STE WILLIAMS

A piece of banking malware that first debuted more than a decade ago is once again wrecking havoc.

Known as Ursnif, the malware has been spotted in the wild by Cisco’s Talos security team, and is currently spreading in the wild via poisoned Word documents.

The Talos bug-hunters say the Ursnif infection has been active for months, infecting machines and then quietly logging activity and keystrokes in hope of catching users entering their banking credentials or other sensitive financial information.

Cyber-crooks think small biz is easy prey. Here’s a simple checklist to avoid becoming an easy victim

READ MORE

“The alert piqued our curiosity, so we began to dig a bit deeper and provide some recent IoCs related to this threat, which traditionally attempts to steal users’ banking login credentials and other login information,” Talos said in its summary of the finding.

“Talos has covered Ursnif in the past, as it is one of the most popular malware that attackers have deployed recently.”

This is the latest in a game of cat-and-mouse researchers have had with Ursnif criminals spanning back more than eleven years. When it was first reported at the tail end of 2007, Ursnif was classified as a variation of Gozi, a family of banking malware developed for use by Russian cybercrime groups. At that time, Ursnif was being spread via poisoned PDF files.

More than a decade later, Ursnif is back as a favored tool of financial cybercrime groups. The delivery method has remained largely the same too. The creators of this current build are embedding the attack code into a VBA macro command of a Word document and the recipient is instructed to enable macros to view the image if the function isn’t already turned on. Once they do it’s pwnage time!.

The macro is mostly full of junk mathematical functions intended to hide the real payload, but includes the following code which creates a PowerShell command using the AlternativeText property of the Shapes object “j6h1cf.”.

[email protected] RTrim(LTrim(Shapes("j6h1cf").AlternativeText)), 84 * 2 + -168

Once executed the PowerShell command contacts a command and control server and downloads Ursnif into the AppData directory. But it doesn’t run immediately – that would be too obvious – but uses a series of generated PowerShell commands to unpack the malware, create a malicious DLL, allocate memory for it to function and then fire up the full malware application itself.

The latest iterations of the malware also opts for HTTPS connections to its command and control servers, does much of the dirty work of collecting the data in TEMP files and transmits the harvested keystrokes and data as archived .cab format files.

These tactics all make Ursnif tough to spot for most security tools. As ever, disable macros as a standard and only enable them on a case-by-case basis once you are sure of the document’s provenance. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/28/ursnif_malware_talos/

Roundup This week we saw Hadoop hacks, Exchange exploits, and Deadpool besting scammers.

Here’s some more computer security news to round off your week…

Alarms sounded over incoming Cisco attacks

Earlier this week, Cisco cleaned up a series of security flaws in its routers. Now, admins are being urged to apply those fixes as soon as possible now that exploits for two flaws in particular are public.

A security dev going by the name of David Davidson has provided proof-of-concept code that leverages a data-disclosure vulnerability (CVE-2019-1653) in the RV320 WAN router, and extracts various configuration files and other information from the machine. You don’t have to be authenticated, you just have to be able to reach the router’s web-based management portal. This is useful for checking whether or not a device is vulnerable, and whether Cisco’s patch actually works.

The code also achieves remote code execution as root on the router (exploiting CVE-2019-1652) if you know any valid login creds for the box. You can always try to crack the passwords fetched via the info-disclosure bug, or brute-force or guess them.

What’s more, botnet watcher Troy Mursch has spotted miscreants scanning the public internet for vulnerable RV320 routers. This means we now have both working exploits and people trying to find vulnerable devices.

If you’re an admin at a company running one or more of these Cisco WAN routers, you will want to make sure all of the boxes have the latest patches installed, and you should probably do it ASAP.

Adobe Experience Manager gets patched up

While not as prominent as other products like Create Cloud or Flash, Adobe’s Experience Manager is a well-used CMS and forms platform. So anyone running it will want to make sure they have installed the patches Adobe posted earlier this week.

The update patches up cross-site scripting and information disclosure flaws in Experience Manager and one cross-site scripting vulnerability in Experience Manager Forms. Updating to the latest version will apply all of the needed patches.

Credit for discovering the Forms bug was given to researcher Adam Willard.

In brief… Millions of loan and mortgage documents were accidentally exposed to the public internet via a poorly secured database, TechCrunch reports. The system has since been secured.

The PHP Extension and Application Repository (PEAR) was hacked, and go-pear.phar was maliciously tampered with. Anyone who downloaded that software manager between July 2018 and January 2019 may have fetched a poisoned version. “If you have downloaded this go-pear.phar in the past six months, you should get a new copy of the same release version from GitHub (pear/pearweb_phars) and compare file hashes. If different, you may have the infected file,” the PEAR team warned this week.

Google has removed two programs from its Android Play Store – Currency Converter and BatterySaverMobi – that contained online-bank-account-raiding Trojan Anubis. Interestingly, the malware also detects the phone’s motion sensors for movement: if any is detected, it continues on, and if not, then it figures it’s being analyzed in an emulator, and kills itself.

Girl Scouts and HPE to offer cyber-security merit badge

HPE is going to be teaching Girl Scouts how to manage an entirely new type of cookie, as the enterprise tech giant announced this week it would work with the young women’s group to offer a new cybersecurity badge.

The patch will be offered through the Girl Scout Juniors (age 9-11) program and will be focused on how scouts can protect themselves online and steer clear of identity theft and financial fraud schemes.

“Girls are going online earlier and earlier, and it’s especially crucial that they are equipped with the knowledge and tools they need to be savvy consumers, to protect themselves, their identity and data,” said CEO Lidia Soto-Harmon of Girl Scouts Nation’s Capital.

In addition to the patch, the Girl Scouts and HPE are going to develop an online game that centers around how to deal with online scams and privacy protection.

Washington DC worries over bugged Chinese rail cars

Security paranoia is nothing new in the US capital, but this latest episode of infosec scrutiny might be a bit much even for Washington, DC.

A report from NextGov examines how Senators have become concerned that the planned overhaul of the District’s metro rail system with new carriages could put national security at risk.

Four Senators have signed a letter asking the head of the Washington Metropolitan Area Transit Authority to develop a plan to make sure that the agency does not end up purchasing cars from Chinese companies that might be bugged by that country’s government.

The agency is reportedly planning to amend its request for proposals to include a requirement that the cars be built to NIST information security standards.

National intelligence advisers urge US to push hard on cybersecurity

While it is no secret that the US government is trying to improve its cybersecurity protections and practices, a key report this week signaled an even greater urgency is needed.

The National Intelligence Service has released its first report in four years on the US security threat landscape, and cyber looks to be a top priority.

For the first time the report places cybersecurity intelligence alongside areas like counterterrorism and counterintelligence, a signal that, at least as far as intelligence officials are concerned, data protection is now every bit as important as securing physical securities and guarding against spies.

“We face significant changes in the domestic and global environment; we must be ready to meet 21st century challenges and to recognize emerging threats and opportunities,” the report reads.

“To navigate today’s turbulent and complex strategic environment, we must do things differently.”

Trump man hauled in on charges of WikiLeaks dealing

A key figure in Donald Trump’s presidential run has been cuffed and accused by the FBI of lying to Congress about the campaign’s use of stolen Democratic party emails to derail rival Hillary Clinton’s bid for the White House.

Roger Stone was cuffed early Friday morning after being indicted on seven charges related to the ongoing Mueller probe into the 2016 White House race. Specifically, he was charged with one count of obstruction of an official proceeding, five counts of false statements, and one count of witness tampering.

Among the allegations is the claim that Stone was part of the chain of intelligence between the Trump administration and WikiLeaks, which allegedly obtained sensitive Democratic party documents from Russian agents. Those documents – emails lifted from the Clinton campaign and DNC by Kremlin hackers – were credited with helping, in part, Trump win the 2016 election.

It should be noted that WikiLeaks has categorically denied the emails came from Russia. Stone denies any wrongdoing.

CitizenLab creeped out by government surveillance

Digital rights and research group CitizenLab says it has been the target of surveillance, possibly from the shadowy Israeli digital intelligence firm NSO Group.

The research foundation revealed on Friday that two of its investigators had been approached by people who were trying to collect sensitive personal information by creating fake companies and identities. On both occasions, CitizenLab said, it sniffed out the operations and confronted the individuals.

While Citizen Lab says it can’t definitively tie the operation to NSO Group, it has a pretty strong hunch the company is in some way connected. Researchers were asked about antisemitism at the non-profit and whether this would have sparked interest in investigations.

“This failed operation against two Citizen Lab researchers is a new low. Citizen Lab research is public, and the evidence that we use to draw our conclusions is public as well,” CitizenLab said.

“We have always welcomed debate and dialogue about our work, but we condemn these sinister, underhanded activities in the strongest possible terms. Such a deceitful attack on an academic group like the Citizen Lab is an attack on academic freedom everywhere.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/26/security_roundup_250119/

Analysis In an unprecedented decision that has left tech observers struggling to contain their shock, Facebook has decided to create a common software architecture for its three main apps: Facebook Messenger, Instagram, and WhatsApp.

After all, never before in corporate history has one company spent billions acquiring other organizations and then pulled them all under one framework. Companies are usually expected to keep running subsidiaries as entirely separate entities for the remainder of time, even though it would make an enormous amount of sense on every level to consolidate them.

The order has come from on high – the mighty Zuckerberg himself – according to a report in the New York Times, with software teams told to finish up on the work within a year.

The decision came out of the blue with absolutely no indications beyond the high-profile exit of the founders of both Instagram and WhatsApp from Facebook in recent months.

It has also come as a shock to those who imagined that Facebook’s promise that it would allow both outfits – WhatsApp and Instagram – to act independently when it acquired them has not lasted forever.

The backlash has been swift: netizens have taken to their Facebook Messenger, Instagram, and WhatsApp accounts to assure Zuckerberg that his corporate interference will not go unchallenged and that they will, at some point soon, delete those apps from their phone. Just not yet.

There are several serious implications to the decision to integrate Messenger, Instagram, and WhatsApp, however. For one, Facebook has already been under fire for sharing user data across its apps, particularly when it acquired WhatsApp. The UK’s Information Commissioner in particular is unhappy with how Facebook has repeatedly refused to view user data acquired by the three different as separate datasets.

One happy family

If the three are consolidated on top of a single software platform, it is inevitable that Facebook will connect user accounts through their unique identifiers, removing a degree of pseudo-anonymity that some Instagrammers and WhatsApp users in particular value.

But Facebook is of course banking on the fact that the vast majority of users of all three apps will continue to use them as before, which will give the company greater access to its users’ data and everyday lives, which it will then find new ways of profiting from. Most users remain blissfully aware of what Facebook actually does, despite countless articles explaining it.

One plus to the plan, according to those briefed on it, is that end-to-end encryption will be carried over from WhatsApp to all three apps (although Instagram is not a messaging service). That may see Facebook put under pressure by law enforcement personnel, and we wouldn’t be surprised to find that the software reorganization incorporates an FBI-friendly backdoor.

According to the NYT report, there is some internal annoyance at the plan with some unsure as to the benefit of tying the services together, especially since they don’t expect it to bring in many new users.

Which suggests that people working at Facebook are oblivious to how the company actually makes the money it uses to pay their wages. Hint: it’s by gathering as much user data as possible and selling it to advertisers. Some employees have reportedly left as a result of the plans, although it’s safe to say that many, many more have stayed because they get paid incredibly well.

Facebook are going to monetize encrypted messaging by consolidating metadata analysis of 3 key platforms (Messenger, Whatsapp Instagram). They will make money by tracking your relationships and social groups. They will make that information easily accessible to law enforcement.

— Sarah Jamie Lewis (@SarahJamieLewis) January 25, 2019

Another possible benefit for Facebook to the consolidation plan is that it would make it much harder for lawmakers and antitrust investigators to argue that Facebook should be broken up: because each would be working from a common framework.

Special

In short, the decision is a pretty obvious one for a large corporation to take. It seems unlikely that there is anything so super-special about the underlying architecture of WhatsApp or Instagram that the same services can’t be run on Facebook’s systems.

Facebook didn’t care if your kids ran up gigantic credit card bills – lawsuit

READ MORE

Of course that doesn’t mean that it won’t create more software problems that it solves: the history of IT is littered with bad attempts to force different products to work off the same foundation.

But the benefits to Facebook are significant, including the ability to get rid of many of the (very expensive) software engineers that are currently needed to support three different products. And plans to introduce its own cryptocurrency.

With the departure of WhatsApp and Instagram founders, the company has already saved itself a fortune in share allocations. What’s that? You just figured out Facebook isn’t a cuddly bear but is instead a ruthless, profit-driven corporation that wants your data and will let your kids run up huge bills?

We’re so sorry about that. Now go back to tagging your friend in that pic at the event you heard about through Facebook. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/25/facebook_messenger_whatsapp_instagram_merger/

In time for Data Privacy Day, on Monday, the nine-point guidance will offer insights into how companies can more effectively manage personal data.

It’s easy to be cynical about Data Privacy Day, especially with all the data that companies collect on individuals today. Some have even taken to calling Monday’s special day of events Lack of Privacy Day.

Fear not. In time for Data Privacy Day, the Internet Society has issued a nine-point code of conduct that offers insights into how companies can more effectively manage personal data, including ways to improve how they handle anonymized data and keep consumers better informed on what they actually consented to releasing.

“People regard data as a commodity they can exploit, but they have to change to becoming a responsible steward of that data,” says Christine Runnegar, senior director of Internet trust for the Internet Society. Companies have to change their mindset, she adds.

They also must be held accountable and stop using the consumer’s consent to excuse bad practices, she says. For example, very often company websites will post long-winded forms at the bottom of the page written in legalese that people gloss over and accept.

“People often don’t know what it means or what the risks are,” Runnegar says. “Businesses have to offer a clearer explanation of what the personal data will be used for and make clear that it is for legitimate and reasonable purposes. They should follow up with written explanations in plain language of what the person actually consented to releasing.”

There’s good reason for the concern. TrackOff reports that 75% of the websites people visit collect information about them and, on average, that personal information gets sold for as low as less than three cents. Data brokers have expanded from collecting a person’s browser history and email to making inferences about religious affiliations, credit card information, and even health issues.

But with GDPR in effect, the California Consumer Privacy Act coming on line next year, and Brazil and India focusing on privacy, companies and security pros can no longer ignore it and have to find ways to layer in privacy with security.  

Take Care of Anonymized Data
The Internet Society’s code of conduct also makes clear that anonymized data should be treated as if it were personal data. A good example: A travel website may ask for your name, address, age, and frequent travel destinations. In anonymizing the data, the company may strip out the names and run an analysis on the age demographic of people who visit a certain destination. Today, companies often resell this information, but moving forward they need to think twice about doing so because there are ways to trace that data back to specific individuals.

“We also want companies to be creative and go above and beyond what the privacy laws require,” Runnegar says. “A good example would be a secure messaging service that would only use your phone number to set up the account, then delete it after that so it can’t be reused.”

Jadee Hanson, CISO at Code42, says too many companies don’t even know what kind of data they have, and, even if they do, they haven’t set specific rules on who can use what data and how they will monitor that those rules will be followed.

“Once I have established what PII the company has, then I need to use security controls to set privacy settings for the two people who can have access to that data,” Hanson explains. “Where companies fall down is they don’t have any way to validate that the rules are being followed.”

Related Content:

• California’s New Privacy Law Gives GDPR-Compliant Orgs Little to Fear
• 7 Privacy Mistakes That Keep Security Pros on Their Toes
• Satya Nadella: Privacy Is a Human Right
• 3 out of 4 Employees Pose a Security Risk

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: https://www.darkreading.com/endpoint/privacy/internet-society-to-issue-privacy-code-of-conduct/d/d-id/1333739?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Analysis The Illinois Supreme Court on Friday ruled that a family’s lawsuit against downmarket-Disneyland Six Flags for allegedly violating the state’s Biometric Privacy Act can proceed, reversing an appellate court ruling that rejected the claim because the plaintiff’s did not allege any specific harm.

The ruling [PDF], being hailed by consumer and privacy advocacy groups and condemned by industry trade groups, has major implications for privacy claims in Illinois, and perhaps for future state and federal privacy regulation across America.

The law requires companies that want to collect biometric data have to obtain informed opt-in consent. It recognizes that a biometric privacy violation is actionable under the law even in the absence of harm following from the violation, like identity theft.

The court ruling bodes ill for companies like Facebook and Google that have been sued under the state law and have been lobbying for years to undo it. A bill backed by industry groups that consider the law commercially damaging is being considered by the Illinois legislature. If passed, it will limit the law’s privacy protections.

The Biometric Privacy Act, enacted in 2008, is considered to be one of the strongest privacy laws in the US because it allows private individuals to bring claims to protect their privacy. Other privacy laws restrict the right to sue to government authorities.

Hands off my kid’s fingers!

The case, Rosenbach v. Six Flags Entertainment Corp, was brought by Stacy Rosenbach, the mother of 14-year-old Alexander, who alleged that the theme park’s collection of her son’s fingerprint data was done without written consent or the data handling disclosures required under the law.

Six Flags challenged the family’s lawsuit on the grounds that the family had not alleged any actual harm, something that’s difficult to prove with privacy cases, and a state appellate court agreed.

However, the Illinois Supreme Court overturned that decision, stating that the Biometric Privacy Act was written to address “risks posed by the growing use of biometrics by businesses and the difficulty in providing meaningful recourse once a person’s biometric identifiers or biometric information has been compromised.”

No, you can’t have a warrant to force a big bunch of people to unlock their phones by fingerprint, face scans

READ MORE

“Contrary to the appellate court’s view, an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages and injunctive relief pursuant to the Act,” the court concluded.

In December, a judge in Chicago, Illinois, dismissed a 2016 claim against Google over facial data collection in Google Photos because the plaintiff didn’t suffer “concrete injuries.” It’s unclear whether today’s ruling will lead to the resurrection of that claim. Facebook is currently facing a class action lawsuit in the state over its use of facial recognition technology.

The Biometric Privacy Act’s rationale for holding companies to a higher standard of protection for biometric data than for personal information like social security numbers is that biometric data cannot be easily changed.

“Biometric information is uniquely sensitive,” said Abraham Scarr, director of Illinois PIRG Education Fund, in a statement.

“You can cancel your credit card but you cannot cancel your face. Illinois’ biometric privacy law is unique in part because it gives individuals the power to enforce the law when their rights have been violated. We applaud the Illinois Supreme Court for reaffirming consumers’ ability to effectively defend their rights.”

Let a thousand lawsuits bloom

“The Illinois Supreme Court has adopted the view that EPIC has long argued as amici in standing cases – a violation of a privacy law is sufficient to confer standing,” said Alan Butler, senior counsel at the Electronic Privacy Information Center, in an email to The Register.

“It should not be necessary for a plaintiff to show additional, compensable injury. As the Illinois court explained regarding the state biometric privacy law, that ‘would be completely antithetical to the Act’s preventative and deterrent purposes.'”

Meanwhile, Todd Maisch, president and CEO of the pro-business Illinois Chamber of Commerce, issued a statement of concern: “We fear that today’s decision will open the floodgates for future litigation at the expense of Illinois’ commercial health.”

In November, 2018, the National Law Review said at least 32 cases had been filed in the preceding two months by Illinois residents against companies over their handling of biometric data. It also said state legislatures in Alaska, Connecticut, Massachusetts and New Hampshire are looking into similar legislation. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/25/six_flag_fingerprint_lawsuit/

In cybersecurity, as in history, security leaders who forget the lessons of the past will be doomed to repeat them.

The chief information security officer (CISO) role may seem relatively new to those who work in organizations hiring their first or second CISO. However, it has been almost 25 years since Steve Katz was hired as the first CISO at Citibank. While few organizations would argue today that an organization does not need someone accountable for the cybersecurity program, the role is quite varied across organizations.

The position may exist at an executive level (i.e., executive or senior vice president role), a middle management role (director/manager) or may be an individual role combined with other system administration activities in a small organization. Whatever the level, to quote Harry Truman, what CISOs should know to be successful today is that the only thing new in the world is the history you don’t know.”

I believe the past teaches us that there are five distinct stages of CISO evolution that lead to a cybersecurity success story. Each stage had a different focus based upon the events at the time, as shown in the following diagram.

CISO Phase 1: The Limited Security Phase (Pre-2000)
Organizations secured their assets during this phase, but without the level of management and board of director awareness we have today. The function was typically buried in the data center and the main function was to provide logon access and authorization to files. As such, the function was primarily a technically oriented function.

2019 CISO Advisory: Technical skills are still necessary, but not sufficient for CISO success. Emphasis should be on breadth of technical knowledge across the entire infrastructure versus depth in a specific technology.

CISO Phase 2: Regulatory Compliance (2000–2004)
This phase saw the passage of a plethora of new laws addressing privacy and security in the healthcare, government, and financial sectors. It was during this period that the requirement for an “information security officer,” commonly referred to today as the CISO, came into being for many organizations. Connectivity to the Internet and mainstream awareness of data breaches were occurring. Company resources were mobilized to “check the box” for security compliance, typically adhering to a set of controls defined by ISO27001/2 or COBIT.

2019 CISO Advisory: The laws are ever-changing, and the CISO needs to be aware of laws affecting the organization, as well as the differences between the controls necessary to be compliant with each law. Successful CISOs will consolidate these requirements and tie implementation projects to satisfy multiple laws to reduce organizational change management disruption.

CISO Phase 3: Risk-Oriented CISO (2004–2008)
The “check-the-box” compliance phase did not live up to expectations because organizations could not afford to secure all the information equally. The movement to a risk-based approach facilitated allocation of funds to more critical assets and a better use of people, process, and technology. This also provided an inroad to corporate risk management and enabled a conversation of information security risk along with other organizational risks.

2019 CISO Advisory: CISOs must always look at controls in terms of probability and impact, recognizing the organization can choose to accept, mitigate, transfer, or avoid the risk. These risk strategies must be clearly defined and explicitly approved by management.

CISO Phase 4: Socially Mobile Cloud-Enabled Threat Aware CISO (2008–2016)
Just when the CISO was getting a handle on risk, new technologies were implemented, such as the introduction of social media on a mass scale, a smartphone in every pocket, consumerization of technology, and migration to the cloud. All of this happened in less than a decade, and the CISO had to adjust. The CISO could not say, “No, this technology is too risky.”

2019 CISO Advisory: The technical environment today will substantially change within the next five to 10 years. Artificial intelligence, the Internet of Things, managed security service provider outsourcing, machine learning, quantum computing, blockchain, mobile applications, managing third-party vendor relationships, and different methods of managing these components will emerge, and the CISO will need to stay ahead of the curve to adapt. Always.

CISO Phase 5: Privacy and the Data-Aware CISO (2016–2020s)
Several major incidents involving the use of personal information for social media purposes beyond the expectations of individuals has given rise to an increased focus on privacy. The General Data Protection Regulation (GDPR), effective May 2018, also increased the visibility of data protection through the introduction of substantial fines as much as 4% of annual turnover (revenue). Organizations, until now, typically have been deficient in the management and retention of unstructured data as well as business ownership and access to the structured information within the organization.

2019 CISO Advisory: The CISO must have knowledge of the critical information assets, or crown jewels: where they are kept, for what purpose, and for how long. The CISO should become as knowledgeable in privacy laws and concepts as much as being knowledgeable of security practices. The CISO must know where the data is, how it flows through the organization, and how it is being secured. In the event of a breach, this information becomes crucial for the incident response teams.

We still have a long way to go to educate members of the workforce with their own roles with respect to cybersecurity. As indicated in recent culture of cybersecurity research from ISACA and CMMI Institute, only 34% of employees, outside of the security team, adequately understand their role in the organization’s desired cybersecurity culture.

Bottom line, in 2019 the CISO who understands the breadth of technology used and desired by the organization, complies with the regulations via control frameworks, assesses information asset risk, expands security beyond the organization (such as cloud, mobile, social media, threat intelligence networking), and knows how the privacy regulations affect the organization (where the data is, how it is being used, and how it is being protected) will be the CISOs in demand by their organization and others.

Author’s note: This evolution to CISO and the implications, along with an insightful interview with the first CISO, Steve Katz, are detailed in the author’s newly released 2019 book, CISO COMPASS: Navigating Cybersecurity Leadership Challenges with Insights from Pioneers.

Related Content:

• Real-World Threats That Trump Spectre Meltdown
• Think Twice Before Paying a Ransom
• Enterprise Malware Detections Up 79% as Attackers Refocus

Todd Fitzgerald has built and led information Fortune 500/large company security programs for 20 years. He was named 2016–17 Chicago CISO of the Year, ranked Top 50 Information Security Executive, authored four books  —   CISO Compass: Navigating … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/the-5-stages-of-ciso-success-past-and-future/a/d-id/1333710?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Recent statistics show just how much credential stealing has become a staple in the attacker playbook.

Image Source: Envato Elements

This month’s discovery of a massive repository of 773 million stolen email addresses and 21 million stolen passwords offers the industry another valuable piece of evidence about how out-of-control online credential theft has become. And it’s backed by many recent statistics that show just how much credential stealing is now a staple in the attacker playbook.

In practice, the bad guys gather as much stolen password data as they can collect from low-hanging fruit — often low-value sites with little protection — which they then use to fuel attacks against better secured targets. Those subsequent attacks typically start with credential stuffing, in which attackers automate the process of recycling the credential information they’ve stolen from one platform, website, or system and trying it against another.

“Credential-stuffing attacks are much more effective than simple brute forcing, as people often use the same credentials for accessing various systems,” according to analysts with Positive Technologies.

Here’s a look at some of the statistics that offer a bit of insight into the problem of credential theft and stuffing, and where we are at mitigating these risks.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/credential-compromises-by-the-numbers/d/d-id/1333733?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In a talk at the World Economic Forum, Microsoft’s CEO voiced support for GDPR and expressed hope the United States creates a similar approach to privacy.

Microsoft CEO Satya Nadella believes privacy is a human right and called for new global norms on data, privacy, and artificial intelligence in a talk held at the World Economic Forum in Davos.

Nadella, who has driven a cloud-focused approach at Microsoft, sees a need for improved data regulations. People should own their data by default, he said, and he hopes the United States – along with the rest of the world – agrees on a common privacy standard.

“My own point of view is that it’s a fantastic start in treating privacy as a human right,” he said of GDPR, the World Economic Forum reports.

In addition to privacy, Nadella also voiced his concern for the growing prevalence of artificial intelligence, specifically facial recognition. “I can come up with 10 uses that are very virtuous and important and can improve human life, and 10 uses that would cause problems,” he said.

In an example of the former, he said, New Delhi police used facial recognition to identify thousands of mission children in four days. However, there is potential AI could be used to invade privacy. While Microsoft has created principles to govern AI’s use, he noted, self-regulation isn’t sufficient.

Read more details on the WEF site here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/satya-nadella-privacy-is-a-human-right/d/d-id/1333737?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The nation suspects Russia’s hand in the attacks, which seem aimed at disrupting the upcoming presidential election.

As reported by Reuters, officials in Ukraine say hackers, likely controlled or sponsored by Russia, are targeting government and political party servers in an attempt to disrupt the presidential election scheduled for March.

Attackers are using a variety of phishing techniques in addition to simply purchasing stolen credentials in campaigns that are similar to ongoing cyberattacks on the country’s energy, transport, and banking systems, officials say.

So far, no successful penetration of the national election system has occurred, though more strenuous attacks are anticipated as the election draws nearer. Russia has denied any association with hacking activities aimed at Ukraine’s elections.

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/ukraine-sees-surge-in-election-targeted-cyberattacks/d/d-id/1333738?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

After getting sued for defamation over fake celebrity endorsements on what are often scam ads, Facebook on Wednesday launched a new tool on the UK site that will let people report scam ads they find on the platform.

At the same time, Facebook said it’s donating £3 million ($3.9 million) to set up an action project, due to launch in May, with consumer charity network Citizens Advice that will help people deal with scams. Facebook announced both pro-consumer moves at a joint press conference in London with consumer advocate Martin Lewis.

In fact, it was Lewis who had sued Facebook and subsequently convinced it to take those steps. Lewis, a TV presenter and journalist, is founder of the consumer information site MoneySavingExpert.com.

Last year, Lewis sued Facebook, claiming it had published over 50 fake advertisements that used his face and name without his permission.

None of those ads were posted by him. Most of them were scams that linked to get-rich-quick schemes. Two such were schemes titled “Bitcoin code” and “Cloud Trader” that Lewis described as fronts for binary trading firms based outside the EU. Binary trading is, he says, a “financially dangerous, near-certain money-loser” that financial regulators warn against.

It made him sick, Lewis said.

One grandmother lost all the money she’d put aside for her orphaned grandchildren. She finished a TV interview by laying the blame at the celebrity’s feet:

It’s because I trusted Martin Lewis.

Lewis emphasized at the time he launched the defamation lawsuit that he “[doesn’t] do adverts.”

I’ve told Facebook that. Any ad with my picture or name in is without my permission. I’ve asked it not to publish them, or at least to check their legitimacy with me before publishing. This shouldn’t be difficult – after all, it’s a leader in face and text recognition. Yet it simply continues to repeatedly publish these adverts and then relies on me to report them, once the damage has been done.

As CNET reports, Facebook admitted to struggling with the problem of fake endorsements. The company said that it’s playing cat-and-mouse with scammers who refine their techniques as its technology evolves. It’s hoping the new tools will both protect people and give them a way to get help should they get sucked in by one of these scam ads.

How that £3m will be used

Citizens Advice plans to use Facebook’s donation to set up a new project called Citizens Advice Scams Action. Unfortunately for scam victims, they won’t see any of their money refunded out of the £3m. Rather, the project will focus on prevention and raising awareness of these type of scams. Besides Lewis, the fraudsters have used respected celebrities including Alan Sugar and Dragon’s Den star Deborah Meaden to lend credence to their con jobs.

The Sun offered these details about how the Citizens Advice scheme will work and what else Facebook is doing to combat online scam ads:

The Citizens Advice Scams Action project aims to …

• Increase education and awareness about digital scam ads and how to recognize them.
• Provide one-to-one tailored support to help people recognize scams, and working with victim of online scams who need help to get their lives back on track.
• Explore and build on existing work by Facebook on the development of online tools to assist consumers (including victims) with online scams.

Facebook’s new scam ad reporting tool is designed to …
…easily and quickly flag ads that Facebook believes violate its Advertising Policies or other standards.

Facebook also plans to launch a dedicated team to handle reports of scam ads, to investigate trends and to take action against violating ads.

This is just the start

Steve Hatch, Facebook’s regional manager for Northern Europe, thanked Lewis for bringing attention to the issue and helping the company figure out what steps to take to battle scam ads. The new tools are “part of a wider commitment to tackling scams and to ensuring people are given more transparency and controls over the ads they see on Facebook,” he said.

Hatch said that Facebook plans to monitor the tool’s effectiveness. The company hasn’t committed to a global rollout. But, he added, it’s “very imaginable that we’d push this out into other markets” if it works.

For his part, Lewis said it shouldn’t have taken a lawsuit to get here, but Facebook is finally stepping up to the plate to deal with the issue:

Once we started talking, Facebook quickly realized the scale of the problem, its impact on real people, and agreed to commit to making a difference both on its own platform, and across the wider sector.

Lewis said that there are still scam ads popping up on Facebook, but that it’s moving a lot quicker to take them down, as The Guardian reports.

Unfortunately, the same can’t be said about Google, Yahoo, or other sites where these ads appear, Lewis said. They should all take this as a “warning shot” across their bows:

Google and the rest of you, online advertising has to stand up and take some responsibility. [Google has] not even given us a direct contact, even though I am a major target of scam ads.

I want every online advertiser to see this as a warning shot across their bows.

Google responded with this statement to the Guardian:

Because we want the ads people see on Google to be useful and relevant, we take immediate action to prevent fake and inappropriate ads. We have a tool where anyone can report these ads and these complaints are reviewed manually by our team. In 2017, we removed 3.2 billion bad ads and we’re constantly updating our policies as we see new threats emerge.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/I6-CpA_4KL4/