STE WILLIAMS

An infosec firm has unleashed a NotPetya-style worm onto a customer’s network – and discovered that a simple Windows Active Directory tweak has a surprising effect on self-spreading malware.

In the wake of the outbreak of NotPetya – so-called because it masquerades as Petya ransomware – one of NCC Group’s customers asked the firm to create a safer version of the malware, which rampaged through half the world’s computers in 2017, encrypting files and destroying Windows machines’ master boot records.

Not only did the client want to observe a “less lethal” version of NotPetya, it wanted the not-quite-malware deployed on its own production network as a learning exercise to understand how better to harden itself against destructive malware outbreaks.

UK names Russia as source of NotPetya, USA follows suit

READ MORE

Thus was born NCC’s Eternalglue worm, which differs from actual malware in being configurable not to touch defined network ranges or hosts; in the case of NCC’s rather adventurous customer, the firm’s industrial control systems.

When studying how Eternalglue spread through the target network, NCC made a rather surprising discovery: a simple Active Directory setting was enough to stop it in its tracks, even if a domain admin account was used to log into an infected device.

The unnamed NCC customer “had configured within Active Directory the ‘Account is sensitive and cannot be delegated’ flag prior to NotPetya for their domain administrator accounts. We found that this configuration would have hindered NotPetya propagation significantly using the token impersonation route for domain admin accounts,” said the infosec firm.

As a Microsoft Technet post stated, the “account is sensitive” flag means that “an account’s credentials cannot be forwarded to other computers or services on the network by a trusted application,” something NCC summed up as “this is now your favourite setting”.

Two-hundred-and-sixteen hosts on the anonymous customer’s network were infected with Eternalglue during the trials, with six different combinations of user accounts and privilege levels as starting scenarios. Of those hosts, 209 were “compromised by stealing non-domain admin tokens”, of which 57 were done through the use of current user tokens and 152 through token impersonation techniques.

“What we have learnt from other firms looking to replicate the exercise in their own institutions is the craving for real-world data against these types of threat scenarios and the value it has to seniors in terms of measuring efficacy,” mused NCC.

NotPetya itself was publicly attributed to Russian military hackers in early 2018 by the British government. One notable casualty of the full-strength malware was shipping line Maersk, which had the entirety of its internal networks KO’d, resulting in the forced rebuild of 4,000 servers across the world. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/12/03/notpetya_ncc_eternalglue_production_network/

Employers must start broadening their search for experienced security professionals to include people with the right traits rather than the right skills.

At the beginning of the year, the World Economic Forum (WEF) released its annual Global Risks Report, in which the organization outlined the greatest risks to businesses around the world in 2018. Unsurprisingly, cyberattacks and data breaches both ranked in the top five.

The report is simultaneously doubtful that its findings will have any effect on the current cybersecurity skills gap, which is estimated to result in 3.5 million unfulfilled cybersecurity jobs by 2021. The bottom line is that cyberattacks continue to increase in scope and frequency, and we simply don’t have the manpower to address them.

This is a critical moment, and now is the time for us to act. Enlisting the next generation of skilled cyber professionals, as well as training existing employees, will help us build stronger defenses and restore confidence among Americans worried about their — and our nation’s — cyber safety.

The Issue at Hand
If demand for cybersecurity talent continues to increase, then we must strengthen our commitment to educating and training society in this domain as early as possible.

Luckily, today’s young adults are increasingly aware of and interested in cybersecurity jobs. At the same time, there’s been an increase in the number of cybersecurity-related courses and degrees offered at universities. In fact, some universities are collaborating with the private sector to build a new curriculum that more directly meets workforce need.

The bad news is that on-the-job training is scarce, mostly as a result of limited budgets and unclear roles and responsibilities. If organizations continue to fail at providing both non-cyber and cyber employees more formal training, businesses as well as policy and technology leaders agree that there will be serious implications for the world’s security, safety, and economic stability.

How We Move Forward
Many employers falsely believe that those interested in a career in cybersecurity must first have a penchant for technology. The truth is, as Marc van Zadelhoff, general manager of IBM Security, pointed out in the Harvard Business Review, “unbridled curiosity, passion for problem solving, strong ethics, and an understanding of risks” are all qualities that would make anyone well suited for a career in cybersecurity. Employers must start broadening their search to include people with the right traits, rather than the right skills, in order to start closing the workforce gap.

This is particularly important for attracting midcareer professionals looking to make a career change. Many of these people exist but don’t have the time or money to return to school for another degree. While their previous career path or degree may at first seem irrelevant, they are likely to bring new experiences and perspectives that would make them an ideal candidate.

Filling 3.5 million jobs by 2021, however, will require more than hiring midcareer professionals. Everyone today, regardless of the industry or position they work in, has a digital presence and must have an understanding of how to protect themselves, as well as their employers, online. To successfully grow cyber talent across industries, we must not focus solely on those who have specific cybersecurity skills. Rather, it should be the goal of every organization to arm those working in finance, communications, product, or even HR with cybersecurity knowledge. Cybersecurity is simply too complex for there to be only one individual appointed as the expert.

Enhancing cybersecurity awareness in the workplace starts with education, beginning in elementary school and continuing all the way through college. Both parents and teachers need to encourage young children to take part in cyber challenges or enroll in programs like GenCyber, which aims to help kids understand safe online behavior, and Think Like a Programmer, Girl Scouts of the USA’s new computer science curriculum.

The consequences of the cybersecurity talent gap have never been more serious; we must have a strong, informed, and ready pool of young adults capable of taking the lead for decades to come. To get there, we must encourage even more awareness and interest, enrichment activities, and career exploration incentive programs. If we do so, the improvement in closing the skills gap we’re already seeing will increase tenfold.

Related Content:

• 9 Traits of A Strong Infosec Resume
• The “Typical” Security Engineer: Hiring Myths Stereotypes
• How to Find a Privacy Job That You’ll Love ( Why)

John DeSimone, VP, Cybersecurity Special Missions, Raytheon
John DeSimone is vice president of cybersecurity and special missions for Raytheon Intelligence, Information and Services (IIS). He is an experienced cybersecurity and technology executive working within corporate … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/filling-the-cybersecurity-jobs-gap---now-and-in-the-future/a/d-id/1333368?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A new partnership wants to improve how people use and manage the virtual identities that govern their lives online.

Microsoft and Mastercard have formed a partnership to change the way people use and manage their digital identities, the duo announced this morning.

Identity management is an old issue in need of new solutions as people rely on the internet to manage every part of their lives. Online identity verification still requires physical or digital proof from a central party: proof of address, driver’s license or passport number, for example. The more accounts someone has, the more usernames and passwords they have to remember.

And the burden to users doesn’t stop at passwords. The identity verification process is growing in complexity as companies find new ways to ensure the person logging into an account is who they claim to be. Microsoft and Mastercard want to provide a more secure and efficient way of doing that.

Their idea is to create a service designed to let people enter, control, and share their digital identity data with others, on the devices they use every day. A universally recognized digital identity could make it easier and more seamless for people to work with businesses.

This project, which brings together Microsoft’s identity technology and Mastercard’s digital transaction capabilities, will serve as the foundation for new Mastercard services run on Microsoft Azure, officials explain in a blog post on the news. The two are teaming up with banks, mobile network operators, and government organizations to make the idea reality.

Microsoft has been building on this idea of identity ownership, arguing that everyone should have their own digital identity within which they can privately store personal information. For businesses, this means creating ways to interact with customers, partners, and suppliers while minimizing security risks. Earlier this summer, the company created a new bug bounty program to reward researchers who found vulnerabilities in its identity services.

The potential for this “universal identity” concept crosses industries. In financial services, a single identity could accelerate the process of creating a new account or securing a loan. Shoppers browsing e-commerce sites could benefit from more personalized experiences and faster transactions across payment types, devices, and service providers.

Aside from financial opportunities, a single identity could simplify tax filing, passport applications, support payments like Social Security, and other government processes. Email, social media, entertainment services, and other lifestyle platforms could also be simplified.

Microsoft and Mastercard think their service could solve several challenges in the identity space. For starters, there are more than one billion people who aren’t officially recognized, the majority of whom are women, children, and refugees. A digital identity could prove invaluable in helping people obtain health, financial, and social services they may not otherwise access.

“Today’s digital identity landscape is patchy, inconsistent and what works in one country often won’t work in another,” says Ajay Bhalla, president of cyber and intelligence solutions at Mastercard, in a statement. “We have an opportunity to establish a system that puts people first, giving them control of their identity data and where it is used.”

Related Content:

• Holiday Hacks: 6 Cyberthreats to Watch Right Now
• 39 Arrested in Tech Support Scam Crackdown: Microsoft
• Overall Volume of Thanksgiving Weekend Malware Attacks Lower This Year
• Establishing True Trust in a Zero-Trust World

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/microsoft-mastercard-aim-to-change-identity-management/d/d-id/1333384?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A group of researchers has found 42 zero-day flaws in a range of software tools using a new take on an old concept. The team, from Singapore, Australia and Romania, worked out a better approach to a decades-old testing technique called fuzzing.

A standard part of software testing involves developers placing inputs in software that they think might cause trouble. They then use scripts or tools to automatically run the program and test it with those inputs. They might test a web form that takes a first name as input for example, and ensure that it doesn’t allow a blank entry, or an entry that includes a command to manipulate a database.

This can be useful in ferreting out flaws, but it is difficult to make that comprehensive. Developers may not think of everything. And it gets even more complicated if you are uploading a sound file or a photograph. It’s far more difficult to produce testing data that might break the program, or even to know what that might look like.

Fuzzing programs fill that gap by automatically changing files and other inputs in many unpredictable ways. They can run thousands of different inputs against the program, often changing individual bits in each file that they present to it, to see if anything breaks.

There are three broad kinds of fuzzing.

Black box fuzzing knows nothing about the target program and just throws as many combinations as possible at it indiscriminately. This is fast, but it isn’t good at exposing bugs buried deep inside a program.

White box fuzzing is at the other end of the spectrum, analysing the structure of the program in depth to understand how it functions. This lets it tailor its tests to particular logic flows in the program code, increasing the percentage of a program’s function that it can look at, which testers call ‘coverage’. It can uncover some deep and meaningful bugs, but it can be slow and time-consuming.

Grey box fuzzing looks for a happy medium. Instead of analysing a program’s structure, it uses some ‘seed’ files designed to generate valid inputs and mutates them by flipping bits in those files. When it finds a result that it considers interesting, it adds the input that generated it to the list of seed files and then iterates on that.

Grey box fuzzers effectively feel their way around a program like a person feeling their way around a dark room. They are faster than white box fuzzers but more effective in increasing coverage than black box ones.

American Fuzzy Lop (AFL) is a good example of a grey box fuzzer. However, the researchers wanted to make it even better. They decided that just feeling its way through a program by flipping bits in an input file would only get the fuzzer so far. It would be unlikely to address major structural changes in a file that could expose deeper bugs. To change that, they decided to create a map of the input file structure. This map, known as a virtual structure, describes the file format and shows where different parts (chunks) of the file begin and end along with how each chunk differs from others. In their case, they developed a virtual structure for media formats like wave audio files.

This approach lets the researchers apply the same bit-flipping approach that traditional grey-hat fuzzers use, but to do it with seeds representing different file chunks. The tool can add, delete and splice different chunks when fuzzing at this level, producing more meaningful variations in its files. It then uses these to feel its way through the program, increasing its coverage by exploring variants on interesting files that can expose more bugs.

The research team used this concept to enhance AFL, creating a tool called AFLSmart. By using this file structure, the researchers have managed to improve upon AFL’s already impressive record. According to the research paper, AFLSmart discovered more than 42 zero-day vulnerabilities in software tools that are already widely used and well tested. At the time of publication, the tool had led to 17 CVEs.

This tool promises to refine the already highly effective grey box approach to fuzzing. What would be really interesting is to analyse its performance compared to a white box fuzzer that has the considerable resources of a large cloud infrastructure behind it, like Google’s OSS-Fuzz.

Is it better to try and compromise with efficient approaches that balance coverage and speed, or to use a tedious but highly productive approach and then throw lots of cheap computing power at it?

It’s an important question because both software engineers and malicious hackers are increasingly relying on fuzzing to ferret out zero-days.

Whichever way works best, one thing is clear: the venerable old fuzzing process is improving thanks to advancing techniques.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/J4rOaTulhc0/

More than 100 Indian police swarmed 16 tech support scam call centers in Gurgaon and Noida last week, arresting 39 people for allegedly impersonating legitimate support reps for companies including Microsoft, Apple, Google, Dell and HP.

The day after the raids, which were carried out on Tuesday and Wednesday, Microsoft said that it has received over 7,000 victim reports from customers in more than 15 countries who’ve been ripped off by the call centers.

This is the second of two recent, big raids on Indian tech support scammers. In October, after Microsoft filed complaints about customers falling for pop-up messages that lied about their systems being infected with malware, Indian police raided 10 illegal call centers and arrested 24 alleged scammers.

In that second raid, law enforcement seized a wealth of evidence, including the call scripts, live chats, voice call recordings and customer records used to run the scams.

Typosquatting and malvertising

There are a few ways that people can fall prey to these swindlers, who get to people via both phone calls and pop-up windows. Last year, researchers at Stony Brook University rigged up a robot to automatically crawl the web searching for tech support scammers and to figure out where they lurk, how they monetize the scam, what software tools they use to pull it off, and what social engineering ploys they use to weasel money out of victims.

They found that users often get exposed to these scams via malvertising that’s found on domain squatting pages: the pages that take advantage of typos we make when typing popular domain names. For example, a scammer company will register a typosquatting domain such as twwitter.com.

Studies have shown that visitors who stumble into the typosquatting pages often get redirected to pages laced with malware, while a certain percentage get shuffled over to tech support scam pages.

Once there, a visitor is bombarded with messages saying their operating system is infected with malware. Typically, the site is festooned with logos and trademarks from well-known software and security companies or user interfaces.

A popular gambit has been to present users with a page that mimics the Windows blue screen of death.

The frequency of fake blue screens of death has over the years turned “Microsoft” into a red-alert word. According to Microsoft’s recently released global survey, three out of five Windows users had encountered a tech support scam in the previous year. That reflects a five-point drop since 2016, which is good, but it’s not great, Microsoft said: the scams are still going strong, targeting all ages and all geographies.

As the list of impersonated companies from the recent raid shows, you’re not immune if you don’t use Windows: scammers have branched out so they can prey on a broader audience, pretending to be aligned with Apple or other big-name tech companies.

Like a fly in a web

Beyond spooking visitors with their bogus alerts, tech support pages will wrap them up in intrusive JavaScript so they can’t navigate away. For example, they’ll constantly show alert boxes that ask the intended prey to call the tech support number. Other techniques include messing with a user’s attempt to close the browser tab or navigate away from the site by hooking into the onunload event.

Feeling stuck like a fly in a web, a naive user will call what’s often a toll-free number for “help” with the “malware infection”. The person on the other end of the line will instruct the caller to download remote desktop to allow the remote “technician” to connect to their machine. That gives the crook complete control over the victim’s computer. At that point, perfectly innocent system messages will be interpreted as dire indications of infection.

Microsoft has found that its victimized customers typically get charged between $150 and $499 for the unnecessary tech support they supposedly need to get unstuck from the fictitious web. To add insult to injury, besides being gouged for fake tech support, once the victims have opened up their systems to remote access, they’re left vulnerable to malware or other types of attacks.

Microsoft has been fighting these scams since 2014, when it dragged multiple US companies into court. That’s also when it began to collect customer complaints about the scams via its Report a technical support scam portal.

What to do

Microsoft passed on these key ways to save yourself from getting scammed and having to use that portal:

• Be wary of any unsolicited phone call or pop-up message on your device.
• Microsoft will never proactively reach out to you to provide unsolicited PC or technical support. Any communication it has with you must be initiated by you.
• Don’t call the phone number in a pop-up window on your device, and be cautious about clicking on notifications asking you to scan your computer or download software. Many scammers try to fool you into thinking their notifications are legitimate.
• Never give control of your computer to a third party unless you can confirm that it is a legitimate representative of a computer support team with whom you are already a customer.
• If skeptical, take the person’s information down and immediately report it to your local authorities.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/xzrVfVsEnnw/

Roundup November ended with a week of medical mishaps, near disaster at Dell, and the introduction of Pesky Pepper.

Here are a few more bits that went under the radar.

Linux gets its own nasty Bitcoin malware

Researchers with Dr Web took credit for the discovery of Linux.BtcMine.174. If the malware gets onto a Linux system it, as the name suggests, attempts to hijack cycles to mine cryptocurrency and also tries to disable any security software.

On top of that, the malware seeks and destroys any competing coin miners that might be running on the host, and also checks for any possible SSH connections to other machines that could be infected for purposes of funbux creation.

Council officials in the City of York in England were under-fire for somewhat overreacting and calling the police on a security researcher who discovered a data-leaking gaffe in an app, One Planet York, which is used for organizing bin collections. The cops declined to investigate, seeing as no crime was committed.

The city’s busybodies publicly claimed they couldn’t get hold of the researcher after he tipped them off to the vulnerability, causing them to freak out, whereas his bosses at infosec biz RapidStrike demonstrated both sides had been exchanging emails just fine.

The council also alleged the researcher deliberately swiped info from the app without permission, which was an unfair claim. In reality, the software spaffed people’s personal info to other users of the app via a leaderboard page. Simply visiting the board caused the application’s backend to cough up, in plaintext via its API, other folks’ names, email addresses, phone numbers, postal addresses, postcodes, and their SHA-256-hashed password. The API would emit these details for its top-ten users.

The app was pulled, and city residents and the UK’s privacy watchdog, the ICO, were alerted.

London calling to the crypto jerks, FCA action is now in the works

British financial regulators are keeping a close eye on the cryptocurrency market, and legal action against bad actors looks to be on the upswing.

This according to a report from The Telegraph, citing the results of an information request from the London Financial Conduct Authority on its investigations of cryptocurrency firms.

The report found that, as of November, it was investigating at least 50 cases of businesses operating in the cryptocurrency market without proper authorization, and at least seven more whistleblower cases from employees who said they believed their company was acting outside of the law.

Of course, with the price of Bitcoin and other currencies currently plummeting, the FCA may see its case load drop in the coming year as cryptocoins become less appealing to the shady get-rich-quick crowd.

An Amazon-hosted ElasticSearch database was discovered misconfigured and wide open containing the first name, last name, employer name, job title, email address, postal address, state, zip code, phone number, and IP address for 56,934,021 US citizens. The database is now hidden from view. It may have been built from publicly disclosed sources.

UrbanMassage gets unhappy ending in data breach caper

Customers of on-demand bodyworkers UrbanMassage are going to be carrying a bit more tension than usual this week, after the company exposed the records on some 300,000 people.

Researcher Oliver Hough discovered that the massage company was the latest firm to leave a database accessible to the open internet (and anyone doing a Shodan search). The lost data included names, email addresses, phone numbers, and referral codes.

More disturbing was the exposure of a collection of sexual misconduct claims the company had fielded, including creepy customers who had a reputation of asking their therapists for “extra service” on top of their normal massage.

The company has since taken down the database and is investigating the matter.

Orange is the new Blackmail

A group of South Carolina inmates are in hot water after they were caught catfishing military members from behind bars.

The US Naval Criminal Investigative Service (NCIS) says it has begun a crackdown on an extortion ring in what it calls “Operation Surprise Party.”

According to the NCIS, the prisoners have been scamming money out of military members by posing as young women on social networking and dating sites. After striking up a friendship with the targeted military members, the inmates would send the targets naked photos.

Shortly after, they would contact the targets from a separate account claiming to be the woman’s father and alleging the woman was underage. The soldiers, fearful of arrest and the loss of their military careers, were then told to send money in order to keep the entire affair quiet.

Investigators said that, by the time the racket was broken up, it had netted more than $550K to the inmates and their associates outside.

Ebay Japan accidentally leaked its source code onto the web by making its Git repo public from its website.

OpenSSL changes up licensing, version scheme

Those who use OpenSSL should take note: some changes to the library are coming up.

Matt Caswell says that the upcoming release, which will be the first released under the Apache License 2.0, will also introduce a new version scheme that will look to simplify the release process and bring it more into line with other software.

“In practical terms our “letter” patch releases become patch numbers and “fix” is dropped from the concept. In future, API/ABI compatibility will only be guaranteed for the same MAJOR version number. Previously we guaranteed API/ABI compatibility across the same MAJOR.MINOR combination,” Caswell explained.

“This more closely aligns with the expectations of users who are familiar with semantic versioning. We are not at this stage directly adopting semantic versioning because it would mean changing our current LTS policies and practices.”

Dunkin’ puts the D’oh! in donuts

Beloved US coffee chain Dunkin’ Donuts is giving out more than tasty pastries to its punters this week after the company caught wind of an attempted hack on its customer rewards program.

It turns out that one or more evil-doers got a cache of stolen email addresses and passwords from other sites and attempted to point them at the Dunkin’ Donuts customer portal. Those who had re-used the stolen credentials would have had the attacker pull up a page that would contain their name, email address, and DD Perks account codes.

While that is hardly considered sensitive information in the grand scheme of things, it would be enough to allow the hackers to use other peoples’ accounts, and the money stored on them, to pay for food and drink.

If you do get a notice from Dunkn’, it would be a good idea to change your password ASAP, and let this be a lesson to never re-use your passwords.

AWS tightens up security with Hub launch

Now you have no excuse not to lock down your Elastic Compute and S3 instances.

AWS has introduced a new security hub that the cloud giant hopes will allow admins to have a better overview of all the security settings in place across their VMs and storage bucks.

“AWS Security Hub reduces the effort of collecting and prioritizing security findings across accounts, from AWS services, and AWS partner tools,” AWS says of the hub.

“The service ingests data using a standard findings format, eliminating the need for time-consuming data conversion efforts. It then correlates findings across providers to prioritize the most important findings.” ®

Sponsored:
Putting the Sec into DevSecOps

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/12/01/security_roundup_301118/

Roundup November ended with a week of medical mishaps, near disaster at Dell, and the introduction of Pesky Pepper.

Here are a few more bits that went under the radar.

Linux gets its own nasty Bitcoin malware

Researchers with Dr Web took credit for the discovery of Linux.BtcMine.174. If the malware gets onto a Linux system it, as the name suggests, attempts to hijack cycles to mine cryptocurrency and also tries to disable any security software.

On top of that, the malware seeks and destroys any competing coin miners that might be running on the host, and also checks for any possible SSH connections to other machines that could be infected for purposes of funbux creation.

Council officials in the City of York in England were under-fire for somewhat overreacting and calling the police on a security researcher who discovered a data-leaking gaffe in an app, One Planet York, which is used for organizing bin collections. The cops declined to investigate, seeing as no crime was committed.

The city’s busybodies publicly claimed they couldn’t get hold of the researcher after he tipped them off to the vulnerability, causing them to freak out, whereas his bosses at infosec biz RapidStrike demonstrated both sides had been exchanging emails just fine.

The council also alleged the researcher deliberately swiped info from the app without permission, which was an unfair claim. In reality, the software spaffed people’s personal info to other users of the app via a leaderboard page. Simply visiting the board caused the application’s backend to cough up, in plaintext via its API, other folks’ names, email addresses, phone numbers, postal addresses, postcodes, and their SHA-256-hashed password. The API would emit these details for its top-ten users.

The app was pulled, and city residents and the UK’s privacy watchdog, the ICO, were alerted.

London calling to the crypto jerks, FCA action is now in the works

British financial regulators are keeping a close eye on the cryptocurrency market, and legal action against bad actors looks to be on the upswing.

This according to a report from The Telegraph, citing the results of an information request from the London Financial Conduct Authority on its investigations of cryptocurrency firms.

The report found that, as of November, it was investigating at least 50 cases of businesses operating in the cryptocurrency market without proper authorization, and at least seven more whistleblower cases from employees who said they believed their company was acting outside of the law.

Of course, with the price of Bitcoin and other currencies currently plummeting, the FCA may see its case load drop in the coming year as cryptocoins become less appealing to the shady get-rich-quick crowd.

An Amazon-hosted ElasticSearch database was discovered misconfigured and wide open containing the first name, last name, employer name, job title, email address, postal address, state, zip code, phone number, and IP address for 56,934,021 US citizens. The database is now hidden from view. It may have been built from publicly disclosed sources.

UrbanMassage gets unhappy ending in data breach caper

Customers of on-demand bodyworkers UrbanMassage are going to be carrying a bit more tension than usual this week, after the company exposed the records on some 300,000 people.

Researcher Oliver Hough discovered that the massage company was the latest firm to leave a database accessible to the open internet (and anyone doing a Shodan search). The lost data included names, email addresses, phone numbers, and referral codes.

More disturbing was the exposure of a collection of sexual misconduct claims the company had fielded, including creepy customers who had a reputation of asking their therapists for “extra service” on top of their normal massage.

The company has since taken down the database and is investigating the matter.

Orange is the new Blackmail

A group of South Carolina inmates are in hot water after they were caught catfishing military members from behind bars.

The US Naval Criminal Investigative Service (NCIS) says it has begun a crackdown on an extortion ring in what it calls “Operation Surprise Party.”

According to the NCIS, the prisoners have been scamming money out of military members by posing as young women on social networking and dating sites. After striking up a friendship with the targeted military members, the inmates would send the targets naked photos.

Shortly after, they would contact the targets from a separate account claiming to be the woman’s father and alleging the woman was underage. The soldiers, fearful of arrest and the loss of their military careers, were then told to send money in order to keep the entire affair quiet.

Investigators said that, by the time the racket was broken up, it had netted more than $550K to the inmates and their associates outside.

Ebay Japan accidentally leaked its source code onto the web by making its Git repo public from its website.

OpenSSL changes up licensing, version scheme

Those who use OpenSSL should take note: some changes to the library are coming up.

Matt Caswell says that the upcoming release, which will be the first released under the Apache License 2.0, will also introduce a new version scheme that will look to simplify the release process and bring it more into line with other software.

“In practical terms our “letter” patch releases become patch numbers and “fix” is dropped from the concept. In future, API/ABI compatibility will only be guaranteed for the same MAJOR version number. Previously we guaranteed API/ABI compatibility across the same MAJOR.MINOR combination,” Caswell explained.

“This more closely aligns with the expectations of users who are familiar with semantic versioning. We are not at this stage directly adopting semantic versioning because it would mean changing our current LTS policies and practices.”

Dunkin’ puts the D’oh! in donuts

Beloved US coffee chain Dunkin’ Donuts is giving out more than tasty pastries to its punters this week after the company caught wind of an attempted hack on its customer rewards program.

It turns out that one or more evil-doers got a cache of stolen email addresses and passwords from other sites and attempted to point them at the Dunkin’ Donuts customer portal. Those who had re-used the stolen credentials would have had the attacker pull up a page that would contain their name, email address, and DD Perks account codes.

While that is hardly considered sensitive information in the grand scheme of things, it would be enough to allow the hackers to use other peoples’ accounts, and the money stored on them, to pay for food and drink.

If you do get a notice from Dunkn’, it would be a good idea to change your password ASAP, and let this be a lesson to never re-use your passwords.

AWS tightens up security with Hub launch

Now you have no excuse not to lock down your Elastic Compute and S3 instances.

AWS has introduced a new security hub that the cloud giant hopes will allow admins to have a better overview of all the security settings in place across their VMs and storage bucks.

“AWS Security Hub reduces the effort of collecting and prioritizing security findings across accounts, from AWS services, and AWS partner tools,” AWS says of the hub.

“The service ingests data using a standard findings format, eliminating the need for time-consuming data conversion efforts. It then correlates findings across providers to prioritize the most important findings.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/12/01/security_roundup_301118/

Kaspersky Lab won’t be getting its day in court after all, as the Washington DC Court of Appeals rejected its case against Uncle Sam.

On Friday, the appeals court panel upheld an earlier district court ruling that Kaspersky could not bring a lawsuit against the US government in hopes of overturning the 2017 order that blocked American government agencies from using its antivirus software.

The decision [PDF] all but ends Kaspersky’s hopes of getting the ban on its products lifted and allowing federal agencies to once again purchase its antimalware and security offerings.

In striking down the motion, the three-judge panel agreed with the lower court’s decision that Congress has the right to block the purchase of a specific vendor’s software if it has legitimate security concerns. This is a key point, as Kaspersky has contended the move was a form of extrajudicial punishment rather than a safety measure.

“Indeed, although Kaspersky argues that Congress enacted section 1634 to further that body’s undisclosed punitive intentions, the company does not dispute, as a general matter, that protecting federal computers from cyber-threats qualifies as a legitimate nonpunitive purpose,” the court noted.

The judges go on to dismiss Kaspersky’s argument that it was being unfairly singled out as a possible security risk by the government, noting the company’s close relationship with a Russian government known to be actively attacking US networks and siphoning off top-secret information.

NSA dev in the clink for 5.5 years after letting Kaspersky, allegedly Russia slurp US exploits

READ MORE

“Kaspersky identifies no cyber-product as vulnerable to malicious exploitation as Kaspersky’s,” the court found.

“And although the company accurately points out that many cyber-companies operate in Russia, we conclude that Congress, based on the evidence before it, could have reasonably determined that Kaspersky’s Russian ties differ in degree and kind from these other companies’.”

Kaspersky, meanwhile, said that it was disappointed with the ruling and maintained the security shop was “still the good guys fighting cybercrime all over the world.”

“The DC Circuit Court’s decision is disappointing, but the events of the past year that culminated in this decision were almost expected, and not just by our company, but by the cybersecurity industry in general,” wrote co-founder, CEO, and company namesake Eugene Kaspersky.

“We’re sure that the issues involved in our litigation go far beyond technical aspects of US constitutional law; they include real-world problems concerning everyone: a progression of protectionism and balkanization in a world of understated cyber-rivalry and highly sophisticated international cyber-threats.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/11/30/court_rejects_kaspersky/

Did your work printer produce a strange call to action this week, urging you to follow some tasteless twerp on YouTube, and then offer you a “bro fist” made up of punctuation marks?

Hopefully not because if it did someone in your IT department has really screwed up and failed to patch a two-year-old security hole. But thousands of confused workers did get the message and have been sharing it online.

“My work printer was hacked today! This message printed out on our cheques…” tweeted one. “Ok so basically a printer at a friend’s workplace got hacked,” posted another.

What’s going on?

Well, someone hacked them. And, if his claims are to be believed, it was a guy going by the name TheHackerGiraffe who opened up the account yesterday to retweet images of his successful takeover of others’ printers.

It seems to have been weirdly effective. People across the world have been complaining about the message printing unprompted. And HackerGiraffe has laid out exactly how he did it online.

“Right okay so I don’t wanna paste the code right now, but basically I used a website called https://shodan.io and did a search for devices with port 9100 open. I downloaded that list,” he tweeted.

Using what he says is a “five dollar Google cloud server” he then even lists the tools he used: “I used a tool I found called PRET (find it on github) which allowed me to connect to these printers, print my PDF, change the display to HACKED, and then quit… Wrapped everything in a script that loops through the list I downloaded off shodan, and TADA, a worldwide printer epidemic.”

The success of the project appears to have caught him off guard, leading to Hacker Giraffe to insist that he did it to “raise awareness” but the truth is that he did it in order to attract the attention of the YouTuber at the center of the printout: online YouTube “personality” PewDiePie, real name Felix Arvid Ulf Kjellberg.

Why are local printers being hacked for this pic.twitter.com/fAnNTIp6ds

— madison. (@maddybenavente1) November 29, 2018

Down the rabbit hole we go

If you’re not aware of PewDiePie: well done. He’s right now YouTube’s number-one streamer which means that he posts lots of videos in which he talks rapid fire at the camera while playing computer games, pulling stupid stunts, and generally being obnoxious about everything in the world.

So far, so millennial. But last year, Kjellberg ended up in hot water when he produced a series of extremely uncomfortable anti-Semitic videos that included Nazi imagery. In one, he paid two people through a freelancer website to open and hold up a sign that said “Death to all Jews.”

He thought it was hilarious, and pretended to be horrified even though it was actually him who planned it, sent the banner, and paid someone to film it so he could act all shocked. The rest of the world wasn’t very impressed, however.

But this is YouTube and so PewDiePie has continued to maintain the top spot on YouTube in terms of subscribers. Until that is T-Series came along. T-Series is a YouTube channel that posts Bollywood videos – a catchy combination of Indian beats and highly produced music videos.

Developer swings DMCA sueball at foul-mouthed streamer PewDiePie

READ MORE

T-Series currently had 72.5 million followers on its channel and PewDiePie has 72.6 million. And so, of course, PewDiePie did what he does and created a campaign about retaining the top spot with a focus on, you guessed it, boosting his own profile and followers.

And in a perfect reflection of YouTube content, PewDiePie launched his campaign against the highly produced and professional content on T-Series by posting his own rap video in which he prances about on a seafront, swears a lot and repeatedly references an internet meme that has already been forgotten. It is, in this hack’s opinion, absolute garbage. And it’s been watched 41 million times so far.

Needless to say, some of PewDiePie’s millions of followers have taken the task seriously and are flooding whatever and whoever they can in an effort to get them to subscribe to his YouTube channel, seemingly unaware that most of the world couldn’t care less.

Hence the printouts.

Welcome to the future: where idiots hack your printers to urge you to follow other idiots online. Seriously though, close port 9100. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/12/01/pewdiepie_public_hack/

Crypto boffins have found a way to exploit side-channel information to downgrade most of the current TLS implementations, thanks to ongoing support for outmoded RSA key exchanges.

In a paper published on Friday, “The 9 Lives of Bleichenbacher’s CAT: New Cache ATtacks on TLS Implementations,” co-authors Eyal Ronen, Robert Gillham, Daniel Genkin, Adi Shamir, David Wong and Yuval Yarom describe an updated version of an attack, first outlined by Swiss cryptographer Daniel Bleichenbacher two decades ago.

The original attack was called a padding oracle attack because it uses the padding – dummy data – added to plaintext to make it fit neatly into the block size required for the ciphertext. A padding oracle is a function that leaks the validity of the padding, by throwing an error, for example. Knowing whether or not the padding is valid facilitates the recovery of the plaintext from the ciphertext.

Mitigations against padding oracle attacks have been deployed over the years, but it turns out that information available through cache-based side channels provides a way around those defenses.

The Spectre and Meltdown processor design flaws disclosed earlier this year arise from side-channel information – akin to watching a hotel window for a light to infer an person’s presence in the room. The researchers who developed the CAT attack, some of whom were involved in the Spectre and Meltdown work, rely on similar techniques.

Security flushed away

One of these is called FLUSH+RELOAD, in which the attacker flushes and reloads part of the CPU cache while the victim is accessing the same area of cached memory. By measuring the time it takes for the victim’s data to evict the attacker’s from the processor cache, the attacker can make inferences about the victim’s data.

The researchers found that using a FLUSH+RELOAD attack, in conjunction with CPU branch prediction and a technique called Browser Exploit Against SSL/TLS (BEAST), they were able to break the TLS implementations in seven of nine popular packages.

Their technique involves running multiple padding oracle attacks in parallel, the results of which get combined in a way that recovers secret encryption keys from spied-on TLS-secured connections. In theory, bypassing TLS in this manner could allow an attacker to steal a victim’s authentication token to access an online account (e.g. Gmail). In other words, it is possible to snoop on a browser’s connection to Gmail, and recover the user’s authentication token from the encrypted connection to later log in as them. It’s a way to hijack accounts.

The boffins tested OpenSSL, Amazon s2n, MbedTLS, Apple CoreTLS, Mozilla NSS, WolfSSL, GnuTLS, BearSSL and BoringSSL. And they were able to downgrade all except for the last two, BearSSL and BoringSSL.

A local hack, for local people, we’ll have no trouble here

A crucial difference between the original attack and the latest version is that the original flavor worked over the network while the modern version needs to be on the same machine to scrutinize microarchitectural side channels. Therefore, only malware or a malicious logged-in user on a vulnerable system can exploit these security holes to sniff out secret encryption keys of running applications, and hijack connections and accounts.

Any software using the above vulnerable libraries, particularly OpenSSL and CoreTLS, is at risk of surveillance by rogue users or malicious code on a system via this CAT attack technique. And, sure, having malware or evil users on your computer is never a good thing. Think of this as something else they can get up to.

You like HTTPS. We like HTTPS. Except when a quirk of TLS can smash someone’s web privacy

READ MORE

So while the research findings underscore the need to get rid of support for RSA key transport in the Public Key Cryptography Standard #1 (PKCS #1), they don’t quite qualify as a Heartbleed-level risk.

RSA key transport has already been excluded from TLS 1.3, the latest version. But it’s still used in about 6 per cent of TLS connections, according to the paper. The researchers, however, show that any TLS connection arising from the vulnerable implementations can be downgraded. So the CAT attack will need to be patched.

“We show that padding oracle attacks can be made extremely efficient, via more careful analysis and novel parallelization techniques,” the researchers explain in their paper.

“Finally, we show that while the use of RSA key exchange is declining, padding oracles can be used to mount downgrade attacks, posing them as a threat to the security of a much larger number of connections (including those done via protocols that do not even support the RSA key exchange).”

The flaws identified have been assigned the following CVE designations: CVE-2018-12404, CVE-2018-19608, CVE-2018-16868, CVE-2018-16869, and CVE-2018-16870. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/12/01/tls_broken_crypto/