STE WILLIAMS

US pushed Russian troll factory offline during US midterm elections

While Americans were going to the polls for the 2018 US midterm elections, the US military was cyber-hammering Russian’s infamous troll factory to frustrate its election-meddling ways, the Washington Post has reported.

According to unnamed US officials who weren’t authorized to discuss classified information, the cyberstrike was launched against the Russian government-linked Internet Research Agency (IRA).

This is reportedly the first official US cyberattack on the IRA, a St. Petersburg company underwritten by an oligarch close to President Vladi­mir Putin. From the sounds of it, it was more annoying – think messing with their minds – to those whom US intelligence has deemed to be Russian election meddlers than crippling to that country’s ongoing propaganda efforts.

The Post quoted one individual who was familiar with the matter:

They basically took the IRA offline. They shut them down.

Or not, said Thomas Rid, a strategic-studies professor at Johns Hopkins University:

Such an operation would be more of a pinprick that is more annoying than deterring in the long run.

Well, maybe, but there’s still value in inflicting fear, uncertainty and doubt, one defense official told the Post:

Part of our objective is to throw a little curveball, inject a little friction, sow confusion. There’s value in that. We showed what’s in the realm of the possible. It’s not the old way of doing business anymore.

US to Russia: You’re not the only internet-borne threat

The “new” way of doing business is another way to say hacking back – what’s also called offensive hacking, or what the Defense Department has called “defending forward” in its new cyber strategy, which it introduced in September.

It’s what we can think of as plain old “attacking,” but without the need for the military to get an OK from the president’s National Security Council.

One of the Post’s sources from the Defense Department said that the ability to hack back/defend forward makes the US, finally, a contender:

The calculus for us here was that you’re just pushing back in the same way that the adversary has for years. It’s not escalatory. In fact, we’re finally in the game.

Cybercom stomps

In this case, the Post reports, the attack was carried out by Cyber Command (Cybercom). In October, the New York Times reported that Cybercom’s attack was in part psychological: agents individually targeted Russian operatives to try to convince them not to spread disinformation that could skewer elections. The Russian operatives were told that US operatives knew their names and their online handles and that they were tracking their work.

Two US officials told the Post that some IRA officials were so freaked out, they launched an internal investigation to root out what they thought were insiders leaking information.

Some officials said that this type of mind-play won’t have much impact on Russia’s overall strategy. One such:

Causing consternation or throwing sand in the gears may raise the cost of engaging in nefarious activities, but it is not going to cause a nation state to just drop their election interference or their malign influence in general. It’s not going to convince the decision-maker at the top.

Besides Cybercom’s efforts to defend the elections, the broader defensive/offensive strategy included Homeland Security, the State and Justice departments, and the FBI. The Post reports that it was led by Gen. Paul Nakasone, who in July formed the Russia Small Group, made up of 75 to 80 people from Cybercom and the National Security Agency (NSA), which are part of the Defense Department.

In an interview with Joint Force Quarterly, Nakasone said that up until now, the country has employed ineffective defenses against adversaries who’ve penetrated our networks, weaponized information for conducting propaganda campaigns, stolen intellectual property, and ripped off people’s personally identifiable information (PII).

In order to fight off such adversaries, Nakasone said that we have to get on the same playing field and figure out their moves:

We’ve learned that if we’re going to have an impact on an adversary, we have to persistently engage with that adversary, we have to understand that adversary, we have to be able to impose cumulative costs on that adversary, and we have to be able to understand where that adversary not only is but also where he is going.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/H2P0YoOzWlU/

  • 28/02/2019
  • adm

US House and Senate debate new data privacy law

Most people in the US – 91%, according to the Pew Research Center – feel they’ve lost control over their data.

Lawmakers feel your pain, citizens. They’re not interested in hearing your thoughts, though.

This week, both the House and the Senate are holding hearings on privacy legislation, transparency about how data is collected and shared, and the stiffening of penalties for data-handling violations.

But it’s not the consumers whose data gets fumbled, or quietly pickpocketed, who are sitting in on those meetings.

Rather, it’s mostly tech companies, the Electronic Frontier Foundation (EFF) points out. From the EFF’s India McKinney and Katharine Trendacosta:

Last year, the US Senate held a hearing about consumer privacy without a single voice for actual consumers. At the time, we were promised more hearings with more diverse voices. And while a hearing a month later with consumer advocates did seem to be a step forward, this week’s two hearings – only mostly full of witnesses from tech companies – make us worried about a step back.

House disses GDPR, California’s CPA

At the mostly consumer-free House hearing on Tuesday, the Consumer Protection and Commerce subcommittee agreed that we need a new, single federal privacy law. At this point, we’ve got a hodgepodge of state laws and a slew of proposed federal laws. Lawmakers are now considering one such: the Data Care Act (PDF).

Other bills: In September, Rep. Suzan DelBene introduced a privacy bill that would require information transparency and personal data control. In November, Senator Ron Wyden proposed a bill that would throw execs into jail for up to 20 years if they play loosey-goosey with consumer privacy. Senator Marco Rubio announced yet another bill in January, titled the American Data Dissemination Act.

CNET quoted Rep. Jan Schakowsky, who spoke at the beginning of Tuesday’s House hearing:

Reports of the abuse of personal information undoubtedly give Americans the creeps. Without a comprehensive federal privacy law, the burden has fallen completely on consumers to protect themselves, and this has to end.

Overall, the committee was none too thrilled with the notion of modeling a new law on the laws we now have: either the EU’s General Data Protection Regulation (GDPR) or California’s Consumer Privacy Act (CCPA).

Rep. Cathy McMorris Rodgers, for one, argued that the GDPR is detrimental to the free market and has tipped the scales in favor of large tech companies. Legaltech News quoted her:

Millions of dollars in compliance costs aren’t doable for startups and small businesses, and we have already seen this in Europe where GDPR has helped increase the market share of tech companies while forcing smaller companies offline.

Other reps accused the GDPR of burying consumers in a blizzard of required notices and privacy policies they don’t read. Other committee members or witnesses said that the law stops people from getting to certain newspapers, such as the Chicago Tribune, and to the WHOIS domain registration database in the EU.

Given how negative the committee was about the GDPR, it’s not surprising that many members didn’t cotton to the notion of modeling a new law on the CCPA.

Roslyn Layton, visiting scholar at conservative think tank American Enterprise Institute:

It’s not fair that one state gets to dictate [privacy] for everyone else.

Dave Grimaldi, executive vice president for public policy at Interactive Advertising Bureau, said that businesses could be swamped by fines due to the CCPA’s requirement that businesses have to hand over consumers’ data when requested:

[If a business doesn’t meet the timeline], it is in the violation of the law. [Given the potential for thousands of requests,] that’s something smaller companies wouldn’t be able to deal with.

Of course, a new law doesn’t have to hew to what’s already been done in California or in the EU.

Meanwhile, industry and interest groups are bending Senatorial ears

On Wednesday, the Senate Committee on Commerce, Science, and Transportation were scheduled to hold a hearing titled “Policy Principles for a Federal Data Privacy Framework in the United States” in order to examine what Congress should do to address risks to consumers and implement data privacy protections for all Americans. The Commerce Committee exercises jurisdiction over the Federal Trade Commission (FTC), which is the primary enforcement agency for consumer privacy and information security protections.

Earlier this month, House Energy and Commerce Chairman Frank Pallone, Jr. released a Government Accountability Office (GAO) report (PDF) that suggests Congress should consider “developing comprehensive legislation on internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving internet environment.” He requested that report two years ago and said in a statement that the need has only grown more apparent.

What do the privacy people want?

The EFF may not have gotten a seat at the table, but it’s got ideas that it wants lawmakers to mull over when it comes to crafting privacy legislation.

The EFF is calling for the creation of “Information Fiduciaries” for large internet companies that collect user data. Such a rule would impose a “duty of care and loyalty on large internet companies,” it says.

For such a rule, it would be “essential” for people to be able to sue companies that violate their privacy rights, the EFF says.

We see a persistent lack of federal enforcement regarding consumers’ private data. For years the FCC has looked the other way while wireless carriers have allowed bounty hunters (or anyone) to purchase consumers’ geolocation data. The FTC ignores Facebook and Google continuing to flaunt their consent decree, even after a litany of privacy scandals in the last year alone. It is long past time to allow individuals to protect their own privacy rights.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/VYxJEN-ASN0/

  • 28/02/2019
  • adm

Thunderclap: Apple Macs at risk from malicious Thunderbolt peripherals

Researchers have revealed how malicious Thunderbolt and PCI Express (PCIe) peripherals could be used to compromise computers running macOS, Windows, Linux and FreeBSD.

Nicknamed ‘Thunderclap’ in a presentation at last week’s Network and Distributed System Security Symposium (NDSS), the vulnerability has to do with Direct Memory Access (DMA), a standard technique for speeding up access to main memory from storage, USB controllers, and network and graphics cards.

More recently, the same low-level privilege has been extended to external peripherals such as Firewire, Thunderbolt 2 and 3, and USB-C, essentially expanding the risk of DMA attack from the trusted subsystems inside a computer to almost anything that might be plugged into it.

DMA attacks have been theorised for years which is why access is granted through a virtual address space managed by the operating system in conjunction with hardware Input-Output Memory Management Units (IOMMUs).

To test and model how secure DMA peripheral access is under real-world conditions, in 2015 the researchers built their own FPGA device – called Thunderclap – comprising PCIe slots and external Thunderbolt 2/3, USB-C interfaces.

Unfortunately, the researchers point out, it turns out that IOMMUs aren’t as effective as system designers have assumed for a complex web of reasons:

The software side of peripheral DMA interfaces is not implemented by carefully hardened kernel system-call code tested by decades of malicious attacks and fuzzing, but by thousands of device drivers that have been designed around historic mutual trust, hardware convenience, and performance maximization.

In short, there appeared to be numerous paths for a malicious peripheral to bypass or manipulate the IOMMU layer, not helped by OS developers and peripheral drivers implementing access in a jumble of different ways.

The Intel-Apple Thunderbolt interface was a particular focus because it’s been around for years and is in almost all Apple laptop and desktops. Notes the researchers’ blog:

These vulnerabilities allow an attacker with physical access to a Thunderbolt port to compromise a target machine in a matter of seconds, running arbitrary code at the highest privilege level and potentially gaining access to passwords, banking logins, encryption keys, private files, browsing and other data.

Which computers are affected?

For starters, any computer with a Thunderbolt port running on Windows, Linux or FreeBSD as well as macOS.

However, because Thunderbolt has been standard on Macs since 2011 and only started appearing on Windows and Linux systems more recently, this platform is most at risk. All Apple models are affected (except for the 12-inch MacBook), including post-2016 models running Thunderbolt 3 over USB-C as well as older ones using a Mini DisplayPort.

The issue isn’t just about Thunderbolt and can also affect PCIe cards found on lots of computers if these have somehow been compromised in the supply chain. That seems far less likely given that Thunderbolt and other external peripherals represent an easier line of attack.

What to do?

It depends how seriously you take the likelihood of an attack that exists as a proof-of-concept. If it bothers you, disabling Thunderbolt ports is one response although this might be either difficult or inconvenient depending on the computer.

The researchers suggest avoiding public USB-C charging stations and being wary about using unknown peripherals:

If you are prompted unexpectedly, you should not agree to any prompts, in particular with regard to installing drivers, and should unplug and not use the device.

Can this be fixed?

All OS vendors were informed of the issue in 2016 and have partially mitigated it with updates since then, specifically macOS 10.12.4 and later, Windows 10 version 1803 and later (additional hardware updates required for upgraded systems), and Intel patches for Linux kernel v5.0.

However, say the researchers, these patches don’t remove all of the risk, including against PCIe cards.

Longer term, the possibility of malicious peripherals with powerful access the OS can’t stop appears to be another complicated security problem developers will just have to get to work fixing with hard graft.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/U-jYGxBMslI/

  • 28/02/2019
  • adm

Qbot malware’s back, and latest strain relies on Visual Basic script to slip into target machines

A new version of the decade-old banking credential-stealing Qbot malware is doing the rounds, according to infosec firm Varonis.

The latest version, spotted after an unfortunate customer’s systems were infected, retains the anti-analysis polymorphism features of the original, Varonis researchers said.

Once present on a targeted network, the Windows malware starts brute-forcing network accounts from the Active Directory Domain Users group. It also runs the traditional keylogging, hooking (scanning all system processes for banking-related strings and extracting those) and credential-stealing functions.

powershell

Who needs malware? IBM says most hackers just PowerShell through boxes now, leaving little in the way of footprints

READ MORE

“The campaign is actively targeting US corporations, but has hit networks worldwide – with victims throughout Europe and South America – with a goal of stealing proprietary financial information, including bank accounts,” warned the infosec biz.

On analysing the new strain, the researchers found the launcher was a .zip archive containing a file ending in the extension “.doc.vbs”, which they said indicated “that the first infection was likely carried out via a phishing email that lured the victim into running the malicious VBS file”.

Fooling an ordinary user into running a Visual Basic script is a new twist on the original Qbot, whose local trigger was a Word macro – a malware-spreading technique at least twice the age of Qbot itself.

Once run, the VB script hunts for common antivirus programs including Windows Defender, Malwarebytes, Kaspersky and Trend Micro among others. It then uses the baked-in Windows command line downloader tool BITSAdmin to download the malware itself, making a change from previous Qbot samples which simply Powershell’d their way into a target machine.

If there is no internet connection on the target machine, “the malware is going to copy itself to different places on the infected devices and will continue running and operating. If it can’t send information it will be stored and encrypted on the device,” Snir Ben Shimol, Varonis’ director of cybersecurity, told The Register.

Varonis analysed all the versions of the new Qbot loader they were able to find and discovered they were all digitally signed in the names of UK limited companies, all of which were incorporated within the last two years.

The firm said that by analysing one of the command-and-control servers the new Qbot strain talked to, it had identified 40,000 Windows machines that had connected to that one server alone. “We were able to find log files containing the victim IPs, operating system details, and antivirus product names. The C2 server revealed past activities, as well as what appears to be additional malware versions.”

Almost all of the infected machines were running Windows Defender, based on the VB script results that were phoned home to the server. Around 90 per cent of the infected IP addresses originated in the US, with less than 10 per cent of the rest being from Britain. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/28/new_qbot_banking_malware_strain/

  • 28/02/2019
  • adm

Security Firm to Offer Free Hacking Toolkit

CQTools suite includes both exploit kits and information-extraction functions, its developers say.

A penetration testing and consulting firm plans to release a free penetration testing toolkit next month at Black Hat Asia; the toolkit includes privilege escalation and network attack functions.

Paula Januszkiewicz, CEO of CQURE, says she and her team at the security firm are rolling 39 of the company’s 200 homegrown hacking tools — plus five new ones — into the freebie CQTools kit that they will demonstrate and offer during their talk at the conference in Singapore.

“This toolkit allows a cybersecurity specialist to deliver complete tests within the infrastructure, starting with sniffing and spoofing activities, going through information extraction, password extraction, and custom payload generation,” Januszkiewicz says.

Januszkiewicz’s firm traditionally has developed its own penetration testing tools for its client engagements as well as its own research work. She says existing forensic investigation tools rarely come with all of the features her team requires and that provide researchers the ability to gather specific types of information. CQURE researchers built, for example, their own hacking tool for the cryptographic Data Protection Application Programming Interface (DPAPI) in Windows.

Her team reverse-engineered DPAPI and its later version, DPAPI-NG. “That is why we had to write our toolkit, which consists of over 40 tools decrypting almost everything in the operating system,” she said. The researchers discovered how to decrypt DPAPI user-protected data by using the private key stored on a domain controller.

“DPAPI-NG is a very fresh subject and we already have the whole toolkit for it,” Januszkiewicz notes.

Januszkiewicz says CQTools encompasses both exploit kits and information-extraction functions, which a researcher could use to grab information from different areas in an operating system, for example, and it can bypass anti-malware software during pen testing engagements and research.

CQURE performs consulting, pen testing, incident response services, training, and security research

Januszkiewicz, along with Mike Jankowski-Lorek, CQURE’s cybersecurity specialist and cybersecurity and database architect, will demonstrate CQTools in their talk at Black Hat Asia. “I will be presenting different ways of revealing secrets from the operating system,” she says. “I will show how data and secret storage and encryption work on Windows, and how we are able to compromise related operating system mechanisms.”

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/analytics/security-firm-to-offer-free-hacking-toolkit/d/d-id/1333984?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 28/02/2019
  • adm

Find your New Favorite Security Tool in the Black Hat Asia Arsenal

From data exfiltration over FM radio to open-source cybersecurity training suites, Black Hat Asia’s Arsenal offers live demos of the latest security tools.

Looking for some new cybersecurity tools? Then make time to check out the Arsenal at Black Hat Asia in Singapore next month, it’s open to everyone bearing a Black Hat Asia pass, and offers a unique opportunity to see live demonstrations of the latest open-source security tools.

Stop by the Arsenal (located in the Business Hall) and check out the “RF-Xfil: Prototype Toolkit for Data Exfiltration Over Radio Frequencies” demo if you’re looking for a new (albeit proof-of-concept) tool for exfiltrating data over FM radio frequencies generated using an off-the-shelf USB-to-VGA dongle.

Developed during Hacksmith v2.0, the RF-Xfil runs on a Linux target, feeding audio, screenshots, text, and keystroke data over an FM radio channel. It’s a potentially useful tool for anyone seeking new ways to covertly exfiltrate data (for fun or profit), and a great way to learn more about software-defined radio.

You might also appreciate the “Archery: Open Source Vulnerability Assessment and Management – 2.0” Arsenal demo, which aims to showcase how the open-source Archery tool helps developers and pentesters perform scans and manage vulnerabilities. It’s been updated with some new features ahead of Black Hat Asia, so swing by and catch a live demo.

“Kurukshetra: Playground for Interactive Security Learning,” by contrast, is a web framework developed to be the first open-source framework to provide a solid foundation to host reasonably complex secure coding challenges. It’s a framework where developers can learn secure coding practices in a hands-on manner.

Kurukshetra is composed of two components. The backend framework, written in PHP, manages and leverages the underlying docker system to provide the secure sandbox for challenges. The frontend is a web app providing all the necessary controls for the admin to host and modify the challenges and for the user to execute and view the result of each of his input. A major update will be released at Black Hat Asia with a better dashboard, new language support, and gamification features, so make time to stop by!

If cybersquatting is among your concerns, don’t overlook the “Squatm3gator: 360° Cybersquatting” Arsenal demo. Squatm3gator is a Python tool designed to enumerate available and not available domains generated by modifying the original domain name through different techniques (substitution attacks, homoglyph attacks, etc.). It’s especially useful for helping penetration testers identify domains vulnerable to being used in phishing attack simulations, as well as helping security analysts prevent effective phishing attacks,

Black Hat Asia returns to the Marina Bay Sands in Singapore March 26-29. Early registration pricing for Briefings Trainings ends Friday, January 18, so register before then to get the best price!

For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/find-your-new-favorite-security-tool-in-the-black-hat-asia-arsenal/d/d-id/1333995?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 28/02/2019
  • adm

In 2019, Cryptomining Just Might Have an Even Better Year

The practice today is so pervasive that cryptojacking scripts are said to be running on an estimated 3% of all sites that users visit.

In 2018, bad actors — that is, those perpetrating cyberattacks on businesses and organizations — upped their game across a range of fronts, devising new and insidious attack vectors. While more-savvy users have continued to play defense, cybersecurity in general remains relatively weak — certainly, far weaker than it should be, given the nature and extent of the threat(s).

Anecdotally, the year witnessed a significant uptick in targeted attacks against cloud hosting companies. Where hacks once occurred seemingly at random, attacks are now more targeted, tracking the user population as organizations have moved to the cloud. No longer are attacks limited to local machines; as the number of virtual servers has proliferated, hackers have set their sights on these remote servers, recognizing the potential for both more damage and greater profit.

Ironically, the money isn’t rolling in only from ransomware — which, on a relative basis, is actually less effective than it used to be. (Credit there goes to the IT/user community for more vigilant backup practices.) Cryptomining, or cryptojacking, emerged as a cash cow in 2018; the practice of embedding software that runs in the background, searching over time for cryptocurrency in stealth fashion, attests to the smarter, more sophisticated class of hacker that surfaced (or didn’t) these last 12 months.  

According to Webroot’s Mid-Year Threat Report Update, cryptomining — which consists of both ransomware and cryptomining — accounted for 52% of cybersecurity threats in the first half the year. By itself, cryptojacking (defined as “the nonconsensual act of cryptomining someone else’s machine”) was behind 35% of threats. The practice is so pervasive, the Webroot’s report notes, that cryptojacking scripts are said to be running on an estimated 3% of all sites that users visit.

Closely linked to cryptomining is the notable rise this year in advanced persistent threat, or APT, incidents — a clear sign that attackers are creating ever-smarter malware, at nearly an artificial intelligence (AI) level. Malware is becoming sandbox-aware; once it gets out of the sandbox, it runs malicious code. That code can do almost anything nefarious — steal passwords, log keystrokes, send information from the server to the attacker, gain remote access to the server, hide files, and accept commands. By midyear, our organization began to see more “fileless malware.” Running in memory, traditional anti-malware software can’t intercept it. AI-driven anti-malware software is now in the works — yet another example of how any technology can be used for good or ill.

That said, I find it encouraging that organizations in 2018 did boost their investments in proactive security measures; some even began to change the way they look at security, examining past breaches and isolating lessons learned. Cloud hosting providers are getting better at playing defense, although methodologies like zero trust and least privilege aren’t being adopted as rapidly or as widely as they should be.

That needs to change in 2019 if the IT community is to gain the upper hand on cryptomining and cryptojacking. Zero-trust architecture, as Forrester Research defines it, abolishes the idea of a trusted network inside a defined corporate perimeter. Zero trust mandates the creation of microperimeters of control around an enterprise’s sensitive data assets and provides visibility into how it uses data across its ecosystem to win, serve, and retain customers.

Under a zero-trust regime, all applications are configured to challenge and encrypt, enabling the organization to build out its infrastructure around that concept. Zero trust, with multifactor authentication, is the industrial-strength option in today’s environment and ought to be standard operating procedure moving forward.  

While perceived threats and vulnerabilities are assumed to exist outside the firewall, truly effective security policies assume nothing. The conventional wisdom once held that everyone inside the network was trusted and everyone outside was not. The newer, more enlightened paradigm for security is “more trusted” and “less trusted” — and that’s where the principle of least privilege comes into play.

Per a University of Indiana knowledge base, the principle of least privilege promotes minimal user profile privileges on computers, based on users’ job necessities. Each system component or process should have the least authority necessary to perform its duties. This helps reduce the attack vector of the computer by eliminating unnecessary privileges that can result in network exploits and computer compromises.

In savvy organizations, least privilege applies to every employee. Encryption is the rule internally, and multifactor authentication to log in to every networking component and storage system is mandated; no one can delete a snapshot or burrow into the firewall.

In this near-full employment economy, organizations are frankly hurting in their quest to find and retain qualified cybersecurity professionals. It’s a challenge to hire people who truly know what they’re doing, and distressingly, hackerworld is exploiting the talent gap. With cryptomining and cryptojacking poised to become a juggernaut in 2019, the security wing of the IT industry would be wise to plug that gap with all deliberate speed.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Based in the Greater Phoenix area, Alex Artamonov is a systems engineer and cybersecurity specialist now in his 10th year with Infinitely Virtual.  Skilled in VMware ESX, Microsoft Server and desktop operating systems, HP Proliant, and HP blade … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/in-2019-cryptomining-just-might-have-an-even-better-year/a/d-id/1333971?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 28/02/2019
  • adm

Bots Plague Ticketing Industry

Bots now account for 39.9% of all ticketing traffic, mostly originating in North America.

While bots are a problem across many industries, the ticketing industry has experienced a dramatic increase in such traffic over the past couple of years. And much of that bad traffic occurs in our own backyard, with 85% of bots launched against ticketing companies originating in North America, according to a report released today by Distil Networks.

The report, “How Bots Affect Ticketing,” also found the proportion of bad bots among ticketing companies has risen to 39.9% of all ticketing traffic. That’s a notable increase from the 22.9% found in previous reports, and even that number was considered worse than the average for all industries.

Edward Roberts, director of product marketing at Distil Networks, says the number increased because of the greater number of ticketing companies included in this year’s study, as well as the increase in volume of traffic analyzed.

“The sophistication of the bots and the ability of the organizations that propagate the bots to monetize them and survive as a business has also increased,” Roberts says. “Whether it’s brokers, scalpers, hospitality agencies, corporations, or criminals, they can lock down tickets, buy them at a cheaper price, and sell them at a premium on a secondary market.”

Christopher Rodriguez, a research manager for cybersecurity products at IDC, says he has observed this kind of activity in many other industries, including retail, travel and hospitality, and financial services.

“That’s why companies are looking at bot mitigation products such as from Distil, Akamai, PerimeterX, ShieldSquare, and Shape Security,” Rodriguez says. “These products do device fingerprinting and tracking, looking how long a user dwells on a certain page, the movement of the mouse and how quickly they type, all in an effort to determine if the user is legitimate.”

Criminals at Work
Though criminal elements are a much smaller share of the bad bot ticketing market compared with brokers, scalpers, and other companies, they seek to compromise customer accounts via credential stuffing, Distil’s Roberts says.

By running stolen credentials against the login pages of ticketing platforms, bots identify the accounts where access was granted. Once inside the account, any stored tickets (usually two to four tickets at a time) can be stolen or transferred to another account. And once inside an account, any stored credit card and personal information could be stolen or used to commit fraud. The bots also steal customer loyalty points, a problem that has become prevalent with season ticket holders of European soccer teams.

“Ticketing companies need to pay attention to public data breaches because any time there’s a major breach, the criminal will hit the names on that list,” Roberts says. “Companies also need to consider blocking the known hosting providers for bot operators.”

According to the report, ticketing has long experienced the evolution of the bot problem. As the ticketing industry moved online in the 1990s, it was the first industry to suffer from malicious bot operators using automated attacks to hold and scalp tickets. Following complaints by customers and increased pressure from artists, it was also the first industry to adopt legislation as an additional tool in the war on bad bots. In 2016, the US passed the Better Online Ticket Sales (BOTS) Act, which outlawed the resale of tickets purchased using bot technology and imposed fines. The UK, Australia, and parts of Canada have enacted similar legislation.

The latest report on the ticketing industry follows a report Distill issued last year on the airline industry, in which it found that 43.9% of all traffic on airlines websites came from bad bots, Roberts says

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: https://www.darkreading.com/analytics/bots-plague-ticketing-industry/d/d-id/1334003?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 28/02/2019
  • adm

IoT, APIs, and Criminal Bots Pose Evolving Dangers

A pair of reports reach similar conclusions about some of the threats growing in cyberspace and the industries likely to be most affected.

A pair of research reports released today paint a picture of a cyberthreat landscape that is continuing to evolve in ways both expected and not. The reports, released by Netscout and Akamai, each look at the overall threat landscape from its own perspective and offer a slightly different view of what cybersecurity professionals face. Together, they reach similar conclusions about some of the threats growing in cyberspace and some of the industries likely to be most affected.

The “Netscout Threat Intelligence Report” focuses on large organizations, such as nation-state actors, and the the impact they’re having on both statecraft and industries important to various nations. According to Richard Hummel, manager, Netscout Threat Intelligence, the number of groups working on behalf of national security organizations has skyrocketed.

“A couple of years ago, I would tell you that there were probably 35 to 40 different groups, and that’s predominantly China, Iran, Russia — some of the really big names,” he says. “But now with Netscout we’re actively tracking at least 35 of these groups ourselves, and we know of at least 170 more different groups around the globe where you have these nation states adding cyberattack capabilities to their statecraft.”

Those groups are growing in sophistication and broadening their target groups, as well. The report says academia, government, finance, and telecommunications are the targeted industries.

Another large and growing group of threat actors are criminal organizations that now have activities reaching around the globe. “The criminal organizations and the nation-state groups really have a lot of similarities,” Hummel says. “They both have large-scale operations. They both have access to a lot of really skilled operators. They’re able to throw money at their problems to fix it.”

Those efforts are resulting in attacks that are both more frequent and larger in scale than those of last year or the year before.

In the distributed denial-of-service (DDoS) attack space alone, attacks were up 26%, according to the report. “Attacks in the 100–200 Gbps, 200–300 Gbps, and 300–400 Gbps [range] exploded, up 169 percent, 2,500 percent, and 3,600 percent, respectively,” the report states.

Those attacks were aimed against strategic targets, with a “significant increase” in DDoS attacks on wireless telecommunications, satellite telecommunications, data processing, data hosting, television, libraries, and archive sites.

Akamai’s “2019 State of the Internet” report points out that a growing number of these attacks are generated by networks populated by All-in-One bots, or AIOs. These bots can be rented to commercial clients for spamming inboxes or message clients, launching DDoS attacks, or credential stuffing. According to the Akamai report, the retail apparel market experienced 3.7 billion credential stuffing attempts in the eight months of 2018 used as the basis for the report.

Those attacks aren’t coming from international actors, though the weapons used span the globe. “A lot of it’s coming from Russia, a lot is coming from Canada, but it’s largely Americans buying these botnets and running them against the sites,” says Martin McKeay, security researcher and editorial director at Akamai.

The American criminals know their targets: McKeay says that 1.636 billion credential-stuffing attacks were launched against a single retail organization.

Both reports point out Internet of Things (IoT) devices as particularly vulnerable when it comes to recruitment into these criminal botnets. Netscout’s report points out that IoT devices are especially vulnerable to brute-force attacks, since so many either have hard-coded user names and passwords or interfaces so primitive that they encourage owners to use simple credentials.

In Akamai’s case, it uses data from its own network to show that API traffic, from IoT devices that range from smartwatches to televisions, now accounts for 83% of the traffic it sees versus 17% from browsers. While McKeay is quick to point out that not every network will see the traffic mix handled by Akamai, he does believe these broad analyses are applicable to the Internet as a whole and have significant implications for security.

Both Hummel and McKeay say the most important takeaways from their respective reports is the importance of cybersecurity professionals being aware of changing patterns so they can begin to deal with the implications. There’s no indication, in either report, of the Internet becoming noticeably safer before the next version.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/iot-apis-and-criminal-bots-pose-evolving-dangers/d/d-id/1333999?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 28/02/2019
  • adm

Friendly reminder to Drupal admins: Secure your sh!t before latest RCE-holes get you

Just days after a remote code execution flaw in open-source web publishing software Drupal was made public, researchers have already spotted live exploits in the wild – reinforcing the need for admins to patch and update their sites immediately.

As The Register reported last week: “A successful exploit of the vulnerability would allow a hacker to remotely run malicious code on the targeted website’s server, effectively commandeering the site.”

Drupal’s maintainers told us at the time they went public that “some field types do not properly sanitize data from non-form sources”, which could “lead to arbitrary PHP code execution in some cases”.

The vuln affects sites running Drupal 8 core with the RESTful Web Services (rest) module enabled, and it handles PATCH or POST requests. Sites with another web services module enabled such as JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7, may also be vulnerable.

Infosec outfit Ambionics Security said in a blog post: “By making use of the patch provided by Drupal, we were able to build a working exploit; furthermore, we discovered that the immediate remediation proposed for the vulnerability was incomplete, which could lead to a false sense of security.”

They added that in their opinion remote code execution (RCE) “is triggerable through a GET request, and without any kind of authentication, even if POST/PATCH requests are disabled in the REST configuration” and suggested the only true fix would be upgrading Drupal or disabling the REST module.

Security firm Imperva reckoned that in recent days it had seen attackers trying to inject a Javascript-based cryptocurrency (Monero and Webchain) miner named CoinIMP into target sites’ index.php files “so that site visitors will run the mining script when they browse the site’s main page”.

Imperva also said it had seen attempts “to install a shell uploader to upload arbitrary files on demand” on targeted Drupal sites.

Mitigating the vuln is straightforward if you’re on Drupal 8.5 or 8.6: update to version 8.6.10 or 8.5.11 as appropriate. Drupal 7 does not require a core update, according to Drupal itself, though “several Drupal 7 contributed modules require updates”.

If you’re on versions of Drupal prior to 8.5, good luck: they’ve reached end-of-life. You could, however, take the other Drupal-suggested approach of configuring your webserver “to not allow GET/PUT/PATCH/POST requests to web services resources”. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/27/drupal_rce_exploits_seen_wild/

  • 27/02/2019
  • adm