STE WILLIAMS

The humble web browser is a workhorse of the modern world, and it can get you into some real trouble if you’re not careful.

Security experts know that better than most, and there’s no better place to bone up on the ins and outs of web security than Black Hat Asia in Singapore next month, where a bevy of Briefings, Trainings, and Arsenal tool demos offer loads of opportunities for hands-on learning.

“Who Left Open the Cookie Jar?” is a 50-minute Briefing where researchers Tom Van Goethem and Gertjan Franke will walk you through how several flaws in seven browsers and 46 browser extensions purportedly block third-party cookies.

You want to see this Briefing to learn how the researchers novel techniques can prevent attackers from circumventing many of today’s built-in protection mechanisms. They’ll also show you that for every anti-tracking or ad-blocking browser extension there exists at least one technique to bypass its defenses, then offer a solution and analyze why these bypass techniques exist.

For a different perspective on Web security, check out the 25-minute Briefing on “Make Redirection Evil Again – URL Parser Issues in OAuth.” You’ll get a quick refresher on the security community’s understanding of OAuth redirection threats, learn how OAuth has evolved and what the best practices are for implementing it in your own projects.

Now, the fun part: You’ll get a demonstration of new OAuth redirection attack techniques which exploit the interaction of URL parsing problems with redirection handling in mainstream browsers or mobile apps. In particular, some attacks leverage newly-discovered URL interpretation bugs in mainstream browsers or the Android platform. (The latter were independently discovered and have been recently patched.)

Don’t forget to stop by the Black Hat Asia Arsenal (located in the Business Hall) to enjoy some live demos of useful web security tools and chat with the folks who make them. Catch “A Look at ModSec 3.0 for NGINX: A Software Web Application Firewall” on Friday morning to see how at how the popular open-source proxy server NGINX can be combined with the respected open-source web app firewall ModSecurity to create an effective, secure layer for your web application stack.

You can also see the latest version of ModSecurity live during the “ModSecurity 3.1: Stepping up the Game for Web Attacks” Arsenal demo. The 3.1 release promises improved performance, stability and new exciting features including an exclusive testing feature that allows rules writers and WAF administrators to effortlessly search and match for known malware payloads and signatures. Be sure to stop by and check it out!

Get a firsthand look at a new web exploit by attending the “ReDTunnel: Explore Internal Networks via DNS Rebinding Tunnel” Arsenal demo. You’ll see how researchers have found a new way to attack web browsers by combining two concepts: JavaScript reconnaissance techniques and the DNS rebinding attack.

The result (at least if everything works well) is that you open your browser, wait until the victim visits your website, and then start browsing the internal websites in their network. It’s a great trick (especially if you’re part of a red team), and the best way to see it is to come to Black Hat Asia next month.

Black Hat Asia returns to the Marina Bay Sands in Singapore March 26-29, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/learn-to-plug-(or-exploit)-new-vulnerabilities-at-black-hat-asia/d/d-id/1333935?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Companies spend millions on security technology designed to prevent cyberattacks, yet they are still plagued by costly breaches and network intrusions.

Indeed, the number of attacks are on the rise, taking longer to address than ever before. It’s estimated that the average cost of a data breach in 2018 was up 6.4% over the previous year to $3.86 million. This is why companies cannot afford to simply rely on preventative technologies, which often lull them into a false sense of security.

Such a heightened focus on prevention also comes at the sacrifice of the security team. This is why CISOs should invest in hiring people who can provide the critical thinking that technology can’t.

People First, Tech Second
Security teams understand they need to think like hackers. And they understand that it’s not computers attacking their companies. Rather, it’s the people behind them — people with real-life experience and intuition.

But that doesn’t necessarily hold true elsewhere in the organization. One place I often see an over-reliance on technology versus human expertise is among the data science team. It’s common for a data science team to operate in a vacuum, without security expertise. For example, static meta data is frequently used to efficiently find and retrieve data. Data scientists may try to cluster malware based on import hashes without taking into account that they are representative of a layer of anti-analysis protection, rather than the malware itself. Working on a faulty premise without the right expertise will garner flawed results.

It pays to invest in talent, too. A recent study from Kaspersky Lab revealed that large companies that rely on external security resources pay up to three times more to recover from a cyberattack than businesses with in-house expertise. Teams without enough people also become overwhelmed more easily. This can lead to general apathy and even burnout.

After all, protecting an organization is a stressful job. So it’s imperative that security teams have enough human resources to support the company’s security strategy and keep their organizations safe from attack.

When Prevention Fails, Visibility Is Key
Let’s say you have the resources in place. Now let’s talk about network visibility. In a survey I conducted last year in a private social media group for security pros, 67% of the 87 security analysts, researchers, and leaders said they did not have enough visibility into their organizations’ technical assets in order to identify potential compromises. Being able to see a real-time view of what’s happening in the network, verify an attack is happening, gather evidence, and actively investigate is of paramount importance to a holistic security strategy.

For example, a security team might see an exfiltration attempt but may be unable to detect the hacker’s attempt to log back into the system. Visibility ensures they can see what is happening in the network, on the endpoints, and in between the endpoints. It also allows teams to triage and investigate new and unusual occurrences. Relying on alerts that say “this was blocked” without a way to see what may not have been blocked leaves an organization with blind spots.

To ensure visibility, enterprises can take the following steps:

1. Enable logging and store logs in a consumable way.
2. Understand where to have visibility and how best to take advantage of it.
3. Know what data the devices on your network can provide so that you can understand what you can see and know where you’re exposed.
4. Once you have identified the data you have access to, store it for as long as you can.

The key to mitigating advanced threats is a combination of visibility and speed, which ultimately comes down to investing in security experts. This can take many forms, including cultivating expertise from within. While there are seemingly endless opportunities for experienced personnel, consider upskilling entry-level team members, too, so as to create a pipeline of talent that will rise to the top.

If companies prioritize investing in humans first, then focus on visibility, detection, and prevention (in that order), they will be well-equipped for a successful security strategy.  

Related Content:

• 6 CISO Resolutions for 2019
• Cybersecurity and the Human Element: We’re All Fallible 
  
• How to Create a Dream Team for the New Age of Cybersecurity

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Brandon Levene leads Applied Intelligence for Chronicle (VirusTotal). Prior to Chronicle, he was a founding member of threat organizations at Salesforce.com and Palo Alto Networks. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/to-mitigate-advanced-threats-put-people-ahead-of-tech/a/d-id/1333913?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

California Attorney General Xavier Becerra and Assemblymember Marc Levine this week unveiled legislation to close a loophole in the state’s existing data breach notification laws.

AB 1130, introduced by Levine, requires breached organizations to notify consumers if their passport number or biometric data is exposed. Becerra said this bill “closes a gap in California law and ensures that our state remains the nation’s leader in data privacy and protection.”

California became the first state to pass a data breach notification law in 2003, when it mandated companies inform consumers when they believe an unauthorized party has accessed their information. At the time, this personal data was limited to Social Security numbers, driver’s license numbers, credit card numbers, and medical and health insurance data.

Legislation introduced this week will update the law to include passport numbers and biometric data, such as a fingerprint or retina/iris scan, as information protected under the statute.

The addition was prompted by the 2018 breach of Starwood Hotels’ guest database. Marriott, which had acquired the company, revealed the incident had exposed more than 327 million records containing travelers’ names, addresses, and more than 25 million passport numbers. California officials note how passport numbers are unique, government-issued, static identifiers, making them especially appealing to cybercriminals. Indeed, passport scans are hot on the Dark Web.

Read more details here.

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/new-legislation-builds-on-california-data-breach-law/d/d-id/1333943?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Automated online password-guessing attacks, where adversaries try numerous combinations of usernames and passwords to try and break into accounts, have emerged as a major threat to Web service providers in recent years.

Next week, two security researchers will present a paper at the Network and Distributed System Security Symposium (NDSS Symposium) in San Diego that proposes a new, more scalable approach to addressing the problem.

The approach — described in a paper titled “Distinguishing Attacks from Legitimate Authentication Traffic at Scale” — is designed specifically to address challenges posed by untargeted online password-guessing attacks. These are attacks where an adversary distributes password guesses across a very large range of accounts in an automated fashion.

Such “breadth-first” attacks are typically a lot harder to address for a large organization than a more targeted “depth-first” attack, where an attacker might try lots of password guesses against a relatively small number of online accounts, the research paper noted.

The typical approach to addressing online password attacks currently is to block or throttle repeated guesses against an account. The approach can work in depth-first attacks but is not very effective when password guesses are distributed against a wide range of accounts, the researchers said. “At large providers with tens, or hundreds, of millions of accounts, breadth-first attacks offer a way to send millions or even billions of guesses without ever triggering the depth-first defenses,” they noted.

Cormac Herley, principal researcher at Microsoft Research and primary author of the report, says the challenge for organizations is figuring out a way to reliably distinguish legitimate traffic from attack traffic. “The traffic at an authentication password server is an unknown mixture of traffic from good users and attackers,” he says.

Each request contains a username, password, and other data, such as IP address and browser information. It can be hard to distinguish requests from legitimate users attempting to log into their accounts with those from attackers trying to guess their way in, especially when attack volumes are large, Herley says. Companies like Microsoft, for instance, detect several million credential attacks against its identity systems on a daily basis.

The way to address this problem starts with figuring out the percentage of traffic on the network that is benign and the percentage that is attack traffic. “This sounds hard but is actually easy,” Herley says.

Both attackers and legitimate users can a fail a login attempt. “However, legit users fail maybe 5% or so of the time, while an attacker who is guessing fails [over] 99% of the time,” he says.

Herley’s research shows how organizations can use this fact to estimate the ratio of good to bad traffic among login requests. It shows how they can then use the estimate to identify the segments of traffic that contain the most attack traffic and the segments that have little or none. “Finding some portions that look clean allows us to learn what the traffic from legit users looks like so that we can punish traffic that deviates from that pattern more,” Herley says.

The impetus for developing a new approach that addresses online password attacks was prompted by the lack of innovation in the area. Account lockout approaches have been recommended for a very long time, with little effort put into understanding how effective they really are, Herely says.

There’s little science or analysis, for instance, to show that a single, fixed account lockout threshold — for example, after 10 failed guesses — can work equally well for small organizations and those with massive user bases, such as Microsoft and Google, he says.

“We concluded that this problem needed a ground-up, systematic approach instead of the rag-bag of heuristics that were much-used but little studied,” Herley says. The approach described in the paper is pretty easy for organizations to implement, he adds, and hinges on their gathering the right statistics from incoming traffic.

Related Content:

• PassGAN: Password Cracking Using Machine Learning
• Worst Password Blunders of 2018 Hit Organizations East and West
• 773 Million Email Addresses, 21 Million Passwords For Sale on Hacker Forum
• 7 Tips for Communicating with the Board

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/researchers-propose-new-approach-to-address-online-password-guessing-attacks/d/d-id/1333939?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cybercriminals seeking sensitive data on high net-worth individuals will pay aspiring extortionists an average of $360,000 per year to target executives, lawyers, doctors, and other prominent figures, researchers discovered.

The Digital Shadows Photon Research Team today published “A Tale of Epic Extortions,” a deep dive into the ways cybercriminals prey on individuals’ online exposure. Extortionists take advantage of compromised credentials, sensitive data (documents, intellectual property), and technical vulnerabilities on Internet-facing applications to convince their victims to pay up.

“The extortion landscape is broader and more diverse than any of us thought before we started,” says Rafael Amado, senior strategy and research analyst with Digital Shadows.

Oftentimes, he continues, the technical news that resonates with the infosec community is considered esoteric to everyone else. “Extortion has the human element,” says Amado. “Attacks on organizations have real-world impact for everyday humans on the street.”

It wasn’t long ago when online extortion meant blackmailers composing threatening emails to threaten victims with exposure of their personal data. Some warned their targets of a potential cyberattack – for example, a denial-of-service attempt – if demands were ignored. Ransomware emerged in the 2010s, bringing a viable means of coercion and culminating in WannaCry (2017).

Sextortion, SamSam, and Scaled Funding

Today’s extortionists are getting creative and finding new ways to earn cash. They’re after details of victims’ personal lives and/or sensitive corporate data. Sextortion scams, in which criminals claim to have evidence of targets watching sexually explicit content, have skyrocketed. Between July 2018 and Feb. 2019, Digital Shadows collected and analyzed 792,000 sextortion attempts targeting 89,000 recipients. Criminals amassed $332,000 USD in payments; analysis of Bitcoin wallets linked to attacks shows they could earn $540 per victim, on average.

Even suspicious-looking sextortion emails have the power to sway recipients. Many follow a similar pattern: an attacker shows their target a known password as proof of compromise, claims to have footage of them viewing adult content online, and demands ransom paid to a Bitcoin address. Later versions involve the attacker further proving their credibility with another email referring to a Cisco ASA router bug, which they say let them access the victim’s device.

“The research shows that cybercriminal groups are increasing their targeting of high net worth individuals and/or those that hold positions of power within companies,” said Rick Holland, CISO and head of the Photon Research Team at Digital Shadows, in a statement on the report.

Still, other attackers use technical vulnerabilities to exploit victims. The SamSam group used public-facing applications, and abuse of valid account for remote access systems, to extort. Its actors relied on businesses not patching their software against known vulnerabilities, and once inside they used their access to extort organizations.

Researchers warn companies are still giving groups like SamSam this level of access. At the time of writing, they say, there were over 3.6M RDP servers available on the public Internet.

Some groups, like extortionists thedarkoverlord (TDO), choose not to extort victims directly. Instead, TDO has begun using online crowdfunding campaigns to sell stolen data in batches. In Sept. 2018 it appeared on the hacking forum KickAss, where it sought accomplices and sold valuable databases, source code, and intellectual property. They demand ransom to prevent the information’s release, and threaten to expose more data with each financial milestone.

Criminal Groups Hunt for Talent

Many cybercriminals are looking for members to collaborate with so they can grow their operations. There are many ways to jump into the game, and you don’t have to be technically savvy: aspiring extortionists with weak skillsets can find tutorials on the Dark Web. Some experienced attackers sell DoS and ransomware-as-a-service models to novice hackers.

“Extortion campaigns aren’t the most sophisticated from a technical perspective, but you still need people to create spoof emails, to mine for personal data like compromised credentials,” says Amado. “You need someone to manage Bitcoin transactions, someone to launder money.”

The extortion skillset is broad. Researchers found admin panels, network and website access, and sensitive data being sold on the “accesses” sections of top-tier criminal forums. For these, extortionists would need technical skills to move laterally inside target networks and find data. On the other end of the spectrum are entry-level buyers and sellers of data trading credentials.

Researchers found message boards and forums where experts are willing to pay new recruits $30,000 or more for cyber extortion scams targeting high net-worth individuals. Those with network management, penetration testing, and programming skills are in higher demand, and can earn $64,000 per month, with add-ons and a final salary of $90,000 per month after their second year. Recruits who can speak Chinese, Arabic, or German get a 5% bump on their salaries.

Is Your Business at Risk?

Extortion can affect any organization, says Amado, but the type of threat you’re likely to encounter depends on the type of business you are. Are you a financial firm processing confidential documents? Or a healthcare company, handling personal health data? Law and insurance firms are also at risk due to the nature of sensitive files they have on their clients.

“These types of organizations are particularly attractive to extortionists,” Amado explains, adding that large public bodies and municipal organizations are also top of mind for attackers.

Sometimes extortionists don’t go after an organization because they’re in a particular industry, but because a scan of public facing infrastructure showed they were vulnerable. All businesses should be asking themselves: Do I have public-facing infrastructure? Should it be public-facing? If it does need to be open to the public, are there vulnerabilities?

“If so, [you] need to patch those as soon as possible,” Amado says.

There is an element of control for users and businesses to protect themselves, he continues. Researchers recommend treating sextortion emails as spam, discovering breached accounts and passwords on HaveIBeenPwned, and securing email end-users, developing a ransomware playbook, and applying best practices for user permissions: remove local admin rights, restrict execution privileges on temporary data folders, and implement whitelists application lists.

Related Content:

• 2019 Security Spending Outlook
• As Businesses Move Critical Data to Cloud, Security Risks Abound
• The Anatomy of a Lazy Phish
• ‘Formjacking’ Compromises 4,800 Sites Per Month. Could Yours Be One?

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/cyber-extortionists-can-earn-$360000-a-year/d/d-id/1333933?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Chrome is, by far, the most widely used browser in the world. Its popularity is enhanced by the more than 180,000 add-ins, themes, apps, and extensions available for the browser. But are they safe to use? Now a new free tool from Duo Security can scan those extensions in real time to provide IT teams with assurance whether they are, indeed, safe for business users.

The CRXcavator scans a set of factors including permissions, external calls, third-party libraries, content security, and metadata to give security and IT staff insight into the safety of the browsers on their companies’ computers. According to the blog post announcing the tool’s availability, Duo researchers scanned 120,463 extensions and apps in January and found that many developers have used poor programming practices in their software. For example, 38,289 extensions ” … used third-party libraries that contain publicly known vulnerabilities,” wrote the researchers.

Read more here.

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/new-free-tool-scans-for-chrome-extension-safety/d/d-id/1333936?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple