turn has boosted an industry of privacy professionals, experts versed not only in law and policy but also in technology and management of personal data. Uniquely in a corporate context, particularly in tech-related markets, the privacy profession displays gender parity all the way from entry-level positions to senior leadership roles.

According to IAPP research into the governance practices of Fortune magazine’s top 100 publicly traded companies, more than half (58) of the companies surveyed had appointed a chief privacy officer (CPO) and that C-suite office was twice as likely to be filled by a female than a male. In privacy, large and publicly traded corporations have chosen to hire and promote women to fill roles at the top of the corporate ladder.

It’s no longer news that outside of privacy, women have been left out of corporate leadership roles, and that their absence can have negative political as well as economic consequences for firms. In a 2016 report, the Petersen Institute for International Economics found that the presence of females in the executive ranks can improve a firm’s performance, underscoring the importance of creating a pipeline of female managers ready and qualified for promotion — rather than simply “getting lone women to the top.” Privacy presents an opportunity for women to advance into executive roles because there are many well-qualified and trained women in the pipeline.

Since its emergence as a profession in the late 1990s, privacy has always been gender-balanced, with women making up at least half of the population of privacy professions and holding their own in privacy leadership roles. Indeed, the first-ever CPOs were Acxiom’s Jennifer Barrett Glasgow and IBM’s Harriet Pearson.

This year’s IAPP-EY Privacy Governance Report shows that in the United States, female professionals outnumbered males in the profession 53% to 47%. Consistent with our Fortune 100 research, gender parity extends to the senior ranks of the corporate hierarchy. Specifically, where privacy leadership was housed in a legal department, women outnumbered men 59% to 37%.

For companies seeking gender diversity in their executive ranks, there are many qualified females in the privacy profession pipeline. Privacy presents an unparalleled opportunity to hire and promote women into senior executive positions. Moreover, given the importance of privacy to a firm’s reputation and brand (registration required), firms of all sizes without a CPO role should seize the opportunity to create one, potentially gender-diversifying the C-Suite while benefiting customers and the brand.

The privacy profession — a field that molds together qualifications, skills, and expertise from both STEM and humanities — is a model for busting the glass ceiling.

Related Content:

• 7 Privacy Mistakes That Keep Security Pros on Their Toes
• Privacy Ops: The New Nexus for CISOs DPOs
• Data Privacy Careers Are Helping to Close the IT Gender Gap
• To Improve Security, We Must Focus on Its Peoplek

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Rita Heimes is data protection officer, research director and general counsel at the International Association of Privacy Professionals (IAPP), a non-profit professional membership association headquartered in Portsmouth, NH. At the IAPP, Rita works with a team of privacy … View Full Bio

Article source: https://www.darkreading.com/risk/a-glass-ceiling-not-in-privacy/a/d-id/1334231?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple