STE WILLIAMS

New Android malware hit more than 100,000 users in 196 countries before Google removed it from Google Play — and it continues to steal personal information from users across the globe.

Researchers at Trend Micro found ANDROIDOS_MOBSTSPY, spyware that disguised itself as six different Android apps, five of which were removed from Google Play in February 2018. One of the apps, Flappy Birr Dog, remained available in the store until the beginning of 2019.

According to the researchers, the malware collects personal information, including user location and SMS conversations, using Firebase Cloud Messaging to send information to its command and control server. That same server can instruct the software to gather data that could include downloading files located on the Android device and conduct a phishing campaign by displaying fake Google and Facebook pop-up ads to encourage the victim to give up credentials.

While the greatest number of victims were in India, which accounted for nearly one-third of the total, the malware’s reach extended to nearly every continent.

For more, read here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities-and-threats/android-malware-hits-victims-in-196-countries/d/d-id/1333585?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Emotet, a nasty botnet and popular malware family, has proven increasingly dangerous over the past year as its operators adopt new tactics. Now armed with the ability to drop additional payloads and arriving via business email compromise (BEC), it’s become a major threat to organizations.

Security watchers are wary of Emotet, which was among the first botnets to spread banking Trojans laterally within target organizations, making removal difficult. Emotet first appeared in 2014 as a Trojan designed to snatch banking credentials and other sensitive data. The threat was frequently spread via phishing emails packed with malicious documents or links.

Over time, Emotet’s operators – a group called Mealybug – have evolved its business model and the shape of their attack from a banking Trojan to a means of delivering other groups’ threats. In 2018, Webroot dubbed Emotet the year’s worst botnet seen distributing banking Trojans.

“Its information stealing payloads are delivered at an impressive pace, suggesting threat actors have automated multiple steps in their campaign operations,” Webroot researchers write in a blog post on their rankings of 2018’s worst threats. The changes to Emotet, while gradual at first, quickly ramped up in recent years as attackers switched to even more nefarious tactics.

After a quiet period in 2015, Emotet detections spiked in the second half of 2017, Symantec reported. Mealybug’s victims expanded that year to include targets in Canada, China, Mexico, and the UK. Toward the end of 2017, the Cylance Threat Research Team analyzed a malicious Microsoft Word file with a malicious macro program created to download Emotet malware.

Taking on New Threats

In 2018, Mealybug ramped up its activity to the point where it was selling malware to other actors, says Sig Murphy, managing director of incident response and forensics at Cylance. Emotet was combined with Trickbot and Qakbot, a tactic Symantec also had detected in Feb. 2018. The blend of Emotet with other strains of ransomware made the threat more dangerous.

“The combination there is really hard to defend against properly because the loader is polymorphic,” says Murphy. “It changes every time it infects a computer.”

US-CERT issued an alert for Emotet in July 2018, calling it an advanced modular banking Trojan that mainly functions as a downloader or dropper of other banking Trojans. Emotet is “the most costly and destructive malware affecting state, local, tribal, and territorial (SLTT) governments, and the private and public sectors,” it says, costing governments up to $1M per incident.

This hybrid threat model “is a unique challenge” to organizations, Murphy says, and catches many off guard. Emotet alone used to drop its own Emotet-branded malware. Later in the year, it was used to deliver new types of threats. Before, it would collect email credentials and use them to spread laterally. It later became interested in the content of targeted emails, he adds.

“It’s pretty clear they’re trying to pivot into [the] BEC attack model, which is different from what they’ve done in the past,” says Murphy of the Mealybug threat group’s evolving strategies. In August 2018, Trend Micro pick up on Spoofed banking emails arriving with Emotet malware. For example, spam emails contain payment notifications from spoofed bank email addresses. The email’s body has a link to download a .doc file, which contains macros that, when run, activate a PowerShell command that downloads and runs the Emotet malware, researchers explain. 

After ramping up in early 2018, Murphy says Emotet increased again during the holiday season. Through the start of 2019, the malware continued to spread, and new enterprise clients were asking Cylance for help after getting infected, he says. Its growth signifies greater maturity among the Mealybug actors as they learn what’s effective.

“They seem much more organized than a lot of other groups,” Murphy explains. “The shift [to BEC] says they’re continuing to be more organized … they know what’s working and what’s not.” New ransomware variants like Qakbot provide a new source of income, he adds.

Thinking Ahead of the Attackers

It’s hard to tell what Mealybug will do next. One route they could take, says Murphy, is attempt to make their attacks quieter. While he has no indication they might do this, he points out how Emotet in its current form is “very noisy” in its spread. If they could change the threat so it spreads without taking down systems, it would be harder to know a business is at risk.

Related Content:

• 6 CISO Resolutions for 2019
• 7 Business Metrics Security Pros Need to Know
• Taming the Digital Wild West
• Cyberattack Halts Publication for US Newspapers

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/emotet-malware-gets-more-aggressive-/d/d-id/1333584?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

When we think of critical infrastructure in the cyber context, we tend to think about industrial control systems for power plants and water treatment facilities, or the electronic ballet box. But in today’s environment, when disinformation is a major threat vector to our national security, it’s important to expand these preconceptions.  

Let’s start with the basic tenet that an informed citizenry is foundational to the integrity of a democratic system.  In that context, certain sources of information — especially those outside of entertainment or commerce — can also be considered critical. The concept of a newspaper of record, which was established long ago, is a good example, along with their modern equivalents such as radio, television, and Internet media. These institutions play an important role in shaping public opinion and policy decisions.

Although news sources have always carried some degree of editorial bias, the bias in journals of record is based on an assumption that, whatever the bias, the foundation of the reported information is personal observation and recorded fact. Now that “alternative facts” have become mainstream, understanding sources of (mis)information and combating overt information warfare operations demands the rigor of critical infrastructure protection.

The Unintended Consequences of Privacy Regulations
We are also seeing the potentially detrimental effects of well-meaning privacy legislation, which has been enacted at a particularly inopportune time given the rise in fake news and election meddling. The European Union’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act of 2018, and the Canadian Personal Information Protection and Electronic Documents Act are all positive steps forward in protecting citizens. But, as is so often the case, these well-intentioned efforts have unintended consequences.

While there is no doubt that privacy regulation aims to safeguard citizens’ private data, these new laws are also hampering cybersecurity efforts — specifically, in the context of security analysts’ ability to gather and share threat intelligence about suspicious or malicious online infrastructure. As a particularly concerning example, privacy rules have taken a large bite out of the data available through the domain Whois services, making domain ownership largely opaque to investigators. This is significant, because analysis of infrastructure through a combination of DNS and registration data has been a mainstay of threat intelligence operations for years.

It’s true that threat actors have used Whois privacy for years to cover their tracks. But they have also routinely used bogus registration information to cover their tracks. Sooner or later, many of them slip up, and those mistakes help investigators and analysts crack open emerging or ongoing attack campaigns. That’s why it is critical that security researchers have access to registration and infrastructure information that can identify the actors behind cyber incidents of all kinds — including fake news campaigns and outright election tampering. Threat research from FireEye on Iranian operations further emphasizes the importance of this kind of  threat intel.

This One Weird Trick to Save Democracy
OK, “save democracy” is perhaps a bit of hyperbole, but the underlying point is valid: Using threat intelligence productively in the effort to defeat disinformation campaigns is important for creating an online environment that bolsters democracy in an age of tighter privacy laws. While the removal of identifying information from domain Whois records has put a crimp in adversary infrastructure analysis workflows, it is by no means a showstopper. With the current privacy limitations on how data can be used and shared, cybersecurity professionals simply will need to understand how their efforts to combat threat actors are affected.

The good news is that analysts and hunters still can very effectively identify and combat cyber threats. But it will require going beyond Whois with shifts in long-ingrained workflows and practices used in adversary analysis. For example:

• Registration details certainly have been some of the lowest-hanging fruit for developing an actor persona or mapping a campaign. But there is a wealth of other data that can often be just as effective. Examples include DNS records (including Start of Authority, or SOA, records, which are email addresses), as well as web content such as SSL/TLS certificates, tracking codes, website titles, and screenshots. When actors create the infrastructure for an attack campaign, they often reuse many of these elements across multiple domains. It would be costly in terms of time and, in some cases money, for them to do otherwise. This is to your advantage when correlating threat actor assets.
• Remember that doxing isn’t your goal (unless you’re in law enforcement, perhaps). When trying to understand an emerging or evolving attack campaign, the most valuable aspect of attribution is to identify a persona (like a “John Doe” profile in physical crime investigations) that ties together the domains, IP addresses, web assets, malware files, and other components of the campaign. You don’t need an actual, genuine identity. Even in the days of open Whois records, it was very hard to be certain that a given identity was legitimate.
• Once a persona or correlated set of attack infrastructure has been identified, it becomes easier to take concrete actions such as searching for the discovered items (domains, IPs, URLs, etc.) in log archives or SIEMs, creating blocking rules to cover the entire campaign, or creating watchlists to monitor for ongoing evolution or expansion of the attack infrastructure.

What’s Next
The last two major US elections turned a sharp spotlight on the security (or lack of security) of the mechanisms that allow democracy to operate. Long after the votes have been counted, forensic analysis will seek to understand what, if any, impact was made by adversarial online activity, while intelligence analysis will similarly examine whether disinformation campaigns were effective in influencing electoral outcomes. The ability to comprehensively, accurately, and efficiently analyze threat actor infrastructure and campaigns is a core requirement of such work.

The good news is that there are excellent data sources, tools, and practices to enable security and intelligence professionals to shed light on, and ultimately protect against, adversaries who seek to hide in the Internet’s shadows.

Related Content:

• 6 Ways to Anger Attackers on Your Network
• Toxic Data: How ‘Deepfakes’ Threaten Cybersecurity
• Privacy Futures: Fed-up Consumers Take Their Data Back

Tim Helming, DomainTools Director of Product Management, has over 15 years of experience in cybersecurity, from network to cloud to application attacks and defenses. At DomainTools, he applies this background to helping define and evangelize the company’s growing portfolio of … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/redefining-critical-infrastructure-for-the-age-of-disinformation-/a/d-id/1333568?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A data breach at BlankMediaGames (BMG) has affected more than 7.6 million players of Town of Salem, a browser-based role-playing game.

The incident was disclosed on December 28 to cybersecurity company DeHashed, which received an anonymous email containing evidence of server access and the database. DeHashed says affected data includes usernames, emails, passwords, IP addresses, game and forum activity, and payment information. Some users who paid for features had billing data compromised.

However, in an announcement about the breach on the Town of Salem forum, a representative by the name of Achilles reported that the game does not store any credit card or payment data. Further, the representative wrote, all passwords were hashed and not stored in plain text. Third-party payment processors are responsible for financial transactions; Town of Salem does not have access.

“The only important data compromised would be your Username/hashed password, IP and email,” Achilles wrote. “Everything else is just game related data.”

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/town-of-salem-game-breached-76m-players-affected/d/d-id/1333580?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Fred Wolens, VP of Policy and Communications at Recorded Future, also contributed to this article.

The Internet is the digital Wild West, more so now than ever before.

The past two years specifically have been a vortex of accelerating malice and resulting chaos: attempted Olympic disruption, American election interference, global ransomware worms, central bank heists, credit bureau pillaging, global business losses, cryptocurrency exchange thefts. And these are only the highlights of what has been publicly reported.

Despite the increasingly dire headlines, there’s hope yet for the Internet. It begins with an improved public/private model — backed by legislation — for policing cybercrime and helping American businesses defend themselves.

Step 1: One Focused Agency
For American individuals and businesses, there is no clear answer on who leads the fight on cybercrime — or who leads interagency collaboration. In federal law enforcement, there are numerous agencies within the Departments of Justice and Homeland Security that investigate cybercrime, among them: the FBI, Secret Service, Homeland Security Investigations (HSI), and Office of the Inspector General (OSI). In addition, you can also add state and local police agencies to the web of confusion — and that’s still before considering the overlap with intelligence (ODNI/NSA), military (DIA or NCIS), and international (Interpol/Europol) agencies.

Certainly, there has been progress toward industry partnership in the past decade. Both the Secret Service and FBI have created cybersecurity-focused entities (the Electronic Crimes Task Forces [ECTF] and InfraGard, respectively). However, the limitations on law enforcement information sharing make these groups less effective, blunting their ability to further affect cybercrime.

Equally responsible for the marginal success in prior efforts is the lack of NSA participation. It is clear that the NSA has the most visibility into malicious cyber activity and is the most informed organization in America (and probably the planet) on adversary cyber activity.

We need an organization within the NSA — modeled on the UK’s National Cyber Security Centre (NCSC), which is part of Government Communications Headquarters (GCHQ, the British NSA equivalent) — that is focused solely on helping American individuals and businesses defend themselves. The NCSC provides timely guidance on threats, ranging from phishing to malware to fraud, and shares technology with the private sector directly. Similarly, America needs a well-informed cybersecurity guidance resource to fill the current void.

History has shown that businesses are ill equipped for sustained defense from well-funded and motivated attackers. Sophisticated enemies, with seemingly endless time are using the cyber domain to continuously victimize American businesses at will. The cost of doing business should not include fending off nation-state-sponsored offensive cyber campaigns.

The answer begins with Congress legislating a new organization, modeled after the NCSC, owned by the NSA, and mandated to share all possible threat guidance and defensive technology with American businesses. The goal: to increase America’s cybersecurity awareness and resilience.

Step 2: Retain and Invest in Government Talent
We need America’s best and brightest in public service defending America from cyber enemies. Employee compensation and training budgets must increase across the board.

The problem is that government salaries and the General Services Administration (GSA) schedule have not kept pace with private sector salaries for employees with cybersecurity skills. This is equally true across military, intelligence, and law enforcement agencies.

Government employees increase their skills, learn tradecraft, and then depart for the private sector because the opportunity costs are too great for them and their families to stay in government service. Ultimately, a government retirement plan can’t compete with a 30% (or more) private sector salary increase.

Related to training, police officers are generally the first line of support for individual victims. But when the phone rings, it’s frustrating for officers trying to take a report or advise on next steps. All law enforcement agencies should have sufficient budget for cybercrime training, and an NSA-led agency like the NCSC should lead the way on training these officers.

Congress must revise the GSA schedule for federal employees in cybersecurity concentrations, and earmark funding for police training across all agencies because, as a nation, we can’t afford to continually lose our most talented people to the private sector.

Step 3: Empowering the Private Sector
The private sector has the knowledge and skills to be a force multiplier for law enforcement. Network defenders and researchers typically have better tools and data than law enforcement on cyber malfeasance. The current problem for the private sector is trust, or the lack thereof, with law enforcement. Specifically, private sector collaborators need protection from having the law wielded against them as a result of their efforts.

The past 15 years are a testament to the success of proactive private sector volunteers and working groups — DNS Changer is a great example. It was created to tackle dire cyber threats and assist with attribution.

A primary impediment to increased cooperation is the Computer Fraud and Abuse Act (CFAA) (18 US Code §1030), signed in 1986 and, to a lesser extent, Section 1201 of the Digital Millennium Copyright Act (DMCA) (17 US Code §1201). These two laws indiscriminately lump in valid cybersecurity research along with the most reprehensible of cybercrimes. The CFAA criminalizes “exceeding unauthorized access” to websites, which allows site owners to unilaterally prevent any investigation of potential vulnerabilities through prohibitions written in to terms of service.

Similarly, the DMCA penalizes almost any circumvention of copyright protections (including encryption protocols), which is often necessary to carry out security research. These federal laws are being augmented by state laws, such as legislation recently passed in Georgia, that perpetuates these oversights.

Revised legislation should reaffirm Fourth Amendment digital rights and also encourage law enforcement to share cybercrime case details (not national security cases or cases that began from a counterintelligence nexus) with the private sector where relevant. Legislative efforts should also creatively provide law enforcement with improved investigative tools (again, while reaffirming the Fourth Amendment), increase law enforcement budgets for training, and encourage all nations to adopt similar definitions for “unauthorized access.” Additionally, we should encourage more legislation like the Internet of Things Cybersecurity Improvement Act of 2017 that provides specific security research exemptions.

As a society, we have an incredibly skilled and willing modern-day private sector that has been diligently working behind the scenes toward a safer Internet. This is the reason that global malware attacks are relatively muted. For example, large-scale attacks like the Storm and WannaCry worms were poised for maximum destructive impact before the private sector intervened. Congress should do more to encourage good Samaritan efforts in the cybersecurity community and make it easier for law enforcement to consistently collaborate with them and vice versa.

Related Content:

• 6 Ways to Anger Attackers on Your Network
• Hacking Back the Digital Wild West
• The Coolest Hacks of 2018
• Criminals Move Markets to Remain in the Shadows

Author Bios:

Fred Wolens is VP of Policy and Communications at Recorded Future, the real-time threat intelligence company. Fred oversees Recorded Future’s compliance programs, and manages many of the internal policies that guide the company’s intelligence efforts. Before joining Recorded Future, Fred was a member of Facebook’s Public Policy Team, managing PR and policy for many security, privacy, and safety issues. In the past, Fred has also worked with a number of technology companies including AirBnB, Uber, and SurveyMonkey, and with the Office of the Shadow Foreign Secretary in the United Kingdom researching technology policy. Fred holds a B.A. in Political Science from Stanford University, and a J.D./M.B.A. from Harvard.

Levi Gundert is the vice president of intelligence and risk at Recorded Future where he leads the continuous effort to measurably decrease operational risk for customers.
Levi has spent the past 20 years in both government and the private sector, defending networks, … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/taming-the-digital-wild-west/a/d-id/1333569?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple