STE WILLIAMS

The busiest threat actor groups of 2017 were Sofacy (otherwise known as Fancy Bear or APT28) and the Lazarus Group, security experts report. As these groups ramped up activity, threat actors operating out of China became quiet.

Analysts at AlienVault leveraged data from its Open Threat Exchange (OTX) threat intelligence sharing platform to take a broad look at threat patterns from last year. They found the most frequently referenced threat group in 2017 was Sofacy.

Ten years ago, Sofacy primarily targeted NATO and defense ministries. Over the past three years its operations have expanded to target businesses, individuals, and elections in the United States and France. Leaked information from the US government, and an official report from the German government, indicate the threat group is associated with Russian military intelligence.

The second most active group was Lazarus, which is believed to operate out of North Korea (or Democratic People’s Republic of Korea, DPRK).

“In the past, security researchers thought DPRK cyber adversaries were unsophisticated compared to more traditional nation-state adversary groups, like China or Russia,” says Dmitri Alperovitch, cofounder and CTO at CrowdStrike.

“However, the North Korea regime has invested significant resources in training and development in recent years and their cyber capabilities have matured significantly as a result.” Alperovitch points out that in 2017, cyber operations were linked to DPRK almost monthly. Lazarus was linked to WannaCry and has hacked into banks and cryptocurrency exchanges.

Crowdstrike found Lazarus is comprised of four groups: Silent Chollima, Stardust Chollima, Labyrinth Chollima, and Ricochet Chollima. Most adversaries focus on targeted attacks or cyberespionage; DPRK threat actors aren’t as particular. While they primarily focused on South Korean targets in 2017, they have been known to hit organizations in other regions.

What usually motivates these groups? John Bambenek, manager of threat systems at Fidelis Cybersecurity, says financial gain is often a driver. “You’re dealing with organized crime, in essence,” he explains. “There’s a payday at the end of it.”

Attackers, specifically those in North Korea, have begun turning to cryptocurrency. More are targeting consumer devices and leveraging their computing power to mine crypto. “For a nation that is highly sanctioned with currency requirements, Bitcoin and its related cousins provided great means to capitalize,” Bambenek points out.

The goals of nation-state threat actors will vary from group to group. Those looking for money could target cryptocurrency exchanges while those seeking to disrupt election cycles could target social media to spread disinformation. “It depends on the geopolitical circumstances,” he says.

Why Chinese threat groups fell silent

AlienVault’s data shows Stone Panda, also known as APT10 or CloudHopper, fell in tenth place for 2017 activity. This is the highest-ranked group operating out of China, and AlienVault threat engineer Chris Doman notes its ranking “would have been very different three years ago.”

The last year saw a significant decrease in the number of targeted attacks from China-based threat groups against Western businesses. While this followed political pressure and agreements to stop activity, it’s also possible their attacks have become tougher to detect. CloudHopper is known to hit targets by compromising major IT service providers, a method that’s difficult to detect for vendors and government agencies.

“We may continue to see reported activity from groups in China drop further,” Doman writes, adding that UPS (also known as Boyusec or APT3) switched from Western to domestic targets.

What should you worry about?

Alperovitch warns businesses to worry about the danger North Korean threat groups pose to their brands and networks. “These adversaries have demonstrated a degree of unpredictability about what they may try to do next,” he says. “It is important for organizations to continually hunt their systems for potential intrusions and swiftly remediate before any damage is done.”

Bambenek acknowledges the potential for ICS-based attacks, which he says will be a growing area of focus for threat groups. “Someone will take a utility hostage for ransom,” he says. “With Triton getting published to GitHub, we’ve drastically lowered the bar for ICS attacks.”

Related Content:

• IoT Botnets by the Numbers
• Phishing Campaign Underscores Threat from Low Budget, Low Skilled Attackers
• Digital Extortion to Expand Beyond Ransomware
• DNS Hijacking: The Silent Threat That’s Putting Your Network at Risk

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/lazarus-group-fancy-bear-most-active-threat-groups-in-2017/d/d-id/1330954?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Google today announced that its custom roles feature for its Cloud IAM (Identity and Access Management) is now available in production after a beta phase that began last October.

The new least-privilege feature basically allows organizations to carve out specific, custom access for users that ensures they only access and perform the functions they need for their jobs.

“IT security aims to ensure the right people have access to the right resources and use them in the right ways. Making sure those are the only things that can happen is the ‘principle of least privilege,’ a cornerstone of enterprise security policy,” Google product manager Rohit Khare and engineering manager Pradeep Madhavarapu wrote in a post about the new offering.

While Google Cloud already provides predefined roles such as owner and cloud storage view, for example, the custom roles feature allows more specific and targeted user roles. 

Read more here about Custom roles for Cloud IAM.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/google-cloud-least-privilege-function-goes-live/d/d-id/1330957?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Employing data encryption is a no-brainer, as it supports the defense-in-depth strategy that organizations must embrace to stop bad actors from accessing sensitive network files. However, outside of the extra layers of protection data encryption can provide, there are also tradeoffs in network performance and complexity that might arise when organizations aren’t approaching encryption thoughtfully. Here are four pitfalls to avoid as you begin encrypting content.

Pitfall One: Proprietary Algorithms
It may seem counterintuitive to the way many effective security strategies are designed and implemented, but relying on standardized algorithms to encrypt sensitive data is actually safer for organizations than tasking their own IT staff or developers with crafting a unique encryption algorithm or even authentication system. The reason for this is that cryptography is its own specialization that requires an advanced degree of scientific and mathematical precision. While specific individuals from in-house security teams may have this highly specialized set of skills, dedicated cryptographers have devoted their sole attention to crafting industry-standard algorithms like IDEA 128-bit and ARC4 128-bit – more attention than an IT generalist or cross-functional developer could devote given the wealth of other projects in their purview.

Pitfall Two: Full Disk Encryption
While it is essential to ensure that data is encrypted while at rest and in motion, considerations must be made for the systems that manage that encryption.

Full Disk encryption, for instance, is designed to prevent access to sensitive data if a device or its hard drive(s) are removed. When the device is on, and a user is logged in, the sensitive data is available for anyone who is logged in – including bad actors who may have a backdoor into the system. In a roundabout way, this highlights challenges with key management. No matter how strong the crypto, if the key that provides the ability to return the content to plain text is available to adversaries, its game over.

Pitfall Three: Regulatory Compliance
Across most industries, rules regarding data collection, sovereignty and storage are extensive and usually mandated by legislation at the local and federal level. While regulations like HIPAA, PCI, CJIS and CIPA go far in detailing the costs of noncompliance, they are less instructive in telling businesses how to avoid it. In fact, many of these regulations don’t mention data encryption at all, even though encryption can prevent many of the most egregious regulations from taking place. These laws may represent a good starting point for mapping out a security strategy, but teams need to be diligent about going beyond just the standard “checklist” of protocols and standards many of these mandates provide.

Pitfall Four: Decryption Key Storage
Even after teams have gone about extensively encrypting their data, many developers make the mistake of storing the decryption key within the very database they are hoping to protect. After all, encryption is a means for protecting data even after bad actors have infiltrated the data base. If the key to decrypt all that data is basically hiding “under the doormat” right on the other side of the network gateway, all those efforts to encrypt are basically worthless.

As a result, many teams are exploring “Key Encryption Key,” “Master Encryption Key” and “Master Signing Key” encryptions that they store elsewhere to protect enterprise data – a step that may seem excessive to some, but provides an all-important level of assurance that minor missteps don’t curtail major security operations.

Joe Cosmano has over 15 years of leadership and hands-on technical experience in roles including Senior Systems and Network Engineer and cybersecurity expert. Prior to iboss, he held positions with Atlantic Net, as engineering director overseeing a large team of engineers and … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/iboss/data-encryption-4-common-pitfalls/a/d-id/1330918?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

How tired are we of “artificial intelligence” and “machine learning” being sprinkled like pixie dust on every product being hawked by vendors? The challenge for cybersecurity professionals is to see through the fog and figure out what’s real and what’s just marketing hyperbole.

Often, marketing hyperbole exceeds the reality. Notoriously, Tesla’s Autopilot sensors can be fooled in certain edge conditions, iPhone X can be fooled to unlock a phone by a doppelganger, and Apple’s Siri isn’t very good at taking directions. Even the winning team in the DARPA Cyber Grand Challenge lost spectacularly to actual hackers at the DEFCON conference following its win against other machines at Black Hat.

Machine learning is built on recursive algorithms and mathematics, making the concept itself difficult for many to comprehend. So how can buyers and practitioners decipher what’s “real” machine learning technology from marketing spin and, just as importantly, what is effective versus what is not?

The five questions below go to the heart of how well a particular machine learning approach performs in detecting attacks, regardless of which particular algorithm it uses.

1. That detection rate you quote in your marketing materials is impressive, but what’s the corresponding false-positive rate?

The false-positive rate is the flip side of detection rates. False positives and true detection rates go hand in hand. In fact, a system can be tuned to optimize false positives or true detections to acceptable levels. The receiver operating characteristic (ROC) is a curve that shows the relation between true detections versus false positives. Pick a false-positive rate on the curve and you’ll see the corresponding true detection rate of the algorithm. If a vendor can’t or won’t show you a ROC curve for its system, you can bet it hasn’t done proper machine learning research, or the results are not something it would brag about.

2. How often does your model need updating, and how much does your model’s accuracy drop off between updates?

Just as important as detection and false-positive rates is the ability of the model to age well. Machine learning models will age with time as the training data it trained on becomes obsolete. The ability of a machine learning model to generalize from what it has trained on can be measured by its decay rate, the rate at which the model’s performance declines with time as the data it trained on ages. A good machine learning model will age slowly, which in practice means it will not need to be replaced that often. For comparison, traditional signature-based models need updating daily. A good machine learning model only needs to be replaced once every few months rather than every few days. The decay rate is heavily influenced by the training data. A diverse training set leads to a stable model, and a narrow training set ages out very fast.

3. Does your machine learning algorithm make decisions in real time?

Depending on your application, you can use machine learning for retrospective forensic analysis or for inline blocking — that is, blocking attacks as they occur in real time. If used for inline blocking, the approach needs to operate in real time, typically measured in milliseconds. In general, this rules out online lookups because of round-trip times from the cloud. Real-time performance requires a compact model able to run on-premises in the device’s memory. Asking the real-time performance of the model is one way of figuring out whether the model is compact enough to block attacks in real time. 

4. What is your training set?

The most overlooked important attribute in machine learning is the training set. The performance of a machine learning algorithm depends on the quality of the training set. Good, curated training sets that are robust to change, reflect real-world conditions, and diverse are hard to acquire, but they are incredibly important for effective performance. If the data on which the model is trained is not representative of the threats you will face, then the performance on your network will suffer regardless of how the model was tested. Models tested on narrow data sets will have misleading performance results.

5. How well does your machine learning system scale?

The good and bad news for machine learning in security is that there is a massive amount of data on which to train. Machine learning algorithms typically require those massive amounts of data to properly learn the phenomena it is trying to detect. That’s the good news. The bad news is the models must be able to scale to Internet-sized databases that change continuously. Understanding how much data an algorithm is trained on gives an indication of its scalability. Understanding the footprint of the model gives an indication of its ability to compactly represent and process Internet-scale databases.

As you can see, for a machine learning approach to be successful, it must do the following:

• Have high detection rates and low false positives on known and unknown attacks, with a published ROC curve.
• Be trained on a robust training set that is representative of real-world threats.
• Continue to deliver high performance for months after each update.
• Provide real-time performance (threat blocking) without consuming large amounts of system resources such as memory and disk.
• Scale reliably, without using more memory or losing performance, even as the training set increases.

Next time you talk to a company that claims to use machine learning in its products, be sure to get answers to these questions.

Related Content:

• 5 Things Security Pros Need To Know About Machine Learning
• AI in Cybersecurity: Where We Stand Where We Need to Go
• How to Keep Blue Teams Happy in an Automated Security World

Anup Ghosh is Chief Strategist, Next-Gen Endpoint, at Sophos. Ghosh was previously Founder and CEO at Invincea until Invincea was acquired by Sophos in March 2017. Prior to founding Invincea, he was a Program Manager at the Defense Advanced Research Projects Agency (DARPA). … View Full Bio

Article source: https://www.darkreading.com/operations/5-questions-to-ask-about-machine-learning/a/d-id/1330930?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Google took down 700,000 apps from Google Play in 2017 because they violated the store’s policies. This marks a 70% increase from the amount of apps removed in 2016, reports Google Play product manager Andrew Ahn in a blog post on 2017 security measures.

Ahn says 99% of malicious apps were identified and rejected before anyone could install them. Improvements in detection models helped find apps containing malware or inappropriate content, as well as threat actors and abusive developer networks. Google Play took down 100,000 bad developers in 2017 and made it difficult for them to create new accounts.

Examples of bad apps that were removed include copycats, which try to deceive users by disguising as famous apps. More apps were flagged for content, including pornography, extreme violence, hate, and illegal activities. Potentially harmful applications, which had a 50% lower install rate in 2017, are designed to phish users’ data, act as Trojans, or conduct SMS fraud.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/700000-bad-apps-deleted-from-google-play-in-2017/d/d-id/1330945?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Image Source: Adobe Stock

Even before Mirai burst onto the scene a year-and-a-half ago, security experts had been warning anyone who listened about how juicy Internet of things (IoT) devices were looking to criminal botnet herders. Proliferating faster than black t-shirts at a security conference, IoT sensors have spread throughout our personal and business lives inside cameras, automobiles, TVs, refrigerators, wearable technology, and more.

They offer the perfect combination of variables for attackers seeking an ideal botnet node: ubiquity, connectivity, poor default settings, rampant software vulnerability – and utter forgetability. Once these devices are deployed, they’re rarely patched or even monitored. So it was only a matter of time before cybercriminals started harvesting them for botnet operations.

Mirai offered one of the first large-scale implementations of IoT botnets, and since its inception in late 2016 the attacks have been relentless.

Here is a rundown of some of the most relevant stats around IoT botnet attacks.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/perimeter/iot-botnets-by-the-numbers/d/d-id/1330924?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple