STE WILLIAMS

Led by top infosec talent, these cutting-edge courses are an efficient way to get practical, hands-on training in everything from blockchain security to machine learning.

Black Hat USA returns to the Mandalay Bay Convention Center in Las Vegas this August, and it’s shaping up to be the best show to date.

Organizers are pleased to welcome an exciting array of new trainers this year, and invite you to begin perusing the lineup of 2- and 4-Day Trainings. Led by the information security industry’s top talent, these cutting-edge courses are an efficient way to get practical, hands-on training in everything from blockchain security to machine learning.

“An Introduction to Hacking Blockchain Applications and Smart Contracts,” for example, is a 2-day Training which offers an entry-level dive into state of the art methodologies for developing smart contracts for Blockchain enabled decentralized applications (DApps). Expect to focus on the Ethereum blockchain, Web3.0, and the Solidity language, as these are currently the most used platforms for building decentralized applications. You’ll walk away with new skills and new ways to identify (and exploit) the most common vulnerabilities on this platform.

For more advanced hardware work, check out the “Advanced Hardware Hacking – Hands-on Power Analysis and Glitching with the ChipWhisperer” 2-day Training course, which is all about side-channel power analysis for fun and profit. Trainees will use the open-source ChipWhisperer project for both hardware software tools, meaning you can immediately take the knowledge learned in this course and apply it in real life. The course includes a ChipWhisperer-Lite for each student, too, so you’re going to walk away with both new skills and the actual hardware you used to build them. Don’t miss it!

If you want to go even deeper, hone in on the 4-day Trainings. “A Complete Practical Approach to Malware Analysis and Memory Forensics – 2019 Edition” does just what it says on the tin, giving you an introductory look at malware analysis, reverse engineering, Windows internals, and techniques to perform malware and rootkit investigations of real-world memory samples using the Volatility open-source advanced memory forensics framework. Expect hands-on training in the analysis and investigation of various real-world malware samples and infected memory images, including crimeware, malware, and rootkits.

By contrast, “Applied Data Science and Machine Learning for Cybersecurity” offers a more advanced 4-day Training experience. This interactive course will teach your how to use data science techniques to quickly manipulate and analyze network and security data and ultimately uncover valuable insights from this data. The course will cover the entire data science process from data preparation, feature engineering and selection, exploratory data analysis, data visualization, machine learning, model evaluation and optimization and, finally, implementing at scale — all with a focus on security-related problems and solutions.

Take a moment to peruse this year’s Black Hat USA Trainings lineup, which can be easily sorted to show you just 2-Day or 4-Day Trainings in accordance with your schedule.

Black Hat USA will return to the Mandalay Bay in Las Vegas August 3-8, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/black-hat-usa-2019-offers-a-boatload-of-new-training-opportunities/d/d-id/1333788?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The industry has long needed an open, industry-standard testing framework. NetSecOPEN is working to make that happen.

Deciding what products can improve an organization’s network security is a complex process. You must weigh a number of factors as part of the purchase decision, one of the most crucial of which is the impact of the product on network performance. However, given the current state of security product testing, it is virtually impossible to perform an accurate “apples-to-apples” product comparison. Proprietary testing methods conducted under uniquely optimized conditions create a chaotic scenario in which everyone plays by their own rules and customers are left struggling to sort it all out. NetSecOPEN is working to solve this problem by developing an open, industry-standard testing framework.

Wild, Wild West
Other industries have established standards, with which all companies must comply, and for good reason. When different companies use the same terms and claim to use the same metrics but define the terms and calculate the metrics entirely differently, it creates chaos for customers.

For example, years ago there was no standard for determining miles per gallon for vehicles. Automobile manufacturers had their own proprietary definitions and methods for calculating miles per gallon. Two vehicles that both got 25 mpg according to the manufacturer might have wildly different mileage results in the real world. The National Highway Traffic Safety Administration and the Environment Protection Agency stepped in and established standardized definitions and requirements for fuel economy, enabling consumers to use miles-per-gallon ratings to evaluate automobile performance with confidence.

There are many other industries that could benefit from standardized methodologies. Laptop manufacturers cite battery life as a key feature of their devices, but the battery life results customers experience rarely — if ever — live up to the claims. Vendors test battery life in very specific conditions with highly customized configurations. The result is that there is no accurate way to compare battery life claims from one vendor to the next.

Cybersecurity is critical for organizations, and it generally represents a very significant investment. It is not feasible for a company to implement and test a wide variety of solutions to determine which works best. Even when an organization is able to narrow down the options and conduct pilot tests in the organization’s own environment, vendors can, and often do, place strict limits and constraints on how the pilot test is configured and managed

I previously worked in the technology testing field and have firsthand experience with some of the challenges of traditional testing methodologies. Vendors frequently impose specific test requirements that highlight the performance aspects on which they want to focus — which more or less invalidates the purpose of testing in the first place. Ultimately, such an approach threatens the integrity of testing in general.

Standardizing Network Security Product Testing
There are currently no up-to-date, relevant open test standards for network security performance testing. In the last decade, networks have evolved from 80% unencrypted HTTP — in many enterprises, over 80% of the perimeter traffic is now encrypted with HTTPS and modern secure cipher suites. In other words, network traffic has evolved, changing significantly over the last 10 years, but testing standards and methodologies have not been updated or adapted to account for these changes.

One result of these rapid changes and the absence of universal test standards is that to determine the performance of their network security solutions, testing groups have developed proprietary methods. We have reached a critical point, however, where we need to close the gap between proprietary test performance metrics and observed real-world performance. Otherwise, the tests themselves may become meaningless.

What is needed is greater transparency and standardization of testing methodology, with real-world factors integrated into the testing scenarios. Leading cybersecurity tool vendors and testing labs recognize these requirements, which is why momentum is building for developing and implementing standardized testing methodologies.

Role of NetSecOPEN
NetSecOPEN, a nonprofit, membership-driven organization, was formed in 2017 with the goal of developing open standards for testing network security products. Founding members include leading security vendors, test equipment vendors, and testing laboratories, including Check Point, Cisco, Fortinet, Palo Alto Networks, SonicWall, Sophos, and WatchGuard; test solution and services vendors Spirent and Ixia/Keysight; and testing labs European Advanced Networking Test Center (EANTC), and the University of New Hampshire InterOperability Lab (UNH-IOL).

The organization exists to overcome the current situation — competing and confusing testing methodologies — and establish a new way of designing tests that are open, transparent, and created collaboratively. NetSecOPEN’s testing methodology was developed in consultation with the current membership and will continue to evolve as new members join and as a new generation of security products come to market.

The effort to standardize is backed by significant collaboration and momentum. The intent is not to compete with or replace today’s testing labs. In fact, the industry’s premier testing labs support the effort and are collaborating to improve and standardize network security performance testing. Testing organizations and vendors alike recognize that apples-to-apples performance tests that realistically portray the impact of a network security product on network performance are essential, and they are cooperating to make that happen.

Related Content:

• 6 Ways to Anger Attackers on Your Network
• Meet ‘Bro’: The Best-Kept Secret of Network Security
• Remote Access the Diminishing Security Perimeter

Brian Monkman is executive director of NetSecOPEN, a nonprofit, membership-driven organization with a goal of developing open standards for testing network security products. A 25-year network security veteran, he has extensive experience in technical support, sales … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/taming-the-wild-west-world-of-security-product-testing-/a/d-id/1333755?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A security flaw affecting LibreOffice and Apache OpenOffice has been fixed in one of the two open-source office suites. The other still appears to be vulnerable.

Before attempting to guess which app has yet to be patched, consider that Apache OpenOffice for years has struggled attract more contributors. And though the number of people adding code to the project has grown since last we checked, the project missed its recent January report to the Apache Foundation. The upshot is: security holes aren’t being patched, it seems.

The issue, identified by security researcher Alex Inführ, is that there’s a way to achieve remote code execution by triggering an event embedded in an ODT (OpenDocument Text) file.

In a blog post on Friday, Inführ explains how he found a way to abuse the OpenDocument scripting framework by adding an onmouseover event to a link in an ODT file.

The event, which fires when a user’s mouse pointer moves over the link, can traverse local directories and execute a local Python script.

After trying various approaches to exploit the vulnerability, Inführ found that he could rig the event to call a specific function within a Python file included with the Python interpreter that ships with LibreOffice.

Apache OpenOffice, the Schrodinger’s app: No one knows if it’s dead or alive, no one really wants to look inside

READ MORE

“For the solution I looked into the Python parsing code a little more in depth and discovered that it is not only possible to specify the function you want to call inside a python script, but it is possible to pass parameters as well,” he said.

The exploit was tested on Windows, and should work on Linux, too.

Inführ says he reported the bug on October 18 and it was fixed in LibreOffice by the end of the month. RedHat assigned it CVE-2018-16858 in mid-November and gave Inführ a disclosure date of January 31, 2019.

When he published on February 1, in conjunction with the LibreOffice fix notification, OpenOffice still had not been patched. Inführ says he reconfirmed that he could go ahead with disclosure even though OpenOffice 4.16 has yet to be fixed.

His proof-of-concept exploit doesn’t work with OpenOffice out-of-the-box because the software doesn’t allow parameters to be passed in the same way as the unpatched version of LibreOffice did. However, he says that the path traversal issue can still be abused to execute a local Python file and cause further mischief and damage.

We’re imagining specifically targeted netizens being tricked into opening a ZIP file, unpacking an ODT and Python script, and then the ODT document attempting to execute the Python script when the victim rolls their mouse over a link, for instance.

The Register tried to reach two OpenOffice contributors to find out what’s going on. We’ve not heard back.

According to Inführ, OpenOffice users can mitigate the risk by removing or renaming the pythonscript.py file in the installation folder. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/04/apache_openoffice_no_patch/

A computer engineering professor has an interesting idea for how to handle the public disclosure of serious vulnerabilities: don’t.

Professor Gus Uht, engineering professor-in-residence at the University of Rhode Island, USA, argues that everyone would be safer if those who discover serious vulnerabilities refrain from revealing the details to the public, allowing the flaws to be secretly fixed by vendors and developers, and updates pushed out before anyone crafts suitable exploits to hack victims.

The discovered security blunders would thus be privately reported, and kept under wraps until someone actually exploits them in the wild, at which point people can be alerted to make sure they’ve installed the necessary and available patches. In effect, Prof Uht fears disclosing details of weaknesses within software and hardware too soon gives crooks a chance to build exploit code and go on the offensive. We’d argue that publicity draws attention to the need to patch and protect, but what do we know?

“The norm today is to fully disclose vulnerabilities, most often following the tenets of responsible disclosure,” Prof Uht wrote in an editorial for ACM Sigarch at the end of January. “It is our view that this is not the best thing to do since it effectively broadcasts weaknesses, and thus aids and abets black hat hackers as to the best ways to compromise systems.

“With the complexity of current hardware and software systems arising from billions of transistors and millions of lines of code, it is unlikely that any system will ever be bug-free or vulnerability-free. There are effectively an infinite number of unknown vulnerabilities … What then is the point of actively ‘discovering’ new vulnerabilities and disclosing them? They are effectively being invented and empower black hats to wreak havoc without making systems safer. It is a race to the bottom. At the same time it can unnecessarily ratchet up the public’s anxieties.”

In case you’re not already sick of Spectre… Boffins demo Speculator tool for sniffing out data-leaking CPU holes

READ MORE

Uht points at last year’s disclosure of the Spectre and Meltdown CPU side-channel vulnerabilities as an instance where everyone would have been better off had a lid been kept on the flaws while the semiconductor industry worked to adjust their designs and slip out new chips and software mitigations.

For what it’s worth, The Register was first to report the concrete existence of the speculative-execution bugs in modern CPUs in early 2018. Google and others went public with details of the flaws within days, and months of patching and code updates to secure affected processors followed. Intel, AMD, Arm, Microsoft, Red Hat, and other organizations, had privately known about the issues for months, and were working throughout the Fall and Christmas on software and microcode-level mitigations, aiming to release them in time for Windows’ January Patch Tuesday.

The professor suggests that the side-channel flaws were so obscure and difficult to actually abuse in a useful manner, though, that it was unlikely anyone would have ever been able to develop a working exploit and deploy it in the wild. Thus, if everyone had kept schtum until the fixes were in silicon, and in operating system kernels and hypervisors and software toolchains, no-one would have been the wiser, and no exploits would have been developed.

We’re not aware of any malware in the wild leverage the speculative-execution holes, perhaps because they are tricky to abuse and perhaps because so much attention was paid to patching them. There are many, many more flaws out there that are easier to exploit to steal information, for instance.

We’d like to note that El Reg was tipped off to Meltdown and Spectre by noticing obfuscated changes to the open-source Linux kernel in the final months of 2017. These changes indicated some guarantees of security protections provided by today’s processors were mysteriously unavailable, suggesting there was a flaw in the CPUs. Combining this information with previous public research and confirmation from industry sources, led us to reporting on the upcoming patches without disclosing exploitation details.

LibreOffice patches malicious code-execution bug, Apache OpenOffice… wait for it, wait for it… doesn’t

READ MORE

“Although hardware micro-architects are now aware that security needs to be a first-class design parameter, now black hatters have another vulnerability dimension to pursue; who knows what they will come up with?” Uht continued. “The world has been shaken up by the disclosure; was that necessary and helpful?”

Uht thus suggests that the short-term risks of disclosing bugs publicly outweighs the long-term benefits of quietly hardening products.

Regular and long-time Reg readers will be aware of huge debate over responsible versus full versus no disclosure over the years, so there’s not much point repeating it. Well, other than to say: people need to be warned that patches are available, and why they need to be installed, and that some companies won’t patch or admit anything unless there’s public pressure, in our view.

“Thank you for your comments. No satire,” the prof added, when readers of his column criticized his position. “I am serious. Assume someone else does know about a vulnerability. Broadcasting it before a fix has been devised and distributed so that many, many more know about it and can use it with ill intent does not solve the problem, it exacerbates it.”

Professor Uht was not available for comment today. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/04/vulnerability_no_public_disclosure/

Dating-slash-hook-up app Jack’d is exposing to the public internet intimate snaps privately swapped between its users, allowing miscreants to download countless X-rated selfies without permission.

The phone application, installed more than 110,000 times on Android devices and also available for iOS, lets primarily gay and bi men chat each other up, exchange private and public pics, and arrange to meet.

Those photos, public and private, can be accessed by anyone with a web browser and who knows just where to look, though, it appears. As there is no authentication, no need to sign up to the app, and no limits in place, miscreants can therefore download the entire image database for further havoc and potential blackmail.

We’re told the developers of the application were warned of the security vulnerability three months ago, and yet no fix has been made. We’ve repeatedly tried to contact the programmers to no avail. In the interests of alerting Jack’d users to the fact their highly NSFW pictures are facing the public internet, we’re publishing this story today, although we are withholding details of the flaw to discourage exploitation.

Timeline

Researcher Oliver Hough, who said he found and reported the security shortcoming to the Jack’d team some three months ago, demonstrated to The Register how the programming bug can be exploited. We were able to verify it is seemingly possible to access masses of public and private images without logging in nor installing the app.

The app should place strict access restrictions on which images should be viewable, so that if one user allows another user to see a sext pic, only the receiver should be allowed to see it. Instead, it is possible to see everyone’s naked selfies, to be frank.

Fortunately, there appears to be no easy way to connect each of the images to specific individual profiles, although it may be possible to make educated guesses depending on how skilled the attacker is, Hough told us. The infosec bod has previously appeared on El Reg‘s pages, having found Rubrik and UrbanMassage customer info exposed online.

Obviously, having the private images of users accessible to the whole world is not an intended function of the app. Apart from leaking highly compromising snaps of folks, some of its users may not be publicly out as gay or bi, and thus a trove of compromising images of them sitting on the web is not particularly great for their welfare – particularly if homosexuality is illegal where they live.

Jack’d parent company Online Buddies did not respond to repeated requests for an explanation.

This wouldn’t be the first time a dating site’s security slip-up left the private details of its users blowing in the wind. Famously, in 2015 love-rat cyber-warren Ashley Madison was was relieved of the details and activity of millions of its users, which were duly leaked online by hackers.

More recently, dating app Grindr faced criticism after it was found to have been letting some of its analytics partners have access to the personal data, including HIV status, of a number customers. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/05/jackd_private_photo_bug/

Rogelio Vasquez, the owner of California-based PRB Logics Corporation, has pleaded guilty to selling fake branded semiconductor chips from China, some of which made their way into US military systems.

The 44-year-old resident of Orange County, Cali, accepted four charges in a thirty-count indictment: one count of trafficking in counterfeit military goods, two counts of trafficking in counterfeit goods, and one count of wire fraud.

From July 2009 through around May 2016, according to the indictment, Vasquez acquired old, used or discarded chips that had been altered to appear as new from sources in China, and then proceeded to sell those integrated circuits (ICs) to subcontractors who resold them to customers in the US, including defense contractors.

“In order to deceive customers and end users, defendant Vasquez instructed his suppliers to remark ICs in a manner such that his customers and end users seeking new ICs would believe that the ICs were new, rather than used and remarked,” the US federal court indictment [PDF] states.

Nick Hanna, US Attorney for the Central District of California, warned counterfeit goods that fall short of specifications pose a potential threat due to the possibility of failure.

“Some of the counterfeit parts in this case were installed in military applications, which means the trafficking of these circuits posed a threat to national security,” he said in a statement last month.

The indictment suggests the deceptively branded chips included ICs from Analog Devices, Intel, and and Xilinx; there are no allegations they chips cause any actual harm.

According to the plea agreement, Vasquez in 2012 bought fake ICs from China and sold them to a US defense contractor which then provided the counterfeit parts to a primary defense vendor. The suspect chips ended up in a US Air Force classified weapon system.

CES 2019 Hot Tech Product: Microphones

Bloomberg Businessweek says that one of its reporters was invited to witness a sting operation against Huawei, the Chinese telecom giant that has been accused by the US government of fraud, conspiracy, and trade secret theft. The sting, which took place at CES in Las Vegas last month, arose from an investigation into claims Huawei tried to steal the manufacturing technique behind Akhan Semiconductor’s durable screen material called Miraj Diamond Glass.

Vasquez also admits that in 2016 he sold eight ICs that he believed would be used in Air Force’s B-1 Lancer Bomber. And he acknowledges selling some 8,000 counterfeit ICs between April and May 2016 to a company that resold them to a defense contractor. The chips ended up in products used by the US Army, Navy, and Marine Corps.

The total theoretical value of the counterfeit goods sold and seized is estimated to be about $900,000, had the chips been genuine and sold for list price. As part of his plea Vasquez has agreed to forfeit almost $100,000 in ill-gotten gains. He is scheduled to be sentenced on May 10, 2019.

In a 2013 white paper, the Semiconductor Industry Association (SIA), a chip trade group, said semiconductor counterfeiting has risen since the mid-1990s due to the technology boom, e-waste programs, and a growing number of brokers and distributors to meet the needs of buyers and sellers.

Such inquiries have become less common in recent years, the SIA claimed in recent comments submitted as part of Congressional rule making. The trade group wants more seizures of counterfeit electronics and industry information sharing rather than a new export licensing regime as a defense against fake chips.

The investigation of Vasquez and PRB Logics Corporation was conducted by US Immigration and Customs Enforcement’s (ICE) Homeland Security Investigations (HSI), the Defense Criminal Investigative Service, and the National Reconnaissance Office’s Office of Inspector General (OIG). ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/05/us_counterfeit_chips/

The number of data breaches dropped overall, but the amount of sensitive records exposed jumped to 446.5 million last year, according to the ITRC.

Good news: The number of data breaches reported in 2018 dropped 23% compared with 2017. Bad news: The number of sensitive consumer records exposed increased 126% year-over-year.

The data comes from the Identity Theft Resource Center (ITRC), which has been tracking publicly available breach disclosures and reporting on trends since 2005 alongside sponsor CyberScout. Its “2018 End-of-Year Data Breach Report” reflects severe compromise of sensitive consumer data and the methods with which cybercriminals now access personal information.

There were 1,244 breaches reported in 2018, marking a 23% drop from the year prior. But the reported number of consumer records containing personally identifiable information (PII) significantly increased from 197.6 million to 446.5 million – a 126% jump. ITRC notes the actual total number of records exposed is likely higher, given that only half of reported breaches disclose the number.

Sensitive PII wasn’t the only type of data tracked for this year’s report. The number of non-sensitive records (email addresses, passwords, usernames) exposed in data breaches amounted to an additional 1.68 billion compromised records exposed in only 37 of 1,244 incidents.

The lowest rate of exposure was in the business sector, which was hit with the most data breaches (571) but had the smallest amount of data compromised in each. Healthcare had the second-highest number of breaches (363) but had the highest rate of exposure at 9.92 million records total.

The ITRC’s team took a look at the decline in breaches versus amount of information exposed and determined the explanation is twofold. First, businesses are creating more data troves, placing larger amounts of user-submitted data into on-prem and cloud-based stores. At the same time, attackers are scouring the Web for massive data sets, which makes it easier to achieve their goals.

The more data an attacker has on a victim, the easier it is to assume the person’s identity, an ITRC spokesperson explains. If one vulnerable account grants access to birthdates, home and email addresses, Social Security numbers, and driver’s license data, an attacker stops looking. Savvy hackers will take usernames and passwords and try to credential crack into more online accounts, where they could potentially access financial data, shopping history, or travel plans.

How They’re Breaking In
Hacking was the most common breach tactic in 2018, seen in 482 data breaches. Considering the different types of breaches, it led to the third-highest exposure of data (16.7 million consumer records). In 2017 hacking was the most popular type of breach, as seen in 956 breaches, and ranked first for records exposed (168 million in total).

Unauthorized access was the second most common form of attack in 2018, when it led to 377 data breaches and exposed the most records, at 404 million. Accidental exposure was the cause behind 114 data breaches and ranked second for the total number of records exposed (22 million).

Other sources of data compromise included employee error/negligence/improper disposal, which made up 12% of 2018 incidents, insider theft (4%), and data on the move (2%).

The Big Ones
In a year when data breaches were day-to-day occurrences, some incidents stood out, ITRC researchers report.

The Marriott breach, for example, had the highest number of reported records exposed, with 383 million people affected worldwide. Google Plus was also attacked; 53 million people were affected, and the service was shut down. A major Facebook breach let hackers grab 50 million account tokens.

Some of 2018’s biggest attacks involved social media platforms or community-based apps. Facebook, also affected by the Cambridge Analytica scandal, was the most notable compromised company. Cyberattacks also hit MyFitnessPal (150 million victims) and Quora (100 million victims), giving hackers access to usernames, email addresses, passwords, and fitness data.

The travel sector also saw its fair share of cyberattacks. Cathay Pacific, a major Hong Kong-based airline, disclosed a breach affecting 9.4 million passengers – the largest of any airline to date. Radisson Rewards notified customers of a breach when members of its programs were compromised in an incident, and Delta Airlines disclosed a major breach as well.

What You Can Do
The ITRC advises reconsidering the data you request from consumers and only ask for information necessary to run your business. If you run a bakery, do you need a driver’s license number? Probably not.

Following the publication of the ITRC’s 2018 report, security experts also weighed in to share best practices for securing consumer data. Anthony James, chief strategy officer at CipherCloud, urges companies to encrypt personal information in all machines and networks, including on-premise and SaaS-based applications, as well as custom IaaS-based applications.

“Recognize that it is more common to find cyberthieves attacking APIs, middleware, and database-only encryption,” he says. “These are the new skirmish lines for cyberattacks, especially within the cloud where you’re most vulnerable.”

Colin Bastable, CEO of Lucy Security, points to the additional risk of working with third parties. The fewer moving parts involved with handling users’ data, the safer their information is. For example, using Google or Facebook as a login intermediary puts people at chronic risk.

“By combining different accounts, such as by enabling hotel loyalty programs to access airline rewards accounts, users not only increase their risk profile significantly, they may be blindsided,” he says. “You reset your hotel account password, but you did not realize that your airline and car rental accounts may also be compromised.” Many business cloud applications use APIs to integrate with systems, and each connection drives the risk of hacking.

Related Content:

• 6 Security Tips Before You Put a Digital Assistant to Work
• Cisco Router Vulnerability Gives Window into Researchers’ World
• 8 Cybersecurity Myths Debunked
• Dell, CrowdStrike, Secureworks Join Forces to Secure Endpoints

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/exposed-consumer-data-skyrocketed-126--in-2018/d/d-id/1333790?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cayosin brings together multiple strands of botnet tech and hacker behavior for a disturbing new threat.

When botnet-as-a-service meets social media marketing, you have a threat poised to rapidly spread. That’s precisely what researchers have found in a quickly evolving botnet called Cayosin (Kay-OH-sin), which combines the most dangerous features of multiple previous botnets and makes them available to a broad audience at a low price.

When researchers at Perch were going through customer telemetry last month, they found strings they hadn’t seen before. In looking through the signatures, Perch senior threat researcher Paul Scott found leads on a Reddit forum dedicated to Linux malware that showed Cayosin was “actually a custom piece of malware developed from multiple public sources,” Scott explains. “So it’s kind of a Frankenstein between Qbot, Marai, and a few other pieces of software. The actors kind of cobbled them all together to make a new thing.”

This new thing is a botnet for hire that draws marketing and support techniques from the best of legitimate commercial activity. “They were primarily renting spots or having subscribers sign up for an account when it was still in early development, and they were charging a very low amount of money, like $5 a spot,” Scott says. Since Cayosin has matured and become more full-featured, though, the developing syndicate (or individual) has raised the price.

Cayosin has been marketed through “legitimate” social media platforms rather than the Dark Web. One of the first marketing instruments was a YouTube video showing its operation. “[Then] in the comments of the YouTube video, they started talking about an Instagram account that was selling it,” Scott says.

The Instagram account of a user called “unholdable” contains multiple articles and videos explaining how to lease space on the Cayosin botnet, how to best use the malware, and how to purchase source code for the original version of the botnet software. “You can kind of see the development of not only Cayosin but other tools that this threat actor has published” in the Instagram posts, Scott says.

Following the social media accounts led researchers to the additional malware and botnets, including Yowai, a botnet described by researchers at Trend Micro. And tThe social media accounts are allowing the developer of Cayosin to engage in market research and customers support on a commercial scale.

“If you were to click on [the post], you can see that he’s like, ‘Hey, can you give me some feedback on the service I’ve been providing to you?'” Scott says. “I mean, he’s very good on customer service — top notch — and his marketing game and advertising is on point. I mean, he is letting everybody see everything through the Instagram Stories that he’s publishing here.”

Cayosin is evolving in both its ability to infect new systems and the payloads it can distribute, he adds. “It’s got a lot of different vulnerabilities packaged into it. It is looking for vulnerabilities in Linux Web servers, Internet of Things devices, and a number of routers,” Scott says.

With the evolution comes increasing business success. “This is just the newest iteration, and they’re actually starting to build up a following and a real service and business for their customers,” he says. “As each of these tools gets burned out because everybody learns the infrastructure, they just republish it under a new name.”

While Cayosin has primarily been used to launch distributed denial-of-service (DDoS) attacks, Scott says the evolving payloads show it’s beginning to see action as a tool for exfiltrating sensitive information, stealing credentials, and other activities that may have a greater economic impact than simple DDoS.

While an individual attack using the new botnet may have an impact, Scott indicates that the greater threat may come from the new business model Cayosin represents. “There’s a whole culture here,” he says. “So this is a generation that’s very comfortable with social media. They’re just making it part of their infrastructure. We’re moving out of the Darknet and into the light.”

Related Content:

• Justice Dept. Alerting Victims of North Korean Botnet Infections
• Report: Bots Add Volume to Account Takeover Attacks
• The Coolest Hacks of 2018
• Your Life Is the Attack Surface: The Risks of IoT

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/new-botnet-shows-evolution-of-tech-and-criminal-culture/d/d-id/1333792?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The European Commission has ordered the recall of a smartwatch aimed at kids that allows miscreants to pinpoint the wearer’s location, posing a potentially “serious risk”.

The commission uses its Rapid Alert System for Non-Food products (Rapex) to send out alerts to other nations in the European Economic Area about dangerous products in their markets.

The latest weekly report includes German firm Enox’s Safe-KID-One watch, which is marketed to parents as a way of keeping tabs on their little ones – ostensibly to keep them safe – and comes with one-click buttons for speed-dialling family members.

Year after being blasted for dodgy security, GPS kid tracker biz takes heat again for leaving families’ private info lying around for crims

READ MORE

However, the commission said the device does not comply with the Radio Equipment Directive and detailed “serious” risks associated with the device.

“The mobile application accompanying the watch has unencrypted communications with its backend server and the server enables unauthenticated access to data,” the directive said.

As a result, data on location history, phone numbers and device serial number can be found and changed.

“A malicious user can send commands to any watch making it call another number of his choosing, can communicate with the child wearing the device or locate the child through GPS,” the alert warned.

It ordered public authorities to “recall the product from end users”.

Data protection experts suggested this is the first time the Rapex system has been used for dangerous products related to data protection and privacy. Data protection officer Bernieri Christian, who spotted the alert, described the use of the system – and the product recall – as “huge”.

1/4 This is huge!! As far as I know, the UE has issued the FIRST Rapid Alert (#RAPEX) for dangerous products that may be related to data protection and #Privacy.

This drive me crazy: the product is a smartwatch for MONITORING KIDS (#ENOX SAFE KID ONE with GSM and GPS integrated) pic.twitter.com/huFsSxDrOp

— Bernieri Christian (@prevenzione) February 1, 2019

The Enox watch is far from the only creepy, leaky kid-tracking smartwatch on the market. In October, security firm Mnemonic and the Norwegian Consumer Council released a report that found “significant security flaws, unreliable safety features and a lack of consumer protection” in the models they tested.

Similar issues have been raised about connected toys; last June Amazon stopped selling CloudPets toys after privacy advocates raised the alarm about the devices, in which a range of security holes had been found.

We’ve asked Enox for comment. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/04/european_commission_security_risks_kids_smartwatch/

A security flaw affecting LibreOffice and Apache OpenOffice has been fixed in one of the two open-source office suites. The other still appears to be vulnerable.

Before attempting to guess which app has yet to be patched, consider that Apache OpenOffice for years has struggled attract more contributors. And though the number of people adding code to the project has grown since last we checked, the project missed its recent January report to the Apache Foundation. The upshot is: security holes aren’t being patched, it seems.

The issue, identified by security researcher Alex Inführ, is that there’s a way to achieve remote code execution by triggering an event embedded in an ODT (OpenDocument Text) file.

In a blog post on Friday, Inführ explains how he found a way to abuse the OpenDocument scripting framework by adding an onmouseover event to a link in an ODT file.

The event, which fires when a user’s mouse pointer moves over the link, can traverse local directories and execute a local Python script.

After trying various approaches to exploit the vulnerability, Inführ found that he could rig the event to call a specific function within a Python file included with the Python interpreter that ships with LibreOffice.

Apache OpenOffice, the Schrodinger’s app: No one knows if it’s dead or alive, no one really wants to look inside

READ MORE

“For the solution I looked into the Python parsing code a little more in depth and discovered that it is not only possible to specify the function you want to call inside a python script, but it is possible to pass parameters as well,” he said.

The exploit was tested on Windows, and should work on Linux, too.

Inführ says he reported the bug on October 18 and it was fixed in LibreOffice by the end of the month. RedHat assigned it CVE-2018-16858 in mid-November and gave Inführ a disclosure date of January 31, 2019.

When he published on February 1, in conjunction with the LibreOffice fix notification, OpenOffice still had not been patched. Inführ says he reconfirmed that he could go ahead with disclosure even though OpenOffice 4.16 has yet to be fixed.

His proof-of-concept exploit doesn’t work with OpenOffice out-of-the-box because the software doesn’t allow parameters to be passed in the same way as the unpatched version of LibreOffice did. However, he says that the path traversal issue can still be abused to execute a local Python file and cause further mischief and damage.

We’re imagining specifically targeted netizens being tricked into opening a ZIP file, unpacking an ODT and Python script, and then the ODT document attempting to execute the Python script when the victim rolls their mouse over a link, for instance.

The Register tried to reach two OpenOffice contributors to find out what’s going on. We’ve not heard back.

According to Inführ, OpenOffice users can mitigate the risk by removing or renaming the pythonscript.py file in the installation folder. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/04/apache_openoffice_no_patch/