STE WILLIAMS

The enterprise must do its part in deploying and maintaining secure systems so that end users stand a chance against attackers.

Relying on end users for security is difficult, but securing enterprise systems doesn’t have to be. For a system to be valuable, it must be accessible and beneficial to end users. Organizations have improved security awareness training for employees, but the training has limited value until the underlying systems are secured. Securing a system removes an attack vector that funnels the attack up to the end user (such as phishing). This is when training shows its value.

Remove the Attack on the System + Train End Users on Most Likely Attacks = Thwart the Attacker
Secure life cycle management sounds difficult, but it isn’t. The approach starts with identifying the systems that are running in the enterprise. If you have an inventory of these assets, great! If not, then start scanning your networks for hosts, look at Active Directory or LDAP, ask around, and create an inventory list. (Your last resort is pulling the plug to see who screams.) If you work in the cloud, check the invoice for systems.

Once you have an inventory, prioritize everything according to what’s important to the enterprise. Anything hanging off the external network is a priority because it is accessible from the Internet. Internal systems with sensitive information are a high priority (personally identifiable information, financial info, customer, backups, etc.). Prioritizing is important because resources to secure the systems are always constrained.

Now it’s time to find out how bad things are. It’s impossible to manually check each system for patch levels or security settings, so don’t even try. Use a benchmarking tool like the Center for Internet Security’s CIS-CAT, Microsoft’s Baseline Security Analyzer, or a vulnerability scanner. These tools will take your inventory list, compare items to known good security configurations, and provide a gap report for each system.

Review the recommendations and decide which ones make sense for your enterprise. Benchmarks have different levels of recommendations, and the highest-level security recommendations may not work for your enterprise (because they’re too restrictive). If your enterprise has regulatory requirements, now is the time to align with them.

Come up with a strategy to get systems secured according to the recommendations. All new systems should receive the approved recommendations by default. Existing systems will need to be scheduled according to their priority. Now is a good time to decommission unnecessary or legacy systems (for example, the dusty machine under the desk), and don’t forget about development systems. Even though a system may not be in production for end users, if it is on the network then it can be a weak link in the overall security of the enterprise.

The full life cycle of the system is from when it’s turned on until it’s turned off. It must be secure during the entire life, so deploy it based on the secure configuration and keep it maintained until it is powered off. Maintenance is critical because a lot of time and effort was spent getting the enterprise secured up to this point. Keep on top of the latest benchmark releases, and scan the enterprise environment with a vulnerability tool (such as OpenVas, Tenable Nessus, Rapid7 Nexpose, etc.). Benchmarking and vulnerability scanning should be integrated into the enterprise patch management program. This will ensure that a system is initially deployed securely and is kept up to date until it’s powered off and securely disposed.

There is a great feeling in the secure life cycle when subsequent reports show how much progress has been made in securing systems. No enterprise can be made 100% secure; the goal is to reduce the risk to an acceptable level and give end users the best chance at thwarting attackers through the training they receive. Most breaches occur because of insecure configuration or lack of system patching. Ponemon Institute’s 2018 State of Endpoint Security Risk states that the average time to patch is 102 days. This provides attackers with a large window to find weak points to exploit. Unless your enterprise is specifically targeted, keeping secure configurations and patches up to date is a great way to not end up in the news.

Related Content:

• Security Spills: 9 Problems Causing the Most Stress
• Cybersecurity and the Human Element: We’re All Fallible
• Creating a Security Culture Solving the Human Problem
• The Case for a Human Security Officer

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

John Carbo is the Director of Information Security at Abacus Group, an IT service provider for alternative investment firms. He oversees the security of the Abacus Cloud platform and advises clients on their security strategies. John has spent his entire career in the … View Full Bio

Article source: https://www.darkreading.com/cloud/secure-the-system-help-the-user/a/d-id/1333932?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

How often does a vendor find itself having to patch the same critical flaw twice within a matter of days?

It’s almost unheard of. Nevertheless, that’s exactly what Adobe has had to do: fix CVE 2019-7089, a vulnerability in Reader it thought it had addressed on 12 February as part of Patch Tuesday.

The flaw was originally made public by Cure53 researcher Alex Inführ in January, who discovered how a malicious PDF could be used to trigger an SMB call-back revealing an NTLMv2 hash.

Ironically, he was inspired to look at this PDF mechanism by the very similar ‘BadPDF’ flaw affecting NTLMv2, reported last April and eventually patched by Adobe in November as CVE-2018-4993.

However, a day after this month’s apparent Patch Tuesday fix, Inführ took to Twitter to report that he’d discovered a way that the latest patched version could be bypassed.

@z00kov @0patch No it does not seem to properly patched as I discovered a bypass. Going to report the bypass to Adobe

—
alex (@insertScript) February 13, 2019

On 21 February, Adobe had a second go at fixing the problem, now identified as CVE-2019-7815, through bulletin APSB19-13.

Affecting Acrobat/Reader DC versions 2019.010.20091 and earlier, this brings the software to 2019.010.20098.

With the first flaw, Adobe had to act fast, as Inführ had revealed it in broad outline which raised the risk of an exploit.

The second version was also urgent because anyone looking to exploit the first issue might stumble across it.

Guerrilla patching

A small twist to this saga is that before Adobe issued its original fix for CVE 2019-7089, a company called Acros came up with one of its own “0Patch”, a guerrilla patch issued in advance of an official fix.

All good publicity for the cause of third-party patching but also a hint that some researchers don’t trust Adobe to do the job effectively.

And so ends a mildly embarrassing few days for Adobe.

Vendors occasionally re-issue patches that cause unforeseen problems or, more rarely still, find themselves addressing a new vulnerability created by a fix. Fixing the same or similar flaw twice in the same week (and three times in as many months) feels like new territory.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/IrTJnXVi3Ho/

We’re not fans of the phrase “First World problem”, not even now it’s in the Oxford Dictionary of English

After all, if humans indeed lived in Africa long before they decided to see what Europe was like, surely Africa ought to be the First World, and we’d count upwards from there?

But no matter – the meaning of the term is now well-established.

An FWP is when someone who already has all of life’s necessities receives the terrible news that their local supermarket will no longer be selling pre-smashed avocado.

So we didn’t know whether to laugh or cry at the recent troubles reported on Google Play by users of an app called Nike Adapt, used to control Nike’s Back To The Future-like Nike Adapt BB trainers.

(BB, by the way, refers not to the diameter of a specific sort of shotgun and airgun pellet – by convention 4.5mm or 0.177″ – but to the phrase “Built for Basketball”.)

Those who are ready to drop $350 on a pair of trainers have probably heard of the cool new Adapt BB product, and may even have bought a pair, given that Nike’s website already lists them [2019-02-22T18:40Z] as sold out.

They’re popularly described as self-lacing, like Marty Mc Fly’s shoes in the movie Back To The Future, although they come pre-laced – it’s just that the laces tighten up all by themselves.

OK, not entirely by themselves – as you probably guessed from the words Google Play above, there’s an app for that:

Designed to give you a customized, consistent fit, the Nike Adapt BB is our first power lacing shoe that’s built for basketball. Strong yet flexible, it adapts to your foot to provide a locked-in feel for distraction-free play. Pair it with the Nike Adapt app to fine-tune the fit and customize the features from your smartphone.

Oh, in case you wondered:

If the battery runs out while you’re wearing them, don’t sweat it. Your shoes will still unlace so you never get stuck.

First World problem

Manual overide is good to know about, because it looks as though it’s not just the batteries that might lose the plot, but also the Android version of Nike’s app.

As one user complained:

This app bricked my left shoe right out the box it’s not connecting or turning on. But my right shoe works just fine I’m starting to think this was a waste of money.

Another’s experience went the other way round:

The first software update for the shoe threw an error while updating, bricking the right shoe.

A third Adapter claims to have had problems of an ambipedestrian sort:

I played basketball at my local gym and when I was done the shoes would not loosen up! i thought that’s fine i know how to manual reset but then the buttons were not lighting up. no joke I was stuck in my shoes for about 45 min. thoughts of cutting the shoe came to mind.

Are we alone in wondering, “What happened after 45 minutes that fixed the shoes, and was it a boot?”

What to do?

According to user Ricky La, there’s a solution ,and you’ll kick yourself for not guessing it for yourself:

to hard-reset shoes: 1) For one shoe, hold both buttons at the same time for 5 seconds. You’ll see two red flashes and then a solid red before fade. 2) After, press + hold one button throughout this process. Once it turns white, press + hold other button three times, one or two seconds each time. First time will turn red. Second time will turn yellow. Third time will turn green. Let buttons go for 15 seconds; it’s fully reset. Repeat for other shoe. Connection should work!

Seriously, folks, we have no idea whether Ricky’s “fix” works or not, but we can’t imagine that it could make things worse, assuming you actually get the sequence of shoe-clicks correct.

Another approach, apparently, is to eat humble pie and get an Apple user to help you out:

If you know someone with a iPhone or iPad connect your shoes their device and update your Nike Adapt BB. After you update your shoe software. 1. Go into the app and disconnect your shoes. 2. Go into the bluetooth settings on the iPhone or iPad and unpair your Left and Right Shoe. 3. Log out of app. Log into app on android and follow the setup and your good to go!

Or just chill out, like user Muscle Beach, who doesn’t seem worried at all, and is willing to wait:

I’m giving a rate of 5 stars because I love Nike and I know this is a easy fix.

You can see his dilemma: own a pair of $350 shoes that you can’t wear until an update comes out, or eat crow in front of an Apple fanbuoy or fangurl?

Now THAT’s a real FWP!

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/xC6FWUC_xhE/

French defence tech conglomerate Thales has flogged off its hardware security module biz nCipher Security, a sale demanded by competition regulators over Thales’ buyout of Gemalto.

nCipher Security, an £87m firm which began its corporate life in the UK, will be acquired by bank cards ‘n’ passports biz Entrust Datacard, the artist formerly known as Datacard Group.

Philippe Keryer, Thales’ exec veep of strategy, research and technology, stated: “This announcement marks a key step in the ongoing process regarding the acquisition of Gemalto which we expect to close by end March 2019.”

The company said in a statement today that the sale satisfies “commitments made by Thales to several competition authorities to divest this business to a suitable purchaser in order to ensure a strongly competitive market for GP HSM [general purpose hardware security module] solutions and to finalize the acquisition of Gemalto”.

The deal is subject to approval from a host of countries’ regulators, including the US Department of Justice, the Australian Competition and Consumer Commission, and the New Zealand Commerce Commission. The EU Commission is also required to give its blessing to the sale – which, on top of all of that, is conditional on Thales actually closing its purchase of Gemalto.

The British hardware encryption company was originally snapped up by Thales just over a decade ago for around £50m. The price of today’s sale was not disclosed.

The £4.2bn Gemalto buyout was announced in December 2017 as Thales and Atos duked it out, bidding ever-higher sums in order to acquire the business. The huge amounts of money being flung around were seemingly out of proportion to the embarrassing revelation that a large chunk of the company’s key business – secure SIMs for mobile phones – had been allegedly compromised by British and American spies in 2010. At the time Gemalto denied that its SIM encryption keys had been stolen.

Nonetheless, that little blip doesn’t seem to have stopped Thales. Last year Gemalto posted profits of €332m on revenues of €3bn. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/22/thales_sells_ncipher_for_gemalto_buyout/

VPNs are critical for information security. But simply having these cozy security tunnels in the toolkit isn’t enough to keep an organization’s data safe.

Blanket forts are great. As kids, we love the feelings of warmth and security that come from being wrapped, safe from the world, in that cozy embrace. IT security pros get a similar feeling when network communications are wrapped in a virtual private network (VPN).

VPNs are encrypted “tunnels” through which network traffic can safely flow. But simply having a VPN in the toolkit isn’t enough to keep data safe; the VPN has to be deployed properly and used correctly to be effective.

There are two scenarios for deploying a VPN. One is “fixed point,” in which a VPN protects the network links between servers, data centers, or large infrastructure blocks. The other scenario is for mobile, where the VPN wraps the communication from a laptop, desktop, or handheld computer in the blanket fort of encryption wherever the device may be.

In many ways, the VPN between fixed assets is the easier deployment, since it will be totally within the control of the central IT group to connect assets that rarely, if ever, change. However, the mobile VPN “in the wild” is a much different deployment exercise, one that requires particular attention in order for the VPN to be truly effective at protecting the data flowing to and from devices in the field.

What can an organization’s security staff do to make sure that its VPNs are protecting all of the data that has to flow from the field? Start with the steps described here, each of which must be communicated with employees so they understand how important data protection is.

One additional point: For purposes of this article, we’re discussing VPNs as a general tool — not just the public VPN services widely used by consumers. If you’re already using VPNs for all your network connections, let us know what your best practices look like in the comment section, below.

(Image: Photon Photo — Adobe Stock)

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/application-security/6-tips-for-getting-the-most-from-your-vpn/d/d-id/1333942?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

LinkedIn profiles provide a persistent, patient threat actor with the information required to craft spear-phishing messages.

Scammers tend to be skilled at finding the most vulnerable individuals and turning them into victims. Case in point: Researchers at Proofpoint have been tracking campaigns that prey on those looking for work. The payoff is not a job: It’s a copy of the More_eggs backdoor.

The criminal (or criminals) conducting these campaigns seems patient and persistent. The person targets the potential victim through LinkedIn direct messaging, builds rapport, and then begins follow-up through fake websites stuffed with malicious links, email with malware payloads, or both.

LinkedIn profiles provide the threat actor with the information required to craft spear-phishing messages. The malicious payloads are not unique to the campaign: More_eggs is a JScript downloader, while VenomKit and Taurus Builder are malware builders that have been made available for purchase by their developers.

There are overlaps between these campaigns and a campaign launched against anti-money laundering officers at various financial institutions. In addition, the threat actor in these campaigns is showing early signs of moving beyond the basic malware loaded in these instances to more advanced RATs, banking credential skimmers, and other malware. In this case, More_eggs seems likely to lead to more_grief for its victims.

Read more here.

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/new-malware-campaign-targets-job-seekers/d/d-id/1333948?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Despite the openness of the Android platform, Google has managed to keep its Play store mainly free of malware and malicious apps. Outside of the marketplace is a different matter.

In 2018, Google saw more attacks on users’ privacy, continued to fight against dishonest developers, and focused on detecting the more sophisticated tactics of mobile malware and adware developers, the Internet giant stated in a recent blog post. 

Google’s efforts — and those of various security firms — highlight that, despite ongoing success against mobile malware, attackers continue to improve their techniques. Malware developers continue to find news ways to hide functionality in otherwise legitimate-seeming apps. Mobile applications with potentially unwanted functionality, so-called PUAs, and applications that eventually download additional functionality or drop malicious code, known as droppers, are both significant threats, according to security firm Kaspersky Lab.

For Google, the fight against malicious mobile app developers is an unrelenting war to keep bad code off its Google Play app store, the firm said. 

“Despite our enhanced and added layers of defense against bad apps, we know bad actors will continue to try to evade our systems by changing their tactics and cloaking bad behaviors,” said Andrew Ahn, product manager of Google Play, in a Feb. 13 blog post. “We will continue to enhance our capabilities to counter such adversarial behavior, and work relentlessly to provide our users with a secure and safe app store.”

Data from 2018 and prior years reveals a sharp divide between those Android users who download applications exclusively from well-maintained app stores and those who expose themselves to risk by installing standalone apps — so-called sideloading — or downloading applications from third-party providers. 

For Android users who only download apps from Google Play and do not allow the sideloading of non-Play applications, mobile malware is not a major threat, affecting less than 1% of users in any given year. 

“Sticking with Google Play is certainly the best source to get your apps from,” says Christoph Hebeisen, senior manager of security intelligence at mobile-security firm Lookout. “As we know, it hasn’t been completely clean, but they’ve done a good job.”

Yet almost 10% of US Android users — and more than 40% of users in other countries, such as Iran and Bangladesh — encountered at least one instance of malware attempting to install in 2018, according to Kaspersky Lab.

While such data suggests some simple lessons, some surprising trends have emerged from 2018.

The Security Is in the Ecosystem
Despite the occasional discovery of malicious apps on its Play store, current data indicates that Google continues to have success in its battle against malware authors and rogue developers. 

Among its ecosystem’s defenses, Google’s Play Protect system scans more than 50 billion apps on users’ devices every day to detect malicious activity, according to the firm. In 2018, Google removed tens of thousands of apps for violating its stricter privacy policies. The company has also increased its efforts to catch malicious apps submitted to the Google Play store, rejecting 55% more app submissions and suspending 66% more apps for policy violations.

“These increases can be attributed to our continued efforts to tighten policies to reduce the number of harmful apps on the Play Store, as well as our investments in automated protections and human review processes that play critical roles in identifying and enforcing on bad apps,” the company stated.

These successes, however, rely on the entire ecosystem working together. Google Play Protect, for example, does not perform as well against malware compared with bespoke applications from security firms: It detected only about two-thirds of malware in real time, compared with nearly 100% detection for mobile-security apps.

Third-Party App Stores Have High Malware Rates
Third-party app stores do not have the same level of security as Google’s marketplace. Google’s data shows it is eight times more likely that users download harmful apps from third-party stores than from Google Play, the company stated. A 2016 academic paper by researchers at Yokohama National University and Delft University of Technology found that about one-in-five apps in three independent app stores were malicious, and the stores took a very long time to remove the offending apps from the store.

While the Google Play store did actively seek to remove the malicious apps from its servers, a cluster of malicious apps that persisted showed that users should be wary of any app store’s incentives, the researchers said.

“The fact that these apps are flagged by AV vendors point to a divergence in incentives between the vendors, the users and the market operators,” the academic paper stated. “Ads, including third-party advertisement libraries and networks, are a core part of the app market and the different revenue models it supports. The market operator has an incentive to allow and even enable advertisement-related revenue for developers who operate within the terms of service.”

Some Countries Have Extremely High Malware Rates
Dependence on third-party app stores and installing individual apps through sideloading means that users in a many countries are exposed to greater risk. The top-10 countries whose users are most often attacked by mobile malware all have annual encounter rates greater than 25%, meaning a quarter of users have experienced at least one incident of malicious software attempting to install itself on their devices, according to Kaspersky Lab.

The United States is in 29th place, according to the yet-to-be-published data, with a 9.9% encounter rate. While malicious apps can be uploaded to Google Play, rogue developers often use spam to direct users to download untrusted applications, says Victor Chebyshev, security expert at Kaspersky Lab. 

“The Android operating system still has possibility to install malicious applications from third parties,” he says. “Tricking victims to download and install applications from elsewhere is the most widespread attack vector.”

Other Attacks Pose More of a Threat for Mobile Users
While rogue developers continue to create a spectrum of malicious and unwanted apps, other techniques are often used to monetize mobile devices. In its annual report on mobile threats, mobile security firm Wandera stated that phishing attacks have become very common, with 57% of all organizations experiencing a phishing incident in 2018. Attackers are spending more time researching their targets to make the attacks more convincing, the company said.

For the most part, mobile malware is not the preferred way to attack mobile users, the firm stated.

“Malware is certainly a real threat,” said Michael Covington, Wandera’s vice president of product strategy, in the report. “Our cursory research shows that there are more mobile malware samples in the wild, but they aren’t taking hold on the end user devices in any meaningful way.”

For users who stick with a secure ecosystem, Kaspersky Lab points to a variety of other techniques that post more of a risk than mobile malware, such as unsecured Wi-Fi hotspots, phone scams, and — less common — remote exploitation of vulnerabilities.

Searching for Apps Increases the Chance to Encounter Malware
One unexpected lesson is that searching for a specific application or type of program can lead to malware. Because attackers have become experts in finding ways to increase the popularity of their malicious apps, they can often boost the visibility of their programs in the store. In the 2016 study of the Google Play store and three other third-party stores, researchers found that search results often contained malicious apps.

“When users of Google Play search with specific keywords, they may have a 50 times higher probability of encountering malware than when selecting from the popular app list,” the researchers stated.

In the end, expect attackers to adapt and innovate to create better ways of mining value out of compromised devices, as people continue to increasingly use their mobile phones and track a greater part of their lives using the devices.

“Mobile devices are a large target, and they are only getting larger as we put more and more of our information on them,” Lookout’s Hebeisen says.

Related Content

• ‘PowerSnitch’ Hacks Androids via Power Banks
• Google Researcher Unpacks Rare Android Malware Obfuscation Library
• Mobile App Threats Continue to Grow
• Phishing Threats Move to Mobile Devices
• HTTP Injector Steals Mobile Internet Access

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/mobile/lessons-from-the-war-on-malicious-mobile-apps/d/d-id/1333946?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Until this month, Microsoft’s Windows 10 Edge browser could skip over its own “Are you sure?” warnings about Flash content on 58 websites, thanks to a bypass list kept hidden from users.

Google Project Zero researcher Ivan Fratric said he stumbled on the list last November when he analysed domain hashes inside the edgehtml­plugin­policy.bin file.

Fratric eventually resolved 56 of the 58 hashes to be a bypass list of domains that included Facebook, MSN, Deezer, and Yahoo Japan, which all contain some legacy Flash content.

Having a bypass list built into Edge is risky, says Fratric.

Flash is well-known for vulnerabilities, which is why users are regularly reminded either to run it only when necessary or, better still, not run it at all.

Although the setting had limitations (the content must be hosted on the same domain or larger than 398×298 pixels), Fratric said he was alarmed at the reasoning behind having a list of this sort inside Edge that users know nothing about.

Some of the domains didn’t implement HTTPS security, which meant:

Even in the absence of an XSS vulnerability, this would allow a MITM attacker to bypass the click2play policy.

Click-to-run confusion

Although far fewer websites are using Flash than a few years ago, Flash hasn’t disappeared entirely.

As a result, some browsers still have Flash built in, although how each browser supports it varies slightly.

Chrome, Opera and Edge include Flash but disable it by default – users must choose to turn it on, implemented in Edge through something called click-to-run.

(Firefox and Safari don’t have Flash at all by default, so you have to download an Adobe plug-in to get Flash working.)

From Windows 10 version 1703 onwards, running Flash under Edge’s click-to-run setting was deliberately made more inconvenient.

First, you had to enable Flash, and then you’d see a “Do you want to allow Adobe Flash to run on this site?” pop-up every time you came across a site that wanted to use it.

The only way around the recurring pop-ups was to choose the “Always allow” option – except that it now seems Microsoft had a hidden list that would quietly sidestep the pop-up on your behalf for 58 sites.

In February’s Patch Tuesday, Microsoft trimmed the Edge bypass list from 58 entries to just two, both of them Facebook domains, and forced the use of HTTPS.

The issue of Edge running Flash without a pop-up it may go away in due course – Flash is on the chopping block from 2020 – but just how long Flash’s actual Goobye, Farewell and Amen moment will take is anybody’s guess.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/xFRIhtSJiHU/

Microsoft has fixed a bug that could have led to distributed denial of service (DDoS) attacks on its web server software.

The flaw lay in the way that Internet Information Server (IIS) processed requests sent using HTTP/2.

Ratified in 2015, HTTP/2 is an enhanced version of the original HTTP standard that includes better flow control and handles a wider variety of connections between clients and servers.

Flow control in HTTP/2 enables a client computer to describe how it wants to receive information from the sender so that it can work more efficiently.

For example, you might ask your browser to stream a high-bandwidth video, but then pause the video halfway through.

With HTTP/2, the browser can use flow control to pause the delivery and buffering of the video and concentrate on downloading something else that is suddenly more important, such as a real-time ticker update.

To manage flow control, HTTP/2 uses a feature known as a SETTINGS frame.

Clients can specify any number of SETTINGS frames, and this is the root of the problem that Microsoft found in IIS – too many frames can overload the server, maxing out CPU usage at 100%.

Microsoft reported:

In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed.

The flaw meant that attackers with a botnet of zombie computers, or hacktivists with a following of willing helpers, could have brought IIS servers – which as of January 2019 hosted 25% of all web domains, according to Netcraft – to their knees.

Microsoft fixed the problem by adding an option to limit the number of SETTINGS frames in an HTTP/2 request.

What to do?

To access this feature, customers can download the cumulative updates KB4487006, KB4487011, KB4487021, and KB4487029.

The fix allows administrators to set two parameters in the registry: Http2MaxSettingsPerFrame and Http2MaxSettingsPerMinute.

If the number of SETTINGS frames surpasses either of these two limits, IIS will kill the connection:

When appropriately set, [the] two limits together help to terminate the malicious connection violating those limits and form a threshold for legitimate connections.

Don’t forget, though, that these settings aren’t turned on by default, even after you install the update – a suitable registry tweak is needed to enable this DDoS mitigation.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/GexkUmsOPx4/

A YouTube content creator has found what he calls a “wormhole” that, within as few as five clicks, could lead to a “soft-core pedophilia ring” where pedophiles are connecting with each other in the comments sections of innocuous videos featuring children.

That content creator is Matt Watson, also known as MattsWhatItIs, who posted a video of his finds on Sunday.

As of Thursday afternoon, the video had been viewed more than two million times.

In it is a collection of clips, many of them innocent, that show kids doing things like gymnastics, stretching, playing Twister, or simply hanging out with friends – nothing that would get the videos blocked by content filters.

Other videos show flashes of exposed genitals, or feature children – most of them girls – doing the splits or lifting up their tops to show their nipples.

According to Wired, some of the children appear to be as young as five. Many of the videos have been seen by hundreds of thousands, if not millions, of viewers, and they have hundreds of comments.

Those content streams are filled with lechery: for example, a timestamp on one comment about “she’ll make a great mother some day” jumps to a picture of a child’s bare legs.

Other remarks praise the children, jump to points in the video that picture children’s legs or buttocks, ask whether they’re wearing underwear, or simply insert strings of sexually suggestive emojis.

Watson found that child oglers are sharing their social media contact details in the comments. Most disturbing of all are the links to actual child abuse imagery he uncovered.

Watson criticized YouTube for monetizing these videos: he called out major brands, including McDonald’s, Lysol, Disney, Reese’s, Dodge Ram, and Maybelline, among many others.

Kiss those ad dollars goodbye

Many of the advertisers identified in Watson’s video and in Wired’s subsequent report – among them Epic Games and GNC – said they’ve suspended advertising on YouTube.

Bloomberg News on Wednesday reported that the Walt Disney Company has also pulled its ads, as has Nestle SA.

Chi Hea Cho, a spokeswoman for YouTube’s parent company, Google, told the New York Times that the pedophiles’ comments and actions are “abhorrent.”

Any content – including comments – that endangers minors is abhorrent and we have clear policies prohibiting this on YouTube. There’s more to be done, and we continue to work to improve and catch abuse more quickly.

She said that the company took “immediate action” by deleting over 400 YouTube channels because of comments that they’d left on videos.

YouTube also disabled comments on tens of millions of videos featuring minors, removed thousands of inappropriate comments on videos with young people in them, and reported illegal comments to the National Center for Missing and Exploited Children.

An old problem

As Watson noted in his video, this is a problem that YouTube has been battling for years.

Back in 2017, YouTube got in trouble for monetizing disturbing videos meant for kids, such as a Claymation Spiderman urinating on Elsa of Frozen and a cartoon showing Mickey Mouse lying in the street in a pool of blood as Minnie Mouse looks on.

At the time, YouTube said that it used a combination of automated systems and human flagging to block inappropriate comments – be they predatory or sexual – on videos featuring minors.

But it would do more, it said, such as “turn[ing] off all comments on videos of minors where we see these types of comments.”

At YouTube’s scale, is this even fixable?

Given the size and reach of YouTube, the question that inevitably arises when it comes to the long-running saga of trying to find and filter inappropriate content on YouTube is, “Can this ever be fixed?”

One solution is to do away with comments altogether – and if YouTube were to do so, it would find itself in good company.

Other sites that have pulled the plug include Vice, Popular Science, Recode, Mic, The Week, Reuters, The Verge, and USA Today.

Goodbye and good riddance, Vice said back at the end of 2016, when it killed a comments section that it said had turned into:

…racist, misogynistic maelstroms where the loudest, most offensive, and stupidest opinions get pushed to the top and the more reasoned responses drowned out in the noise.

Watson’s video shows that YouTube’s comments section, when it comes to giving child predators a forum in which they can indulge their predilections, goes beyond vile and into the realm of dangerous.

Readers, your thoughts: is it time for YouTube to turn off comments? Is there anything there worth saving?

---

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/0wWV7h1FkjY/