STE WILLIAMS

The dust has yet to settle on the recent revelation of critical vulnerabilities in microprocessors that most modern computers worldwide, but it’s already troublingly clear that fixing the problem isn’t simply a matter of applying the latest vendor security updates.

Last week’s disclosure by researchers from Google’s Project Zero team and research teams from academia of the vulnerabilities in most Intel processors and in some AMD and ARM processors have left organizations scrambling to gather and track security updates available for their firmware, operating systems, and browsers. Given that operating system patches can incur significant performance hits – some experts are estimating up to 30% degradation for Linux and Windows platforms – there’s a lot at stake in fixing the flaws.

The so-called Meltdown and Spectre hardware vulnerabilities allow for so-called side-channel attacks: in the case of Meltdown, that means sensitive information in the kernel memory is at risk of being accessed nefariously, and for Spectre, a user application could read the kernel memory as well as that of another application. So an attacker could read sensitive system memory, which could contain passwords, encryption keys, and emails – information that could be used to help craft a local attack.

Meltdown and Spectre are especially vexing because the attacks take advantage of the design of the hardware itself, the so-called “out-of-order execution” performance feature in most modern processors that runs operations out of order to streamline and speed up processing. The timing differences of the operations, for example, can leak sensitive information from the kernel, and an attacker could use that information to then attack the system via another exploit.

The irony is that a feature meant to boost processor performance for now can only be fixed with software updates that can in some cases deplete performance. And experts say this pervasive security weakness not only has a long tail but is likely only the tip of the iceberg for hardware vulnerabilities yet to be unearthed.

“I would be surprised if these particular issues were the only ones of this class of problems. Just digging a little bit, there appears to be a lot of space for” other microprocessor issues like this, says Dino Dai Zovi, a veteran security researcher and co-founder and CTO at Capsule8.

Patching is the only option to mitigate risk of a Meltdown or Spectre attack, but it’s still not a perfect solution. Given that the basic design flaw lies in the microprocessor hardware, the software updates merely provide software mitigations for the attack. So there’s still the chance the updates ultimately can be bypassed by an attacker, for example.

The US-CERT reiterated those concerns late last week in its Vulnerability Guidance alert: “Due to the fact that the vulnerability exists in CPU architecture rather than in software, patching may not fully address these vulnerabilities in all cases,” the US Department of Homeland Security post said of the flaws, CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754.

The security updates and patches are mainly workarounds and mitigations: a real fix would require a hardware do-over in the microprocessors, experts say. “In general, we think you have to wait until the new generation of processors will be introduced,” says Max Goryachy, security researcher at Positive Technologies, which late last year discovered a buffer overflow Intel’s chip firmware can be abused to take control of a machine even when it’s powered down.

While future-generation chips may address the flaws, for existing systems it’s all about patching. Yet, not all systems will get patched.

“What worries me,” says Chris Pierson, CEO of Binary Sun Cyber Risk Advisors, is that “the wholesale underlying infrastructure vulnerabilities are so deep-seeded that they will remain with us for years to come.”

Patching some systems may come with a price. Large organizations are now weighing their patching decisions based on risk and performance impact. Take the FS-ISAC, the financial services industry organization that shares threat intelligence among banks and other financial institutions, which said it’s well aware of the possible performance and productivity hits and costs, as well as testing, for the processor patches.

“There will need to be consideration and balance between fixing the potential security threat versus the performance and other possible impact to systems,” the FS-ISAC said in a statement last week. Cloud-based and shared, virtualized platforms, are likely to be more at risk than dedicated servers and endpoints.

William Nelson, president and CEO of FS-ISAC, says while Meltdown and Spectre “are a big deal,” the good news is that it’s a vulnerability discovery and has no known exploits in the wild as yet, which gives financial institutions some breathing room to assess and analyze their risk and any performance tradeoffs.

“We are continuing to monitor” and share information about the vulns with our members, he says.

Greg Temm, chief information risk officer at FS-ISAC, says risk is always part of the equation when considering a new patch, as well as operational issues for production systems or applications. “You’re looking at capacity as well,” he says, and how a patched system will affect that.

“Most organizations are not operating their servers at 100% capacity every day, every minute. There’s already built-in capacity to take in extra requests coming into the server, so there’s already some buffer there,” he notes. Segmented networks can help lower risk, he says.

“A lot of financial institutions employ multi-tier architectures so their most sensitive systems are protected with multiple layers of security so the outside world can’t access those systems,” Temm says.

Renowned security expert Dan Kaminsky expects any performance tradeoffs with security patches to be a temporary problem, however. “You’re not going to see computers slow down to a crawl … You might see some temporary slowdowns as we figure things out,” he says.

Kaminsky says Meltdown and Spectre ultimately will force a sea change in security. “What makes this bug really interesting is that it’s really going to require rethinking how we implement security,” he says. “The fundamental flaw is the leaky state” of security domains, he says.

Capsule8 late last week released a free tool to detect Meltdown exploits. “It’s significantly easier to deploy, with less peformance impact” than remediation via a patch, he says. “We wanted to give people some way to measure protection while they rolled out patches, and while they made risk decisions.”

Meantime, in a bizarre twist last week, the Computer Emergency Response Team (CERT) at Carnegie Mellon University, which is sponsored by the US Department of Homeland Security, at first recommended removing the vulnerable hardware as the solution to the vulnerabilities. The CERT later deleted that guidance posted in its alert, replacing it with “Apply updates,” and noting that operating system and “some application updates mitigate these attacks.” 

Related Content:

• The Long Tail of the Intel AMT Flaw
• Secure Wifi Hijacked by KRACK Vulns in WPA2
• 7 Hardware Firmware Hacks Highlighted at Black Hat 2017

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/cloud/meltdown-spectre-likely-just-scratch-the-surface-of-microprocessor-vulnerabilities/d/d-id/1330774?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The dust has yet to settle on the recent revelation of critical vulnerabilities in microprocessors that most modern computers worldwide, but it’s already troublingly clear that fixing the problem isn’t simply a matter of applying the latest vendor security updates.

Last week’s disclosure by researchers from Google’s Project Zero team and research teams from academia of the vulnerabilities in most Intel processors and in some AMD and ARM processors have left organizations scrambling to gather and track security updates available for their firmware, operating systems, and browsers. Given that operating system patches can incur significant performance hits – some experts are estimating up to 30% degradation for Linux and Windows platforms – there’s a lot at stake in fixing the flaws.

The so-called Meltdown and Spectre hardware vulnerabilities allow for so-called side-channel attacks: in the case of Meltdown, that means sensitive information in the kernel memory is at risk of being accessed nefariously, and for Spectre, a user application could read the kernel memory as well as that of another application. So an attacker could read sensitive system memory, which could contain passwords, encryption keys, and emails – information that could be used to help craft a local attack.

Meltdown and Spectre are especially vexing because the attacks take advantage of the design of the hardware itself, the so-called “out-of-order execution” performance feature in most modern processors that runs operations out of order to streamline and speed up processing. The timing differences of the operations, for example, can leak sensitive information from the kernel, and an attacker could use that information to then attack the system via another exploit.

The irony is that a feature meant to boost processor performance for now can only be fixed with software updates that can in some cases deplete performance. And experts say this pervasive security weakness not only has a long tail but is likely only the tip of the iceberg for hardware vulnerabilities yet to be unearthed.

“I would be surprised if these particular issues were the only ones of this class of problems. Just digging a little bit, there appears to be a lot of space for” other microprocessor issues like this, says Dino Dai Zovi, a veteran security researcher and co-founder and CTO at Capsule8.

Patching is the only option to mitigate risk of a Meltdown or Spectre attack, but it’s still not a perfect solution. Given that the basic design flaw lies in the microprocessor hardware, the software updates merely provide software mitigations for the attack. So there’s still the chance the updates ultimately can be bypassed by an attacker, for example.

The US-CERT reiterated those concerns late last week in its Vulnerability Guidance alert: “Due to the fact that the vulnerability exists in CPU architecture rather than in software, patching may not fully address these vulnerabilities in all cases,” the US Department of Homeland Security post said of the flaws, CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754.

The security updates and patches are mainly workarounds and mitigations: a real fix would require a hardware do-over in the microprocessors, experts say. “In general, we think you have to wait until the new generation of processors will be introduced,” says Max Goryachy, security researcher at Positive Technologies, which late last year discovered a buffer overflow Intel’s chip firmware can be abused to take control of a machine even when it’s powered down.

While future-generation chips may address the flaws, for existing systems it’s all about patching. Yet, not all systems will get patched.

“What worries me,” says Chris Pierson, CEO of Binary Sun Cyber Risk Advisors, is that “the wholesale underlying infrastructure vulnerabilities are so deep-seeded that they will remain with us for years to come.”

Patching some systems may come with a price. Large organizations are now weighing their patching decisions based on risk and performance impact. Take the FS-ISAC, the financial services industry organization that shares threat intelligence among banks and other financial institutions, which said it’s well aware of the possible performance and productivity hits and costs, as well as testing, for the processor patches.

“There will need to be consideration and balance between fixing the potential security threat versus the performance and other possible impact to systems,” the FS-ISAC said in a statement last week. Cloud-based and shared, virtualized platforms, are likely to be more at risk than dedicated servers and endpoints.

William Nelson, president and CEO of FS-ISAC, says while Meltdown and Spectre “are a big deal,” the good news is that it’s a vulnerability discovery and has no known exploits in the wild as yet, which gives financial institutions some breathing room to assess and analyze their risk and any performance tradeoffs.

“We are continuing to monitor” and share information about the vulns with our members, he says.

Greg Temm, chief information risk officer at FS-ISAC, says risk is always part of the equation when considering a new patch, as well as operational issues for production systems or applications. “You’re looking at capacity as well,” he says, and how a patched system will affect that.

“Most organizations are not operating their servers at 100% capacity every day, every minute. There’s already built-in capacity to take in extra requests coming into the server, so there’s already some buffer there,” he notes. Segmented networks can help lower risk, he says.

“A lot of financial institutions employ multi-tier architectures so their most sensitive systems are protected with multiple layers of security so the outside world can’t access those systems,” Temm says.

Renowned security expert Dan Kaminsky expects any performance tradeoffs with security patches to be a temporary problem, however. “You’re not going to see computers slow down to a crawl … You might see some temporary slowdowns as we figure things out,” he says.

Kaminsky says Meltdown and Spectre ultimately will force a sea change in security. “What makes this bug really interesting is that it’s really going to require rethinking how we implement security,” he says. “The fundamental flaw is the leaky state” of security domains, he says.

Capsule8 late last week released a free tool to detect Meltdown exploits. “It’s significantly easier to deploy, with less peformance impact” than remediation via a patch, he says. “We wanted to give people some way to measure protection while they rolled out patches, and while they made risk decisions.”

Meantime, in a bizarre twist last week, the Computer Emergency Response Team (CERT) at Carnegie Mellon University, which is sponsored by the US Department of Homeland Security, at first recommended removing the vulnerable hardware as the solution to the vulnerabilities. The CERT later deleted that guidance posted in its alert, replacing it with “Apply updates,” and noting that operating system and “some application updates mitigate these attacks.” 

Related Content:

• The Long Tail of the Intel AMT Flaw
• Secure Wifi Hijacked by KRACK Vulns in WPA2
• 7 Hardware Firmware Hacks Highlighted at Black Hat 2017

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/cloud/meltdown-spectre-likely-just-scratch-the-surface-of-microprocessor-vulnerabilities/d/d-id/1330774?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cyxtera Technologies today announced that it plans to acquire Immunity in a move to blend offensive and defensive security solutions into one portfolio.

Cyxtera, a cloud security and analytics company, plans to fold Immunity’s penetration testing tool Innuendo, assessment tool Canvas, and attack and assessment services into its portfolio of threat analytics solutions.

“The advantages of combining Immunity’s products and services with Cyxtera’s portfolio creates an opportunity to approach cybersecurity in a truly holistic manner. The expertise developed in both companies is highly complementary,” Christopher Day, chief cybersecurity officer of Cyxtera, said in a statement. “It will strengthen our ability to help customers better secure their infrastructure.”

The transaction is expected to close in the first quarter, pending regulatory approval. The companies did not disclose the Immunity purchase price.

Read more about the Immunity acquisition here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/cyxtera-technologies-to-acquire-immunity-/d/d-id/1330766?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In a one-two punch, the Wi-Fi Alliance today introduced several key enhancements to its Wi-Fi Protected Access II (WPA2) security protocol and unveiled its next security protocol WPA3.

“WPA2 has been around since 2003 and the Wi-Fi Alliance has constantly updated and enhanced it. WPA3 will build on the core components of WPA2 and add additional capabilities,” says Kevin Robinson, vice president of marketing for the Wi-Fi Alliance.

The Wi-Fi Alliance is a global network of companies that collaborate and set standards for the Wi-Fi industry. WPA2 is the organization’s family of Wi-Fi CERTIFIED security technologies, which is widely adopted among more than 35,000 Wi-Fi products, and WPA2 will run concurrently as WPA3 gains adoption, Robinson says.

During the early part of the year, the alliance will roll out three key WPA2 enhancements and four new WPA3 security capabilities.

“These new WPA2 enhancements generally take place ‘under the hood’ of Wi-Fi devices,” Robinson says, noting most users will not notice the changes. However, network operators, service providers, and managers of BYOD employees will likely notice the changes.

WPA2 Enhancements

The three key enhancements to the WPA2 protocol will address authentication, encryption, and configuration issues.

The first enhancement is related to the use of Protected Management Frames (PMF) in Wi-Fi devices. The Protected Management Frames feature, which is already broadly adopted in Wi-Fi devices, is designed to ensure the integrity of network management traffic on a Wi-Fi network and maintains the resiliency of networks, Robinson explains.

“Wi-Fi Alliance is implementing changes around when Wi-Fi CERTIFIED devices must use Protected Management Frames, essentially refining the set of acceptable Wi-Fi CERTIFIED device configurations to further raise the bar and ensure devices utilize the highest possible security,” he says.

A second WPA2 enhancement calls for companies to conduct additional checks on all of their Wi-Fi CERTIFIED devices to ensure they are incorporating the best practices on the way they use Wi-Fi security protocols and closely related network protocols. For example, Wi-Fi tests will evaluate expected behaviors when devices validate network authentication server certificates, Robinson says. This enhancement is designed to reduce potential vulnerabilities due to misconfiguration of networks or devices.

The third enhancement aims to deliver better consistency in network security configuration by standardizing 128-bit level cryptographic suite configurations, similar to those defined for the new 192-bit level.

“Often people may focus exclusively on the level of encryption when evaluating security of a technology, but there are a number of components—such as information protection (encryption), key establishment, digital signatures, and condensed representations of information—that work together as a system to deliver strong security,” Robinson notes.

As a result, the third enhancement is designed to ensure all Wi-Fi CERTIFIED devices use cryptographic components of similar strength as the security level that is configured. Robinson compared this enhancement to preventing a weak link in a chain.

“Depending on its intended use, a chain could be made of plastic, aluminum, or hardened steel. However, the chain is only as good as its weakest link. This enhancement will ensure there is consistency across all security elements utilized in a given configuration,” he says.

Although the vast majority of Wi-Fi devices already meet most of these requirements, the alliance notes by having them in its Wi-Fi certification program it can be certain that all Wi-Fi CERTIFIED devices will meet this higher level of security protection.

WP3 Capabilities

Broad adoption of WPA3’s four capabilities is expected to take some time, but when it occurs it is expected to yield greater security for a number of years, Robinson says.

The first capability aims to protect users who choose weak passwords. Under WPA3 certification, companies would need to use technology that informs the network every time an attacker guesses at a password. “Previously, before a handshake could happen on a network, an attacker could do their guessing offline,” explains Robinson.

WPA3 also aims to simplify the configuration process and security for devices with limited display interfaces, which are typically associated with sensor or IoT devices. WPA3 certified devices would allow users to tap their smartphone against a sensor device or IoT device, or scan a QR code, and then provision the device onto the network.

Improved privacy on open networks is a third standard for WPA3-supported devices.  

“With this new capability supported by WPA3 devices, every user on an open network gets individualized data encryption without the need to configure a network password. The experience is identical to connecting to any open network with the benefit of a higher level of privacy because an attacker cannot passively monitor network traffic,” Robinson says.

Lastly, WPA3 aims to deliver stronger security for government, defense, and industrial networks with a new set of protocols using 192-bit security, or Commercial National Security Algorithm (CNSA) Suite. CNSA, previously known as Suite B, is designed to support security-sensitive networks, such as those transmitting top secret information, the Alliance announced.

“WPA3 will emerge in 2018, but broad adoption is not expected for some time,” Robinson says. “WPA2 will continue to be deployed in Wi-Fi CERTIFIED devices for the foreseeable future, and the Wi-Fi Alliance will continue enhancing WPA2 to ensure it delivers strong security protections to Wi-Fi users as the security landscape evolves.”

Related Content:

• Secure Wifi Hijacked by KRACK Vulns in WPA2
• Wi-Fi Direct Products Connect Without A Network
• Hotel Router Vulnerability A Reminder Of Untrusted WiFi Risks

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/endpoint/wi-fi-alliance-launches-wpa2-enhancements-and-debuts-wpa3/d/d-id/1330762?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A fileless malware campaign was discovered targeting organizations associated with the upcoming 2018 winter Olympics being held in Pyeongchang, South Korea, report analysts at McAfee Advanced Threat Research. An unknown nation-state attacker is likely responsible.

The campaign’s primary target was [email protected] with 337 South Korean organizations included on the BCC line. Most targets had some involvement in the Olympics, either in providing infrastructure or playing another supporting role.

This attack arrived as a spearphishing email containing a malicious Word attachment with the original file name “Organized by Ministry of Agriculture and Forestry and Pyeongchang Winter Olympics” (translated from Korean). Emails began on Dec. 22, 2017 with the most recent activity appearing on Dec. 28, when messages were sent from an IP address in Singapore.

Emails were disguised to appear to be from South Korea’s National Counter-Terrorism Center (NCTC). At the time, the NCTC was conducting physical anti-terror drills to prep for the Olympics, which suggests the email is legitimate and increases the odds people will open it.

The malicious document, which contains an obfuscated Visual Basic macro, prompts recipients to open it in their version of Microsoft Word and launches a PowerShell script when “Enable Content” is clicked. Attackers used an open-source steganography tool Invoke-PSImage, released on Dec. 20, to hide malicious PowerShell code on a remote server.

This process ultimately delivers an implant, which creates an encrypted channel to the attacker’s server and gives them the ability to execute commands on the victim’s machine. The goal was to evade detection technologies that rely on pattern matching, researchers explain.

“Based on the use of fileless malware to weaponize steganography tools and quickly deploy it in an active attack … this is the work of a nation state,” says McAfee senior analyst Ryan Sherstobitoff. At this time, there is no information to support which country is responsible.

Threat actors are casting a wide net, researchers report, and their choice of victim is significant.

“This is one notable incident where you have an attacker with the hallmarks of a nation state who took deliberate interest in conducting reconnaissance and identifying a number of targets involved with planning the winter Olympics,” says Sherstobitoff.

General cybercriminals may use the upcoming Olympics as a lure to target consumers and make money, Sherstobitoff explains. This actor, with the intention of sneaking onto victims’ machines, is more interested in understanding the events unfolding in the region.

“The attacker is getting an inside look at what’s happening behind the scenes,” Sherstobitoff says. While analysts haven’t yet seen the full effect, he says this could be “potentially damaging.” With the data collected, a threat actor could hold information for ransom, making it difficult to engage with them further, or cause embarrassment for the host country.

It’s increasingly common to see in-memory implants using PowerShell and obfuscation to avoid detection, though researchers note this type of attack has not been previously seen targeting users in South Korea. Use of the steganography tool, which was used in this campaign less than a week after its release, implies the actors are savvy to new tools.

McAfee reports fileless threats continued to grow in Q3 and PowerShell malware grew by 119%. “The techniques [here] have significantly grown from being used infrequently to being used quite often,” says Sherstobitoff. “This technique is interesting, especially when involved in high-profile, targeted attacks.”

Many cyberattacks continue to exploit basic security vulnerabilities and user behavior; however, the rise in fileless threats shows more are abusing system vulnerabilities, says McAfee Labs vice president Vincent Weafer.

“By leveraging trusted applications or gaining access to native system operating tools such as PowerShell or JavaScript, attackers have made the development leap forward to take control of computers without downloading any executable files, at least in the initial stages of the attack,” he says.

Related Content:

• US Gov Outlines Steps to Fight Botnets, Automated Threats
• The Nightmare Before Christmas: Security Flaws Inside our Computers
• Vendors Rush to Issue Security Updates for Meltdown, Spectre Flaws
• Google Apps Script Vulnerability Exposes SaaS to URL-based Threats

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/emailed-cyberattack-targets-2018-pyeongchang-olympics/d/d-id/1330768?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple