STE WILLIAMS

What happens when you report a vulnerability to a website and it completely ignores your request, in spite of running a bug bounty program that’s supposed to pay for disclosures?

Some hackers might just walk away, but a group of app developers in Russia chose another approach. They used the vulnerability to spam thousands of users on Russia’s largest social network.

The group, called Bagosi, develops apps that run on St Petersburg-based VKontakte (VK), a social network with over 500m users owned by Russian Internet company Mail.ru.

According to ZDNet, the group discovered a vulnerability in the social network and alerted developers there a year ago.

In a post on VKontakte, Bagosi explained that the social network ignored the bug report and didn’t pay the person that discovered it for their submission or acknowledge it in any way. This is in spite of the fact that VKontakte runs a bug bounty program with Hacker One. VK told Naked Security that the program has been running since 2015 and has paid out $250,000 in bounties. However, Hacker One also told us that the VK program is self-managed, meaning that the social network handles bug reports using its own internal teams rather than relying on Hacker One’s employees.

Bagosi decided to bring the vulnerability to users’ attention in a spectacular way. It wrote a VK post containing a script that would activate when viewed. The script posted a link to the post on any group or page that the victim managed.

Bagosi used some obfuscating tactics, according to explanatory posts that it made on VK. It accessed random reviews from the Google Play store and also randomised headlines to help dodge anti-spam filters, it said.

Clearly, VK can move quickly when it wants to. The app developers launched the attack on 14 February, and the social network shut it down quickly. A VK spokesperson told Naked Security:

Within the first minute of the vulnerability being discovered, we began deleting the undesirable posts, and within 20 minutes, the vulnerability was completely fixed.

Still, the page spread quickly before VK blocked the vulnerability. Bagosi explained in a VK post:

The page has accumulated more than 100k views. Since VK takes into account only unique views, it can be concluded that ~140k people have become “victims” of the worm.

VK had banned the group’s account from the website after detecting the spam, only reversing the ban after realising that the worm wasn’t malicious and didn’t steal any user data.

Bagosi said it had done its best to report the error, but it was ignored. This raises the question: Is it ok to launch a benign proof of concept that you know will go wide, to bring a flaw to people’s attention, or should you stay quiet?

We asked Dan Kaminsky what he thought. Kaminsky is arguably the king of responsible disclosure, best known for managing to keep a major DNS flaw under wraps for months while he worked with major internet companies to introduce a fix. He said:

Benign proof-of-concepts tend not to actually manipulate production systems. This one did. That doesn’t make it malicious, but if the goal is to protect users, researchers can be friendlier.

There is a middle ground that doesn’t involve spamming thousands of people to make a point.

He added:

At these end of the day, these sorts of spats between vendors and researchers are not in the interests of user safety.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Zqo_VF1yLm4/

Have you ever been so enraged at Facebook that you’ve messaged CEO Mark Zuckerberg and told him to f— off? …or maybe you simply left that type of comment in a post somewhere on Facebook or one of its apps?

If so, you might well have been inducted into what CNBC reports is the company’s BOLO watch list. That’s an acronym for Be On Lookout: a list of hundreds of people who have threatened Facebook or its staff, sulked over losing a contract, or gotten fired, be it with or without sulking or emotional outbursts.

Keeping a list like that is not, in itself, unusual. Lots of companies keep similar lists, according to CNBC’s sources, which include former security staff from Facebook who are familiar with its program and at least one expert from the physical security field: Tim Bradley, senior consultant with Incident Management Group, a corporate security consulting firm that deals with employee safety issues.

What’s unique about Facebook’s approach to BOLOs is that it doesn’t just disseminate a list of names to security staff. Facebook also mines its platform for threatening posts. Sometimes, Facebook goes so far as to use its apps to discern the whereabouts of people whom it finds threatening, to determine whether they pose a credible threat.

CNBC talked to more than a dozen former Facebook security employees, some of whom questioned the ethics of Facebook’s security strategies. One former security staffer called the tactics “very Big Brother-esque.”

‘Tomorrow everyone is going to pay’

CNBC reported on a number of examples of when Facebook uses its own geolocation tracking or knowledge about a user’s location to figure out how much of a threat the person might be. One such: early last year, a Facebook user threatened one of the company’s European offices in a public post.

Facebook picked up on it and checked into where he was. It turned out that the user was in the same country as the office he was targeting. Facebook notified the authorities about the threat and instructed its security officers to be on the lookout for the user.

CNBC quoted a former Facebook security employee:

He made a veiled threat that ‘Tomorrow everyone is going to pay’ or something to that effect.

Facebook has a lot of enemies

While some former security staffers question the ethics, the attitude of others is hey, who can blame the company? As CNBC points out, Facebook, with 2.7 billion users across all its services, has a massive reach, and it’s got a tendency to inspire strong emotions. From CNBC:

If just 0.01 percent of users make a threat, Facebook is still dealing with 270,000 potential security risks.

Bradley told the news outlet the most important thing is for Facebook to protect its employees. How it does so is “secondary” to that duty:

If they know there’s a threat against them, they have to take steps. How they got the information is secondary to the fact that they have a duty to protect employees.

Facebook provided this statement:

Our physical security team exists to keep Facebook employees safe. They use industry-standard measures to assess and address credible threats of violence against our employees and our company, and refer these threats to law enforcement when necessary.

A Facebook spokesman told CNBC that people are only added to the BOLO list after a “rigorous review to determine the validity of the threat.”

We have strict processes designed to protect people’s privacy and adhere to all data privacy laws and Facebook’s terms of service. Any suggestion our onsite physical security team has overstepped is absolutely false.

But some former employees dispute this description of Facebook’s criteria for making the BOLO list, saying that the bar can be pretty low. From CNBC:

While some users end up on the list after repeated appearances on company property or long email threats, others might find themselves on the BOLO list for saying something as simple as ‘F— you, Mark,’ ‘F— Facebook’ or ‘I’m gonna go kick your a–,” according to a former employee who worked with the executive protection team.

A different former employee who was on the company’s security team said there were no clearly communicated standards to determine what kinds of actions could land somebody on the list, and that decisions were often made on a case-by-case basis.

Ex-Facebookers often become new BOLO-ers

You can see how some employees would make it onto the BOLO list after being shown the door – those who steal from the company, for example. But former Facebook employees say that in many cases, they wind up on the BOLO sheet without any reason being listed. CNBC says that three people told the news outlet that almost every Facebook employee who gets fired is added to the list, with one calling the process “really subjective.” Yet another said that contractors are added “if they get emotional when their contracts are not extended.”

The Facebook spokesman denied this:

Former employees are only added under very specific circumstances, after review by legal and HR, including threats of violence or harassment.

How Facebook uses location data to track BOLOs

Facebook has numerous ways to track our location: it can tap into that data via the mobile Facebook app or by our IP address, which is picked up by the online version.

Once it picks up a credible threat – for example, one with specific details about an attack location and timing, or a threat coming from somebody who regularly shows up at shareholders’ meetings or other company events – its global security operations center and the global security intelligence and investigations units put in a request to the company’s information security team, which can track users’ location information.

Facebook in some cases determines that threats lack credibility, such as if a user makes a threat about a specific location but is themselves located nowhere near that location. But if the BOLO user is in fact nearby, Facebook can continue to monitor their location and keep their security teams on the lookout. Depending on the threat, Facebook’s security teams might also station security guards, escort a BOLO user off campus or alert law enforcement.

Some threats are quite real

While its tactics might seem like overreach, you can’t deny that Facebook faces real threats. For example, one of its execs got swatted in January. The Facebook exec wasn’t harmed. However, he was handcuffed during questioning following his Palo Alto, California, house having been swarmed by police, fire department and public safety agents who responded to a hoax call from a man claiming to be him who said he’d shot his wife with an assault rifle, tied up his kids, put “pipe bombs all over the place,” and that he’d kill police or anyone else if they came near.

Another recent incident: in December, Facebook evacuated buildings at its headquarters in Menlo Park following a bomb threat. Fortunately, no bomb was found.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/S8_eAGgKQ4M/

Privacy warriors have filed fresh evidence in their ongoing battle against real-time web ad exchange systems, which campaigners claim trample over Europe’s data protection laws.

The new filings – submitted today to regulators in the UK, Ireland, and Poland – allege that Google and industry body the Interactive Advertising Bureau (IAB) are well aware that their advertising networks’ business models flout the EU’s privacy-safeguarding GDPR, and yet are doing nothing about it. The IAB, Google – which is an IAB member – and others in the ad-slinging world insist they aren’t doing anything wrong.

The fresh submissions come soon after the UK Information Commissioner’s Office (ICO) revealed plans to probe programmatic ads. These are adverts that are selected and served on-the-fly as you visit a webpage, using whatever personal information has been scraped together about you to pick an ad most relevant to your interests.

Typically, advertisers bid for space on a webpage in real-time given the type of visitor: the page is fetched from a website, it brings in ad network code, which triggers an auction between advertisers that completes in a fraction of a second, and the winning ad is served and displayed (assuming the advert isn’t blocked.) This transaction, dubbed real-time bidding or RTB, happens automatically and immediately when an ad is required, and it can be fairly convoluted: ad slots may be passed through a tangle of publishers and exchanges before they arrive in a browser.

Netizens known to be wealthy and with a lot of disposable income, or IT buyers with big spending budgets, for example, will command higher ad rates than those unlikely to buy anything through an ad. This is why ad networks and exchanges, like Google, love to know everything about you, all that lovely private data, so they can tout you to advertising buyers and target ads at you for stuff you’re previously shown an interest in.

The ICO’s investigation will focus on how well informed people are about how their personal information is used for this kind of online advertising, which laws ad-technology firms rely on for processing said private data, and whether users’ data is secure as it is shared on these platforms.

Meanwhile, these latest filings follow on from gripes lodged by the same online rights campaigners late last month and in 2018.

Ad-tech industry: GDPR complaint is like holding road builders to account for traffic violations

READ MORE

The privacy warriors allege the aforementioned auction systems fall foul of Europe’s General Data Protection Regulation (GDPR) because netizens do not have much or any real control over the massive amounts of ad-related data lobbed between sites and services. Moreover, this information can be highly personal – sometimes including location coordinates along with pseudonymous identifiers, personal interests, and the site they are browsing.

The complaints, which point the finger of blame at the IAB’s openRTB and Google’s Authorized Buyers systems, were filed to watchdogs in the UK by Open Rights Group executive director Jim Killock and privacy research Michael Veale; in Ireland by Johnny Ryan of browser biz Brave; and in Poland by the Panoptykon Foundation.

The IAB has consistently stressed that the complaints should not be directed at RTB technology makers, such as itself – and that doing so is like holding road builders accountable for people who break the speed limit. In other words, the tech can be abused, but apparently not by its developers. And the industry body claimed the complainants have only proven it is possible to break the law, not that it has been broken.

As such, the privacy warriors hope to add more weight to their arguments, and today submitted a fresh set of documents to regulators in the aforementioned trio of nations. This cache includes examples of the data passed through RTB systems, and the number of daily bid requests ad exchanges make, which reach 131 billion for AppNexus and 90 billion for Oath/AOL.

Programmatic trading, or is that problematic trading?

The complainants have also filed documents they claim prove the IAB has long been aware that there is a potential problem with RTB systems and their compliance with GDPR.

Among the latest cache is an email from 2017 – obtained under a Freedom-of-Information request – sent from the CEO of IAB Europe, Townsend Feehan, to senior staff in the European Commission Directorate General for Communications Networks, Content, and Technology.

The email reveals Feehan lobbying commission staffers against proposals for a new ePrivacy Regulation – which was meant to come into force with GDPR but has been stuck in negotiations – saying it could “mean the end of the online advertising model.”

Programmatic trading would seem, at least prima facie, to be incompatible with consent under GDPR

The exec attached an 18-page document to the email detailing IAB Europe’s reasoning, which discussed the impact of proposals to tighten rules on the use of people’s private data to the same level as that of GDPR, particularly the requirement of someone’s consent to share their information. Crucially, consent under GDPR requires that people are told clearly what’s going on with their sensitive info, which means website visitors must be told the identity of the data controller(s) processing their data and the purposes of processing. Given the instantaneous and convoluted nature of ad bidding, it is seemingly impossible to alert netizens prior to the real-time auctions, it is claimed.

This, essentially, is the rub between GDPR and today’s on-the-fly web advertising, it would seem.

“As it is technically impossible for the user to have prior information about every data controller involved in a real-time bidding (RTB) scenario, programmatic trading, the area of fastest growth in digital advertising spend, would seem, at least prima facie, to be incompatible with consent under GDPR,” the IAB said.

Brave’s Johnny Ryan said this acknowledges the issue at the core of the campaigners’ complaint – and suggests the IAB doesn’t think adtech’s operating model can work with GDPR.

The IAB has since launched a “Consent and Transparency Framework” to help companies involved in RTB systems meet their legal requirements – but opponents argue that this doesn’t change the facts at the heart of the matter.

Similarly, a document from May 2018 produced by the IAB Tech Lab – a group that produces standards, software, and services for digital publishers, marketers, media, and adtech firms – acknowledged concerns about GDPR compliance. In it, the lab said publishers were concerned “there is no technical way to limit the way data is used after the data is received by a vendor for decisioning/bidding on/after delivery of an ad but need a way to clearly signal the restriction for permitted uses in an auditable way.”

It also said that “surfacing thousands of vendors with broad rights to use data w/out tailoring those rights may be too many vendors/permissions.” And elsewhere in the 2017 document, the IAB said that, since third parties in adtech have “no link to the end-user [they] will be unable to collect consent.”

All your basis are belong to…?

It is question-marks like these, from the industry itself, that the privacy campaigners hope will bolster their case. These concerns were also highlighted by the ICO’s tech policy lead Simon McDougall in a blog post earlier this month outlining the body’s plan to look into adtech.

“The lawful basis for processing personal data that different organisations operating in the adtech ecosystem currently rely upon are apparently inconsistent,” he said. “There seem to be several schools of thought around the suitability of various basis for processing personal data – we would like to understand why the differences exist.”

He added that the ICO was interested in how and what people are told about how their personal data is used for online advertising, and how accurate these disclosures are.

A third prong of the ICO probe will consider the security of the data that is widely and rapidly shared during the auctions. “We are interested in how organisations can have confidence and provide assurances that any onward transfers of data will be secure,” said McDougall.

The ICO stressed that it was in the fact-finding stages of its work, and that it wanted to listen to all the “diverging views” on adtech.

And, for their part, the complainants in the case against IAB Europe and Google have said that they aren’t, necessarily, seeking an end to online advertising. Rather, they want to see adtech firms operate without sharing the highly personal information they do at the moment. For instance, Ryan said that the IAB RTB system allows 595 different kinds of data to be included in a bid request. Scrapping the use of just four per cent would be an “easy, long overdue, fix.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/20/iab_rtb_complain_fresh_evidence/

A bunch of infosec bods are taking some of the most popular password managers to task after an audit revealed some mildly annoying, non-world-ending security shortcomings.

Researchers at ISE declared on Tuesday that the likes of 1Password, KeePass, LastPass, and Dashline all have vulnerabilities that would potentially allow malicious software on a Windows machine to steal either the master password or individual passwords stored by the applications.

The problem here is mainly secure memory management. To some degree, every one of the four password managers left passwords – either the master password or individual credentials – accessible in memory. This would potentially allow malware on a system, particular malware with admin rights, to obtain those passwords.

And yeah, sure… we know. We get it. If spyware has infected your computer, you’re pretty much screwed. The point here is to demonstrate that software nasties can potentially mine all your login details straight from your password manager in one go. Think of this as a heads up to developers of passphrase managers, and malware researchers.

For what it’s worth, we reckon that if malware has taken hold of your PC it could probably impersonate your password manager, and snaffle your master passphrase that way, but on the other hand, why go to that trouble if the goodies are laying around in RAM?

So, what we’re saying here is: this isn’t anything to panic over right now – it’s something the designers of password managers, at least, should now be aware of.

The team noted that the password managers are not vulnerable when they are not running, such as right after the system boots up, but rather are exposed after the user opens the manager and types in their master password. That means the passwords stored on disk are safe, at least.

Who’s using 2FA? Sweet FA. Less than 10% of Gmail users enable two-factor authentication

READ MORE

“All password managers we examined sufficiently secured user secrets while in a ‘not running’ state. That is, if a password database were to be extracted from disk and if a strong master password was used, then brute forcing of a password manager would be computationally prohibitive,” Team ISE explained.

“Each password manager also attempted to scrub secrets from memory. But residual buffers remained that contained secrets, most likely due to memory leaks, lost memory references, or complex GUI frameworks which do not expose internal memory management mechanisms to sanitize secrets.”

The password managers are not necessarily getting better in their newer editions, either. The ISE studied two versions of 1Password (4.6.2.626 and 7.2.576) and found that the earlier build was in fact better at protecting passwords than the newer version. This is because the later build loaded all passwords into memory as plain text as soon as the master password was entered.

Some of the described flaws have already been fixed. A LastPass spokesperson told The Register it had sorted the memory disclosure issues described in its products, and that even when the flaw was present, a real-world exploit would require the attacker to have local access to the machine with admin clearance.

The report doesn’t by any means suggest you should not be using a password manager. Even with the mild flaws ISE found, a password manager remains by far the best way to keep your login credentials secure, and experts routinely recommend them as a way to manage multiple unique and strong passphrases for your online accounts.

“First and foremost, password managers are a good thing,” Team ISE noted. “All password managers we have examined add value to the security posture of secrets management.”

See their afore-linked report for more dos and don’ts on staying safe. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/20/password_managers_security_bugs/

Privacy warriors have filed fresh evidence in their ongoing battle against real-time web ad exchange systems, which campaigners claim trample over Europe’s data protection laws.

The new filings – submitted today to regulators in the UK, Ireland, and Poland – allege that Google and industry body the Internet Advertising Bureau (IAB) are well aware that their advertising networks’ business models are incompatible with the EU’s privacy-safeguarding GDPR, and yet are doing nothing about it. The IAB, Google – which is an IAB member – and others in the ad-slinging world insist they aren’t doing anything wrong.

The fresh submissions come soon after the UK Information Commissioner’s Office (ICO) revealed plans to probe programmatic ads. These are adverts that are selected and served on-the-fly as you visit a webpage, using whatever personal information has been scraped together about you to pick an ad most relevant to your interests.

Typically, advertisers bid for space on a webpage in real-time given the type of visitor: the page is fetched from a website, it brings in ad network code, which triggers an auction between advertisers that completes in a fraction of a second, and the winning ad is served and displayed (assuming the advert isn’t blocked.) This transaction, dubbed real-time bidding or RTB, happens automatically and immediately when an ad is required, and it can be fairly convoluted: ad slots may be passed through a tangle of publishers and exchanges before they arrive in a browser.

Netizens known to be wealthy and with a lot of disposable income, or IT buyers with big spending budgets, for example, will command higher ad rates than those unlikely to buy anything through an ad. This is why ad networks and exchanges, like Google, love to know everything about you, all that lovely private data, so they can tout you to advertising buyers and target ads at you for stuff you’re previously shown an interest in.

The ICO’s investigation will focus on how well informed people are about how their personal information is used for this kind of online advertising, which laws ad-technology firms rely on for processing said private data, and whether users’ data is secure as it is shared on these platforms.

Meanwhile, these latest filings follow on from gripes lodged by the same online rights campaigners late last month and in 2018.

Ad-tech industry: GDPR complaint is like holding road builders to account for traffic violations

READ MORE

The privacy warriors allege the aforementioned auction systems fall foul of Europe’s General Data Protection Regulation (GDPR) because the industry doesn’t have much or any real control over the massive amounts of ad-related data lobbed between sites and services. Moreover, this information can be highly personal – sometimes including GPS coordinates along with pseudonymous identifiers, personal interests, and the site they are browsing.

The complaints, which point the finger of blame at the Interactive Advertising Bureau’s (IAB) openRTB and Google’s Authorized Buyers systems, were filed in the UK by Open Rights Group executive director Jim Killock and privacy research Michael Veale; in Ireland by Johnny Ryan of browser biz Brave; and in Poland by the Panoptykon Foundation.

The IAB has consistently stressed that the complaints should not be directed at RTB technology makers, such as itself – and that doing so is like holding road builders accountable for people who break the speed limit. In other words, the tech can be abused, but apparently not by its developers. The industry body claimed the complainants have only proven it is possible to break the law, not that it has been broken.

As such, the privacy warriors hope to add more weight to their arguments, and today submitted a fresh set of documents to regulators in the aforementioned trio of nations. This cache includes examples of the data passed through RTB systems, and the number of daily bid requests ad exchanges make, which reach 131 billion for AppNexus and 90 billion for Oath/AOL.

‘Programmatic trading may be incompatible with GDPR’

The complainants have also filed documents they claim prove the IAB has long been aware that there is a potential problem with RTB systems and their compliance with GDPR.

Among the latest cache is an email from 2017 – obtained under a Freedom-of-Information request – sent from the CEO of IAB Europe, Townsend Feehan, to senior staff in the European Commission Directorate General for Communications Networks, Content, and Technology.

The email reveals Feehan lobbying commission staffers against proposals for a new ePrivacy Regulation – which was meant to come into force with GDPR but has been stuck in negotiations – saying it could “mean the end of the online advertising model.”

Programmatic trading would seem, at least prima facie, to be incompatible with consent under GDPR

The exec attached an 18-page document to the email detailing IAB Europe’s reasoning, which discussed the impact of proposals to tighten rules on the use of people’s private data to the same level as that of GDPR, particularly the requirement of someone’s consent to share their information. Crucially, consent under GDPR requires that people are told clearly what’s going on with their sensitive info, which means website visitors must be told the identity of the data controller(s) processing their data and the purposes of processing. Given the instantaneous and convoluted nature of ad bidding, it is seemingly impossible to alert netizens prior to the real-time auctions, it is claimed.

This, essentially, is the rub between GDPR and today’s on-the-fly web advertising, it would seem.

“As it is technically impossible for the user to have prior information about every data controller involved in a real-time bidding (RTB) scenario, programmatic trading, the area of fastest growth in digital advertising spend, would seem, at least prima facie, to be incompatible with consent under GDPR,” the IAB said.

Brave’s Johnny Ryan said this acknowledges the issue at the core of the campaigners’ complaint – and suggests the IAB doesn’t think adtech’s operating model can work with GDPR.

The IAB has since launched a “Consent and Transparency Framework” to help companies involved in RTB systems meet their legal requirements – but opponents argue that this doesn’t change the facts at the heart of the matter.

Similarly, a document from May 2018 produced by the IAB Tech Lab – a group that produces standards, software, and services for digital publishers, marketers, media, and adtech firms – acknowledged concerns about GDPR compliance. In it, the lab said publishers were concerned “there is no technical way to limit the way data is used after the data is received by a vendor for decisioning/bidding on/after delivery of an ad but need a way to clearly signal the restriction for permitted uses in an auditable way.”

It also said that “surfacing thousands of vendors with broad rights to use data w/out tailoring those rights may be too many vendors/permissions.” And elsewhere in the 2017 document, the IAB said that, since third parties in adtech have “no link to the end-user [they] will be unable to collect consent.”

‘Lawful bases are apparently inconsistent’

It is question-marks like these, from the industry itself, that the privacy campaigners hope will bolster their case. These concerns were also highlighted by the ICO’s tech policy lead Simon McDougall in a blog post earlier this month outlining the body’s plan to look into adtech.

“The lawful bases for processing personal data that different organisations operating in the adtech ecosystem currently rely upon are apparently inconsistent,” he said. “There seem to be several schools of thought around the suitability of various bases for processing personal data – we would like to understand why the differences exist.”

He added that the ICO was interested in how and what people are told about how their personal data is used for online advertising, and how accurate these disclosures are.

A third prong of the ICO probe will consider the security of the data that is widely and rapidly shared during the auctions. “We are interested in how organisations can have confidence and provide assurances that any onward transfers of data will be secure,” said McDougall.

The ICO stressed that it was in the fact-finding stages of its work, and that it wanted to listen to all the “diverging views” on adtech.

And, for their part, the complainants in the case against IAB Europe and Google have said that they aren’t, necessarily, seeking an end to online advertising. Rather, they want to see adtech firms operate without sharing the highly personal information they do at the moment. For instance, Ryan said that the IAB RTB system allows 595 different kinds of data to be included in a bid request. Scrapping the use of just four per cent would be an “easy, long overdue, fix.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/20/iab_rtb_complain_fresh_evidence/

Chip makers’ focus on performance has left microprocessors open to numerous side-channel attacks that cannot be fixed by software updates – only by hard choices.

Side-channel attacks such as the Spectre family of vulnerabilities are more widespread threat than previously thought – affecting all microprocessors that employ the performance-enhancing feature of speculative execution, and defeating all software-based attempts at fixing the vulnerabilities, according to Google researchers.

In a deep analysis of the issue published late last week, Spectre is here to stay: An analysis of side-channels and speculative execution, a group of five Google computer scientists built a generalized abstract model of the microarchitectures used in modern processors, and found that any optimizations to the architecture are observable and thus open to side-channel attacks.

To prove the point, they showed that it is possible to create a “universal read gadget” that can read any data with very few limitations. Implementing the gadget in JavaScript, C++, and WebAssembly, the scientists were able to glean a minimum of 10 bytes per second – and up to 1,000 bytes per second – of data from protected memory.

“As a result of our work, we now believe that speculative vulnerabilities on today’s hardware defeat all language-enforced confidentiality with no known comprehensive software mitigations,” the researchers concluded.

The research builds on the original efforts by independent research groups in late 2017 that found that two broad classes of flaws—Meltdown and Spectre—could allow attackers the ability to access areas of a processor’s memory that had been thought to be protected.

Meltdown, a hardware design weakness in Intel x86 processors, allowed attackers to read memory reserved by the operating system kernel. Spectre, a separate design weakness in any processor that implements speculative execution, allows attackers to read other applications protected memory. Speculative execution is a performance feature of modern processors where if there are two choices or branches, both potential sets of code are loaded before it’s known which will be needed.

The practice saves time and makes processors more efficient, but as researchers have found, relied on the poor assumption that attackers could not manipulate the speculative execution process.

“This class of flaws are deeper—at the microarchitectural level of the processors—and more widely distributed—in essentially every high-performance processor—than perhaps any security flaw in history, affecting billions of CPUs in production across all device classes,” the Google team wrote.

The problem is that chip makers have competed on a single metric for the past four decades—performance, says Paul Kocher, an independent cryptography researcher and one of the authors of the original Spectre paper. Because chip designers assumed that speculative execution could not be maliciously manipulated, they did not worry about its security.

The result is that chip manufacturers find themselves with some hard choices, he says. 

“There are easy solutions to Spectre if maximum performance isn’t required,” Kocher says. “The problem is that the mainstream CPU industry has historically been driven by performance benchmarks. If maximizing performance and backward compatibility are non-negotiable requirements, then Spectre and related side-channel attacks are a messy problem.” 

Chrome Fix

Google’s research highlighted four different variants of the speculative-execution attack and then investigated three mitigations to potentially fix the issues: disabling the speculation feature, adding noise to a processor’s timer function, and adding additional safety checks to speculation. However, all three potential solutions had limitations. 

The research led Google to change its defensive strategy for its Chrome browser. The company shipped early mitigations, including timer mitigations, in Chrome 64 to 67. Yet, because the research has shown that such mitigations are only partially effective and require comprehensive changes to the code, the company switched tactics.

“In recognition of the fact that software mitigation is still an open problem for virtual machines, and that mitigations would also need to be applied to all of the millions of lines of C++ code in the browser, Chrome’s defensive strategy shifted entirely to site isolation, which sandboxes code from different origins in different processes, thus relying on hardware-enforced protection,” the researchers said in the paper.

The solution may be to create multi-core processors with some core architected for performance and other cores architected for security, Kocher says.

“One variant on this approach I like is to have separate cores optimized for performance versus security,” he says. “This approach helps with other security issues beyond Spectre, since there are many other security/performance trade offs that would be handled differently for ‘safer’ cores. … While this approach can be frustrating for people who want maximum performance and security simultaneously, I don’t believe it’s possible to have both.”

In the end, the current situation is the result of chip designers overlooking a fundamental security issue for decades, Google’s research team says.

“Computer systems have become massively complex in pursuit of their seemingly number-one goal of performance,” the researchers wrote. “Our models, our mental models, are wrong; we have been trading security for performance and complexity all along and didn’t know it. It is now a painful irony that today, defense requires even more complexity with software mitigations, most of which we kno to be incomplete.”

Related Content:

• The Coolest Hacks of 2018
• Researchers Find New Fast-Acting Side-Channel Vulnerability
• Intel Reveals New Spectre-Like Vulnerability
• Critical Microprocessor Flaws Affect Nearly Every Machine

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/analytics/google-research-no-simple-fix-for-spectre-class-vulnerabilities/d/d-id/1333911?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In an unusual development, the group known for its attacks against companies in countries viewed as geopolitical foes is now going after companies in a country considered an ally, Check Point Software says.

North Korea’s Lazarus Group, known for its sophisticated cyberattacks on organizations in the US, South Korea, Japan, and other countries, has for the first time begun targeting companies in Russia.

Researchers from Check Point Software Technologies uncovered the attacks recently when investigating multiple malicious Office documents that appeared crafted specifically for use against Russian entities. Check Point’s analysis showed that the documents were part of an infection chain designed to drop an updated version of KEYMARBLE, a backdoor associated with the Lazarus Group.

Lotem Finkelshtein, threat intelligence group manager at Check Point, says the company’s researchers observed at least three distinct Lazarus Group attacks targeting Russia in the last week of January. At this point, there isn’t enough information to know whether the attacks were directed at a single company or different entities, he says.

Each of the attacks involved the use of emails with US-themed documents that were designed to trick recipients into triggering macros for downloading malicious code. One of the documents purported to be a nondisclosure agreement for StarForce Technologies, a Russia-based company with offices in the US. Another was designed to appear like a Los Angeles court document.

At the moment, the reasons for the Lazarus Group’s sudden interest in Russian companies are not clear. Many security researchers consider the group to be one of the most active and dangerous threat actors in the world. The group is well-known for its 2014 attack on Sony Pictures in the US; the theft of tens of millions of dollars from the Bank of Bangladesh and other banks; and attacks on several cryptocurrency exchanges in recent years.

But so far, at least, the Lazarus Group has steered cleared of entities in Russia, a country generally perceived as a North Korea ally. “This is actually quite surprising,” Finkelshtein says. “We tend to believe this is somehow tied to financial theft or IP theft.”  

Generally, security researchers have a hard time attributing attacks with certainty to a specific threat group or attacker. However, the tactics, techniques, and tools used in the attacks against the Russian companies indicate very strongly that the Lazarus Group is behind them, Finkelshtein notes.

For instance, the KEYMARBLE backdoor used in the attacks in Russia is a remote administration tool that the Lazarus Group is known to have developed for stealing information from compromised systems. Similarly, the compromised server that is being used to host and download the malware is a system it has used in previous campaigns.

The Lazarus Group attacks on Russian companies that Check Point observed coincide with another campaign by the group dubbed “Operation Extreme Job,” targeting companies in South Korea. The timeline of that campaign, reported by security firm ESTSecurity, overlaps with the attacks in Russia, Check Point said.

However, the two campaigns appear to be completely separate from each other and once again suggest that the Lazarus Group is operating as at least two smaller subgroups, Check Point said in its report. Security researchers have for sometime suspected that Lazarus Group has one subgroup called Andariel, which focuses on attacking South Korean companies, and a second outfit named Bluenoroff, focused on financial theft and global cyber espionage campaigns.

Related Content:

• Lazarus Group Builds its First MacOS Malware
• Inside the North Korean Hacking Operation Behind SWIFT Bank Attacks
• The ‘Opsec Fail’ That Helped Unmask a North Korean State Hacker
• 2019 Attacker Playbook

  

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/north-koreas-lazarus-group-targets-russian-companies-for-first-time/d/d-id/1333912?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cybercriminals see formjacking as a simple opportunity to take advantage of online retailers – and all they need is a small piece of JavaScript.

For a while, it was ransomware. Then it was cryptojacking. Now researchers point to formjacking as the latest threat-of-the-moment and means for hackers to get quick cash.

Cybercriminals have turned to formjacking as ransomware and cryptojacking yield less profit, according to Symantec’s Internet Security Threat Report (ISTR), Volume 24. Symantec reports it blocked more than 3.7 million formjacking attacks on endpoints in 2018, with nearly one-third of those taking place during November and December as holiday shopping season ramped up.

Formjacking attacks are simple: Cybercriminals input malicious code onto retailers’ websites and lift customers’ payment card details. Conservative estimates indicate they collected tens of millions of dollars last year by using stolen data in credit card fraud or selling consumers’ records on the Dark Web. Ten stolen cards from each compromised website could generate up to $2.2 million total in profit for attackers, Symantec reports. A single card can fetch up to $45 in underground forums.

Kevin Haley, director of security response at Symantec, says formjacking’s growth is reminiscent of the time ransomware began to spike back in 2012. “Nobody knew what it was, but we saw this significant growth, and we saw that it would be a big deal moving forward,” he explains.

Now cybercriminals see formjacking as a simple opportunity to take advantage of online retailers. All they need is a small piece of JavaScript; from there, they can take advantage of a website vulnerability or infect a third-party application the site is using. The rise in formjacking is coupled by an increase in supply chain attacks as hackers use those to get onto target sites.

Magecart is a primary driver of the formjacking trend, Haley says. The threat group was behind several high-profile formjacking attacks in 2018 against targets including Ticketmaster and British Airways. Its attackers have infiltrated more than 800 e-commerce sites with card skimming software installed on third-party components and services used by the victims.

The British Airways and Ticketmaster attacks made headlines, but Haley says the majority of websites infected with formjacking attacks are for small and midsize businesses (SMBs). Unlike major corporations, SMBs lack the resources to detect and mitigate these types of threats.

“They become more tempting targets, easier to get on,” he continues. “They may not score as much as you would with a large retailer, but you can be there for a long period of time and get a consistent number of credentials and credit card information.”

Don’t Worry: Ransomware and Cryptojacking Are Still Here
Formjacking may have spiked, but it hasn’t completely eclipsed cryptojacking and ransomware. The latter two threats have changed, researchers report, but they haven’t entirely disappeared.

Data shows ransomware declined 20% overall – its first drop since 2013 – but enterprise ransomware increased 12%. More than 80% of all ransomware infections hit businesses. The shift is likely due to a decline in exploit kit activity, researchers report, as this was previously a key channel for ransomware delivery. Most ransomware attacks in 2018 spread via email, which remains the primary communication tool for most organizations.

“The major propagation and attack method is via email, and it’s less and less accessible against consumers as they change their habits,” Haley explains. People are more likely to read emails on their phones than their PCs. Most major ransomware families still target Windows-based computers, making consumers less vulnerable as attacks don’t execute on smartphones.

And, of course, there’s the financial factor: “There’s a much bigger payday if you get into an enterprise,” he adds. Consumers may not have the money or willpower to pay attackers for personal files. Businesses are more likely to pay ransom if an attack could shut them down.

Cryptojacking is down but still popular. Last year, Symantec blocked nearly 69 million cryptojacking events, more than four times the amount blocked in 2017. However, researchers detected a 52% drop in cryptojacking events between January and December 2018. During the same time periods, cryptocurrency Monero lost 90% of its value, they explain in the newest ISTR report.

“There’s still money to be made, but it’s harder,” says Haley of the threat. “You have to infect more machines.” And while cryptojacking is still an easy feat for most attackers, it will become more difficult to make the same amount of money if they need access to more devices. Many of them are targeting businesses, which have larger numbers of more powerful devices.

Related Content:

• 19 Minutes to Escalation: Russian Hackers Move the Fastest
• 6 Tax Season Tips for Security Pros
• Valentine’s Emails Laced with Gandcrab Ransomware
• High Stress Levels Impacting CISOs Physically, Mentally

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/formjacking-compromises-4800-sites-per-month-could-yours-be-one/d/d-id/1333908?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

There are severe and unsolved problems in our industry that justify a sustained effort and substantial investment. It’s worth picking one.

There’s been a lot of talk lately of a cybersecurity moon shot. Unfortunately, the model seems to be the war on cancer, not the Apollo program. Both are worthwhile, but they are meaningfully different.

Allow me to start with a line from a speech by President Kennedy on May 25, 1961. Odds are you’ve heard these words:

… This nation should commit itself to achieving the goal, before this decade is out, of landing a man on the moon and returning him safely to the Earth. No single space project in this period will be more impressive to mankind, or more important for the long-range exploration of space; and none will be so difficult or expensive to accomplish.

That’s what a moon shot is: a clear, measurable milestone with reasons for doing it and challenges to overcome. And so the image to recall is not the iconic first footstep, but this:

Unlike JFK’s moonshot, explained Grant Schneider, federal CISO, at the recent 9th Annual Billington Cybersecurity Summit, “there isn’t going to be an instant where we say we’ve achieved success in cybersecurity. We’re not blasting anyone into cyberspace.” Instead, Jeannette Manfra, assistant secretary for cybersecurity and communications at the Department of Homeland Security, put forth a different vision:

Within 10 years, I’d like to see a true fundamental shift in how the Internet is operated in. I’d like to be in a place where we have move passed the “whack-a-mole” approach to cybersecurity incidents.

This is not the way to put a woman on the moon and return her safely to earth. But getting away from whack-a-mole is certainly a worthwhile goal for cybersecurity.

Defining a Moon-Shot Goal for Cybersecurity
The Apollo missions did not do everything that space exploration enthusiasts wanted. We did not establish a permanent presence outside the atmosphere, even if you count the International Space Station. (It makes no claim to being self-sustaining.) It’s been 46 years since a person went to the moon. No one has been to Mars. Of the many goals expressed by the engineers and visionaries, we executed on one. 

On the other hand, we can and should define moon-shot goals for cybersecurity. My goal is to define game-changers, with objectives that are imaginable and with the criteria:

• No single project will be more impressive or impactful.
• No single project will be more important for our long-term ability to operate a resilient cyberspace.
• The result thus justifies the effort and expense.

Some possibilities:

• Payloads attached to email will not result in an attacker’s code running on a computer, or the compromise of credentials needed to log in to it. (That is, phishing, either with a URL, an executable attachment, or an exploit-bearing attachment, will fail. We have many of the parts, such as execution whitelists, anti-execution mitigations, password managers, and MFA, but we rarely deploy them all in an integrated, usable package.)
• Red teams given execution access to a standard desktop cannot move laterally without setting off alarms that are not lost because the SOC is a sea of tranquility.
• Investigators digging into a compromise six months after it’s started can enumerate 90% of the actions taken by a red team.

These goals do not solve every problem in security any more than the moon shot solved every problem on earth, or even within the exploration of space.

My success criteria could be usefully refined, but such refinement distracts from the importance of setting and reaching for a moon-shot-style goal. The goal need not be that every computer has these properties, but it would be useful to achieve them with the most-deployed desktop configuration in the federal government. We need criteria about usability. We need to stop complaining about people, and give people technologies that allow them to safely do their jobs. We need to ensure that if a red team is part of the criteria, the goal is not made meaningless by rules placed on their work.

Focusing our attention on a moon shot can be a powerful technique. There are severe and unsolved problems in our field that may be solvable with the right attention. It is worth picking one.

What other goals are worthy of the name “moon shot”?  Share your thoughts in the comments.

Related Content:

• 2019 Attacker Playbook
• 2018 Was Second-Most Active Year for Data Breaches
• ‘EFAIL’ Is Why We Can’t Have Golden Keys

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Adam is a consultant, entrepreneur, technologist, author and game designer. He’s a member of the BlackHat Review Board and helped create the CVE and many other things. He currently helps organizations improve their security via Shostack Associates, and advises startups … View Full Bio

Article source: https://www.darkreading.com/cloud/making-the-case-for-a-cybersecurity-moon-shot/a/d-id/1333880?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New data from CrowdStrike’s incident investigations in 2018 uncover just how quickly nation-state hackers from Russia, North Korea, China, and Iran pivot from patient zero in a target organization.

It takes Russian nation-state hackers just shy of 19 minutes to spread beyond their initial victims in an organization’s network – yet another sign of how brazen Russia’s nation-state hacking machine has become.

CrowdStrike gleaned this attack-escalation rate from some 30,0000-plus cyberattack incidents it investigated in 2018. North Korea followed Russia at a distant second, at around two hours and 20 minutes, to move laterally; followed by China, around four hours; and Iran, at around five hours and nine minutes.

“This validated what we’ve seen and believed – that the Russians were better [at lateral movement],” says Dmitri Alperovitch, co-founder and CTO of CrowdStrike. “We really weren’t sure how much better,” and their dramatically rapid escalation rate came as a bit of a surprise, he says.

Cybercriminals overall are slowest at lateral movement, with an average of nine hours and 42 minutes to move from patient zero to another part of the victim organization. The overall average time for all attackers was more than four-and-a-half hours, CrowdStrike found.

Russia’s speedy infiltration of organizations versus other nation-states like China – which overall was the most active of all nation states in hacking in 2018 – reflects how Russia’s cyber operations have evolved dramatically over the past few years. Russia wasn’t always so brazen: The shift became painfully obvious during the 2016 US presidential election with its aggressive doxing and hacking and other malicious online activity.

“One of the definitive characteristics of Russia is that it’s willing to go fast and break things” without caring about getting identified or outed, notes John Bambenek, director of cybersecurity research at ThreatStop. “They behave in atypical ways for an intel agency [in cases]. They get a beachhead and keep moving.”

It’s often easier to attribute attacks to Russian hacking teams because they move so quickly and are more likely to make mistakes that out or catch them in their tracks, he says. “Their mindset is to go fast and break things … and they are still getting results,” Bambenek says.

Even if they are outed, they rarely face consequences given the lack of an extradition agreement between the US and Russia.

Russia shifted from cagey to brazen around the fall of 2014, according to Kevin Mandia, CEO of FireEye, who explained the transformation in an interview with Dark Reading after the 2016 election. “Suddenly, they [Russian state actors] didn’t go away when we responded” to their attacks, he said. Historically, Russian attackers would disappear as soon as they were rooted out by investigators: “The Russian rules of engagement were when we started a new investigation, they evaporated [and] just went way.” 

Those days are long gone, experts say.

Jennifer Ayers, vice president of OverWatch and Security Response at CrowdStrike, says attackers overall are getting faster at infiltrating and invading their targets’ networks. Russia’s relative speediness, in part, has to do with its abuse of Web servers that, for example, haven’t been hardened, she says.

“In many cases, they are using common malware and techniques like phishing email campaigns and BEC [business email compromise]. They are using Web servers on the Net that have not been hardened, so it lets them in a faster time move laterally from entry point to the next level,” Ayers explains. Organizations, in turn, must lock down those weakest links and speed up their response rates, according to Ayers.

China
In contrast, China operates more slowly and deliberately, underscored by its more than four hours to get beyond its initial victim in a targeted organization. “They do [the initial attack], step back, get more data, and plan their next steps,” taking time, for example, to create kernel modules for specific machines, Threat Stop’s Bambenek says. “That takes time.”

China last year began reupping its hacking for economic and competitive gain after a temporary reprieve following the 2015 pact between President Obama and China President Xi Jinping not to conduct cyber spying attacks for economic gain. “China is back in economic espionage [attacks] – all of this is taking place across diverse industries,” Alperovitch says. 

China was technically the “biggest story of 2018,” he says.

So far in 2019, China continues to be most active nation-state in cyberattacks, notes Benjamin Read, senior manager for cyber espionage analysis at FireEye. While FireEye hasn’t measured the lateral movement speeds of various nation-states in its investigations, he says, it’s logical that Russia would be the most efficient at escalation.

“It makes sense with their being the most technical of adversaries,” Read says. For now, Russian activity mainly is focused on European targets, he notes.

Russia, not surprisingly, is expected to ratchet up its targeting of the US in the run-up to the 2020 US presidential election.

Now What?
With the average dwell time of an attacker at six months, according to Verizon’s Data Breach Investigations Report (DBIR), just how can defenders apply this so-called “breakout time” of various nation-state actors?

CrowdStrike recommends applying those breakout times to benchmark the time it takes them to detect, investigate, and fix or remediate systems after an attack.

They also can tune their security tools and processes, notes Ayers, setting rules that take into consideration tight time frames. You can set the tools to determine in a matter of minutes whether to take action on a specific threat – blocking a hash if it’s a piece of malware, for example. The tools also can determine whether a threat should be escalated to the incident response team for a deeper investigation, or whether passwords should be reset, she notes.

Speeding up response is key, Bambenek notes. “I care if they are marching through my infrastructure, but once they start stealing data, then I have a real problem,” he says.

Meanwhile, CrowdStrike last year also spotted China, Iran, and Russia upping their targeting of telecommunications providers. Alperovitch says it’s all about control of the Internet: “Just as previous wars fought over telegraph lines and radar and radio waves, this is the new battlefield – every nation wants to get an advantage,” he says. “Telecommunications targets hold so much valuable information.”

Related Content: 

• Russian Cyberspies’ Leaked Hacks Could Herald New Normal
• Nation-State Hackers Adopt Russian ‘Maskirovka’ Strategy
• Former Estonian Foreign Minister Urges Cooperation in Cyberattack Attribution, Policy
• 2019 Security Spending Outlook

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/19-minutes-to-escalation-russian-hackers-move-the-fastest/d/d-id/1333907?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple