hacking – Page 573 – STE WILLIAMS

Uber Hit With $1.2 Million Additional Fines for 2016 Data Breach

library
crime | hacking | security

Now the penalties are coming from Europe.

UK and Dutch authorities have fined Uber a total of $1.7 million in fines for exposing customers’ personal information in its 2016 data breach.

The latest financial fallout for Uber comes in the wake of September’s $148 million settlement with the 50 US states and the District of Columbia for violating data breach reporting laws in its cover-up of the epic hack that affected 57 million US users.

The UK Information Commissioner’s Office fined the ride-sharing firm $491,284, while the Dutch Data Protection Authority set a $679,257 penalty, CNBC reported. Some 2.7 million Uber customers were affected in the UK and 174,000 in The Netherlands.

“This was not only a serious failure of data security on Uber’s part, but a complete disregard for the customers and drivers whose personal information was stolen,” said ICO director of investigations Steve Eckersley. “At the time, no steps were taken to inform anyone affected by the breach, or to offer help and support. That left them vulnerable.”

Another Microsoft MFA Outage Affects Multiple Services

library
crime | hacking | security

Once again, multifactor authentication issues have caused login problems for users across Office 365 and Azure, among other services.

For the second time in two weeks, Microsoft’s multifactor authentication (MFA) service was down and causing login headaches for users of services including Office 365, Azure, and Dynamics.

On Nov. 19, users of Microsoft Azure and Office 365 couldn’t log into their accounts due to problems with MFA. When they attempted to log in, they didn’t receive SMS verification codes, phone calls, or push notifications. They were also unable to reset their own passwords.

Today, ZDNet reports Microsoft users are having similar MFA problems with different services. The issues started this morning with Office 365; shortly after, Microsoft updated its Azure status dashboard to indicate problems with MFA login.

Following an investigation, the company reported three root causes to the MFA problems, which have been mitigated. Microsoft also published next steps in the investigative process.

Who’s the Weakest Link in Your Supply Chain?

library
crime | hacking | security

Nearly 60% of organizations have suffered data breaches resulting from a third party, as suppliers pose a growing risk to enterprise security.

Do you know how many third parties your organization works with?

If not, you’re not alone: Only 34% of companies have a comprehensive inventory of all third party suppliers they work with, according to a survey of 1,038 professionals across multiple industries in the US and UK, according to the recently released “Data Risk in the Third-Party Ecosystem” report conducted by The Ponemon Institute and commissioned by Opus.

Third party breaches are significant and in the US at least, they are growing. (This is the first year UK respondents were polled, so no earlier data exists for comparison in that region). In the US, 61% of businesses have had a third-party breach, up 5% from last year and 12% from 2016.

More than three-quarters of respondents say the number of third-party security incidents involving vendors is going up, researchers found. Part of the reason is greater reliance on them: in the US, the number of third party suppliers increased 25% over 2017 and sits at an average of 583.

However, companies struggle to keep an inventory of all their suppliers due to a lack of centralized control (69%) and the complexity of these relationships. Only 15% know how their information is accessed and processed by the companies they work with, and only 28% receive notifications when their information is shared with a third party, researchers report.

Many don’t know what to do. Only 37% say they have sufficient resources to manage third-party relationships; 35% say their third-party risk management program is “highly effective.”

When it comes to supply chain risk, many businesses are in the dark. Researchers note 22% of respondents could not determine whether they’d had a third-party breach in the year prior.

“The reason that’s so scary, or scary to me, is the fact that if you can’t determine if you’ve had a breach … that’s really bad,” says Lee Kirschbaum, senior vice president and head of product, marketing, and alliances at Opus. “Companies need to know who has access to personal and sensitive information.”

Businesses can be held liable for being in the dark on security breaches, he continues. Lee points to the General Data Protection Regulation (GDPR), which requires companies to have a good understanding of who is in their supply chain and has access to sensitive data.

From a practical standpoint, Lee says it’s “not surprising that people don’t have an inventory … it’s just very risky.” Many policies allow employees to download apps and use online services without IT’s approval, driving opportunities to share sensitive data outside the organization.

But keeping meticulous track of the third parties you work with doesn’t guarantee security. Almost 60% of companies with an inventory don’t know if their safeguards are strong enough to prevent a breach and less than 50% evaluate the security practices of their vendors. Sixty percent don’t have the resources to verify vendors’ security posture; the same amount don’t require third parties to complete questionnaires or conduct security assessments.

It’s Not All Bad News

Companies that report no third-party security breaches also report stronger focus on third-party management. Of those who hadn’t suffered third-party breaches, 60% say they allocate resources toward managing vendors. Only 15% of breached companies say they have the same level of focus.

In the US, businesses are starting to take responsibility.

“Over the past few years, we’ve seen in the US more ownership in terms of people being accountable for third-party risk,” says Lee, adding that supply chain security “starts with ownership and accountability. As we drive toward more ownership, it enables a person or a group to be accountable for putting in the appropriate controls so that can occur.”

He advises companies to conduct an inventory of all third parties with whom they share information, and know who can access confidential data. Create a formal process for reviewing and managing vendors’ privacy and security practices. Know how they handle new and emerging threats; for example, unsecured IoT devices. When data is shared with external vendors, make sure you know about it. Get your board of directors involved in the process: companies that didn’t report a vendor breach were 28% more likely to include senior execs.

“Supply chains are an extremely complex multi-stakeholder environment,” says Ophir Gaathon, CEO and co-founder of Dust Identity. “Currently there are wide gaps in what technology can cover that leave unaddressed vulnerabilities.”

Diamonds and Dust

Startup Dust Identity focuses on ensuring the integrity of hardware components, an issue of growing importance to manufacturers in the critical infrastructure space as the IoT continues to grow. Companies need to know hardware components were sourced through the proper channels, says Gaathon, and it’s challenging to learn where objects come from and who accessed them.

“Until now, the industry has depended on technologies such as RFID, holograms or barcodes, that were not really designed for security applications,” he explains. The IoT is driving an “explosion” of connected parts and, as a result, growing the attack surface.

Today’s supply chains are increasingly global and involve more people, says Gaathon, and manufacturing is leaner with smaller batches and shorter runs. The two trends make verifying vendors and parts more complex. Dust Identity aims to ease part identification by placing a layer of nano-engineered diamond crystals onto products. A scanning technology lets them read the angle of those diamonds and produce a unique identity for a specific part; this identity can be used to link the part to data, ledgers, processes, and other components, he explains.

“We started with the hardware, where we focus on delivering high-security authentication with end-to-end tracking that traces down to the component level for the commercial IT, defense and government sectors,” says Gaathon.

Dust was first funded by DARPA, he continues, and the startup recently raised $2.3 million in seed funding. In the long term, it hopes to influence how security is deployed in supply chains across industries.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/whos-the-weakest-link-in-your-supply-chain/d/d-id/1333349?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New Hacker Group Behind ‘DNSpionage’ Attacks in Middle East

library
crime | hacking | security

Motives are not fully clear, though data exfiltration is one possibility, Cisco Talos says.

A previously unknown hacker group is targeting organizations in the United Arab Emirates and Lebanon in a campaign involving the use of fake job websites to drop malware on victim systems.

The campaign appears to be targeted at specific organizations in the two countries but the motives behind it remain somewhat unclear, Cisco’s Talos threat intelligence group said in a report Monday. The attackers also have been attempting to redirect the DNS traffic of legitimate .gov and private company domains in the UAE and Lebanon. One of those targeted was Middle East Airlines, a private Lebanese airline company.

Paul Rascagneres, security researcher at Talos, says it’s unclear how the attackers might have compromised nameservers belonging to the targeted entities for DNS redirection.

Talos is also not sure if the DNS redirection attempts were in fact successful. As with the malware campaign, the motives behind the redirection efforts are not completely obvious though data exfiltration is likely one reason for both campaigns. Talos named the malware in the campaign as DNSpionage.

“It’s clear that this adversary spent time understanding the victims’ network infrastructure in order to remain under the radar and act as inconspicuous as possible during their attacks,” the Talos report noted.

The new campaign is the second in recent months targeting Middle East organizations and is a sign of the recently heightened interest in the region among cyberattackers. In September, Check Point reported on new surveillance attacks on law enforcement and other organizations in Palestine and other Middle East regions by a group known as Big Bang.

A Siemens report from earlier this year described organizations in the oil and gas sectors in the Middle East particularly as being the most aggressively targeted in the world. Half of all cyberattacks in the region are targeted at companies in these two sectors. According to Siemens, a startling 75% or organizations in these sectors have been involved in at least one recent cyberattack that either disrupted their OT network or led to confidential data loss.

With the latest campaign, the infrastructure and the tactics, techniques and procedures that the threat actor is using are not something that Talos has been able to connect with any previously known group.

DNSpionage malware is being distributed via Microsoft Office documents hosted on two malicious websites designed to look like the jobs listing pages of two legitimate companies—Wipro and Suncor Energy. The hosted document is a copy of a legitimate file on Suncor’s site

The malicious documents contain macros which when run drop DNSpionage on the target system. The malware is a Remote Access Trojan that supports HTTP and DNS communication with the attackers, and gets executed when the Microsoft Office document is closed. It appears designed to extract data from the compromised system and send it to the command and control system.

Rascagneres says the attackers appear to be using spear-phishing emails or social media contact to distribute links to the two malicious sites from where DNSpionage is being distributed.

Traffic Redirection Attacks

One of the IPs linked to the DNSpionage campaign was also used in DNS redirection attacks targeting multiple public sector organizations in the UAE and Lebanon between September and November. Hostnames under the control of these organizations were briefly redirected to the rogue IP for reasons that are not fully clear.

In each case, before the redirection occurred, the attackers created a certificate matching the targeted organization’s domain name using certificates from Let’s Encrypt, a provider of free X.509 certificates for TLS.

“The actor most likely used LE certificates as they are free,” Rascagneres says. The certificates do not cause self-signed errors like other certificates do and are trusted by browsers. There are multiple reasons why the threat actor might be using the certificates. One example: to enable man-in-the-middle attacks, Rascagneres says.

The redirection attempts are noteworthy because the attackers appear to have been able to intercept all traffic – including email and VPN traffic – headed toward the compromised sites. This means if the redirection was successful, the attackers would have had a way to access additional information like email and VPN credentials, Talos said in its report.

Talos says it does not know how successful the DNS redirection attacks were. But the attacks have not stopped trying. So far this year, they have launched five DNS redirection attacks, the most recent of which was just two weeks ago, Talos said.

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/new-hacker-group-behind-dnspionage-attacks-in-middle-east-/d/d-id/1333350?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

LinkedIn rapped for targeting ads at 18 million Facebook users

library
crime | hacking | security

During the first half of 2018, LinkedIn US came up with the idea to buy Facebook ads targeted to the owners of 18 million email addresses.

This was done discreetly by uploading hashed versions of the email addresses, which were presumably matched to the same hashes spotted among Facebook’s user base.

We don’t know how successful the campaign was, but with the publication of a report by Ireland’s Data Protection Commissioner (DPC) last week we do know that LinkedIn has been publicly rebuked for doing it at all.

What upset the Irish: none of the 18 million email addresses were those of LinkedIn users.

How did a LinkedIn US campaign come to the attention of Ireland’s data commissioner in the first place?

Where did LinkedIn get hold of email addresses for 18 million non-LinkedIn users?

Unravelling the answers to these questions starts with a complaint the DPC says it received in 2017 from one of those 18 million people who objected to being targeted by LinkedIn, which has its EU headquarters in Ireland.

After investigating, the DPC discovered that:

The audit identified that LinkedIn Corp was undertaking the pre-computation of a suggested professional network for non-LinkedIn members.

That’s a jargon-heavy way of saying that LinkedIn US had run its algorithms on some of the data LinkedIn Ireland was responsible for and identified the 18 million email addresses it was interested in.

Moreover, this was done in the “absence of instruction” from the data processor, that is without legal consent under Irish data protection law.

What is not explained is where LinkedIn obtained these 18 million email addresses from, nor what connection they had with LinkedIn Ireland.

One interpretation is that it had something to do with a move by companies such as LinkedIn and Facebook to minimise their exposure to the EU’s GDPR regulation by shifting data on non-EU users to the US.

This still doesn’t explain why this would have included data on 18 million non-LinkedIn users.

One possibility is LinkedIn’s mobile app, which asks for permission to access each user’s contacts list (including email addresses) to work out which of them has/doesn’t have a LinkedIn account.

We may never know the true source of the data. What we do know is that the complaint to Ireland’s DPC has since been “amicably resolved”, with LinkedIn releasing a mea culpa of sorts:

Unfortunately the strong processes and procedures we have in place were not followed and for that we are sorry. We’ve taken appropriate action and have improved the way we work to ensure that this will not happen again.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/6DMsDyBULXo/

Google Maps scammers put their own phone numbers onto bank listings

library
crime | hacking | security

Google Maps lets users edit and update listings: crowd-sourcing that’s helped Google to fill in the details of its maps, such as adding new roads or parks: a helpful feature, particularly in areas where governments restrict distribution of such data or in what are often less-developed regions.

Some of the results have been giggle-worthy, even though they involve deceptive practices that we don’t endorse, such as sock puppetry that lets the pranksters create fake accounts that they then use to approve their own pranks.

For example, we’ve seen Google Maps depict the Android mascot robot peeing onto the Apple logo, and a giant cat that sprawled over Auckland’s Hobson Bay Walkway.

Besides graphic hijinks, we’ve also seen user-generated content that’s involved changing the details of an address: for example, Google Maps at one point was induced to display a snowboarding shop called Edwards Snow Den, located at 1600 Pennsylvania Avenue: an address otherwise known as the White House.

Unfortunately, the same mechanisms by which Google enables users to make useful or amusing edits to Google Maps is now being used by crooks. On Sunday, Business Insider reported that scammers are tweaking Google Maps to trick people into giving up their bank details.

Google used to enable people to submit changes to Google Maps via Map Maker: a service the company introduced in 2008 that let users worldwide upload new data to the company’s online mapping service. The company closed Map Maker as of 31 March 2017 and absorbed many of its features into Google Maps.

As Tech Crunch reported at the time, following the peeing Android robot vandalism and a few other spam attacks, Google temporarily shut down Map Maker to tighten its security. Eventually, the company shut it down completely, since it was overlapping with Google’s Local Guides: a program that rewards power users for contributing updates to Google Maps and which is mainly geared to improving business listings.

But while Map Maker went away, the ability to edit maps did not. Using Local Guides, users can still add and edit places, share additional details about a place, moderate edits, view the status of their edits, and edit road segments.

According to police in Maharashtra, India, there have been multiple cases of Google Maps vandalism targeting bank details in the past month. The Hindu reported last week that a group of con artists based in Thane – a city just outside of Mumbai – have edited Maps listings to show their own contact numbers, then swindled sensitive account details out of the marks who called.

The news outlet quoted Balsing Rajput, superintendent of police in the state cyber policing department:

We have received at least three complaints from the Bank of India [BoI] over the last one month. In all three instances, we immediately notified the authorities at Google.

Rajput said that the crooks have talked people out of details such as their Personal Identification Numbers (PINs) or the CVV numbers of their debit and credit cards, enabling them to suck money out of victims’ accounts.

A BoI spokesperson said that the bank is asking people to skip Google Maps and instead go directly to its site in order to find contact details:

After these incidents came to our notice, we modified the contact details on these branch listings on Google Maps. We asked users to use only Bank of India’s official website to search for branch contact details.

We’re trying to deal with these things as soon as possible, a Google spokesperson told The Hindu:

Overall, allowing users to suggest edits provides comprehensive and up-to-date info, but we recognise there may be occasional inaccuracies or bad edits suggested by them. When this happens, we do our best to address the issue as quickly as possible. The Google Safety Center outlines tips to help consumers stay safe online.

No surprise here: Google’s Safety Center doesn’t exactly tell visitors to not trust the information they get from Google Maps, but it does offer at least one relevant tip for avoiding these fraudsters: be wary of requests for personal information.

Don’t reply to suspicious emails, instant messages, or pop-up windows that ask for personal information, like passwords, bank account or credit card numbers, or even your birthday. Even if the message comes from a site you trust, like your bank, never click on the link or send a reply message. It is better to go directly to their website or app to log in to your account.

Remember, legitimate sites and services will not send messages requesting that you send passwords or financial information over email.

…and legitimate phone operators at legitimate banks shouldn’t ask for your PINs or CVVs, either.

But not all people are going to realize that when they’re on the phone with a smooth-talking rip-off artist.

I can’t imagine that Google would ever pull the plug on users’ ability to edit Google Maps: its advertising income feeds off of knowing where we go and what we think. But shouldn’t the company at least lock down details about places heavily targeted by financial scammers, such as banks?

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/_ad6rfg8uvo/

Microsoft patches Patch Tuesday’s Outlook 2010 problem patch

library
crime | hacking | security

Just what is going on over in Redmond? Just weeks after issuing a Windows 10 patch of doom that started deleting users’ precious files, Microsoft ‘fixed’ Outlook 2010 with a November Patch Tuesday update that promptly borked it.

On 13 November, Microsoft released a security update, KB4461529, which fixed four security vulnerabilities. These flaws could allow remote code execution if a user opened a specially crafted Office file, it said. KB4461529 solved this problem for the .msi 64-bit version of Outlook 2010 in the worst way by simply having the program not run at all. It crashed Outlook at startup.

Microsoft advised users not to uninstall the patch. Instead, it suggested they use Outlook Web Access until the problem was resolved. In the meantime, it wrote a second patch which it sent scurrying after the first on 21 November. KB4461585 will fix the crashing problem, it said.

This wasn’t the first Outlook 2010 patch problem for Microsoft users this month. On 6 November it released updates KB2863821 and KB4461522, which fixed the program’s Japanese calendar to support new ‘eras’. These patches also caused Access to crash on startup in some cases, it warned. It removed them.

The Japanese calendar inherited the idea of eras from China in the eighth century. Eras punctuate an emperor’s reign or some other major event. You only get a new one every few years, which is how many Windows users probably wish Microsoft would schedule its software patches right about now.

Microsoft has bungled Office-related patches before. One patch last year caused text to disappear from tables in Word causing users to panic and hassle admins. It followed another patch the previous month that caused a similar problem. Microsoft eventually fixed it in October with yet another patch.

These problems follow a worrying October for Microsoft users, some of whom watched files and settings disappear before their eyes after installing Windows 10 update 1809. Microsoft was forced to pause the update while it fixed things.

Concerns over the quality of Microsoft’s patches surfaced earlier this year when Microsoft Most Valuable Professional Susan Bradley wrote an open letter to the company about the problem.

While Microsoft may seem a bit quick off the mark when issuing some patches, it’s been reluctant to ship others. In May we wrote that it refused to patch a Windows-crashing bug after a security researcher reported it, on the grounds that the exploit needed a USB key and so didn’t meet its standards.

Perhaps the biggest problem here is one of trust. Microsoft wants people to install patches promptly – especially security ones – because it helps to prevent malware infections. Bitter experience with the likes of Conficker and WannaCry has taught Redmond that simply making patches available isn’t enough though, so it likes to install Windows 10 updates by default where it can. But the more patches that it messes up, the more likely users are to push back.

Enterprise users can stop patches by changing settings in the Windows Update Server. Windows 10 Pro and Enterprise users can pause patches. Windows 10 Home users don’t have any choice at all when it comes to installing Windows updates, the company says.

The company doesn’t force Office patches, instead giving users the option to turn on automatic updates. However, the more Microsoft fumbles the ball, the more users may start turning patches off where they can. That would be bad for the security ecosystem in general.

It’s a puzzling issue for a company that is supposed to excel at producing quality software. DevOps and continuous integration practices like automated testing and gating were meant to make software quality problems like these go away. So why are they still happening with such apparent regularity in Redmond?

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/8mlIDdPKZo4/

Baroness Trumpington, former Bletchley Park clerk, dies aged 96

library
crime | hacking | security

Obit Baroness Trumpington, a wartime Bletchley Park transcriber who was part of the push to posthumously pardon Alan Turing, has died aged 96.

As the daughter of a society family that had almost been ruined in the Wall Street Crash of 1929, Jean Barker left school aged 15 “having never sat an exam but fluent in French, German and Italian,” according to the BBC’s obituarist.

When the Second World War broke out, her parents, who had retained their society connections despite the stock market crash, found her a post working on former Prime Minister David Lloyd George’s farm, where she recounted that the “old goat” would find reasons to stand her against a wall and measure her with a tape, telling The Guardian: “I suppose that was the nearest to flesh he could get with [live-in mistress and later wife, Frances] Stevenson’s beady eye on him.”

WWII Bombe operator Ruth Bourne: I’d never heard of Enigma until long after the war

A year later she joined the code-crackers of Bletchley Park, aged 18, transcribing intercepted messages from German submarines. While the code-breakers and the rest of the team at the site did not mix, the future baroness spent her free time socialising at London’s key spots for the upper crust, including the Ritz and Claridge’s. She told The Daily Telegraph of one “very unsuitable” incident from her time at Bletchley when her team were disciplined after being caught singing the Nazi Party’s official anthem, explaining: “You had nothing to do but work so you got up to mischief.”

Following the war she travelled to America, where she met her husband, schoolmaster Alan Barker, and the two returned to the UK in 1953. A spirited soul, Jean “smoked, drank, [and] jumped into swimming pools fully clothed”.

Later in life she entered politics with the Conservative Party, first in local government and eventually being created Baroness Trumpington of Sandwich in the County of Kent in 1980, joining Margaret Thatcher’s government in various junior ministerial roles in health and agriculture.

Baroness Trumpington was noted for her political focus on women’s issues, particularly of women in prison and mental health, acting in a semi-diplomatic capacity on behalf of the UK at the UN Commission on the Status of Women. Always one for a smoke and a drink, she also sat on the House of Lords’ Refreshment Sub Committee in the early 1980s.

She was also part of the political campaign to posthumously pardon Alan Turing for his criminal conviction for homosexuality, telling the House of Lords: “While in 2009 the then Prime Minister Gordon Brown issued an apology for Turing’s treatment, this government should do more. This is not about legal issues but about recognising the debt this country owes Alan Turing.”

Baroness Trumpington (the title appears to refer to the Cambridge council ward she once represented) only retired from the Lords in October 2017, having shot to political fame after giving a two-fingered salute to Lord King, who had injudiciously suggested that survivors of the Second World War had “started to look pretty old” before pointedly turning to a very unamused Trumpington.

Youtube Video

Her son, Adam, paid tribute to her on Twitter, posting that she had “a bloody good innings”.

My mother passed away this afternoon in her sleep. She did not make it to October 2022(100) ..but she had a bloody good innings. pic.twitter.com/IdtWi1zhPq

— Adam Barker (@adamant138) November 26, 2018

Jean Barker, Baroness Trumpington, 28 October 1922 – 26 November 2018. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/11/27/baroness_trumpington_bletchley_park_obituary/

See the Future of Cybersecurity at Black Hat Europe

library
crime | hacking | security

New tools, techniques, and a plan for training a new generation of crack security experts are all in the cards for attendees of Black Hat Europe in London next week.

Black Hat Europe kicks off in London next week, and it promises to deliver a melting pot of cybersecurity experts from around the world. If you want to get an early look at the tools, techniques, and training regimens that will shape this next generation of cybersecurity, the The Excel in London is the place to be.

Notably, make time to check out the Briefing No Free Charge Theorem 2.0: How to Steal Private Information from a Mobile Device Using a Powerbank . Modern smartphones are often gold mines of private information (including banking data, emails, and passwords), and now it’s quite common for owners to plug their smartphones into public charging stations to get a bit of juice on the go. Despite preventive measures implemented by Android’s developers to prevent data transfer via USB cable (i.e. “charging only” mode), researchers have been able to exploit a hidden communication channel which leverages only the electrical current provided for charging the smartphone. They will show you how they do it during this special Black Hat Europe Briefing.

Of course, such tricks aren’t much use against trained professionals, and in a 50-minute Briefing on Evolving Security Experts Among Teenagers you’ll learn about Rezillon’s plan to foster a new generation of cybersecurity experts. Such efforts are critical if we want to avoid a significant labor shortage in the future, and this Briefing will show you how to build a framework of programs and groups, with the support of government, industry, and community for the sole purpose of creating a new generation of experts inventing the next big thing.

Delitor’s OSINT Techniques And Methodology 2-Day Training promises to demonstrate multiple free online resources that break through traditional search roadblocks. Participants will not only learn how to “dig” into the Internet for personal information about any target but also how to connect attributes across multiple open source data points. While popular sites such as Twitter, Instagram, and Facebook are covered in detail (including techniques that legally access some “hidden” content), the presentation goes much deeper into the vast resources available for researching personal information. The participants will then take all resources available to them and learn how to create their own methodology through practical exercises.

If you favor a more automated approach, consider checking out The Security Automation Lab, where you’ll learn how to automate the discovery and protection of security weaknesses while automatically responding to incidents and gaining visibility into the areas where further security automation can be enhanced. Presented by Threat Intelligence, this 2-Day Training will help you create your own dedicated cloud-based Security Automation environment consisting of servers and applications with a range of vulnerabilities that need protection from an onslaught of ongoing attacks and security breaches.

If you’re looking to beef up your mobile arsenal, stop by the Black Hat Europe Arsenal to catch a demo of Mafia: Mobile Security Automation Framework for Intelligent Auditing. Mafia is designed to automate a tricky process by performing end-to-end security testing for a given mobile app, creating a self-serve tool for developers and security engineers. Mobile applications are critical when it comes to vulnerabilities in a production environment, and Mafia is meant to take some of the hassle out of finding and fixing those vulnerabilities.

Uitkyk: Identifying Malware via Runtime Memory Analysis is another Arsenal demo worth taking, as it purports to be the first Android framework that allows for its implementers to identify Android malware according to the instantiated objects on the heap for a particular process. Uitkyk does not require the APK of the application to be scanned to be present to identify malicious behavior. Instead, it makes use of runtime memory analysis to detect behavior which normally cannot be identified by static analysis of Android applications. Don’t miss it!

Black Hat Europe returns to The Excel in London December 3-6, 2018. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/see-the-future-of-cybersecurity-at-black-hat-europe/d/d-id/1333338?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

8 Tips for Preventing Credential Theft Attacks on Critical Infrastructure

library
crime | hacking | security

Stolen credentials for industrial control system workstations are fast becoming the modus operandi for ICS attacks by cybercriminals.

It’s no secret that hacked critical infrastructure can have a detrimental safety impact, shut businesses down, and cost millions of dollars in lost revenue and brand damage. Unfortunately, attacks on critical infrastructure are showing no signs of abating. Think WannaCry, NotPetya, Black Energy, and now its malware successor, GreyEnergy.

The GreyEnergy malware family, reported last month by ESET researchers, is utilizing stolen credentials to target ICS workstations running supervisory control and data acquisition (SCADA) systems. To infect the systems, GreyEnergy is using traditional spearphishing attacks and compromising public-facing web servers. This allows the attackers to move laterally on the network, plant backdoors, and communicate with command and control servers. These attack behaviors are becoming more commonplace when examining critical infrastructure attacks.

On top of that, ICS systems are an easy target because it’s widely known that most of them run on legacy, older infrastructure, so you cannot easily update the system or put an agent on the device. There’s no room for system downtime when it comes to the power grid or a water plant, so patching vulnerabilities becomes extremely difficult. Also, with Internet of Things adoption on the rise, IT and OT (operational technology) networks are rapidly converging, making those once isolated systems even easier to threaten with damaging cyberattacks.

According to a new report by CyberX Labs, 53% of all critical infrastructure sites use ICS stations running on older, legacy Windows installations that no longer receive security updates, offering a wide-open playing field for nation-state attackers. The report also found 69% of all industrial sites allow passwords to be sent through the network in plain text — another major exposure gap.

One easy attack vector for nation-states looking to target critical infrastructure is credential theft. After all, it worked well for some of the largest and most costly data breaches to date, including the Equifax, Office of Personnel Management, and Yahoo hacks. Stolen usernames and passwords guarantee an attacker can get in and wreak havoc on these systems. The more access those administrator credentials offer, the more detrimental it is to the organization.

What can protectors of critical infrastructure and other companies do to minimize cyberattacks and, more specifically, credential theft, when this seems to be the attack vector of choice for cybercriminals? Here are eight tips:

Make sure all of your employees leverage multifactor authentication (MFA) across their networks — including their personal social media accounts.
Understand who has privileged and administrative access within your organization. Place MFA in front of every administrator account for every system.
Password vaults are great but use caution as these are often difficult to roll out broadly. Also, as a point of caution, be aware that well-meaning and ill-intentioned system administrators can find ways around these, negating their intended security value.
Train your employees on how to avoid phishing and spearphishing scams and ensure they know how to create strong passwords that are not being recycled. Increasingly, phishing scams are often used to compromise privileged users of ICS.
Know who has remote access to your external workstations. Most attackers target administrators who are granted remote access from these workstations.
Use agentless solutions that won’t affect performance and availability for legacy SCADA systems.
Ensure both IT and OT systems, industrial IoT devices, and networks are hardened from cyberattacks — regularly updating operating systems and utilizing strong encryption, endpoint security tools, vulnerability assessments, patch management, network, and behavioral traffic monitoring tools.
If a device is compromised, isolate it immediately before undergoing incident response.
Ensure regular compliance with NERC, FERC, ISA, and other ISO standards.

By utilizing these tips, security teams can slow down credential theft attacks on critical infrastructure and keep these important systems on lock down.

Related Content:

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

JD Sherry is Chief Revenue Officer for Remediant, Inc. He has spent the last decade in executive senior leadership roles at Optiv Security, Cavirin and Trend Micro, and has successfully implemented large-scale public, private and hybrid clouds emphasizing … View Full Bio

Article source: https://www.darkreading.com/endpoint/8-tips-for-preventing-credential-theft-attacks-on-critical-infrastructure-/a/d-id/1333312?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple