hacking – Page 455 – STE WILLIAMS

US Army clarifies its killer robot plans

library
crime | hacking | security

The US Army has been forced to clarify its intentions for killer robots after unveiling a new program to build AI-powered targeting systems.

The controversy surrounds the Advanced Targeting and Lethality Automated System (ATLAS). Created by the Department of Defense, it is a program to develop:

Autonomous target acquisition technology, that will be integrated with fire control technology, aimed at providing ground combat vehicles with the capability to acquire, identify, and engage targets at least 3X faster than the current manual process.

That text comes from the US Army, which has announced an industry day taking place next week to brief industry and academia on its progress so far, and to source new expertise.

To translate, ATLAS is a project to make ground robots that are capable of finding and shooting at targets more quickly than people can. This raises the spectre of lethal AI once again.

Ethicists and scientists are already hotly debating this issue. Some 2,400 scientists and other AI experts including Elon Musk and DeepMind CEO Demis Hassabis signed a pledge under the banner of the Boston-based Future of Life Institute protesting the development of killer AI.

The UN has not yet taken decisive action, but Secretary-General Antonio Guterres has called for an outright ban.

The Army clearly realizes the controversial nature of the project, because it updated the industry day document last week to include new language:

All development and use of autonomous and semi-autonomous functions in weapon systems, including manned and unmanned platforms, remain subject to the guidelines in the Department of Defense (DoD) Directive 3000.09, which was updated in 2017.

Nothing in this notice should be understood to represent a change in DoD policy towards autonomy in weapon systems. All uses of machine learning and artificial intelligence in this program will be evaluated to ensure that they are consistent with DoD legal and ethical standards.

Directive 3000.9 is a 2012 DoD document outlining the policy associated with developing autonomous weapons. It says:

Semi-autonomous weapon systems that are onboard or integrated with unmanned platforms must be designed such that, in the event of degraded or lost communications, the system does not autonomously select and engage individual targets or specific target groups that have not been previously selected by an authorized human operator.

However, the policy also allows higher-ups to approve autonomous weapon systems that fall outside this scope under some conditions.

According to specialist publication Defense One, the US DoD is already fielding broader ethical guidelines for the adoption of AI across various military functions.

Meanwhile, tensions are high around the technology industry’s engagement with the military. Google faced an employee revolt after signing up for a Pentagon AI project called Project Maven to help automate video and image footage analysis. The company has since announced that it won’t renew Maven when it expires this year, and also refused to bid on the DoD’s massive JEDI cloud computing contract, arguing that it might not align with the ethical AI principles that it introduced last year.

Microsoft, on the other hand, continues to engage the DoD, announcing last October that it will sell the military AI technology in spite of protests from its own employees.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/--eGK1mhKoU/

Iranian-backed hackers ransacked Citrix, swiped 6TB+ of emails, docs, secrets, claims cyber-biz

library
crime | hacking | security

Updated Citrix today warned its customers that foreign hackers romped through its internal company network and stole corporate secrets.

The enterprise software giant – which services businesses, the American military, and various US government agencies – said it was told by the FBI on Wednesday that miscreants had accessed Citrix’s IT systems and exfiltrated files.

According to little-known infosec firm Resecurity, which claimed it had earlier alerted the Feds and Citrix to the cyber-intrusion, at least six terabytes of sensitive internal files were swiped from the US corporation by the Iranian-backed IRIDIUM hacker gang. The spies hit in December, and Monday this week, we’re told, lifting emails, blueprints, and other documents. The hackers have ways to bypass multi-factor login systems to slip into private networks, it is claimed.

“The incident has been identified as a part of a sophisticated cyberespionage campaign supported by nation-state due to strong targeting on government, military-industrial complex, energy companies, financial institutions and large enterprises involved in critical areas of economy,” Team Resecurity said in a statement earlier today.

The outfit’s specific claims have not been independently verified, we note, so at this time, caveat lector.

“Based our recent analysis,” the company continued, “the threat actors leveraged a combination of tools, techniques and procedures, allowing them to conduct targeted network intrusion to access at least six terabytes of sensitive data stored in the Citrix enterprise network, including email correspondence, files in network shares, and other services used for project management and procurement.”

LA-based Resecurity added that IRIDIUM “has hit more than 200 government agencies, oil and gas companies, and technology companies including Citrix.”

Resecurity also said it warned Citrix on December 28 that the software giant had been turned over by the hacker crew during the Christmas period. Citrix, meanwhile, said it took action – launching an internal probe and securing its networks – after hearing from the FBI earlier this week.

Ongoing

Earlier today, Citrix chief information security officer Stan Black gave his company’s side of the story. He said that, as of right now, Citrix does not know exactly which documents the hackers obtained nor how they got in – the FBI thinks it was by brute-force password spraying – nor for how long they may have been camping on the corporate network. Black also described the thieves as “international cyber-criminals” rather than point the finger at any particular country.

“While our investigation is ongoing, based on what we know to date, it appears that the hackers may have accessed and downloaded business documents,” he said. “The specific documents that may have been accessed, however, are currently unknown.”

At this point, Citrix reckons the intrusion was limited to its corporate network, and thus believes customer records and data were not stolen nor touched.

Beyond that, however, it’s anyone’s guess as to what exactly the hackers may have lifted. As a massive provider of remote management, networking, and videoconferencing products, Citrix has a large portfolio spread across a number of sectors in the business and government IT markets. Its customers include the White House and the FBI, though it’s not known at the moment whether the hack involved or menaced Uncle Sam’s operations directly.

Customers baffled as Citrix forces password changes for document-slinging Sharefile outfit

As the investigation is in its extremely early phases, Citrix said it will provide customers with regular updates as it gets more details. For now, Citrix said it is planning to cooperate fully with the FBI probe, and has also brought in an outside security firm to help investigate the intrusion and make sure that hackers will not be able to get back in to the network.

“Citrix is moving as quickly as possible, with the understanding that these investigations are complex, dynamic and require time to conduct properly,” Black said.

“In investigations of cyber incidents, the details matter, and we are committed to communicating appropriately when we have what we believe is credible and actionable information.” ®

Update

This story was revised after publication to include Resecurity’s version of events. A spokesperson for Citrix confirmed “Stan’s blog refers to the same incident” described by Resecurity, adding: “We have no further comment at this time, but as promised, we will provide updates when we have what we believe is credible and actionable information.” Resecurity declined to comment further.

So, was it the Iranians, or not? What data was stolen? Is it too early to tell? On the one hand, Resecurity previously claimed the Iran-linked IRIDIUM team attacked the Australian parliament’s computers, yet sources close to the Oz government reckoned it appeared to be the work of China, though it could be another nation state masquerading as the Chinese.

On the other hand, Microsoft this week said hundreds of companies have been hacked by Iranian miscreants over the past two years. The plot thickens.

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/08/citrix_hacked_data_stolen/

Freelance devs: Oh, you wanted the app to be secure? The job spec didn’t mention that

library
crime | hacking | security

Freelance developers hired to implement password-based security systems do so about as effectively as computer science students, which is to say not very well at all.

Boffins at the University of Bonn in Germany set out to expand on research in 2017 and 2018 that found computer science students asked to implement a user registration system didn’t do so securely unless asked, and even then didn’t always get it right.

The scientists speculated that because the surveyed students knew they were taking part in a study, then they didn’t make security a priority. So they modified the experiment to test whether developers unaware that they were participating in a study did any better.

The eggheads – Alena Naiakshina, Anastasia Danilova, Eva Gerlitz, Emanuel von Zezschwitz, and Matthew Smith – describe their findings in a paper titled, “‘If you want, I can store the encrypted password.’ A Password-Storage Field Study with Freelance Developers.”

Their paper is scheduled to be presented at the CHI Conference on Human Factors in Computing Systems Proceedings, which runs from May 4–9, 2019, in Glasgow, Scotland.

Posing as a client trying to build a social networking site, the researchers hired 43 developers for either €100 (~$112) or €200 (~$225) from Freelancer.com to help them create a portion of the fictitious project, the site’s registration system.

Ethics

The deception was approved by the university’s Research Ethics Board and study participants were told after the conclusion of the research that they could withdraw from the study if they wished. None did and only one declined to answer the post-job questionnaire.

The freelancers were hired to work in Java and took anywhere from one to five days to complete the assigned task. Those hired ranged from 22 to 68 years in age (median: 29; mean: 30.34) and 39 of the 43 reported being male. All but two said they’d been programming for at least two years and in Java for at least one year. Most were not fluent in English.

The study confirms previous findings that if you want security, you won’t get it by default; you have to ask for it. “Our sample shows that freelancers who believe they are creating code for a real company also seldom store passwords securely without prompting,” the paper says.

Security? We’ve heard of it, say web-app devs. 31 in 33 codebases have at least one big bad vuln

The boffins also found many of the freelancers misunderstood that encryption, hashing and encoding are different things. “We found a number of freelancers were reducing password storage security to a visual representation and thus using Base64 as their preferred method to ensure security,” the paper says. “Additionally, encryption and hashing were used as synonyms, which was often reflected by the freelancers’ programming code.”

Another finding consistent with the student research is that many freelancers (16 in this instance) submitted code copied from the internet.

This isn’t necessarily bad if the copied example is actually a secure implementation of a security method worth using. In the 2018 research study of computer science students, all the secure solutions came from people who copied and pasted secure code examples and none came from those who didn’t.

The researchers note in closing that they received more secure code from the better paid group, although not enough to be statistically significant. They suggested further study might be warranted to find whether there’s anything to the saying, “You get what you pay for.” ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/11/developers_lousy_security/

Iranian-backed hackers ransacked Citrix, swiped 6TB+ of emails, docs, secrets, says cyber-biz

library
crime | hacking | security

Updated Citrix today warned its customers that foreign hackers romped through its internal company network and stole corporate secrets.

According to infosec firm Resecurity, which claimed it had earlier alerted the Feds and Citrix to the cyber-intrusion, at least six terabytes of sensitive internal files were swiped from the US corporation by the Iranian-backed IRIDIUM hacker gang. The spies hit in December, and Monday this week, we’re told, lifting emails, blueprints, and other documents. The hackers have ways to bypass multi-factor login systems to slip into private networks, it is claimed.

“Based our recent analysis, the threat actors leveraged a combination of tools, techniques and procedures, allowing them to conduct targeted network intrusion to access at least six terabytes of sensitive data stored in the Citrix enterprise network, including email correspondence, files in network shares, and other services used for project management and procurement.”

LA-based Resecurity added that IRIDIUM “has hit more than 200 government agencies, oil and gas companies, and technology companies including Citrix.”

Ongoing

“While our investigation is ongoing, based on what we know to date, it appears that the hackers may have accessed and downloaded business documents,” Black said. “The specific documents that may have been accessed, however, are currently unknown.”

At this point, Citrix reckons the intrusion was limited to its corporate network, and thus believes customer records and data were not stolen nor touched.

Customers baffled as Citrix forces password changes for document-slinging Sharefile outfit

“Citrix is moving as quickly as possible, with the understanding that these investigations are complex, dynamic and require time to conduct properly,” Black said.

“In investigations of cyber incidents, the details matter, and we are committed to communicating appropriately when we have what we believe is credible and actionable information.” ®

Update

Was it the Iranians, or not? Is it too early to tell? On the one hand, Resecurity previously claimed the Iran-linked IRIDIUM team attacked the Australian parliament’s computers, while sources close to the Oz government reckoned it appeared to be the work of China, though it could be another nation state masquerading as the Chinese.

On the other hand, Microsoft this week said hundreds of companies have been hacked by Iranian miscreants over the past two years. The plot thickens.

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/08/citrix_hacked_data_stolen/

FBI warns of SIM-swap scams, IBM finds holes in visitor software, 13-year-old girl charged over JavaScript prank…

library
crime | hacking | security

Roundup This week we had an NSA reverse-engineering toolkit released at the RSA Conference, a buffer bashed aboard British Airways, big trouble brewing for Citrix, plus much more.

Along the way, a few other things happened:

Alarms raised over IP cameras

A new Internet of Things botnet could be in the works, as security outfit GreyNoise says it has seen a major uptick in machines scanning the public internet for a specific debug port used by surveillance cameras. Presumably the boxes are looking for devices to hijack via this debugging interface:

GreyNoise has observed an ~875% spike in Internet-wide scan traffic on 9527/TCP, an undocumented debug interface for various models of IP camera. GreyNoise has also identified ~2,000 devices likely probing for vulnerable devices, starting four days ago. Tags available now.

— GreyNoise Intelligence (@GreyNoiseIO) March 8, 2019

If true, this would suggest a fresh attempt to infect net-connected cameras for use in an IoT botnet – like Mirai, the massive collection of infected IoT equipment that has menaced the internet in various forms for years.

If you do run an IP-enabled camera, you would be wise to check for and install any available firmware updates, or firewall off TCP port 9527 just to be on the safe side.

FBI warns of SIM-swapping outbreak

Holding a substantial amount of crypto-currency? You may want to take a close look at your multi-factor authentication settings on your online accounts, particularly your email, and protections on your cellphone plan.

The FBI is warning of what it says is an uptick in SIM-swapping fraud incidents. Criminals call a target’s phone carrier’s customer support, and, through blagging and social engineering, request that their mark’s mobile phone number be switched to a SIM card in a device belonging to the crooks.

Should the transfer work, the thieves then attempt to reset the password on the victim’s email account, using the two-factor authentication code sent to the mark’s phone number, which is directed to the crim’s handset. From there, the miscreants can reset the password on the victim’s cloud-based crypto-coin wallets, and drain it of digital dosh.

Either switch to physical hardware tokens to protect accounts, ideally, or authentication apps, and/or call your carrier and put SIM transfer protections on your plan.

“The FBI has seen an increase in the use of SIM swapping by criminals to steal digital currency using information found on social media,” said Special Agent John Bennett from the FBI San Francisco Division.

“This includes personally identifying information or details about the victim’s digital currency accounts.

“The FBI wants to help individuals make themselves harder targets and, if they are victimized, to quickly regain control of their accounts to mitigate any potential harm.”

Security MadLibs! Hackers can steal your medical records by exploiting your ultrasound scan

Thanks to the terrible state of IT security in various medical facilities, here’s yet another example of patient records being put at risk by obsolete devices.

Researchers at Check Point stumbled upon an ultraSound machine that could be compromised to steal patient medical data. See the vid before for more…

Youtube Video

In this case, Check Point says, the ultrasound machines use Windows 2000, an OS that is so outdated as to be trivial for an attacker who has infiltrated a hospital IT network to crack open. As the bug-hunters note, this is not just a privacy risk for the patients, but also a legal liability for the hospitals, who could be on the hook for heavy fines and lawsuits should they allow patient records to fall into the wrong hands.

Japanese teen charged for JavaScript loop prank

A 13-year-old girl in Japan has been charged with computer crimes after she allegedly copied and shared a JavaScript infinite loop script as a prank.

Reportedly, the unnamed young woman linked to the script on a message board, causing any one who followed the link to see an alert dialog box that automatically, on some browsers, respawned itself every time the user clicked the “OK” button.

Hardly the Stuxnet worm, but apparently it was serious enough for the police in Kariya to charge the teen with distributing malicious computer code.

IBM says hospitality kiosks are being lousy hosts when it comes to security

Researchers with IBM are warning that some of the automatic desktop reception systems used to process building guests are rife with bugs.

Big Blue’s Red Team found that a number of popular visitor management systems (things like automated guest registration for offices) contain some basic security holes, like default admin credentials, enabled breakout keys that opened the Windows desktop, and had data leakage bugs that would expose employee information.

This, says IBM, is particularly bad because these systems are, by design, left open to world + dog.

“Considering that these systems are intentionally physically exposed to outsiders and have a role in the security of an organization, they should be developed with security in mind throughout the product life cycle and should include physically present attackers in their threat model,” IBM says.

“However, our team has identified vulnerabilities in a number of visitor management system products that could prevent them from achieving that goal.”

Kittens and puppies put the “Awww!” in RSA Conference

Let’s face it, RSA Conference isn’t always a lot of fun. It’s crowded, the bathroom lines are long, the marketing bullshit is often turned up to 11, and this year the weather in its host city San Francisco was awful.

If you were lucky enough to wander over to one particular corner of the show, however, there were two booths that were sure to make your day a bit better, thanks to some furry friends in search of a home.

Two companies opted to supplement the usual crew of bored execs and chipper marketing folks with some shelter pets, of floof babes as we like to call them.

Tinfoil Security, a company specializing in security and vulnerability scanning tools for developer APIs, teamed up with the Humane Society of Silicon Valley to let convention-goers meet Grace and Hopper, a pair of foster-kittens picked because their easy-going and friendly nature left them unfazed by the hustle and bustle of the show floor.

Hopper, reflecting the mood of every RSA attendee by day 3

While ThreatQuotient, a vulnerability management and intelligence platform, brought in a handful of puppies from Finding a Best Friend Rescue to brighten everyone’s day. Those willing to use hand sanitizer and disinfecting spray were even able to get some quality snuggle time with the junior doggos.

Cuddles with Bruce the pup: better than any booth swag

Playing with puppies and kittens was a nice respite from the expo floor and a great way for two of the smaller companies at RSA Conference to make themselves stand out, but more importantly, the two booths served as a reminder that there are many great cats and dogs looking for a home.

Hopefully a few attendees upon returning home will consider going over to their local shelter or rescue group and taking in a furry friend of their own. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/09/security_roundup_080319/

Guess who’s addicted to GitHub, busy on Slack, stuck in 2015? No, not another hipster: It’s the Slub backdoor malware

library
crime | hacking | security

A new malware strain tapped into GitHub posts and Slack channels to siphon precious data from infected Windows PCs, it is claimed.

Researchers at Trend Micro have dubbed the malware “Slub”, a mash-up of the names of the two services the software nasty apparently used to obtain instructions from its masterminds and exfiltrate information from hijacked computers.

Trend’s virus-hunters said they spotted at the end of last month Slub lurking on a compromised “watering hole,” which is a website frequented by the sort of people you want to hack: if you wanted to pwn chip designers’ workstations to steal their processor blueprints, for example, you’d hijack popular forums discussing semiconductor industry gossip.

As such a watering hole for folks interested in political activities – Trend didn’t want to say further than that – was hacked by Slub’s masters. The miscreants laced the webpages with malicious code to ultimately infect any vulnerable machines that visited with the malware. Windows boxes opening up a booby-trapped page in Internet Explorer were subjected to an exploit for CVE-2018-8174, a remote-code execution flaw in VBScript that was patched in May last year by Microsoft.

Those who did not install the Windows update for CVE-2018-8174, and visited the site, may have been infected with Slub, we’re told. The exploit code fetched a tool that downloaded and ran the main Slub entity. If an antivirus package was detected on the computer, the malware refused to go any further. Along the way, the downloader exploited CVE-2015-1701, an elevation-of-privilege bug in the Windows kernel, patched in 2015 by Microsoft, that allowed Slub to completely take over the PC.

From there, a backdoor would be opened which allowed miscreants to covertly access, and send commands to, the machine. Here is where Slack came in, according to Trend. Once the malware established itself on a box, it went back to GitHub to obtain a list of commands stashed in a Gist post. Those instructions told the spyware to do things like capture screenshots, and gather hardware and system information, and then upload this swag to a Slack workspace controlled by the attacker. The commands could also tell the nasty to upload files from the infected PC, via the file.io sharing site, execute commands, fetch and run other software, and so on.

Psst, hackers. Just go for the known vulnerabilities

In short, GitHub list went in, Slack messages came out. The spyware then received further instructions, executed them, and reported back, via private channels in the Slack workspace, turning the instant-chat service effectively into a backdoor conduit. Trend said this is the first time it has ever seen Slack used in such a fashion. The miscreants relied on free services – GitHub, Slack and file.io – to operate, leaving no payment traces.

“The commands that the attackers ran clearly show a strong interest in person-related information, with a special focus on communication software, in an attempt to learn more about the people behind the computers they infected,” said Trend researchers Cedric Pernet, Daniel Lunghi, Jaromir Horejsi, and Joseph Chen on Thursday.

“The attackers also appear to be professionals, based on their way of handling their attack. They only use public third party services, and therefore did not need to register any domains or anything else that could leave a trail. The few email addresses we found during the investigation were also using trash email systems, giving the attackers a clean footprint.

“Finally, the watering hole chosen by the attackers can be considered interesting for those who follow political activities, which might give a glimpse into the nature of the groups and individuals that the attackers are targeting.”

Due to the nature of the watering hole attack, and the use of Slack and GitHub in its operations, the Trend crew therefore believes Slub is part of a sophisticated, targeted campaign with a specific set of victims in mind.

“Our technical investigation and analysis of the attacker’s tools, techniques, and procedures (TTP) lead us to think that this threat is actually a stealthy targeted attack run by capable actors, and not a typical cybercriminal scheme,” they wrote.

More technical details, including the Gist snippets and location, are in the afore-linked blog post. The primary Gist has been taken down, after Trend reported it to GitHub, and Slack has shut down the workspace.

“Trend Micro recently discovered a third party’s unauthorized access of another third party’s computer using malware, and reported to us the existence of a Workspace on Slack related to this effort,” Team Slack said in a statement.

“We investigated and immediately shut down the single Workspace as a violation of our terms of service, and we confirmed that Slack was not compromised in any way as part of this incident. We are committed to preventing the misuse of our platform and we will take action against anyone who violates our terms of service.”

Users and admins can protect themselves against the particular strain of malware by taking basic precautions including keeping their machines up to date with patches – remember, this spying nasty exploits holes addressed in 2015 and mid-2018 by Microsoft – and running a trusted antivirus package. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/08/slub_malware_slack_github/

Five female technoheroes you might never have heard of…

library
crime | hacking | security

Today is International Women’s Day 2019.

In the leadup, a bunch of people – friends, family, colleagues and you, our readers – asked us whom we’d count amongst our female technoheroes, so we thought we’d tell you.

We know what you’re thinking, which is probably along the lines of, “They’re bound to mention Rear Admiral Grace Hopper, and they love their old-school computing stories so Ada, Countess of Lovelace will get a look in for sure.”

And you can’t really talk about science and technology without bringing Marie Curie into the story…

…and if you’re looking for someone who isn’t a technologist, but has been buffeted from pillar to post by technology and bureaucrats while showing incredible grace under pressure, you might be hoping for a left field answer such as Caster Semenya OIB.

Are those four of our five #IWD2019 heroes?

One thing’s for sure, all our technoheroes made us say, “Wish I’d thought of that, wish I’d done that, wish I’d had the guts to try that.”

Watch now and find out whom we chose! (Yes, the image above contains a series of hints.)

(No video? Watch on YouTube.)

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/bYoaO8iz7kQ/

Iranian hackers ransack Citrix, make off with 6TB+ of emails, biz docs, internal secrets

library
crime | hacking | security

Updated Citrix today warned its customers that foreign hackers romped through its internal company network and stole corporate secrets.

According to infosec firm Resecurity, which had earlier alerted the Feds and Citrix to the cyber-intrusion, at least six terabytes of sensitive internal files were swiped from the US corporation by the Iranian-backed IRIDIUM hacker gang. The spies hit in December, and Monday this week, we’re told, lifting emails, blueprints, and other documents, after bypassing multi-factor login systems and slipping into Citrix’s VPNs.

LA-based Resecurity added that IRIDIUM “has hit more than 200 government agencies, oil and gas companies, and technology companies including Citrix.”

Ongoing

Earlier today, Citrix chief information security officer Stan Black gave his company’s side of the story. He said that, as of right now, Citrix does not know exactly which documents the hackers obtained nor how they got in – the FBI thinks it was by brute-forcing weak passwords – nor for how long they may have been camping on the corporate network.

At this point, Citrix reckons the intrusion was limited to its corporate network, and thus believes customer records and data were not stolen nor touched.

Beyond that, however, it’s anyone’s guess as to what exactly the hackers may have lifted. As a massive provider of remote management, networking, and videoconferencing products, Citrix has an extremely large portfolio spread across a number of sectors in the enterprise IT market. Its customers include the White House and the FBI, though it’s not known at the moment whether the hack involved or menaced Uncle Sam’s operations directly.

Customers baffled as Citrix forces password changes for document-slinging Sharefile outfit

“Citrix is moving as quickly as possible, with the understanding that these investigations are complex, dynamic and require time to conduct properly,” Black said.

“In investigations of cyber incidents, the details matter, and we are committed to communicating appropriately when we have what we believe is credible and actionable information.” ®

Editor’s note: This story was revised after publication to include Resecurity’s version of events. A spokesperson for Citrix confirmed “Stan’s blog refers to the same incident” described by Resecurity, adding: “We have no further comment at this time, but as promised, we will provide updates when we have what we believe is credible and actionable information.” Resecurity declined to comment further.

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/08/citrix_hacked_data_stolen/

That marketing email database that exposed 809 million contact records? Maybe make that two-BILLION-plus

library
crime | hacking | security

An unprotected MongoDB database belonging to a marketing tech company exposed up to 809 million email addresses, phone numbers, business leads, and bits of personal information to the public internet, it emerged yesterday.

Today, however, it appears the scope of that security snafu was dramatically underestimated.

According to cyber security biz Dynarisk, there were four databases exposed to the internet – rather than just the one previously reported – bringing the total to more than two billion records weighing in at 196GB rather than 150GB. Anyone knowing where to look on the ‘net would have been able to spot and siphon off the data, without any authentication.

“There was one server that was exposed to the web,” explained Andrew Martin, CEO and founder of DynaRisk, in an email to The Register on Friday. “On this server were four databases. The original discovery analysed records from mainEmailDatabase. The additional three databases were hosted on the same server, which is no longer accessible.”

Martin said he believes the original analysis may have been conducted with limited time or computing power, which would explain the lesser number of records found. “Our analysis was conducted over all four databases and extracted over two billion email addresses which is more than the 809 million first discussed,” he said.

The databases were operated by Verifications.io, which provides enterprise email validation – a way for marketers to check that email addresses on their mailing lists are valid and active before firing off pitches. The Verifications.io website is currently inaccessible.

The database first reported included the following data fields, some of which, such as date of birth, qualify as personal information under various data laws:

Email Records (emailrecords): a JSON object with the keys id, zip, visit_date, phone, city, site_url, state, gender, email, user_ip, dob, firstname, lastname, done, and email_lower_sha265.

Email With Phone (emailWithPhone): No example provided but presumably a JSON object with the two named attributes.

Business Leads (businessLeads): a JSON object with the keys id, email, sic_code, naics_code, company_name, title, address, city, state, country, phone, fax, company_website, revenue, employees, industry, desc, sic_code_description, firstname, lastname, and email_lower_sha256.

The image below shows Verifications.io’s four MongoDB databases exposed to the internet, as identified by Dynarisk:

Martin said the impact of the security blunder is less than it may be fear because there are no credit card numbers, medical records nor any other super-sensitive information involved.

“The issue here is this is a gigantic amalgamation of data all in one place,” he explained. “The leaking of this information may breach data protection regulations in various countries. The leak may also violate the privacy and security provisions between Verification.io and their clients within their contracts.”

Bob Diachenko, a security researcher for consultancy Security Discovery, found the first Verifications.io database online, and said the marketing tech biz, based in Tallinn, Estonia, acknowledged the gaffe and hid the data silos from public view after he flagged it up.

Verifications.io told Diachenko that its company database was “built with public information, not client data.” This suggests at least some of email addresses and other details in the company’s databases were downloaded or scraped from the internet.

Diachenko didn’t immediately respond to a request for comment.

Amazon tries to ruin infosec world’s fastest-growing cottage industry (finding data-spaffing S3 storage buckets)

Security researcher Troy Hunt, who maintains the HaveIBeenPwned database of email accounts that have been exposed in online data dumps, said about a third of the email addresses in the Verifications.io database are new to HaveIBeenPwned. The other two thirds presumably were culled from the same online sources that supplied Hunt’s archives.

Martin said Verification.io’s claim that its data came from public sources is open to interpretation. “These data sources might have been public at one time in the past and then not public at a later time,” he said. “It would be interesting to know if the company had a process of continuous compliance where they would validate if they were still allowed to store the data over time.”

Dtex, a security biz that focuses on the dangers of rogue or slipshod employees within businesses, said in its recent 2019 Insider Threat Intelligence Report that 98 per cent of incidents involving data left exposed in the cloud can be attributed to human error.

MongoDB versions prior to 2.6.0, released in 2014, were network accessible by default. Reversing that default setting hasn’t persuaded people to securely configure their MongoDB installations, though. Out of the box, MongoDB requires no authentication to access, a detail a lot of folks appear to overlook. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/08/verificationio_database_hole/

DHS: No Investigation Planned for Electrical Grid Incursions

library
crime | hacking | security

The subtext to a panel discussion during RSA is that risks to national infrastructure are fraught with political considerations.

RSA CONFERENCE 2019 – San Francisco – Despite concrete evidence of Russian infiltration of the US electrical grid and acknowledgment of the hacking by the US government, no formal investigation is planned, according to a Department of Homeland Security (DHS) official who spoke here at this week’s RSA Conference.

“[Our] worldwide threat assessment looks at threats and capabilities,” said Bob Kolasky, director of the National Risk Management Center, which is part of DHS. The complexity of the malware like what attacked Ukraine’s electrical grid “is still largely theoretical,” he added. “We will look at what’s going on, but we don’t do technical investigations. We have some idea of the threat.”

Pressed by an audience member about whether there was sufficient evidence and cause to investigate bad actors and vulnerabilities associated with the US electrical grid, Kolasky demurred. “We jump on planes when we’re asked to jump on planes,” he said. “There’s the reality of malware that [electrical grid operators] don’t want on their systems.”

Kolasky’s comments were part of a panel discussion Monday night examining security challenges to critical infrastructure in the US. More than once, panelists invoked 9/11 and the many lessons learned around threat assessment, preparedness, and defense. Several also highlighted the ongoing challenges of getting multiple government entities to work together, share information, and decide who leads an investigation.

In other words, the politics of malware.

“From a threat perspective, we start with nation-states – China, Russia, North Korea, and Iran – and look at what they’re interested in,” Kolasky explained.

In general, he added, their intent is to advance their own industries and take out competitors. Russia, according to Kolasky, is most interested in undermining liberal democracy, whether it’s elections, social media, or just sowing general contempt. “There are risks to information systems and information,” he said. “Where does it become an issue, undermining the economy and the nation? That’s the conversation we want to have.”

The interlude over what might prompt the feds to mount a full-bore cybersecurity investigation was in contrast to the rest of the discussion, where panelists with long federal government resumés vigorously agreed plenty of progress has been made around information sharing among agencies and departments. They were also quick to add that plenty of challenges remain.

“9/11 was the bloody nose for us – what’s happened in counter-terrorism is really the model for cybersecurity going forward,” said Brig. Gen. Francis X. Taylor, who once served as undersecretary for intelligence and analysis at DHS and was the first CSO at General Electric Co. Just as the feds learned to work with and share information with local police departments after the 2001 attacks, federal agencies and departments can do a better job of working with their state and local counterparts and private-sector security pros, he said.

Taylor advocated for more sharing of unclassified information; what’s less clear is who manages that or what the sharing platform should be. “It takes a leader, and I think DHS is the right leader,” he said, adding that information can’t just be shared on a “need-to-know” basis – a common stalling tactic in the intelligence community. Information about cybersecurity needs to be always available, Taylor said.

Cybersecurity politics aren’t limited to the feds; highly regulated industries like oil and gas are extra cautious about what they do, noted Suzanne Lemieux, manager, midstream and industry operations, at the American Petroleum Institute, and another panelist. “Our companies are limited in what they can share with each other as competitors [operating] under antitrust restrictions,” she explained.

Lemieux noted improvements for cybersecurity, such as the formation of the ONG information analysis center. API members share threats they see with other industries, like with electrical grid opportunities, because oil and gas companies recognize they’re the only targets.

“We also have partnerships with DHS, TSA, and others, but [sharing information] is just as much a challenge outside the government,” Lemieux said. “We’re trying to figure out what that model looks like.”

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Terry Sweeney is a Los Angeles-based writer and editor who has covered technology, networking, and security for more than 20 years. He was part of the team that started Dark Reading and has been a contributor to The Washington Post, Crain’s New York Business, Red Herring, … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/dhs-no-investigation-planned-for-electrical-grid-incursions/d/d-id/1334121?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple