STE WILLIAMS

Finance minister says country may add artificial intelligence and data security to list of nation’s strategically important, regulated sectors

France may deem artificial intelligence and data protection firms strategically important to the country – a move that could enable the government to block foreign takeovers of French companies in those industries, French foreign minister Bruno LaMaire said Friday.  

As Reuters reports, a decree made in 2014 already requires foreign companies to get permission from the French state before taking control of firms in the energy, telecoms, transport, water and health sectors. 

From Reuters:

“I think that when you look at current economic trends, there’s a certain number of sectors that could be added to this decree,” Le Maire said on BFM TV.

Meanwhile, a French company is proceeding with its own takeover of a foreign data protection company: French security firm Thales and Amsterdam-based Gemalto released a joint statement Thursday stating that Thales’ 4.8 billion EUR cash acquisition of Gemalto, first announced last month, is expected to close in the second half of 2018.  

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/france-might-vet-acquisitions-of-ai-data-protection-firms/d/d-id/1330819?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Sure, as of Thursday, you could still get a last-minute ticket to attend next week’s North American Bitcoin Conference, to be held in Miami. That will be $1,000, if you please.

But if you expect to pay with Bitcoin – or with any other cryptocurrency, for that matter – prepare to be bit-crushed. The conference organizers said on the event’s site that it’s just too slow and pricey to accept at the last minute.

We have, and always will, accept cryptocurrencies for our conferences, up to fourteen days before the event. However, due to the manual inputting of data in our ticketing platforms when paid in cryptocurrencies, we decided to shut down bitcoin payments for last minute sales due to print deadlines.

The organizers blamed “network congestion and manual processing” for the decision. In other words, the fees are painful, and network congestion is gumming everything up. They said that they hope next year brings “more unity in the community about scaling” and that “global adoption becomes reality.”

As Bitcoin.com has reported and Redditors confirm, transaction fees have risen to $30-$60/per transaction at certain times of the day. The fees have skyrocketed from what was a few cents per transaction a few years back.

Moe Levin, the conference organizer, told Bitcoin.com that the organizers are “scrambling” to get bitcoin cash or a digital asset with cheaper fees integrated into the ticketing system. At this point, ticket service operators like Eventbrite or others just haven’t managed to integrate cryptocurrencies yet, he said.

We wish this was easier, but no ticketing options exist which can handle large volumes of ticket sales, and transaction fees on the Bitcoin blockchain exceed $30 at certain times of the day.

The conference certainly isn’t the only merchant that’s been forced to rethink cryptocurrency payments.

In December, the popular video game purchasing platform Steam announced that it would no longer accept bitcoin, also because of volatility and prohibitive fees.

Then, last week, Microsoft temporarily stopped accepting cryptocurrencies as payment for online games and apps, citing the high fees and unpredictability. It had begun to accept cryptocurrency as payment back in 2014.

Microsoft quickly reversed the decision to ban cryptocurrency payments from customers’ digital wallets though (a block which it had instituted twice in the past, in 2015 and 2016). The company told news.com.au on Wednesday that bitcoin was back on the table following its work to make sure customers could use cryptocurrency for smaller amounts:

We’ve restored bitcoin as a payment option in our store after working with our provider to ensure lower bitcoin amounts would be redeemable by customers.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/0QzDpKtMJek/

The technical description of the “Fruitfly” malware is “spyware.” But given the way it has allegedly been used, a better label would be creepware – creepware that should have easily been detected, but somehow stayed under the radar for more than a decade.

According to a 16-count indictment unsealed on Wednesday in US District Court for the Northern District of Ohio, its creator, Phillip R. Durachinsky, 28, used it to spy on thousands of victims for more than 13 years. Durachinsky spent this time not only collecting personal data but also watching and listening to victims through their webcams and microphones, and using some of what he collected to produce child abuse imagery.

Durachinsky, of North Royalton, Ohio, was charged with Computer Fraud and Abuse Act violations, Wiretap Act violations, production of child abuse imagery, and aggravated identity theft, according to a Department of Justice (DoJ) press release.

The victims ranged from individuals to companies, schools, a police department and government entities including one owned by a subsidiary of the US Department of Energy.

According to the DoJ:

(It) enabled him to control each computer by accessing stored data, uploading files, taking and downloading screenshots, logging a user’s keystrokes, and turning on the camera and microphone to surreptitiously record images and audio.

(He) used the malware to steal the personal data of victims, including their logon credentials, tax records, medical records, photographs, banking records, internet searches, and potentially embarrassing communications.

The indictment charges that while Durachinsky primarily used Fruitfly to infect Macs, he also wrote variants of Fruitfly that were capable of infecting computers running Windows.

It said he saved millions of images, kept detailed notes on what he observed, and designed it to alert him if a user typed words associated with pornography.

Besides the creep factor, a stunning thing about Fruitfly is that it is both unsophisticated and relatively easy to spot, yet according to the DoJ, Durachinsky was able to use it undetected from 2003 until January 2017, when he was arrested and jailed on another charge. He remains in custody.

Forbes reported that Durachinsky was charged a year ago with hacking into computers at Case Western Reserve University (CWRU), which had reported to the FBI that 100 of its computers were infected. The FBI found that they had been infected for “several years” and that the same malware had infected other universities.

But apparently that arrest was not connected to Fruitfly, even though this was when the spyware was discovered.

Six months later, Forbes reported that Patrick Wardle, a former National Security Agency analyst and now a researcher specializing in Mac malware, found a new version of Fruitfly, decrypted the names of several backup domains hardcoded into the malware and found the addresses remained available.

Within two days of registering one of them, almost 400 infected Macs connected to his server, mostly from homes in the US. He then gave his findings to law enforcement, which may have provided the evidence used to bring this week’s indictment.

So far, it is not clear how Fruitfly infects computers, but since there is no evidence it exploited vulnerabilities, it likely gained access by tricking victims into clicking on malicious Web links or email attachments.

Wardle told Forbes that it was clear that surveillance was the primary purpose of Fruitfly.

This didn’t look like cybercrime type behaviour, there were no ads, no keyloggers, or ransomware. Its features had looked like they were actions that would support interactivity: it had the ability to alert the attacker when users were active on the computer, it could simulate mouse clicks and keyboard events.

And, he said there were signs it had been around for years, since the code included comments about updates for Mac OS X Yosemite, first released in 2014, indicating that it had been running well before that.

Within this week’s complaint, prosecutors also asked the court to order that Durachinsky forfeit any property he derived from his 13-year campaign, an indication that they allege he sold the images and data he acquired to others.

The DoJ didn’t say whether Durachinsky had entered a plea, but included the standard disclaimer in its press release:

The charges in the indictment are merely allegations, and the defendant is presumed innocent unless proven guilty beyond a reasonable doubt in a court of law.

Sophos detects Firefly as OSX/Bckdr-RUA and Troj/Bckdr-RUC.

Follow @tarmerding2
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/zvw9GCP_Vd4/

You can’t move these days without bumping into words such as cryptocurrency, Bitcoin, coinminer and blockchain.

With Bitcoin’s value up more than 1000% in the past year, and with companies multiplying their share price simply by adding “Blockchain” to their names, you can see why these words are everywhere.

As you’ll have seen in many Naked Security articles, cryptocurrency is popular with cybercrooks, too.

Usually, cryptocurrency is the end, rather than the means of the crime, for example when crooks infect your computer with coinmining software to hijack your CPU to earn them money, or scramble your data with ransomware and demand that you pay them in cryptocoins to get it back.

But here’s something a bit different that ‘we’ve seen recently: cryptocurrency as the means to a malware infection, not the end of that infection.

These phishing campaigns are also slightly unusual in that they include attachments that are ISO files.

You probably associate ISO files with ripped music CDs or movie DVDs, and with bootable Linux (or Windows) distros – ISOs are just byte-for-byte copies of the raw content of an optical disk.

You usually use them as CD backups, or as a source to burn new CDs.

However, many Windows users have utilities that can open ISO files as though they really were CDs; in fact, Windows 10 will open up ISOs simply by double clicking on them, which allocates them a regular drive letter in the system.

We’re assuming that the crooks have chosen this mix because cryptocurrencies are a red-hot lure, while ISO attachments, though unfamiliar, are nevertheless an undramatic and largely unsuspicious type.

Sure, ISOs are unusual, and they’ve been associated with Linux malware attacks before, but for Windows users, they simply don’t have the malware-related associations of attachments such as EXEs or ZIPs.

Yet they’re as straightforward as ZIPs to open and use.

Here are two examples of the ISO-laden, cryptocoin-themed phishes we’re talking about:

If you open the ISOs, they contain malicious EXE files (programs) with names of the form xxxxx.PDF.exe; by default, Windows doesn’t display the extension at the end of a filenames, so these show up as though they were documents with the much more innocent name xxxxx.PDF.

The most common malware we’ve seen in ISO files of this sort is known as Fareit, a threat family notorious for snopping around on your computer trying to steal login credentials.

What to do?

Even if you are dead keen on cryptocurrency, even if you watch the Bitcoin price like a hawk, and even if you actually have an account with the company Blockchain.com…

…you ought to spot these phishes if you keep alert, and don’t let yourself feel rushed.

• Legitimate emails don’t invite you to check your account via an attached file, or even a weblink. They expect you to find your own way to the site, precisely to avoid getting suckered into opening a bogus attachment or visiting an imposter site.
• ISOs aren’t typically used in email exchanges. If you’re not sure what it is, or why someone would choose to send it to you other than to make things look different, don’t trust it. If you’re a sysadmin, consider blocking ISOs at your email gateway unless your organisation has a genuine reason to swap them via email. (We can’t think of any reason, let alone a good one.)
• File extensions aren’t there to be hidden. Don’t stick with the Windows default – go to File Explorer → View and turn on File name extensions so you can easily spot trickery such as double-extensions like PDF.exe or TXT.docx. If you’re a sysadmin, consider turning this on for all your users via group policy.
• Spelling and grammar mistakes are a useful warning. These days, not all phishes are badly-written, and some legitimate corporate emails are at the borderline of illiteracy, so you can’t rely on grammar alone to spot a phish. Nevertheless, many phishes still smell fishy, so don’t ignore your nose.

If in doubt, leave it out!

Follow @NakedSecurity
Follow @duckblog

Picture of CD in featured image by Ubern00b – Own work, CC BY-SA 3.0.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/MwpBhoJXvCE/

Researchers have found a batch of over 60 malware-carrying apps in Google’s Play Store designed to rob mobile users or show them pornography, all with a kid-friendly theme.

The malware, dubbed AdultSwine by security shop Check Point, was found in apps like “Drawing Lessons Lego Star Wars”, “Fidget spinner for Minecraft” and “Spinner Toy for Slither”, along with a large number of Android games. The apps were downloaded between three and seven million times before the infection was caught.

One father complained to Google that the software had exposed his four-year-old son to “a bunch of thilthy (sic) hardcore porn pictures”.

Time for a conversation, about dictionaries at the very least

AdultSwine offers a three-pronged approach to the operator. It can throw up a fake virus warning screen and get the user to download cleaning software that would more effectively pwn the phone, trick people into sending premium SMS messages with the offer to win a prize or just throw up websites aimed at the amateur gynecologist.

“We’ve removed the apps from Play, disabled the developers’ accounts, and will continue to show strong warnings to anyone that has installed them,” a Google spokesperson told The Register. “We appreciate Check Point’s work to help keep users safe.”

Another month, another malware outbreak in Google’s Play Store

READ MORE

Such exclusively family-based apps are checked manually by Google for malware and ad content, according to those familiar with the situation, but the AdultSwine code was put out for general release. That gets machine checked and, despite the Chocolate Factory’s AI virus-hunting protestations, past experience and research suggests malware writers are finding Google’s malware seeking bots easy to evade.

“Apps infected with the nasty ‘AdultSwine’ malware are able to cause emotional and financial distress,” said Check Point in a blog post.

“Due to the pervasive use of mobile apps, ‘AdultSwine’ and other similar malware will likely be continually repeated and imitated by hackers. Users should be extra vigilant when installing apps, particularly those intended for use by children.” ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/01/12/android_apps_google_play/

Security people talk of an attack surface to describe exposure to malware and hacking. The bigger the attack surface, the more at risk you are.

Data is the fuel of a new industrial revolution, powering business changes such as digitalisation and advances in fields such as machine learning. The greater our reliance on data, the greater becomes our exposure to security risks. If data is lost, stolen or unavailable, or if we break the rules of stewardship, we become vulnerable.

In addition the European Union’s General Data Protection Regulation (GDPR), which comes into force in May 2018, introduces new requirements for the handling of personal data and fines for its mishandling. The more systems you have to protect, the greater your surface area for data loss and falling foul GDPR.

The way data is used and stored is changing, and the rules governing its protection are moving on from relatively simple backup and recovery to a sharper focus on data management.

How do we achieve the necessary level of management? The answer is through visibility and control, which is achieved by an overall view of the data estate. Managing the protection of your data from a central vantage point is better than protecting individual data silos.

Central management of distributed resources is a well-proven way of operating in business. We take it for granted that as we move from one department to another in an organisation the general procedures and facilities will be dependably the same.

Consistent internal operations mean better cost control – think central purchasing for example – and more efficiency.

If businesses take a centralised approach to physical office estate management such as car fleets, office supplies, banking and more, why is data protection not treated in the same way? Instead what we often see is uncoordinated and varied practices geared towards protecting individual data silos.

The new wave

The old way of providing data protection – basically backup and archive – is focused on data sources or silos, and on-premise ones at that: a few relational databases and file collections plus data warehouses and BI systems.

Each of these is protected using backup software or systems, with for example deduplicating disk-based target arrays or tape-based libraries. The setup could include, for example, purpose-built backup appliances such as Data Domain, Quantum’s DXi and Exagrid.

But a newer and more diverse work environment has emerged. This spans new endpoints such as devices and laptops, and wraps in off-premise infrastructure services such as Amazon’s S3 data stores and software-as-a-service platforms such as Microsoft’s Office 365.

The data formats have expanded, too, from purely relational to unstructured formats stored using NoSQL databases. Data volumes have grown hugely, exacerbating the problems.

Traditional data models trying to adapt to this new world are inhibited by their use of legacy software and design. But newer models are emerging from companies such as Rubrik and Druva.

These are either on-premise systems that typically include hyper-convergence and employ systems such as Hadoop, or they are cloud-based models that bring the benefits of cutting hardware cost and allowing elastic scaling qualities.

A bird’s eye view

The changing landscape has brought an evolution in technology. A new set of data protecting suppliers are pushing the idea that you need to look at your data in its entirety and decide where, how and how often to protect it.

Additionally, factors such as GDPR render critical the need to know more about your data – where it is, who has access to it and how is it being used. Some vendors are going so far as offering additional data management capabilities, such as copy data generation and reclaim, data tiering, eDiscovery and more.

We’re seeing suppliers offer overall data management, control and visibility as well as data protection. They have the ability to select different protection methods – backup, clone, snapshot, replication and so on – based on the differing protection needs of data subsets.

To these companies, however, staying with an approach based only on protecting the individual silos in isolation from each other is no longer valid.

This approach doesn’t provide the necessary degree of visibility and also breeds something troubling: dark data, caused by replication between systems.

Additionally, with the significant increase in data growth and longer retention periods, infrastructure and administrative expense can become excessive if not managed carefully.

The system contains the hidden dangers of over-copying data into protection systems, under-copying it resulting in unprotected data, and failing to meet governance and regulatory needs, leading to excess expense and even financial penalties.

Morality tales

When things go wrong, they do so with spectacular consequences.

• UK telco KCOM was hit with a £900,000 fine for failing to ensure its emergency service operated correctly.
• Mobile operator Three was fined £1l9m fine for a UK emergency call handling failure.
• A “confidential commercial settlement” was reached between Hewlett Packard Enterprise and the Australian government following SAN data loss failures.

What does the new system of data protection and recovery look like?

The data to be protected has to be viewed as a single logical resource, even if physically distributed in various physical silos both on and off premises.

To guarantee full data protection coverage and consistency, this single pool, or data estate, has to be centrally managed, monitored and protected by a system that spans the on-premise and public cloud worlds

Protection policies which can be applied to new data source systems need to be in place to define the type and frequency of basic protection according to recovery point and time needs, replication, and archiving

The system has to provide a portal or its equivalent to view the data and to support compliance with issues such as GDPR.

It has to enable businesses to recover from ransomware attacks and other data loss events. Organisations need to understand the importance of data isolation, highlighting the value of cloud storage as ransomware attacks are increasingly targeting on-premise servers, including data protection systems.

It should enable you to choose the best destination targets for your protection data, bearing in mind recovery times, archival needs, data identification and removal needs, and also eDiscovery and legal holds. Only a central control plane can provide this over-arching ability to unify data protection and provide consistency.

The implementation of this ideal data protection control facility could be on-premises or in the cloud. On-premise does mean potentially increasing costs as the data sets increase in size and you have to buy more hardware. One option would be critical RTO/RPO on premise with the remainder using a deduplicated cloud environment.

When should you change to this centralised overall approach to data protection? That’s a hard call: if you don’t change, nothing bad is likely to suddenly happen. However you may be spending too much money on inadequate and inconsistent protection schemes that will leave you vulnerable

Organisations are becoming more mobile and distributed. People and systems are generating and storing data across the globe. As the perimeters of this estate expand, so the rules governing data protection must evolve.

Only a centralised form of data management that brings greater visibility and control will mitigate the risks. ®

Supported by Druva

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/01/12/data_protection_is_best_managed_from_the_centre/

Security shortcomings in Intel’s Active Management Technology (AMT) create a means for miscreants to bypass login credentials on corporate laptops.

Insecure defaults in Intel AMT allow an intruder to completely bypass user and BIOS passwords and TPM and Bitlocker PINs to break into almost any corporate laptop in a matter of 30 seconds or so, according to security firm F-Secure. The issue, which can only be exploited given physical access to targeted laptop, is unrelated to the recent Spectre and Meltdown vulnerabilities.

The problem potentially affects millions of laptops globally.

AMT offers remote-access monitoring and maintenance of corporate-grade personal computers, allowing remote management of assets. Weaknesses in the tech have been discovered before (examples here and here) but the latest flaw is nonetheless noteworthy because of the ease of exploitation. “The weakness can be exploited in mere seconds without a single line of code,” F-Secure reports.

Setting a BIOS password, which normally prevents an unauthorised user from booting up the device or making low-level changes to it, does not prevent access to the AMT BIOS extension. This allows an attacker access to configure AMT and make remote exploitation possible.

Trivial

To run an exploit, all an attacker needs to do is power up the target machine and press CTRL+P during boot. The attacker then may log into Intel Management Engine BIOS Extension (MEBx) using the default password “admin”, as thi is most likely unchanged on most corporate laptops. The attacker would then be free to change the default password, enable remote access and set AMT’s user opt-in to “None”.

At this point a hacker would be able to gain remote access to the system as long as they’re able to insert themselves onto the same network segment as the victim. Access to the device may also be possible from outside the local network via an attacker-operated CIRA server.

How to remote hijack computers using Intel’s insecure chips: Just use an empty login string

READ MORE

The security issue “is almost deceptively simple to exploit, but it has incredible destructive potential,” said Harry Sintonen, the senior security consultant at F-Secure who came across the flaw. “In practice, it can give an attacker complete control over an individual’s work laptop, despite even the most extensive security measures.”

Although the initial attack requires physical access, Sintonen explained that the speed with which it can be carried out makes it easily exploitable in a so-called “evil maid” scenario. “You leave your laptop in your hotel room while you go out for a drink. The attacker breaks into your room and configures your laptop in less than a minute, and now he or she can access your desktop when you use your laptop in the hotel WLAN. And since the computer connects to your company VPN, the attacker can access company resources.”

Hacks in an airport or coffee shop might also be possible in cases where a prospective mark either leaves their system unattended or is distracted for a minute or two, perhaps by the accomplice of a hacker.

Sintonen and his colleagues at F-Secure have come across the issue repeatedly since early summer last year. A similar vulnerability, related to USB provisioning, was previously uncovered by CERT-Bund. The issue highlighted by F-Secure is distinct from that and other recent problems, the company confirmed, and relates to the insecure configuration and deployment of Intel AMT.

A large part of the problem is that enterprises are not following Intel’s guidance in practice, said F-Secure, adding that it was going public in order to draw attention to the issue.

“We discovered the issue this summer, and since discovering it, we have found it in thousands of laptops,” F-Secure told El Reg. “Despite there being information available for manufacturers on how to prevent this, manufacturers are still not following best practices, leaving vast numbers of vulnerable laptops out there. Organisations and users are left to protect against this themselves, but most don’t realise this is a problem. That is why it’s important to raise public awareness.”

F-Secure’s research indicates that some system manufacturers were not requiring a BIOS password to access MEBx. As a result, an unauthorised person with physical access to a computer in which access to MEBx is not restricted, and in which AMT is in factory default, could potentially alter its AMT settings.

El Reg understands that Intel began telling systems manufacturers to provide a system BIOS option to disable USB provisioning and to set the value to disable by default as far back as 2015. This guidance (PDF) was updated and reiterated last November.

F-Secure reports that despite all this guidance, insecure Intel AMT setups remain widespread.

While Intel has written extensive guides on AMT, they have not had the desired impact on the real world security of corporate laptops.

The issue affects most, if not all, laptops that support Intel Management Engine/Intel AMT. Chipzilla advises vendors to require the BIOS password when rolling out AMT. However, many device manufacturers do not follow this advice.

F-Secure recommends enterprises adjust the system provisioning process to include setting a strong AMT password, and disabling AMT if this option is available. ®

Youtube Video

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/01/12/intel_amt_insecure/

Analysis Processor security experts – including one cited in the Meltdown paper – are split on whether the resolution of the Spectre vulnerability may need to involve hardware modifications or the software defences being rolled out are adequate.

The Meltdown vulnerability, which by contrast is already comprehensively defended against, could become the focus of malware attacking the operations of processors on unpatched systems, experts warn.

“The theory behind Spectre and Meltdown is hard to understand,” according to Anders Fogh, a security researcher at G-Data and expert in processor security. “If it was used in the past it was only in advanced attacks. Now that research has been released, Meltdown is likely to be abused by commodity malware relatively quickly.”

Meltdown – like Spectre – is an information disclosure flaw that isn’t by itself suited to remote code execution, so the concern is that it might be combined as part of other attacks and used to lift secrets such as passwords and cryptographic credentials from unpatched systems.

Meltdown is easy to exploit but relatively easy to patch. Spectre is tougher in both respects. Daniel Genkin, a postdoctoral researcher at the University of Pennsylvania and the University of Maryland, previously told El Reg that a lasting fix against Spectre would require a hardware redesign.

Woo-yay, Meltdown CPU fixes are here. Now, Spectre flaws will haunt tech industry for years

READ MORE

Fogh disputed this during a phone interview with El Reg, adding that mitigations already in place are increasing the difficulty of mounting an attack. “A processor recall is not possible anyway,” he said. “The next step is getting customers to adopt patches.”

Werner Haas, CTO at Cyberus Technology and a member of one of the three teams that independently discovered and reported Meltdown, told El Reg that achieving comprehensive protection against Spectre is far from straightforward and likely to involve an “ongoing process” involving a combination of software fixes and hardware modifications.

“The [Spectre] attack scenario is not as simple as user code reading kernel data, as it is conceivable to have cross-application attacks without OS involvement,” Haas said. “On the other hand, branch prediction or speculation is such an integral part of high-performance CPUs that I lack the fantasy for a straightforward micro-architectural fix.

“So a generic solution as with Meltdown (either fix protection information processing in the pipeline, or change virtual memory handling in the OS) seems unlikely. As a consequence, I expect combined hardware/software mitigations with the caveat that plugging Spectre holes might become an ongoing process.”

Defending against Spectre will involve trade-offs beyond the already widely reported processor performance hits, Haas added.

“I suspect we will see a compromise between legacy software support, energy efficiency goals, and security requirements. The three new capabilities (= MSRs) announced by Intel smell like testability features that help address some of the issues immediately. As such they are probably not ideally suited to counter Spectre attacks. Longer term, I wish there was a broader discussion on what kind of Branch Prediction Unit control would be useful.”

Meltdown, Spectre 101

Meltdown and Spectre are both processor-level vulnerabilities that make it potentially possible for code running in user-mode – which might include malware or even malicious JavaScript served through rogue ads or the like – to read from portions of protected kernel memory, an area hosting passwords, login cookies and other secrets, or other portions of memory it should be blocked from accessing.

Meltdown primarily affects Intel processors. Spectre affects a much larger range of chipmakers, including AMD and ARM. Smartphones, servers and cloud services as well as PCs are at risk.

In response to proof of security problems from researchers, operating system developers and cloud service providers have released and rolled out patches to defend against both Meltdown and Spectre.

Haas laments that security in processor design was not baked in from the beginning – expressing nostalgia for the days of RISC processor development.

“Generally speaking, I am a bit worried that security has been an afterthought with current designs. It might be top priority now but originally, security was more like nice-to-have. I dream (and made suggestions) of an architecture with security in its genes and thus closely follow the RISC-V development.”

Chip vendor response scorecard

Anders Fogh was among the first to probe the security issues involved in speculative execution by modern processors and is an expert in the area even though he didn’t directly contribute to either the Meltdown or Spectre research papers. He praised the response by vendors as “heroic”.

“The response has been amazing both in terms of handling the complexity of the disclosure process and in getting patches out in time,” Fogh told El Reg.

Vendor security staff as well as researchers deserve to be considered “heroes” who worked over many months since last June, skipping holidays in the process, to get mitigations out early in the new year. Many are now “all too understandably tired”, Fogh reports.

Haas said the disclosure process had been less than ideal but praised Intel and ARM’s overall response.

“Complaints about keeping the issues secret for too long do not take into account that the Meltdown patches were finalised only recently so we would have had tons of computers without protection for an extended period of time.

“I disapprove the secrecy with respect to implementation details, though. I know that there are trade secrets involved but on the other hand, at Cyberus Technology, we are forced to spend considerable resources on reverse engineering where we would prefer focusing on the solution space. There has to be a way to work jointly together instead of the one-way flow of information we experienced in our interaction with Intel.”

Intel, Microsoft confess: Meltdown, Spectre may slow your servers

READ MORE

Haas is far more critical of AMD’s handling of the problem.

“AMD’s reaction has been a complete disappointment. I still have not figured out whether I should feel insulted by their claim about ‘a highly knowledgeable team with detailed, non-public information about the processors targeted’.

“Well, of course we feel flattered by the first part, but I strongly reject the notion that we at Cyberus used any kind of internal details from our previous jobs at Intel! And calling ‘Information Security is a Priority’ while discounting the research findings three sentences later does not quite match in my eyes.”

The Cyberus team’s Meltdown discovery started as a hobby project at the security startup. Haas predicts Meltdown may inspire others to look for processor security flaws while noting that this work was already under way before the Meltdown/Spectre revelations.

“I would argue that it does not require Meltdown to motivate looking into low-level attacks,” Haas said. “Just look at recent attacks against Intel’s Management Engine or AMD’s Platform Security Processor. But I do expect additional interest in exploring the corners of x86 execution. Successful research, however, likely requires more insight into the inner workings of a CPU than many security people have.” ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/01/12/meltdown_spectre_researchers_sitrep/

Shortfall exists despite nearly all global technology enterprise companies having security policies to manage IoT devices.

A global survey of infosec decision-makers found 92% of respondents have security policies to manage IoT devices, yet 53% lack sufficient tools to enforce the policies, according to a Forrester Research report.

Ten percent of the 3,378 survey respondents lacked any tools at all to enforce the policies, Forrester’s State of IoT Security 2018 report found.

The top three challenges in implementing IoT security, according to respondents, included privacy issues, integration hurdles, and migration or installation risks, Forrester reports.

For those survey respondents who implemented IoT applications, 43% launched intelligent customer service apps, 41% smart product apps, and 37% inventory management or warehouse management apps.

Read more about the Forrester Report here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/majority-of-companies-lack-sufficient-iot-policy-enforcement-tools-/d/d-id/1330813?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The best practices and technologies that originated in the intelligence realm can help businesses stay safer, too.

Cyber attacks changed drastically over the last few years. Cyber attackers now focus on disrupting our day-to-day operations or use attacks as a strategic weapon.

For example, in December 2016, Kiev experienced a blackout, likely as a result of a cyber attack on the Ukrainian capital’s power system. In the 2016 Dyn attack, Internet of Things (IoT) devices were exploited to disrupt dozens of major Internet services. And recently, the US Department of Homeland Security and the FBI issued a rare public alert about a cyber campaign in progress that was preparing to attack US critical infrastructure companies in multiple sectors, including energy, water, aviation, and nuclear. In 2017, it was also the year that ransomware transformed from a nuisance to a massive operation with the potential to shut down global organizations and data centers. These are only a few examples of the exponential growth in attacks we have experienced recently.

It’s clear we have entered the age of cyber warfare. The enemy is armed with new strategies, goals, and capabilities, and we must rethink our approaches as we prepare our organizations and nations to meet these evolving challenges. Below are four best practices utilized by national security and counterterrorism organizations that the cybersecurity industry should adopt.

1. We must acknowledge that we can’t hermetically seal our borders. Homeland security organizations have worked hard to secure the borders and keep out criminals and terrorists. Even though it’s not a simple task, in the physical world it’s much easier to try to close a border than in the cyber realm. While there is no such thing as a perfectly secured perimeter no matter where you operate, with persistence, attackers eventually will find a way in. As we get more creative and increase investments to try and close all the potential gaps, attackers will only get more creative, too. Continuing to invest in locking down the borders will not lead to any significant improvement in national security.

In the cybersecurity industry, we must realize that we have maxed out on our ability to lock down networks. It has become critical that we look to ways not only to prevent but to defend. To start, implement an incident response capability. If you don’t have the expertise to do this internally, that’s OK – there are a growing number of managed security service providers (MSSPs) offering these services. If you go this route, make sure you do your due diligence and work with an MSSP that has a solid reputation.

Additional firewalls and advanced intrusion-prevention systems may reduce the number of attacks, but some of the sophisticated attackers eventually will find a way in. The key is in how you respond. Instrumenting and monitoring your network so you have the information and evidence to respond is your best investment towards recovery.

2. We must assume attackers have already penetrated our defenses. National security agencies work under the assumption that terror cells have already penetrated their borders and are in the process of preparing for their next attack. The agencies focus resources on detecting potentially malicious activity and mitigating it as fast as possible, before the attack is carried out. They build and deploy numerous data collection sensors and invest in building large-scale data centers, which can analyze in real time the enormous amount of collected data and look for the smoking gun that will indicate planned terror activity.

In the same manner, cybersecurity leaders must assume that attackers have penetrated their perimeter security array. To combat this, they must set up the means to detect their activity, respond, and remediate it before a breach occurs or causes catastrophic damage. This means shifting resources from the traditional cybersecurity concepts and tools to the new generation of detection and response platforms, and to also build security operations centers (SOCs) that will let teams respond effectively and quickly.

3. We must embrace a data-centric approach. Data is the lifeblood of intelligence. Lawfully intercepted information, security footage, online chatter, mobile texting and more are all monitored continuously, resulting in massive amounts of data. This data is processed to look for suspicious behavioral patterns that will help reveal an upcoming attack. The challenge is to quickly and accurately distill high-quality intelligence from all of this data. Each piece of data on its own may look benign, but together they may tell a story that should be investigated. The challenge is to correlate data sources to produce and prioritize these insights, and then give them to the commanders in real time, enabling swift action.

In the cybersecurity world, organizations are facing the same challenges. Currently, organizations are leveraging a number of different resources to help them detect upcoming attacks, including external threat feeds, firewall alerts, endpoint sensors, or email. However, there is too much data and too few analysts to process it for actionable insights. There is also the expanding attack surface that includes OT (operational technology) networks and IoT devices, each one monitored and analyzed by a separate security system. Just as in the intelligence world, we need to get our systems talking to each other, aggregating the data into a homogenous big data platform, analyzing it with artificial intelligence, and helping limited SOC teams obtain insights faster.

4. We must collaborate. Criminal activity is global. Failing to share information leaves geographical blind spots, which criminals will exploit. Therefore, nations are continuously increasing their efforts to share timely intelligence information and alerts.

In the cybersecurity world, a security vulnerability is likely to exist across multiple organizations of the same industry segment because companies use similar technologies. Attackers look for an easy win, and after a successful attack they will attempt to replicate it against similar institutions, exploiting the same vulnerability. For example, the SWIFT heist of 2013 is believed to have been replicated in several other banks.

To address this, collaboration initiatives have begun in the IT security world, such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), the financial industry’s platform for threat intelligence analysis and sharing. These initiatives help organizations within similar industries jointly resolve vulnerabilities and share threat intelligence. Just like in the counterterrorism realm, we must put aside the desire to keep “bad” information to ourselves. Today, we can only confront attackers as a community.

National security and counterterrorism operations have made substantial progress over the last few years. They have become data driven and collaborative, and they’ve set up the processes to track down and mitigate an attack whether across or within their borders. Our industry should adopt best practices and technologies that originated in the intelligence realm and integrate them as a fundamental element of our SOCs, so we can keep our digital assets safer.

Related Content:

• Post-Breach Carnage: Worst Ways the Axe Fell in 2017
• Uber’s Biggest Mistake: It Wasn’t Paying Ransom
• The Internet of (Secure) Things Checklist

Adi Dar, CEO and founder of Cyberbit, is an experienced cybersecurity leader and chief executive who has repeatedly lead the development and launch of successful products and services in highly competitive markets. Previously, as CEO of ELOP (Israel’s largest electro-optics … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/what-can-we-learn-from-counterterrorism-and-national-security-efforts-/a/d-id/1330765?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple