STE WILLIAMS

Nothing beats practical training and hands-on time with new infosec tools and techniques, so don’t overlook the smorgasbord of opportunities at Black Hat Asia in March.

For example, Microsoft Office is everywhere, and in “Office in Wonderland” you’ll pick up some new tricks to use (and abuse) it for your own purposes. The Outflank B.V. researchers presenting this Briefing will disclose details on new Word and Excel vulnerabilities, release attack vectors that Microsoft deemed features, and demonstrate the security impact of the architectural design of the MS Office suite.

They’ll also share their most recent findings and insights into unexplored legacy functionality in the MS Office suite that can be abused in all stages of an attack. For example, they’ll demonstrate how to abuse Word documents for stealing sensitive information from systems, how to create phishing documents for credential harvesting without a macro payload, and how to bypass the most recent security features in MS Office (AMSI for VBA, ASR).

If you’re interested in the inner workings of neural networks, make time to check out the Black Hat Asia 2019 Briefing on “The Cost of Learning from the Best: How Prior Knowledge Weakens the Security of Deep Neural Networks.” Presented by researchers from Baidu and Syracuse University, this Briefing will walk you through an intriguing vulnerability that allows an attacker to effectively attack black-box object detection DNNs (deep neural networks) using adversarial examples generated from white-box open source models.

In practice, that means you’re going to get a guided tour of a new hidden attack vector of DNNs which allows adversarial examples to be efficiently generated against black-box models used in mission-critical tasks such as facial recognition, image classification, and autonomous driving. If you work with (or are thinking of working with) neural networks, this is a Briefing you don’t want to skip!

Got blockchain security on the brain? Consider “Monocerus: Dynamic Analysis for Smart Contract”, an efficient 25-minute Briefing which will introduce you a lightweight, multi-platform framework for dynamic analysis of Ethereum smart contracts.

Smart contracts are a big deal for the future of financial tech, but they can be hard to dynamically analyze and test because of their big selling point: the use of blockchain. Monocerus is designed to lay a foundation for dynamic analysis on the Ethereum blockchain.  If you come to this Briefing you’ll get a first-hand look at how it works. Plus, you’ll get to check out the new analysis toolset built on top of Monocerus (including a bytecode debugger, code tracer/profiler and advanced fuzzer) and see some cool demos.

Plus, check out the “Zombie POODLE, GOLDENDOODLE, and How TLSv1.3 Can Save Us All” Briefing from Tripwire’s VERT (Vulnerability and Exposures Research Team) if you want a practical look at how vulnerable HTTPS encryption is due to the weaknesses of the underlying TLSv1.2 protocol.

This session will highlight research into more effective testing and exploitation techniques for CBC (cipher-block chaining) padding oracles. You’ll see how a slight tweak to the old POODLE attack resurrected the vulnerability in a major enterprise HTTPS implementation more than three years after it had been patched. The presentation will also introduce GOLDENDOODLE, a special case attack based on POODLE with the promise to disclose session IDs in just a fraction of the time it takes to exploit POODLE.

In “Who Left Open the Cookie Jar?”, presented by researchers from KU Leuven, you’ll get useful insight into how cookies are currently used and abused as online authentication tools. You’ll explore several flaws revealed by the presenters’ unique testing framework, which they used to evaluate the policy implementations of seven browsers and 46 browser extensions. 

Even built-in protection mechanisms can be circumvented by the researchers’ novel techniques: they claim to have documented bypasses for every anti-tracking or ad-blocking browser extension tested. How do they work? Why do they work, and how do you deal with them? Come to this Briefing to find out!

Black Hat Asia returns to the Marina Bay Sands in Singapore March 26-29. Early registration pricing for Briefings Trainings ends Friday, January 18, so register before then to get the best price!

For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/go-hands-on-with-new-security-tricks-at-black-hat-asia/d/d-id/1333664?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A big portion of breaching an organization’s infrastructure involves challenging normal procedures and processes. A red team’s main purpose is to simulate adversary activities and help the security administrators understand, monitor, and remediate the threats.

As a security researcher, I’m constantly looking for new ways to simulate advanced lateral movement, sophisticated Active Directory escalation, persistence, and exfiltration. One of our recent areas of focus has been on defeating network and domain boundaries by moving laterally within the network, with a focus on pivoting from unsecured networks to isolated secure networks.

One of the most common attack methods used by all adversaries is email, mostly because of the ease of use. Phishing attacks have always been a major source of worry for organizations. Over the last year, we have witnessed more organizations and individuals targeted by phishing campaigns designed to capture an employee’s login credentials. Recently, the FBI’s Internet Crime Complaint Center (IC3) issued a warning regarding some of those threats targeting the online payroll accounts of employees in a variety of industries.

My team and I decided to dig deeper into simulating how a skilled adversary can easily pivot to a compromised network segment by abusing commonly used email applications. Many email clients are built right into modern operating systems and can potentially help facilitate lateral movement.

The techniques described here are considered as post-exploitation, which means the user account has been breached and the adversary has full control over the user’s workstation.

In many cases, adversaries use compromised account credentials to access employees’ email in order to change their bank account information, sometimes adding a malicious Outlook rule to prevent the user from receiving alerts regarding a deposit or withdraw change. There are many account breach vectors, including phishing and password spraying.

By performing a phishing campaign, the adversary can easily gain system access to a user’s workstation and can obviously control the installed mail client and all related communication. Instead of targeting users outside the organization by sending phishing emails or using cloud services to sync malicious metadata, the adversary can control all communication. Let’s take this concept one step further to see how local access to an email client advances our agenda to pivot from network to network.

Use Case 1
Many times, advanced adversaries establish an internal command and control server (commonly referred to as a C2 server) to be used as a jump server to the outside world. The jump server can act as middleware between the infected workstations and an external C2 server. The internal C2 server can also be used as a man-in-the-middle proxy or a watering hole site. The adversaries can easily manipulate all mail hyperlinks shared by the compromised user/workstation to redirect the recipients to an internal watering hole website, bypassing many of the link detection and firewall application control mechanisms.

Use Case 2
Let’s look at how we can build on top a known attack technique “fileshare infection” to pivot on an internal network using a compromised mail application. First, the adversaries must have the ability to weaponize a legitimate file. They would do this by focusing on widely used shared files by email platforms. There are many exploit options available online for free, including Office documents, PDF documents, and archive file vulnerabilities.

Now imagine what happens when a user’s workstation is compromised. We all know many users love to share documents with their colleagues through email. The attacker has gained full control over email communication and can now inject malicious code into legitimate office files. These malicious files are now shared over a legitimate mail channel, which means that the adversaries use actual email correspondence instead of faking and acting on behalf of the user. The user would then reply or create a new email message using the malicious file. The mail recipient does not suspect that anything is wrong and opens the malicious file, exploiting the responsible file application.

As collateral damage, they can dump the global address book of the company and conduct a targeted phishing campaign against high-value targets such as IT or executive management.

Use Case 3
Instead of exploiting vulnerabilities in common files as described above, an adversary can use a much stealthier technique to leak credentials in the form of NTLM hashes to an internal C2 server. Usually, this is achieved by silently forcing a file application to authenticate against the C2 server using a specific protocol such as Server Message Block (SMB). The adversary can use the C2 to relay the received authentication attempt to any network protocol supporting NTLM authentication.

Microsoft has issued an optional security enhancement (Microsoft Advisory ADV170014) that provides organizations with the ability to disable NTLM single sign-on authentication as a method for public resources. However, this method is usually inefficient for internal resource communication, and in many cases will allow an internal network boundary bypass. A much more efficient way to mitigate this threat is by forcing NTLM signing on client and servers.

All the above examples show how linking several existing techniques together can be combined into one or more complex attack flows to achieve lateral movement and pivoting inside a network. Our team has demonstrated that this approach together with scalable automation is highly efficient and can be used to gain control over critical targets in real enterprise environments.

Related Content:

• 7 Most Prevalent Phishing Subject Lines
• 4 Ways to Fight the Email Security Threat
• FBI: Email Account Compromise Losses Reach $12B
• 6.4 Billion Fake Emails Sent Each Day

Igal Gofman is Head of Security Research at XM Cyber. He has a proven track record in network security, research-oriented development, and threat intelligence. His research interests include network security, intrusion detection, operating systems, and Active Directory. Prior … View Full Bio

Article source: https://www.darkreading.com/endpoint/simulating-lateral-attacks-through-email/a/d-id/1333638?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

IT professionals often see government regulation as a last resort or even a hindrance to solving their problems. Yet when it comes to Internet of Things (IoT) security, 96% of IT decision-makers say government regulation is necessary – even though some wouldn’t actually want it.

Findings come from a Gemalto survey, released Tuesday, of 950 IT and business decision-makers across the globe. One-third of the respondents say they create IoT devices, 30% create IoT software, 30% are IoT integrators, and half use IoT devices created by a third party. (Multiple responses were allowed.)

“If I’m really, really honest, my true belief before this report was that we have learned nothing,” says Jason Hart, CTO of data protection at Gemalto. A former ethical hacker in the security business for over 20 years, Hart says he thought businesses’ and individuals’ cybersecurity perceptions and habits had never improved. “Have we woken up? Is this the turning point where security becomes default?” he asks.

Hart is cautious, though, about what form IoT security regulation might take. What do respondents want most from global regulation? According to the survey, rules and guidelines on who is responsible for data security at each stage of its life cycle (59%) and which methods should be used to secure data storage (59%). 

“You could have a teddy bear that’s IoT-enabled – that’s data that has minimal impact,” Hart explains. “On the other hand, you have a medical device. … So my point is we need a sliding scale.” 

The onus for IoT security should be shared by a variety of stakeholders, according to survey respondents, with IoT security providers and cloud providers sharing the dubious honor of the top spot (60%), and IoT manufacturers (55%) and security specialists (50%) close behind.  

To Hart, the responsibility is clearer. “It’s down to the [IoT] manufacturers to make it a responsibility from day one,” he says.

In his opinion, IoT security can be achieved through a combination of data encryption, authentication/access control, and key management that puts users in control of the keys. The strongest implementations of those technologies require components that must be built in by the manufacturer, he says. Just as there are rules about supply chain safety if there is a problem with your vacuum cleaner or Nespresso machine, there should be ways to protect data. “This isn’t a new problem, he says. 

There may be, however, a new awareness of the problem as it relates to cybersecurity.

Fourteen percent of survey respondents say the single best way to describe their organizations’ views on IoT security is as “an ethical responsibility.” This is an increase from just 4% in 2017.

Responses to the question indicate a shift toward security as business necessity, as opposed to a business add-on. There are increases in “a way to avoid costs of failure and brand damage” (from 9% in 2017 to 14%) and “regulatory requirement” (from 10% to 13%), but drops in “as a revenue driver” (from 18% to 9%), “as a secure foundation to offer new services” (way down from 32% to 24%), and “as a PR exercise to attract customers” (from 10% to 7%).

Companies are also increasing their investments in security, with 13.15% of their IoT spend devoted to security, up from 11.07% in 2017, according to the survey. 

That investment may increasingly go to tackling data privacy and security. Respondents say that their top IoT challenges are ensuring data privacy (38%) and that large amounts of data are being collected (34%); authenticating device access and validating identities also made the list.

Most of the respondents are relatively confident in their ability to detect an IoT breach: Although only 48% say they are confident they could detect one on every IoT product, an additional 39% saud they could detect it on at least some.

“The key thing for me is the increased awareness of the privacy of data” and seeing the value of data, Hart says. “That’s a huge step forward.” 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad … View Full Bio

Article source: https://www.darkreading.com/endpoint/we-want-iot-security-regulation-say-95--of-it-decision-makers/d/d-id/1333667?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Four potent forces have turned network security on its head: the decentralization of corporate networks; the proliferation of mobile devices; the evolution of the bring-your-own-device (BYOD) policies to include multiple devices; and the massively disruptive Internet of Things (IoT) phenomenon. One of these forces on its own is enough to weaken the best security defenses, but together they are wreaking havoc in enterprises in every industry.

The impact of these forces has essentially erased the enterprise perimeter, traditionally used to protect organizations from external attacks. The fall of this wall has created a new security landscape in which each endpoint, no matter from where it connects, has become its own perimeter — a weakness that can give adversaries access to the entire network.

The Fall of the Wall
Decentralization caused the first bricks to crumble. The final bricks were taken away by the widespread adoption of BYOD policies and the often chaotic infiltration of IoT devices.

Today, an enterprise might have multiple offices in cities across the country or across the globe, with each location potentially having different security protocols, products, and services. Meanwhile, employees connecting through public, unsecured Wi-Fi connections, as well as contractors and other third-parties using unmanaged BYOD devices all log in to the corporate network. 

The Lateral Threat
A significant challenge to network and information security is lateral movement of attacks such as malware or ransomware and hackers, once inside the network. Undetected, these threats can propagate from one compromised endpoint to others.

In recent years, adversaries have carried out large-scale attacks by exploiting known vulnerabilities and security gaps on endpoints. WannaCry, NotPetya, and Bad Rabbit malware all used lateral movement to spread on a global scale in 2017. Using a single entry point — generally, the most vulnerable device — hackers were able to quickly take down unpatched systems.

Often, the weakest points are unmanaged, unprotected IoT devices, especially those deployed on secure network segments used by important company assets. IoT devices aren’t transient and typically remain undetected by network scans. Therefore, security teams are often unaware of the attack surface they create.

Best Practices
Visibility: Having full visibility of all devices connected to the network is essential. This includes gathering information such as the location and type of device, the processes and applications it is running, and how many similar devices are connected across the enterprise. Full visibility should not be limited to headquarters and includes all branches and endpoints.

Use Historical Data: Historical data on endpoint usage — such as past processes, network connections, and other information — can be very useful in detecting compromised devices as well as in tracing the path of a threat once it has been identified. This data can also be invaluable for conducting rapid and accurate responses to incidents as well as preventing future attacks.

Keep It Simple: Simple security configurations and deployments can translate to painless ongoing maintenance and better security in a world of increasing threats. Simplicity is crucial because enterprises are shorthanded, manage dozens of security products, and have limited time to investigate and respond to threats.

Automate Monitoring and Mitigation: Continuous monitoring is the best way to prevent risks from escalating into security incidents. Organizations need the ability to automatically quarantine threats before they access crucial enterprise data or services. This allows the security teams to assess if a risk is a threat, and, if it is, to block affected endpoints.

Avoid Vendor Lock-in: In a dynamic world where organizations evolve through organic growth or through merger or acquisition, they should not tie their security to a specific vendor. To prevent vendor lock-in and future-proof security operations, adopt a vendor-agnostic approach when choosing security products or services.

Embrace the Cloud: A cloud service runs the latest version of software at any given moment, provides seamless upgrades, and delivers up to date capabilities. Additionally, it offers smooth scalability and distribution across the world, making it a must-have for decentralized enterprises.

Another advantage of a cloud-based approach: It handles threats both inside and outside the enterprise perimeter, allowing organizations to provide remote branches the same security as their corporate headquarters.

Ultimately, enterprises should consider a security approach that implements a perimeter on endpoints through continuous monitoring, risk assessment, policy enforcement, and automated containment/remediation of compromised devices. Following the previously mentioned best practices provides a good framework for re-establishing control over network security.

Related Content:

• 8 Attack Vectors Puncturing Cloud Environments
• More Than Half of Companies See Rise in Mobile Security Threats: Bitglass 2018 BYOD Report
• Managing Security in Today’s Compliance and Regulatory Environment
• Taming the Digital Wild West

Ofer Amitai is CEO and co-founder of Portnox, where he is responsible for day-to-day operations and setting the company’s strategic direction. He has over 20 years’ experience in network security, during which time he established the first IT security team in the Israeli Air … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/the-security-perimeter-is-dead-long-live-the-new-endpoint-perimeter/a/d-id/1333650?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Last month a code execution vulnerability was found in the ThinkPHP framework, a rapid-development framework developed by Chinese firm TopThink. While the vulnerability, designated CVE-2018-20062, was patched by the developer, a researcher has now found active exploits of the vulnerability in the wild.

Larry Cashdollar, a vulnerability researcher and member of Akamai’s Security Incident Response Team, was doing research on a recent Magecart attack targeting extensions to the Magento e-commerce platform when he noticed a malware request he hadn’t seen before – a request to ThinkPHP.

“I realized there was a software framework developed in China that had this vulnerability, and it was being taken advantage of to install coin miners and skimmers,” Cashdollar says. “They [also] were using it to install any kind of payload targeting Windows machines, IoT devices, or to mine Bitcoin or Monero coins.”

In a blog post describing the new attacks, Cashdollar wrote that multiple threat actors are using relatively simple techniques to take advantage of the vulnerability. He pointed out that a single line of code can scan for the presence of the vulnerability, which can then be exploited with attacks involving simple cut-and-paste code that is widely available.

One of the payloads Cashdollar has seen delivered is a Mirai variant – a development he has worried about, he says. “I had been waiting for Mirai botnet kits to include Web app code in their arsenal,” he says, “and this was an indicator that it’s happening.”

The code being executed through the PHP framework calls can skip a series of steps long considered essential for malware. “Back in the 1990s, people were always trying to get root access,” Cashdollar says. “Now it doesn’t matter. They just want to execute code on the system as any user so they can share malware or mine coin. They want to execute code on as many systems as possible.”

Systems hit by this exploit are largely concentrated in Asia, which is where the ThinkPHP framework was developed and is very popular. Nothing in the attack limits it to the Asia-Pacific region, though, and Cashdollar says that attackers are actively scanning systems across the globe, including Europe and the US. “I’m seeing about 600 scans a day for it,” he explains. “They’re scanning across all verticals, software companies, car rentals, and others.”

Asked about security and remediation, Cashdollar says he has seen some Web application security companies begin to write advisories to their customers regarding the vulnerability. In addition, he recommends that companies ask development groups about the use of the ThinkPHP framework. If it is being used, Cashdollar says, it should be updated to the current version immediately.

Related Content:

• NCSC Launches Nation-State Cyber Threat Protection Program for Businesses
• 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
• Open Bug Bounty Offers Free Program For Websites
• 7 Business Metrics Security Pros Need to Know

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities-and-threats/new-attacks-target-recent-php-framework-vulnerability/d/d-id/1333676?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple