STE WILLIAMS

National Cyber Security Centre and National Crime Agency investigate random attack that locked down the association’s data and deleted backups.

An apparent ransomware attack hit databases and other systems earlier this week at the headquarters of the Police Federation of England and Wales (PFEW), a law enforcement association that represents some 119,000 police officers across the two nations.

The PFEW publicly announced the March 9 attack today, noting that thus far it appears no data was stolen by the attackers and that it had alerted authorities on March 10. “The malware is a type of malicious software which seizes and encrypts data,” the organization said in a tweet. 

“A number of databases and systems were affected. Back up data has been deleted and data has been encrypted and became inaccessible. Email services were disabled and files were inaccessible,” the PFEW said in an online statement about the attack.

The National Crime Agency (NCA) is currently investigating the attack, along with the National Cyber Security Centre (NCSC) and BAE Systems.

“We’ve been working with experts from BAE Systems’ Cyber Incident Response division to analyse assess the scale of impact Initial indications are that the attack was not targeted specifically to us was more likely to have been part of a wider campaign,” the PFEW tweeted today. 

Read more here.

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/police-federation-of-england-and-wales-suffers-apparent-ransomware-attack/d/d-id/1334219?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Windows Defender becomes Microsoft Defender, and it’s available in limited preview for Mac users.

Microsoft is renaming its Windows Defender antivirus protection tool and bringing its security capabilities to macOS devices in a “limited preview” mode now available to businesses.

Starting today, Microsoft Defender Advanced Threat Protection (ATP) will be available for Mac; with this expansion, Windows Defender ATP will be renamed to Microsoft Defender ATP. As part of its endpoint security efforts, Microsoft is also making new Threat and Vulnerability Management (TVM) capabilities available in Microsoft Defender today in preview mode.

The Defender ATP client for Mac was prompted by customer demands for tools that work across platforms, explains Rob Lefferts, who leads enterprise and security program management in the Windows and Devices group. Many customers report “their heterogeneous environment required cross-platform solutions,” the main driver behind this development.

Lefferts says customer feedback from the preview period will dictate if and how Defender will work differently across Windows and Mac. The Windows-specific Defender engine updates monthly, which Microsoft believes is a good cadence, but the trial period will be telling.

“Windows and Mac versions have feature gaps, and we will be looking for customer feedback throughout the preview period to prioritize the development of additional capabilities,” he adds.

Microsoft Defender is also being updated with TVM, a new capability designed to help security teams discover, prioritize, and address known vulnerabilities and misconfigurations. Users can gauge the risk level of threats and decide which to prioritize based on signals from Defender ATP. TVM provides more vulnerability data during incident investigations and a built-in remediation process via integration with Microsoft Intune and the System Center Configuration Manager.

Microsoft’s idea is to bring endpoint protection platform (EPP), endpoint detection and response (EDR), and TVM capabilities to both Windows and Mac, Lefferts says. The preview will start with EPP and expand to include EDR in the coming months.

To be considered for the Microsoft Defender Mac preview, you must have a Microsoft Defender ATP tenant (trial can be accessed here) and one or more macOS computers in your environment. If interested in the preview, you can apply for access here. It will be available for Mac devices running macOS Mojave, macOS High Sierra, or macOS Sierra, The Verge reports.

Related Content:

• Microsoft Office Dominates Most Exploited List
• 6 Ways Mature DevOps Teams Are Killing It in Security
• The Insider Threat: It’s More Common Than You Think
• Less Than 3% of Recycled Computing Devices Properly Wiped

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/analytics/microsoft-brings-defender-security-tools-to-mac/d/d-id/1334220?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Even with common security platforms like CASBs, organizations struggle to deal with the volume of apps and accounts that interact with business-critical data.

The pressure of increasing software-as-a-service (SaaS) deployments in the enterprise and the complexity of administering accounts across a varied cloud environment is ratcheting up the risk of insider threats. A new study out this week shows IT and cybersecurity professionals are struggling to stem the tide of negligent and malicious insider incidents in this era of pervasive cloud sharing, even when they use common security tools like cloud access security brokers (CASBs).

And while maintaining privacy of customers’ personally identifiable information still remains a concern, the greater bulk of cloud-based insider risk revolves around business-critical data. So says the “2019 State of Insider Threats in the Digital Workplace” report, released Wednesday by BetterCloud, which shows almost half of IT leaders believe the rise of SaaS makes them most vulnerable to insider threats today. 

Based on a survey of approximately 500 IT and cybersecurity professionals, along with internal security data at more than 2,000 organizations, the report finds 92% of organizations with more than a quarter of their mission-critical apps in the cloud feel vulnerable to insider threats. Of those SaaS vectors that open them up to insider issues, respondents overwhelmingly name cloud storage and email as the biggest challenges — 75% report these to be the breeding ground of the biggest insider threat risks.

Some of the biggest challenges organizations face when it comes to securing data and applications in SaaS ecosystem is the sheer volume and dynamic nature of applications and account connections in play. Another recent report, the “2019 Annual SaaS Trends Report,” by Blissfully, examines SaaS trends across nearly 1,000 companies and finds overall SaaS spending increased by 78% last year.  

At this point, companies now spend more on SaaS than they do on equipping employees with laptops. But, unlike laptops, SaaS vendors can be switched out with very little friction, which means the makeup of any given company’s SaaS stack is always in flux. The typical midsize company has seen 39% of its SaaS stack change in the last year, according to the SaaS report. What’s more, for every new SaaS app added or changed in an organization’s ecosystem, the headache around managing account connections multiplies.

Take the typical organization with 200 to 501 employees. This kind of company uses an average of 123 SaaS apps, according to Blissfully. It sounds manageable, but across those the typical company of that size must keep tabs on an average of 2,700 app-to-person connections. That doesn’t even account for the app-to-app connections that start to come into play when SaaS apps are integrated through APIs. 

This pervasiveness and complexity is why so many larger organizations still struggle so mightily to take control over how users interact with and share data in SaaS apps today. After all, SaaS security is hardly a new topic — security strategists have been warning about data security in SaaS for a decade now. While the rise of the CASB has helped many organizations mitigate a lot of their SaaS security risks compared with the early days, this latest insider threat report shows 95% of stakeholders at companies that use a CASB still feel vulnerable to insider threats. The reasons cited for why include the escalating freedom of SaaS users that enable unchecked decentralization of SaaS, blind spots in SaaS security created by new interactions between apps, and the growing complexity of managing configurations and file permissions.  

Plus, whereas in the past cloud and SaaS security was usually a compliance or regulatory concern, BetterCloud’s insider threat report shows that 57% of organizations say insider cloud risks are highest around data fundamental to the existential viability of the business. This includes confidential business information and intellectual property. 

According to other recent reports, the pressure is only going to increase. Last month a joint report from Oracle and KPMG found almost half of IT and cybersecurity professionals expect to store the majority of their data in the cloud by 2020. In addition, 92% of organizations said they are concerned about employees following cloud policies to protect that data, and 82% are still so unclear about the shared responsibility model of security that they’ve experienced a security event as a result. 

Related Content:

• Your Employees Want to Learn. How Should You Teach Them?
• Debunking 5 Myths About Zero Trust Security
• It’s Time to Rethink Your Vendor Questionnaire
• Care and Feeding of Your SIEM

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/insider-threats/saas-ecosystem-complexity-ratcheting-up-risk-of-insider-threats/d/d-id/1334221?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Artificial intelligence and machine learning are being weaponized using the same logic and functionality that legitimate organizations use.

The adversarial use of artificial intelligence (AI) and machine learning (ML) in malicious ways by attackers may be embryonic, but the prospect is becoming real. It’s evolutionary: AI and ML gradually have found their way out of the labs and deployed for security defenses, and now they’re increasingly being weaponized to overcome these defenses by subverting the same logic and underlying functionality.

Hackers and CISOs alike have access to the power of these developments, some of which are turning into off-the-shelf offerings that are plug-and-play capabilities enabling hackers to get up and running quickly. It was only a matter of time before hackers started taking advantage of the flexibility of AI to find weaknesses as enterprises roll it out in their defensive strategies.

The intent of intelligence-based assaults remains the same as “regular” hacking. They could be politically motivated incursions, nation-state attacks, enterprise attacks to exfiltrate intellectual property, or financial services attacks to steal funds — the list is endless. AI and ML are normally considered a force for good. But in the hands of bad actors, they can wreak serious damage. Are we heading toward a future where bots will battle each other in cyberspace?

When Good Software Turns Bad
Automated penetration testing using ML is a few years old. Now, tools such as Deep Exploit can be used by adversaries to pen test their targeted organizations and find open holes in defenses in 20 to 30 seconds — it used to take hours. ML models speed the process by quickly ingesting data, analyzing it, and producing results that are optimized for the next stage of attack.

Cloud computing and access to powerful CPUs/GPUs are increasing the risk of these adversaries becoming experts at wielding these AI/ML tool sets, which were designed for the good guys to use.

When combined with AI, ML provides automation platforms for exploit kits and, essentially, we’re fast approaching the industrialization of automated intelligence to break down cyber defenses that were constructed with AI and ML.

Many of these successful exploit kits enable a new level of automation that makes attackers more intelligent, efficient, and dangerous. DevOps and many IT groups are using AI and ML for gaining insights into their operations, and attackers are following suit.

Injecting Corrupted Data
As researchers point out, attackers will learn how the enterprise defends itself with ML, then inject the unique computational algorithms and statistical models used by the enterprises with corrupt data to throw off their defensive machine learning models. Ingested data is the key to the puzzle that enables ML to unlock the AI knowledge.

Many ML models in cybersecurity solutions, especially deep learning models, are considered to be black boxes in the industry. They can use over 100,000+ feature inputs to make their determinations and detect the patterns of knowledge to solve a problem, such as the detection of anomalous cyber exploit behaviors in an organization or network.  

From the point of view of the security team, this can require trust in a model or algorithm within the black box that they don’t understand, and coupled with the level of trust required, this prompts the question: Can “math” really catch the bad actors?

Data Poisoning
One improvement on the horizon is the ability to enable teams in the security operations center to understand how ML models reach their conclusions rather than having to flat-out trust that the algorithms are doing their jobs. So, when the model says there is anomalous risky behavior, the software can explain the reasoning behind the math and how it came to that conclusion.

This is extremely important when it’s difficult to detect if adversaries have injected bad data — or “poisoned” it — into defensive enterprise security tools to retrain the models away from their attack vectors. Adversaries can create a baseline behavioral paradigm by poisoning the ML model data, so their adversarial behaviors artificially attain a low risk score within the enterprise and are allowed to continue their ingress.

What the Future Holds
For other intents — influencing voters, for example — bad actors run ML against Twitter feeds to spot patterns of influence that politicians are using to influence specific groups of voters. Once their ML algorithms find these campaigns and identify their patterns, they can create their own counter-campaigns to manipulate opinion or poison a positive campaign that is being pushed by a political group.

Then, there is the threat of botnets. Mirai was the first to cause widespread havoc, and now there are variants that use new attack vectors to create the zombie hordes of Internet of Things devices. There are even more complex industrial IoT attacks focused on taking down nuclear facilities or even whole smart cities. Researchers have studied how potential advanced botnets can take down water systems and power grids.

The use of AI and ML is off-the-shelf and available to midlevel engineers who no longer need to be data scientists in order to master it. The one thing that keeps this from being a perfect technology for the good actors or the bad actors is how to operationalize machine learning to greatly reduce false positives and false negatives. 

That is what new “cognitive” technologies are aspiring to become — more than the sum of their AI and ML parts — by not just detecting patterns of bad behavior in big data with complete accuracy, but also justifying recommendations about how to deal with them by providing context for the decision-making.

Related Content:

• Mirai Authors Escape Jail Time – But Here Are 7 Other Criminal Hackers Who Didn’t
• Artificial Intelligence: The Terminator of Malware
• Trust, or Lack of It, Is a Key Theme on RSAC Keynote Stage
• IoT Anomaly Detection 101: Data Science to Predict the Unexpected

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Satish Abburi is the Founder of Elysium Analytics, the cognitive SIEM (security information and event management) company, incubated at System Soft Technologies, where he also leads the Big Data Solutions practice. Prior to this, Satish was Vice President of Engineering at … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/advanced-threats/hacker-ai-vs-enterprise-ai-a-new-threat-/a/d-id/1334201?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

2,000 Facebook engineers or developers reportedly made some nine million internal queries for data elements with plain text passwords.

An internal Facebook investigation has found between 200 million and 600 million of its users may have had their account passwords stored in plain text for years, meaning they could have been searched and accessed by more than 20,000 Facebook employees.

The issue was first reported by KrebsOnSecurity, which cites a senior Facebook employee familiar with the ongoing investigation saying archives have been found with unencrypted user passwords dating back to 2012. Investigators are still working to determine the total number of user passwords affected and length of time they were exposed.

Facebook reports the problem was detected in January during a routine security review, when it saw some passwords were being stored in readable format on internal data storage systems.

In a blog post, Pedro Canahuati, vice president of engineering, security and privacy at Facebook, says the company’s login systems are designed to mask passwords using tactics that make them unreadable. He says the passwords were not visible to anyone outside Facebook and there is no evidence anyone within the company abused or improperly accessed passwords. Further, Facebook has fixed the issue and will notify people whose passwords were found unencrypted.

“We estimate that we will notify hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users,” Canahuati says. Because there’s no indication passwords were exposed, users won’t be required to change them.

The anonymous source who spoke with KrebsOnSecurity says Facebook access logs indicate about 2,000 engineers or developers made some nine million internal queries for data elements with plain text passwords. While there’s no sign of abuse, it’s still unclear why they did this.

Read more details here.

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/facebook-employees-for-years-could-see-millions-of-user-passwords-in-plain-text/d/d-id/1334224?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In December, the FBI seized the domains of 15 of the world’s biggest “booters” (websites that sell distributed denial-of-service, or DDoS, services) – a crackdown that’s led to an 85% decrease in the average size of DDoS attacks on a year-on-year basis, according to a new report.

According to NexusGuard’s DDoS Threat Report 2018 Q4, the number of DDoS attacks also fell by 10.99% when compared with attacks during the same time in 2017.

That’s thanks to the FBI taking down the booters that were allegedly responsible for what the DDoS security provider says was more than 200,000 DDoS attacks since 2014.

Besides the drop in overall activity, both the average and the maximum DDoS attack sizes also dropped like rocks – by 85.36% and 23.91%, according to NexusGuard’s analysis.

DDoS-for-hire sites sell high-bandwidth internet attack services under the guise of “stress testing.” One example is Lizard Squad, which, until its operators were busted in 2016, rented out its LizardStresser attack service. …an attack service that was, suitably enough, given a dose of its own medicine when it was hacked in 2015.

You might remember Lizard Squad as the Grinch who ruined gamers’ Christmas with a DDoS against the servers that power PlayStation and Xbox consoles – an attack it carried out for our own good.

For our own good, as in, these server clogger-uppers didn’t feel bad: some kids would just have to spend time with their families instead of playing games, one of them said at the time.

The 85% reduction is good news, but it’s not cause to let down our guards. NexusGuard believes that the 15 services kicked offline by the FBI represented 11% of all attacks worldwide. While the shrinkage in attack bandwidth has shown that the crackdown was effective, it’s likely just a drop in the bucket when it comes to the tsunami of internet e-gunk that people pay these services to hurl.

Juniman Kasman, chief technology officer for NexusGuard:

Seizing command-and-control servers, booters and other resources has been a big part of the FBI’s fight against cybercrime. But this shutdown only scratches the surface of a global problem.

Where are these attacks coming from?

China has the dubious distinction of being the top spot for launching DDoS bots – accounting for 23%, followed by the US with 18%. That’s not surprising, NexusGuard notes, given that the US and China also account for around a third of the total online population.

Rounding out the top five were France (7%), Russia (4%), and Brazil (2.5%).

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ZsrRXz_yv9Y/

Opera announced on Wednesday that it’s added its free Virtual Private Network (VPN) service to its Android browser app …again.

The Norwegian browser maker offered a stand-alone, built-in VPN service before it was sold to a Chinese consortium, but it stopped working after the sale.

Now, it’s back: the latest, VPN-bearing, mobile browser version – Opera for Android 51 – is available now in the Google Play store or on Opera.com. The company hasn’t given any hints about whether it’s planning to bring the VPN to its iOS browser.

The VPN is free, unlike private VPN services for which you have to pay additional fees, Opera stressed. It’s also easy: users don’t have to sign in every time they want to use it; all you have to do is hit a switch.

What this is…

The Opera browser VPN will create a private and encrypted connection between Androids and a remote VPN server, using 256-bit encryption. It will shield users’ geographical locations, thus making it hard to track us, Opera says. That will hopefully provide a bit of relief from the apps that have been sucking our location data like so many leeches and selling it to third parties.

One example of that: Los Angeles recently sued the Weather Channel for allegedly posing as a “personalized local weather data, alerts and forecasts” app that’s more like a money-making stalker, tracking users “throughout the day and night” so as to sell their private, personal location data…

…it being just one of at least 75 companies that the New York Times recently found have been getting purportedly “anonymous” but pinpoint-precise location data from about 200 million smartphones across the US. They’re sharing our location data or selling it to advertisers, retailers or even hedge funds.

That’s just fine if you want to, say, see ads for personal injury lawyers when you’re sitting in an emergency room. Otherwise, not so much.

Opera’s Android VPN service is also a no-log service, which means that the VPN servers don’t log nor retain activity data, so as to protect users’ privacy.

Opera says that its built-in VPN will be good for connecting to sketchy public Wi-Fi hotspots in coffee shops, airports and hotels, protecting our internet traffic by keeping it encrypted …a useful thing, given that we’ve seen a number of Android apps sending unencrypted data that’s easy to spy on over public Wi-Fi.

Peter Wallman, SVP Opera Browser for Android:

By enabling Opera’s browser VPN service, users make it very difficult for third parties to steal pieces of their information and can avoid being tracked. Users no longer need to question if or how they can protect their personal information in these situations.

In its release, Opera referenced a report from the Global World Index that found that there were more than 650 million VPN users as of 2018 and that the use of mobile VPNs is on the rise.

Not surprising, given that people are probably just a teensy bit keen on improving their privacy these days. Of course, it doesn’t hurt for a browser like Opera, with its tiny market share, to jump on that bandwagon. As of February, Opera claimed only 3.53% of the mobile browser market, according to web analytics service StatCounter. It’s a shrimp compared with market leader Chrome, with its 56.74%.

Been there, done that, been scoffed at

This isn’t Opera’s first foray into VPNs. The desktop version of the browser picked up a kind-of, not-really “VPN” in 2016.

What that meant, as we said at the time, was that Opera would encrypt all web traffic through the browser, that it would block cookies, and that the user’s IP address would be hidden away. It meant more privacy for Opera users from potentially prying eyes, be they criminals trying to sniff Wi-Fi traffic or advertisers trying to track a user’s browsing.

What it didn’t mean: that it was a VPN in the true sense.

As people – including us – were quick to point out at the time, Opera’s desktop “VPN” in your browser didn’t protect all network traffic. It only protected users when they were surfing using Opera, not when they were using Outlook, Skype or any other tool.

Opera for Android is likewise nothing more than that: it’s to protect privacy when you’re using the Opera browser. Opera’s Communications Manager, Alejandro Viquez, explains it like this:

Regarding people discussing if it’s a true VPN, the thing is that there are few differences between VPN services and proxy services. Our browser VPN is a service that allows you to appear at a location of your choice around the world. From a users’ point of view, the only differences are that the browser VPN in Opera is fully free and that it’s restricted to the browser application.

What this isn’t…

A VPN can be a very useful security tool, but it’s not a cure-all. The usual caveats apply: pushing your traffic through a VPN means trusting your VPN provider – a lot. It hides your traffic from interlopers who aren’t your VPN provider by revealing all of it to your VPN provider. Your VPN becomes your ISP, effectively.

And there are good reasons for being leery when it comes to trusting those third-party VPNs. A recent study found that 60% of free VPN services are either from developers based in China or have some form of Chinese ownership: a worrisome connection, given how China has recently clamped down on VPNs.

Nor do most free VPN apps found in Google Play Store and Apple Play Store have much by way of formal privacy protections …or user support.

Can we trust Opera not to sell us out?

Opera itself now has Chinese owners. When TechCrunch’s Frederic Lardinois asked Opera about it earlier this year, he says the company stressed that it’s still based in Norway and operates under that country’s privacy laws. From TechCrunch:

The message being that it may be owned by a Chinese consortium but that it’s still very much a Norwegian company.

Opera is stressing that the VPN service in the Android app doesn’t log “activity of data.” Nor does it attempt to monetize any aspect of the VPN, it said in a conversation with VentureBeat:

The service is provided fully free of charge as a unique feature to improve the privacy and security. Opera monetizes from other unrelated mechanisms, and unlike other VPN services, Opera doesn’t depend on monetizing the browser VPN service.

You have to watch your Ps and Qs in the VPN

The fact that your VPN provider can see what you’re up to hasn’t stopped a number of people who’ve broken the law while using one.

We’ve seen a cyberstalker busted after he used a VPN to try to cover his tracks as he created accounts through which to send harassing messages. As he himself noted on Twitter just days before he was arrested, VPNs provide privacy …not anonymity. Not when your VPN provider can see what you’re up to.

We’ve also seen examples of how bitcoins added to a VPN don’t keep you anonymous, though crooks apparently thought that it would. (That link leads to an article by Naked Security’s Paul Ducklin that’s well worth a read when it comes to defining exactly what a VPN does …and what it doesn’t!)

And then too there was the employee from hell who was busted by VPN logs. A week before retiring, she used her system privileges to create new, fake employee user accounts, plump with high-level privileges and without any authorization whatsoever, from which she wreaked all sorts of havoc on the reservation and ticket system of her former employer, an airline.

People tend to misunderstand VPNs, so it’s worth restating: VPNs hide your computer’s IP address. They encrypt traffic between you and your VPN provider, making it incomprehensible to anyone intercepting it. But your VPN provider isn’t “intercepting” it: your VPN provider gets to see right into that tunnel, witnessing everything passing through your network.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/hJH4vtYSJk4/

A security researcher has discovered a high-severity bug in a popular PHP library that could enable attackers to run remote code on web servers.

The researcher, who calls himself Polict, discovered another way to exploit a bug in the PHP programming language that was originally reported at Black Hat in 2018. The new version of the bug affects TCPDF, a common PHP library used to make PDF files.

The bug relies on deserialization. When programmers want to store or transmit information readable by a program, they often serialize it by transforming it into strings or binary data. This is equivalent to packaging it in a box for easy shipment. Deserialization unpacks what’s in the box so that a software program can use it.

PHP has a command to deserialize data, but it comes with a health warning: Developers should only deserialize content that they trust. However, in 2018 security researcher Sam Thomas found a way to make PHP deserialize content without calling the function at all.

The attack uses a feature of Phar (PHP Archive) files. Phar files have a serialized metadata section meant to contain information about the file. If an attacker can upload a Phar with malicious metadata and get a website to run a file handling operation like file_exists or file_get_contents on it, they can run arbitrary code.

The flaw was exploitable in several applications including TCPDF. A web developer might use this PDF library to take input via a web form and then convert the completed form into a downloadable PDF document, for example.

Thomas was able to exploit this vulnerability in TCPDF by using uploading a Phar file posing as an image. PHP would the attempt to process it using its file_exists function, which would trigger the deserialization.

That flaw was fixed in September 2018, but then Polict found an alternative form of delivery. An attacker can deliver the evil code using a cross-site scripting (XSS) flaw, which enables an attacker to inject arbitrary HTML code onto a web site.

TCPDF includes a function called writeHTML, which takes HTML code and renders it in the PDF. Putting a link tag into that HTML enables the attack to point the PHP interpreter to a Phar file with its malicious metadata, which is then deserialized.

Although Polict blogged about the flaw on 17 March 2019, he disclosed the information privately to the TCPDF developers in September, and the problem was fixed that month. As long as you’re using TCPDF version 6.2.22 or above, you’ll be safe from it.

The bug has been given the name CVE-2018-17057.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-hprdyCHO74/

A researcher has published a new and relatively simple way that Windows BitLocker encryption keys can be sniffed in less secure configurations as they travel from Trusted Platform Modules (TPMs) during boot.

BitLocker is the full volume encryption system that has been shipped with higher-end versions of Windows since Vista, which in the case of Windows 10 requires running or upgrading to Pro, Enterprise or Education versions on a computer with a TPM 1.2 or 2.0 chip.

Inevitably, being the Windows encryption platform has made it a target for researchers looking for weaknesses in something many people use, of which the method published by Denis Andzakovic of Pulse Security last week is only the latest example.

The weakness he exploits is that in its most basic and insecure configuration, BitLocker boots encrypted drives without the user needing to enter a password or PIN other than their normal Windows login. Writes Andzakovic:

The idea behind this is that if the laptop is stolen, and the attacker does not know your login password, they cannot pull the drive and read the contents.

No login, no access to the computer’s encrypted drive. Simply removing the drive and putting it in another computer won’t work either because the encryption key is secured inside the old machine’s TPM.

However, there is one theoretical line of attack – boot the target computer and figure out how to discover the encryption key (or Volume Master Key) as it travels from the TPM across something called the Low Pin Count (LPC) bus.

Microsoft already warns BitLocker users about the risk of using the technology without additional security such as a PIN:

This option is more convenient for sign-in but less secure than the other options, which require an additional authentication factor.

The innovation of the latest attack is, therefore, less to do with the fact it was able to retrieve the keys than the cheap setup and relative simplicity with which this was achieved.

Andzakovic’s attack involved wiring an Infineon TPM 2.0 from a Microsoft Surface Pro 3 to a drive through a $30 Field-Programmable Gate Array (FPGA). To simplify a bit, after using a sniffer tool, he was able to discover the Volume Master Key (VMK) from the LPC bus by executing a boot.

To demonstrate this wasn’t a one-off, he repeated the technique against an older TPM 1.2 chip from an HP laptop.

What to do

As Andzakovic acknowledges, the simplest defence is to follow Microsoft’s advice and not use BitLocker with TPMs in this default state where security is important.

A more secure alternative is either to configure a USB flash drive containing a startup key, set up PIN access or, ideally, add multifactor authentication by using both at the same time.

BitLocker has become an ultimate test of hacking nous for some researchers, which is why they’ll keep picking away at it. Known weaknesses included possible bypasses involving the design of Solid State Drives (SSDs), as well as during upgrade reboots.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/tIUow2fMGPo/

Promo As data thieves and hackers become more inventive, and more destructive, learning how to protect networks from attack and threats is zooming up organizations’ lists of priorities.

Security training specialist SANS Institute is staging one of its renowned events in London from 8-13 April, providing a choice of courses for security professionals at all levels to learn the skills they need to protect their companies’ essential assets.

The lab-packed courses offer a chance to gain valuable GIAC Certification, and attendees are assured they will be able to put their newfound skills into practice immediately.

Choose between these courses:

Enterprise threat and vulnerability assessment: A new course designed for professionals securing 10,000 or more systems in mid-sized to large organisations. On the final day students’ newly learned skills are put to the test against an enterprise-grade cyber range.

Open-source intelligence (OSINT) gathering and analysis: How to find and analyse internet data, focusing on techniques used by threat intelligence analysts, private investigators, insurance claims investigators and law enforcement officers. Hands-on workshops will explore the live internet and dark web.

Security essentials bootcamp style: Would you be able to find compromised systems on your network? Do you know if each security device is configured correctly? Learn the answers plus how to set up proper security metrics and convey them to your executives.

Hacker tools, techniques, exploits, and incident handling: Follow a step-by-step response to computer incidents and examine legal issues such as employee monitoring, working with law enforcement and handling evidence.

Cloud security architecture and operations: An introduction to cloud security, policy and governance. Learn how to adapt security processes to the cloud and delve into incident handling, forensics and event management.

SIEM with tactical analytics: Logging systems collect vast amounts of data and proper analysis requires an understanding of the when, what and why behind the logs. Lab work uses SOF-ELK, a free security information and event management solution.

Windows forensic analysis: How to recover and analyse forensic data on Windows systems and track user activity on your network for incident response and investigations.

Advanced digital forensics, incident response, and threat hunting: Defenders need to catch intrusions in progress rather than after attackers have done their worst. Learn to recognise the criminal behaviours that could signal a data breach.

Advanced smartphone forensics: An in-depth course on the techniques investigators use to recover evidence from mobile devices.

All the information and sign-up details are right here.

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/21/cybercriminals_sans_london/