STE WILLIAMS

She will lock you out, livin’ la Vidar loca: Enterprising crims breed ransomware, file thief into hybrid nasty

A newly spotted piece of hybrid malware steals copies of victims’ files and then encrypts said data, demanding a ransom to unscramble it.

The software nasty, bestowed the moniker Vidar earlier this month, combines the GandCrab ransomware with parts of the Arkei data-harvesting trojan to create a two-pronged attack that, on infected Windows PCs, first copies documents to outside servers, then locks away that personal information with a ransom demand.

According to Malwarebytes researcher Jerome Segura, the infection has been spreading in the wild via malicious advertising being piped into torrent and video streaming sites. The poisoned ads redirect users to a server hosting two exploit kits, Fallout EK and GrandSoft EK, which try to worm their way onto the target’s computer.

Should the exploit kit succeed in breaking in, it launches the data-stealing component of the infection. Segura said that the data-slurper, which looks to lift things like payment card numbers, site passwords, and cryptocoin wallets, is easy to mistake for the Arkei malware.

“Upon closer look, while the sample did share a lot of similarities with Arkei (including network events), it was actually a newer and, at the time, not yet publicly described piece of malware now identified as Vidar,” Segura explained.

After looking to scrape whatever valuable data it can find from the victim’s machine, the Vidar infection then dials up a control server and launches its second phase: the Gandcrab ransomware.

Little girl looks at camera with an I told you soattitude.

He’s not cracked RSA-1024 encryption, he’s a very naughty Belarusian ransomware middleman

READ MORE

If the Vidar infection has been set up to give out the ransomware, the victim’s machine will then be locked off and the wallpaper changed to a notification on how to pay in order to get the files unencrypted.

Segura’s says the entire process, from loading up the malicious add to stealing the data and encrypting all of the victim’s files, takes roughly one minute to complete. The researcher suspects that, in this case, Vidar is using the ransomware as cover for its data-harvesting components.

The idea is that the victim will be so concerned with cleaning up the Gandcrab malware infection that they won’t notice the malware was also lifting their passwords, payment card numbers, and unique system configuration information.

“Threat actors can use ransomware for a variety of reasons within their playbook. It could be, for instance, a simple decoy where the real goal is to irreversibly corrupt systems without any way to recover lost data,” Segura said.

“But as we see here, it can be coupled with other threats and used as a last payload when other resources have already been exhausted.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/07/vidar_infection/

  • 08/01/2019
  • adm

Stronger DNS Security Stymies Would-Be Criminals

2018 saw a reduced number of huge DNS-facilitated DDoS attacks. Vendors and service providers believe that malicious impact will drop with continued technology improvements.

Early numbers indicate that 2018 was a relatively quiet year in terms of huge distributed denial-of-service (DDoS) attacks, but does that indicate quieter times ahead in 2019? While it’s tricky to predict the future in cybersecurity, some experts think that improvements in DNS security are forcing criminals and vandals to change their strategies in order to keep up.

“The current market isn’t so much about the huge DDoS attacks, but there’s an always-on behind-the-scenes battle going on,” says Kris Beevers, co-founder and CEO of NS1. He says that while smaller, highly targeted DDoS attacks are a constant feature of the cybersecurity landscape, improvements and investments made since the huge Mirai-powered DDoS attacks of 2016 have made it much more difficult to use name servers as an attack tool.

Cricket Liu, executive vice president of engineering and chief DNS architect at InfoBlox, agrees with Beevers. “One aspect of DNS security that is improving and making it more difficult for people to use DNS servers in DDoS attacks is the implementation of something called RRL — response rate limiting,” Liu says. With RRL, a DNS server will respond a limited number of times for a request for a single domain resolution from a particular IP address, making it less likely that it will flood a victim with traffic.

The other advancement that is improving DNS security is the increasing use of DNSSEC, a system that makes it much more difficult to spoof DNS requests and responses. DNSSEC requires that servers be authenticated and signed by a trusted certificate. Liu says that adoption of DNSSEC is growing but is still uneven across different countries and top-level domains. “The domains .com and .net, for example, have a very, very low adoption rate of DNSSEC among their subdomains,” he says, while pointing to Sweden and Belgium as top-level domains with very high adoption rates.

For individuals and organizations that use public DNS resolution, the security news continues to improve. Beevers says that public recursive DNS servers like those hosted by Google, Open DNS, and Quad9 are using techniques like RRL and DNSSEC for all transactions. (Note: “Recursive” DNS servers are used to answer queries from clients about the address of particular URLs. “Authoritative” DNS servers, which are frequently mentioned in press accounts, are those that provide the IP address mapping, which the recursive DNS servers use to answer the queries.)

John Todd, executive director of Quad9, a nonprofit service operated by a consortium of vendors, says that the service now has servers in 137 cities spanning 82 counties. Those servers, he says, block more than 10 million malicious events a day with various techniques, with some days seeing as many as 40 million blocked events.

One of the techniques is DNSSEC for DNS query security. The other is blocking resolution to known-malicious URLs — websites, for example, that are known to host malware-laden or phishing links — by drawing on aggregated threat intelligence feeds from 19 partners.

As Internet users become more concerned about traffic, Todd says the increase in Quad9 use has begun to increase on the order of 25% per week. Beevers sees several macro trends contributing to the rise that Quad9 and other secure DNS vendors and service providers are seeing. “Security is at the center of things,” he says. “DNSSEC, the ongoing need for redundancy, and the macro trend toward unifying the stack across public and private cloud infrastructure are the big things we’re seeing happen.”

Moving forward, Liu sees further improvement in near-term DNS security. “I’m pretty excited about DANE, which stands for DNS Authentication of Named Entities,” he says.

DANE, which is described in IETF RFC 6698, allows an organization to put information about a certificate in the response to a query, so that the entity making the query will know whether the response is secured by the right certificate — or a legitimate certificate. It’s a way, Liu says, “of combating the relative ease of getting a bogus cert from a somewhat unscrupulous [certificate authority]. I’m excited about that because it’s an interesting and useful application of DNS, and at the same time it would tend to drive DNSSEC adoption.”

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities-and-threats/stronger-dns-security-stymies-would-be-criminals/d/d-id/1333600?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 08/01/2019
  • adm

Bug Bounty Awards Climb as Software Security Improves

Top reward for iOS remote exploit hits $2 million, as companies who sell exploits to national governments have to offer more money to attract researchers to tackle increasingly secure software.

Exploit techniques for some zero-day software vulnerabilities just got even more lucrative for security researchers willing to sell them as cybersecurity intelligence firm Zerodium this week raised its payout for exploits – in some cases, doubling the awards.

Zerodium doubled the bounty it pays for unknown exploits targeting popular operating systems and software programs. It now pays up to $2 million for a flaw that could exploit Apple’s iOS mobile operating system without any victim interaction, for example. Vulnerabilities in messaging applications, such as WhatsApp and iMessage, could earn up to $1 million, the company said.

“There is a significant increase in demands for remote exploits targeting messaging apps such as WhatsApp from our government customers as these apps are sometimes the only communication channel used by targets and end-to-end encryption makes it very difficult for governments to intercept these messages,” Chaouki Bekrar, CEO at Zerodium, said in an e-mail interview. “Having the ability to remotely and directly compromise these apps without compromising the whole target phone is much more effective and we’re increasing our prices to reflect this strategic need.”

The increasing bounties that governments and companies are willing to pay for vulnerabilities highlights the greater difficulties that researchers have finding flaws in the most popular operating systems and products. Last year, both Google and Microsoft raised the amounts that they pay for specific classes of vulnerabilities. An exploitable flaw in Android will currently fetch up to $200,000 from Google.

Governments are likely paying for iPhone exploits because they are increasingly running into locked phones that they need to access. Similarly, using vulnerabilities in messaging programs allows government to intercept and monitor private messages. 

“At this price, they certainly aren’t being used to generate patches and IPS (intrusion prevention system) signatures,” said Brian Gorenc, the director of vulnerability research at Trend Micro and leader of the firm’s Zero Day Initiative program. “Governments, corporations, and other agencies with large financial resources can and do acquire these exploits to use for their own benefit.”

Supply Side

Yet, other experts argue that the increase in price is driven more by a lack of supply—too few usable exploits in the public domain—and less about the demand countries have to exploit specific products. The high prices of exploitable iOS vulnerabilities are because there are so few exploits for the mobile operating system, says Dmitri Alperovich, co-founder and chief technology officer of CrowdStrike, a cybersecurity services firm.

“Finding these issues is no longer in the realm in an amateur first-year computer-science student takling a couple of hours and finding an exploit, like we saw 20 years ago,” he said. “Now it requires a very dedicated person. It is a permanent and full-time job, not a hobby you can do on the side.”

The high prices garnered for the sale of weaponized vulnerabilities to government agencies and large companies is a sore point for many in the defensive side of the industry. Trend Micro’s Zero Day Initiative, for example, buys vulnerability information from researchers and then works with third-party software firms to confirm and close the security holes. 

“Researchers who sell exploits on the gray market need to understand their work can be used by others for any reason at all—even regimes who haven’t been labeled as ‘repressive’ actively try to acquire these types of exploits, and rarely do they report the bug to the vendor for remediation,” says ZDI’s Gorenc.

Most researchers continue to sell to the defensive bug bounty programs, said Marten Mickos, CEO of HackerOne, a firm that helps companies run bug bounty programs. He puts the premium payments in black-and-white terms, couching the money as a downpayment on researcher’s ethics.

“This effectively becomes the ratio of goodness in the world,” he says. “If you are a ‘bad’ player, you haver to offer 20 times more to attract the attention of researchers.”

For that reason, the bug bounty programs are not worried about the competion of the high-paying exploitation firms, says Trend Micro’s Gorenc.

“We do believe we can compete with gray market vendors because we provide a different experience,” he said, highlighting the researchers submitting vulnerabilities to ZDI can discuss the issue at conference and get credit for the discovery. “White market bounty programs might not pay as much as gray or black market programs, but by providing other benefits, we continue to have success as evidenced by having our biggest year ever with over 1,400 advisories published.”

Yet, Zerodium is finding that plenty of researchers continue to submit exploitable bugs to its program.

“The truth is that exploitation is harder, it takes longer, but more researchers are looking into these targets,” says Zerodium’s Bekrar. The company will continue to increase its prices to keep “the momentum and encourage researchers to keep hunting for exploits,” he said.

Related Content:

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/bug-bounty-awards-climb-as-software-security-improves/d/d-id/1333602?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 08/01/2019
  • adm

LA Times knocked out, HackerOne slips up and – amazingly – router security still sucks

Welcome to 2019, just a few days into the year and we already have Chromecast chaos, Skype backdoors, and a Weather Channel privacy suit.

We also have plenty of other news to catch up on.

Stop the presses! LA Times grinds to a halt over ransomware

Most of us made a point of unplugging from the news over the holidays, but for those who read the LA Times, a ransomware infection nearly made that unplugging mandatory.

Late last week, a mysterious malware attack crippled key parts of the Times infrastructure and other papers in its parent Tribune Company, including portions of its printing systems. This sparked fears of state-sponsored or terrorist hackers at work.

How bad was it? El Reg has learned that, at its worst point, the Tribune Company was seriously considering asking the publishers of the San Francisco Chronicle to print their papers for them so that the weekend editions could get out on time.

Eventually, the panic settled and the issue was traced back to a ransomware infection that had managed to bork the systems that link the papers editorial office with those of the printing plants.

UK military withdraws from Gatwick drone duty

Anyone who had the misfortune of having to travel to, from, or in the general vicinity of London Gatwick airport over the holidays is by now familiar with the “drones” that menaced the airport.

As The Register reported, there was panic over the possibly non-existent drones that were thought to be buzzing planes on the airfield. This caused the airport to temporarily shut down and kicked off a man..er.. dronehunt to catch the rogue copter and its operator. The military was also called in to bring a calm to the situation.

We assume this all happened to the tune of Yakkity Sax.

Fortunately, the worst of the microflyer crisis seems to have passed, and the men and women of the RAF can finally make their triumphant homecoming from the harrowing fields of Gatwick.

There have to date been no arrests made, save for the Sussex couple who were released without charges on December 23.

HackerOne flaw vets cop to rookie mistake

A note to all the developers out there: Don’t beat yourselves up too much over security flaws, as even the bug-brokers at HackerOne fall victim to the occasional slip-up.

An in-house researcher discovered that the RFC2142 system HackerOne uses for its @wearehackerone.com email forwarding service hadn’t properly reserved key names such as “security” or “admin”.

This would have, potentially, allowed someone who was up to no good to register a name like “admin@wearehackerone” or “abuse@wearehackerone” and then use the address to cause chaos.

To its credit, HackerOne not only acknowledged and addressed the vulnerability, but published a report on it on their ‘hacktivity’ feed.

Israeli security shop wants to be a pain in the dong

A secretive security firm exposed in Israel has a highly unusual name.

The outfit wants to sell hacking tools to governments and law enforcement, although experience has shown these aren’t just used to track down criminals but also people governments find tiresome.

The group calls itself Candiru, after the small fish in the Amazon which, legend has it, can swim up a stream of urine and embed itself in a victim’s urethra using a barbed head.

Presumably the name is a reference to how the biz’s malware is both highly invasive and difficult to remove. No doubt someone in marketing no doubt thought this was a terribly clever and/or funny idea. We’d go with the former.

Nice patch Google, too bad it only took three years to arrive

Tardy patching is nothing new in the security industry, but Google is usually thought to be better than most at getting stuff fixed. Not so in this case.

According to flaw finders Nightwatch Cybersecurity there was a serious flaw in the Chrome browser used by Android which would allow an attacker to work out the hardware a particular handset is using. It did this thanks to flaws in WebView and Tabs for Android, which could show the hardware model, firmware version and security patch level of a phone.

Such information is obviously invaluable for an attacker and in May 2015 Nightwatch reported the issue to Google, but the security team at the Chocolate Factory said it wasn’t really an issue.

However, in October the new build of Chrome, version 70, appears to have finally fixed the issue – at least in part. The firmware build information isn’t now readable but the device model number is. Better than nothing, but still not good enough.

Whose switch is it anyway?

Anonymous switches pose a little known, but significant, threat to security. Don’t believe us? Check out this report into the prevalence of unauthenticated HP and Aruba switches that can be found using Shodan.

Unauthenticated switches pose a danger because they do not log activity and could be accessed over Web UI or, even worse, Telnet.

“From Telnet, an attacker could do a number of things from this switch, from redirecting traffic/ports, to serving malware, to pivoting within the network that the switches live in,” the report, authored by one of the hosts of the ThugCrowd podcast reads.

Admins are advised to set usernames and passwords, and disable WebUI if it is not needed.

Insinia pulls mass Twitter ‘hack’ to prove a point

Call it the Twitter security crisis that wasn’t. Earlier this week, mobile security company Insinia pulled something of a cross between a publicity stunt, protest, and a proof of concept when it kicked out a number of fake Tweets to various celebrity accounts.

The company would later explain that it did not actually take over any accounts, but rather exploited a little-known feature on Twitter that lets users send tweets over SMS.

The idea is that a user who has their phone number linked to their account could send an SMS from that number and have the message contents automatically posted as a Tweet from their account.

This also means that anyone who could spoof that number, as Insinia did with the celebrity accounts, could post Tweets as well.

Insinia is urging Twitter to kill the feature and for users to unlink their accounts from their phone numbers.

Luas website hacked, ransom set at $4,000.. er… $3,500… er… $3,800

Irish tram operator Luas is the latest transit agency to fall victim to ransom-demanding hackers. The exact price of that ransom depends on whatever the cryptocurrency market is doing at the moment.

In this case, someone took over the train company’s official website and said they would only hand it back if they were paid one Bitcoin. If the company opted not to pay up within five days, the hacker also threatened to release company emails.

By late Friday, the site was not yet back online, though Luas has apparently been able to regain control of the domain.

“Luas technicians are still investigating [the attack] and are working to restore the site,” the notice reads.

“Luas has contacted the Commissioner for Data Protection and we have in accordance with best practice contacted everyone whose information may have been compromised.”

Bad news from OSnews

Long-running tech news site OSnews appears to have fallen victim to data thieves.

The site announced this week that some or all of its data had apparently been lifted by an intruder. This after readers reported getting spam and phishing emails. It was eventually concluded the site had been breached and OSnews went offline for a few days before returning with an explanation.

“Our best guess is that someone was able to exploit a vulnerability in old, unmaintained code in the site’s content management system, and made off with at least some user data, which may be as little as a few user records or, at worst, our entire database,” the site said.

“Your email addresses were in there, and the encryption on the passwords wasn’t up to modern standards (unsalted SHA1). The truth is that once we concluded it was likely that we were breached, our small volunteer team decided it was better to go offline than it was to learn the avenue of exploit, given that we had no interest in continuing to rely on the aged codebase.”

How many times do we have to do this? Fix your terrible router security, vendors!

Yet again, we have a damning report on the state of security in home wireless routers.

This time, it is Cyber-ITL who peered into (PDF) the safety of 28 popular home routers and found that, depending on the architecture, the state of security was either grim… or totally hopeless.

In the latter category are routers based on MIPS SoCs, which were all found to contain a flaw that renders data execution prevention (DEP) ineffective, potentially allowing an attacker to feed in and execute malicious code.

ARM-based routers fared a bit better, but only slightly.

“Though the Linux/ARM stack is completely unaffected by the aforementioned bug, for many devices it makes almost no difference,” the report reads.

“Of the access points and routers we reviewed, not a single one took full advantage of the basic application armoring features provided by the operating system. Indeed, only one or two models even came close, and no brand did well consistently across all models tested.”

And on that cheery note, we hope everyone enjoys the weekend! ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/05/security_roundup_040119/

  • 07/01/2019
  • adm

Threat of a Remote Cyberattack on Today’s Aircraft Is Real

We need more stringent controls and government action to prevent a catastrophic disaster.

The Federal Aviation Administration says today’s aircraft is safe from cybercriminals. Major aircraft builders say the same thing. But the Department of Homeland Security (DHS) and the Department of Energy say “Not so fast.” A few influential politicians and some experts in the aeronautics industry have also voiced their concerns in the past year.

It’s not beyond the realm of possibility that a determined, properly prepared malicious actor could break into and compromise an airplane’s network — without ever so much as entering the airport.

What’s so exasperating is that policies, process, procedures, and tools exist to mitigate the risk. But the wheels of life-preserving change may not be turning quickly enough — a possibility exacerbated by the fact that a widespread skills gap is preventing change from being realized.

Motherboard, one of several Vice channels, reported in June that US government researchers think it’s only “a matter of time before a cyber security breach on an airline occurs.” Moreover, according to DHS documents the publication obtained via a Freedom of Information Act request, government officials believe aircraft still in use today lack sufficient cybersecurity protections — if they have them at all.

These concerns are not new. Last November, CBS News reported that cybersecurity experts working with DHS in September 2016 took only two days to remotely hack into a Boeing 757 at the Atlantic City (New Jersey) International Airport via radio frequency communications.

The attack was conducted by Robert Hickey, the aviation program manager for the Cyber Security Division of the DHS Science and Technology Directorate. He told Avionics Magazine, “I didn’t have anybody touching the airplane. I didn’t have an insider threat. I stood off using typical stuff that could get through security, and we were able to establish a presence on the systems of the aircraft.” He added that, based on the how most aircraft radio frequencies are configured, “you can come to grips pretty quickly where we went.”

A few notes about that attack:

  • The 757 first entered airline service in 1984, but it’s been 15 years since one was built. Major airlines are still flying the narrow-body, twin-engine aircraft.
  • The 757 is far less networked than modern planes.
  • 757s have only a handful of software parts, whereas the modern e-enabled aircraft has hundreds of loadable software aircraft components that can be delivered to the aircraft wirelessly.
  • 757s have small numbers of potential entry points, while modern planes have dozens. That means the attack was the equivalent of performing a test on a 1985 Ford Escort instead of on a 2018 Tesla Model S.
  • President Trump’s personal plane is a 757, and Air Force Two — the official jet of the vice president — is a Boeing C-32, the US Air Force transportation version of the 757.

Responding to the attack, Boeing issued a multiparagraph statement that included this passage: “Boeing is confident in the cyber-security measures of its airplanes. … Boeing’s cyber-security measures … meet or exceed all applicable regulatory standards.”

In 2015, the General Accounting Office (GAO) stated that the FAA needed a more comprehensive approach to address cybersecurity. That same year, the FAA initiated the Aviation Rulemaking Advisory Committee to provide industry recommendations regarding aircraft systems information security. The industry recommendations have not been acted upon.

So, Washington, we have a problem.

Addressing the Problem
To solve it, we need industry regulations that require updated cybersecurity policies and protocols, including mandatory penetration testing by aviation experts who are independent of manufacturers, vendors, service providers and aircraft operators. Be mindful of those who claim aviation expertise; few have the necessary experience, but many claim they do.

“Pen testing” is essentially what DHS experts were conducting during the Boeing 757 attack. A pen test is a simulated attack on a computer system that identifies its vulnerabilities and strengths. Pen testing is one of many ways to mitigate risk, and we need more trained aviation and cyber personnel to deal with the current and emerging cyber threats — those that haven’t even been conceived of yet.

Unfortunately, a pen-testing skills gap exists. According to a recent SecureAuth survey of IT decision makers, only 43% of organizations say they think they are staffed to handle pen-testing workloads. The skill gap grows far wider when aviation expertise is added to the equation.

Clearly, that issue needs to be addressed by cybersecurity and aviation industry leaders. The FAA Reauthorization Act of 2018 includes language to address cybersecurity. But we need more training, education, and emphasis on preventing malevolent actors from having the ability to use aircraft as potential weapons.

As for government regulations, The Hill wrote on the 17th anniversary of 9/11 that New Jersey Congresswoman Bonnie Watson Coleman and her colleagues are working on a bill that would strengthen the Transportation Security Administration’s basic cybersecurity standards. “We cannot allow [cybercriminals] access to cockpits via cyber means,” she said.

Agreed. Because at the moment, we’re sitting on a ticking time bomb.

Related Content:

Bruce Jackson, President and Managing Director of Air Informatics, has extensive experience with in-flight satellite and Wi-Fi connectivity and was a principal investigator for the NASA Advanced Communication Technology Satellite (ACTS). He was also the wireless architect for … View Full Bio

Article source: https://www.darkreading.com/iot/threat-of-a-remote-cyberattack-on-todays-aircraft-is-real/a/d-id/1333551?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 07/01/2019
  • adm

Akamai Streamlines Identity Management with Janrain Acquisition

Akamai plans to combine Janrain’s Identity Cloud with its Intelligent Platform to improve identity management.

Cloud security firm Akamai plans to acquire Janrain, an identity management software provider, as it aims to better protect customers’ data with a single digital identity across channels.

Authentication on the Internet is “badly broken,” John Summers, vice president and CTO at Akamai, explained in a blog post on the news. Every website and mobile app requires consumers to create new accounts, many of which share usernames and passwords. A 2017 Pew Research report found 39% of all users use the same, or similar, passwords across accounts. Making matters worse, ongoing data breaches expose them.

“From a website owner’s perspective, this leads to a huge digital trust problem,” Summers continued. “Just because someone or something presents the correct credentials, how can the business trust that it is truly the account owner that is attempting to log in?”

Janrain offers Customer Identity and Access Management (CIAM) as a service for mission-critical enterprise Web applications, Summers wrote. It brings identity awareness to online transactions with social and traditional registration, login, authentication, single sign-on, and profile data storage, he added.

Akamai already offers tools to secure customer websites, apps, and APIs from DDoS, bots, application vulnerabilities, and other threats, according to Summers. It plans to use Janrain’s technology to make its own security and performance offerings more “identity aware,” which he explained is critical to enforcing strong access controls while maintaining a positive user experience.

Following the acquisition, Janrain Identity Cloud will be combined with the Akamai Intelligent Platform, according to Summers. Janrain’s identity services will also be combined with the Akamai Bot Manager, which detects bots as they attempt to log in with stolen credentials.

With Janrain’s tech, Akamai will be able to understand login history and access patterns (geography, time of day, etc.) to distinguish legitimate users from bots, Summers explained. Akamai will also be able to offer more nuanced responses to attackers without interfering with user experience. Akamai plans to offer a single digital identity to consolidate user context across channels, social media, and offline sources.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/akamai-streamlines-identity-management-with-janrain-acquisition/d/d-id/1333596?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 07/01/2019
  • adm

Report: Consumers Buy New Smart Devices But Don’t Trust Them

The gap between acceptance and trust for new smart devices is huge, according to a new survey.

Consumers are buying more and more connected devices, but they don’t trust the connected things they’re bringing into their lives. According to a new report, approximately 80% of survey respondents in the US, United Kingdom, and Canada don’t trust Internet-connected devices to secure their data and privacy.

In a survey of 4,100 adults in the three nations, 84% said that they were more likely to buy a future device from a company with a reputation for good security technology and practices, though 36% said that they have no idea of which certifications might matter when it comes to device security.

The survey, conducted by Atomic Research and sponsored by BlackBerry, is based on field work done in mid-December 2018. It shows that more than half of those surveyed said that they would be willing to pay more for Internet-connected products if they knew their data and privacy would be protected — but not much more. Only 10% said they would be willing to pay up to 20% more for security, while the majority said that their security would be worth less than 10% additional cost.

Details of the survey are scheduled to be released this morning in Las Vegas, at CES.

For more, read here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/iot/report-consumers-buy-new-smart-devices-but-dont-trust-them/d/d-id/1333597?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 07/01/2019
  • adm

Monday review – the hot stories of the new year

Get yourself up to date with everything we’ve written since the holidays – it’s weekly roundup time.

Thursday 3 January 2019

Friday 4 January 2019

(Watch directly on YouTube if the video won’t play here.)

News, straight to your inbox

Would you like to keep up with all the stories we write? Why not sign up for our daily newsletter to make sure you don’t miss anything. You can easily unsubscribe if you decide you no longer want it.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/4zM9I3MxrT8/

  • 07/01/2019
  • adm

Update now! Adobe Acrobat and Reader have critical flaws

Adobe has patched two critical flaws in Acrobat and Reader that warrant urgent attention.

Officially, Adobe patches security vulnerabilities around the middle of each month to coordinate with Microsoft’s Patch Tuesday, but recently it’s become almost routine for the company to issue out-of-band updates in between.

APSB19-02, the first of such updates to reach customers in the new year, addresses critical flaws with a priority rating of ‘2’.

That means that the flaw is potentially serious, but Adobe hasn’t detected any real-world exploits (the latter would entail issuing an ‘emergency’ patch with a ‘1’ rating).

The first flaw, identified as CVE-2018-16011, is described by Adobe as a use-after-free bug that could be exploited using a maliciously crafted PDF to take control of a target system with their malware of choice.

The second, CVE-2018-16018 (replacing CVE-2018-19725), is a security bypass targeting JavaScript API restrictions on Adobe Reader DC and seems to have been in the works since before Christmas.

Fixing the flaws

Affecting all versions of Window and macOS Acrobat DC/Reader 2019.010.20064 and earlier, the fix in both cases is to update to 2019.010.20069.

For the legacy Acrobat/Reader 2017 2017.011.30110 and Acrobat/Reader DC 2015 2015.006.30461, the updates take those to 2017.011.30113 and 2015.006.30464 respectively.

As critical flaws with a ‘2’ rating, there is a suggested 30-day window within which to apply the updates, but it’s worth bearing in mind that a new round of patches will likely be offered for Adobe products tomorrow as part of Patch Tuesday.

In December’s Patch Tuesday, Adobe released a not inconsiderable 87 patches, including 39 rated critical.

Only days before, Adobe issued an emergency Flash patch for a zero-day vulnerability that was being exploited, while in November Flash received a separate patch for one whose exploitation was believed to be imminent.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/xXdV6nZDxk0/

  • 07/01/2019
  • adm

Hacker doxes hundreds of German politicians

Since 1 December, one or more hackers have been publishing data and documents from hundreds of German politicians in a Twitter advent calendar – a massive assault on the government that wasn’t discovered until Thursday night.

Apparently, nobody noticed until the hacker hijacked the Twitter account of German YouTube star Simon Unge.

On Friday, Berlin public broadcaster RBB Inforadio was the first to report on the hack.

RBB reported that it’s not yet known who the culprit(s) are. But there are theories: A YouTuber named Tomasz Niemiec told news outlet T-online.de that a guy who’s out to gain attention is behind the attacks.

Niemiec said that he knew the hacker strictly through online communications and that the man has been active for years, collecting data and hacking YouTube accounts.

Niemiec says he talked to the hacker on Friday in an effort to get him to surrender Unge’s hijacked account: a highly valuable one with two million YouTube followers. According to what Niemiec told T-online.de, the hacker has hinted that he hijacked Unge’s account by exploiting a supposed bug in two-factor authentication – a purported bug that he doesn’t intend to publish, Niemiec said.

Interior Minister Horst Seehofer told reporters that an initial analysis suggests that the stolen material was obtained from cloud services, email accounts or social networks.

It’s a motley collection that, at least upon initial review, doesn’t seem to contain any highly sensitive political documents. The data sets contain party memos, mobile phone numbers, contact info, photo ID cards, letters, invoices, direct debit authorizations, invitations, chats between politicians’ family members, and credit card information from their family circles.

The targets included Chancellor Angela Merkel and President Frank-Walter Steinmeier. The hackers published Merkel’s fax number, email address and several letters written by and addressed to her, Deutsche Welle reported, citing the DPA news agency.

A government spokeswoman:

With regard to the Chancellery it seems that, judging by the initial review, no sensitive information and data have been published and this includes [from] the chancellor.

Within hours after the news having broken, Twitter shut down the account that for weeks had been leaking the data. The account, named G0d, claims to be based in Hamburg. Security researcher Luca Hammer, who works on identifying Twitter bots, said that two other Twitter accounts, @_0rbit and @_0rbiter, had also been used to spread the material, as well as the Google blog http://0rbiter.blogspot.com. They’ve all since been taken down.

According to Bloomberg, G0d described itself using the words “security researching,” “artist” and “satire irony.” The account had previously published celebrities’ private data, according to NPR.

Besides politicians, artists and journalists with leftist leanings were also targeted. The first target, on 1 December, was the German television comedian Jan Böhmermann. It went on up from there to pull in members of Chancellor Angela Merkel’s center-right party and its Bavarian counterpart.

All German political parties were affected except one: the far right Alternative for Germany, or AfD. All parties in Germany’s federal parliament, the Bundestag, were targeted: the CDU, CSU, SPD, Greens, Left Party and the FDP.

According to the New York Times, the Federal Office for Information Security called a crisis meeting on Friday to coordinate with the country’s domestic and foreign intelligence agencies in investigating the leaks.

Germany’s digital defense body said that it’s “intensively” investigating the apparent data leak, a spokesman for the Federal Office for IT Safety (BSI) said on Friday:

A computer translation:

Hacker attack on politicians: The BSI is currently intensively examining the case in close cooperation with other federal authorities. The National Cyber ​​Defense Center has taken over the central coordination. According to the current state of knowledge there is no concern of the governmental networks.

Hammer said that one of the Twitter accounts, @_0rbit, had over 18,000 followers. Most of them were probably bots, given that they followed the account in batches in April 2017. It looks like the account had a gaming/YouTube/right-wing background, Hammer said: a hunch that supports what Niemiec claims about the YouTube account hijacker he thinks is behind the hacks.

In the early hours following the news breaking, speculation is rife. Was it a YouTube account hijacker out for glory? An inside job? Was it the exploit of a platform with old, known vulnerabilities used by the Bundestag?

We’ll let you know when and if these questions get answered. Here’s some advice we gave back when terrorists were told to hijack social media accounts to spread propaganda:

How to fend off account hijackers

We write about account hijacking quite a bit. Fortunately, many of the big social media platforms are supporting a way – app-based authentication – to protect our accounts from these attacks, which come in such forms as phishing and SIM swaps.

Using application-based 2FA (such as Sophos Authenticator, which is also included in our free Sophos Mobile Security for Android and iOS) mitigates a lot of the risk of SIM swap attacks because mobile authentication apps don’t rely on communications tied to phone numbers.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/FtGcWV3z_-U/

  • 07/01/2019
  • adm