STE WILLIAMS

Computer systems for the City of Atlanta were hit by an apparent ransomware attack that has caused outages and is now under investigation by the FBI.

According to Atlanta’s local news channel 11Alive, the attack appears to have the earmarks of the Samsam variant of ransomware. Some of the city’s customer-facing billing and court information systems have suffered outages due to the attacks.

“At this time, our Atlanta Information Management team is working diligently with support from Microsoft to resolve the issue. We are confident that our team of technology professionals will be able to restore applications soon. Our city website, Atlantaga.gov, remains accessible and we will provide updates as we receive them,” the City said in a statement provided to 11Alive.

According to the report, a screenshot from one of the infected machines showed the attackers demanding ransom of $6,800 “per unit,” or $51,000 to decrypt the entire system.

For more on this developing story, read the report here.

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/city-of-atlanta-hit-with-ransomware-attack/d/d-id/1331360?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Less than 10 days after getting blindsided by a report about purportedly severe vulnerabilities in some of its products, AMD on Wednesday confirmed the issues and said it would have fixes for them in the next several weeks.

In an alert Wednesday, AMD said it had completed an initial technical assessment of the flaws that Israeli security research firm CTS-Labs had reported to it on March 12 and then controversially released publically just one day later.

The assessment confirmed issues associated with the firmware for AMD Secure Processor and the Promontory Chipset used in AMDs Ryzen and EPYC platforms.

However, exploiting the flaws that CTS identified requires an attacker to already have full administrative access to a system, AMD’s CTO Mark Papermaster said. An attacker would need to overcome multiple OS-level controls such as Microsoft’s Windows Credential Guard to gain the administrative access needed to exploit the flaws, he said.

AMD is working on a firmware update for the Secure Processor issue and will release it in coming weeks, Papermaster said, without offering any specific dates. AMD is also working with the third-party manufacturer of the Promontory chipset on appropriate mitigations, he said. No timeline was given for when those mitigations might become available.

AMD’s advisory is its first public update after CTS released details on the vulnerabilities March 13.

It evoked an immediate response from the Israeli firm. In a statement posted on a website describing the AMD flaws, CTS criticized the chipmaker for attempting to downplay the severity of the flaws. It called AMD’s promise to deliver fixes in a few weeks as overly optimistic and said that some of the flaws would take months to fix. The central idea behind Secure Process in fact is to prevent administrators from gaining access to certain data on systems, the company noted.

CTS has come under considerable criticism for its decision to publicly disclose the vulnerabilities without giving AMD the opportunity to review them fully or issue any fixes for them. In a March 13 release, CTS said it had discovered 13 critical security vulnerabilities and manufacturer backdoors in AMD’s Ryzen and EPYC product sets.

The research firm grouped the vulnerabilities under four broad categories and described them as affecting millions of devices, users and organizations worldwide. Among other things, the flaws give attackers a way to permanently install malicious code in AMD Secure Processor and to steal credentials for moving laterally through compromised networks – including those protected by Microsoft’s Credential Guard.

CTS also warned that ASMedia, a Taiwanese company from which AMD sources some of its chipsets, was shipping products with exploitable manufacturer-installed backdoors in them that could allow attackers to inject malware into the chip.

Many faulted CTS for disclosing the flaws without giving AMD proper notice and also for overblowing the severity of the threat posed by them. An independent security research firm that CTS hired to validate its findings described the flaws as extremely hard to exploit even if complete exploit details were available. Others have maintained that the vulnerabilities are a threat only if a system has already been fully compromised, at which point an attacker would be able to do pretty much what they wanted on the system, anyway.

CTS’ decision to go public with its discovery just weeks after the storm over the Spectre and Meltdown vulnerabilities in Intel chips also prompted wide-ranging questions about the motives and the timing behind the vulnerability disclosure.

Related Content:

• AMD Processor Flaws Real, But Limited
• AMD Investigating Report of Vulnerabilities in its Microprocessors
• Fallout from Rushed Patching for Meltdown, Spectre
• 7 Spectre/Meltdown Symptoms That Might Be Under Your Radar 

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop ITX and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/endpoint/amd-will-release-fixes-for-new-processor-flaws-in-a-few-weeks/d/d-id/1331362?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cloud security is not as simple as picking up traditional network perimeter appliances and converting them into cloud services, a new study shows. But security may ultimately be better for the change.

Barracuda Networks surveyed 608 participants from organizations around the world. A majority (57%) say that their on-premises security is superior to cloud security, with the percentage answering that way growing in lock-step with the size of their organization.

That’s a problem for many organizations when they begin planning for security in the cloud. 83% say they have concerns about deploying traditional firewalls in the cloud, with 39% naming “pricing and licensing not appropriate for the cloud,” and 34% citing “lack of integration prevents cloud automation” as their primary concerns.

The report is based on a survey conducted by Dimensional Research on behalf of Barracuda. 

Tim Jefferson, vice president of public cloud at Barracuda, says these organizations have reason to be concerned. “Companies that are trying to cut and paste into the public cloud are having trouble. Security has always been around the network and a lot of appliances are built around architectures centralized in the data center,” he says. “Firewalls tend to scale vertically and that’s an anti-pattern for the cloud, where best practice is to keep everything federated and elastic. The tools don’t fit.”

The bigger issue, Jefferson says, is that many of the tools that companies struggle to place into the cloud aren’t really needed for cloud security. “In a public cloud you don’t need a lot of those functions,” he says. “A next-generation firewall isn’t required in the cloud – you don’t have to match the user to the function and filter on that because a properly architected cloud application will do that for you.”

APIs Over Firewalls

Relying on the cloud applications – and to put a finer point on it, the cloud application APIs with their controls and logging capabilities – allows forward-thinking security professionals to have better security in the cloud than they have in their traditional data center architecture, Jefferson says. According to the report, 74% of respondents cite “Integration with cloud management, monitoring, and automation capabilities” as the most beneficial cloud-specific firewall capability.

Integration is key, but organizations are finding it difficult to fully integrate cloud security into their DevOps or DevSecOps, with 93% saying they have faced challenges integrating security into those practices. Jefferson is blunt when he talks about the changes needed for organizations to move past the current difficulties: “All the visibility that’s so difficult to instrument in the data center is built in with the public cloud. It’s all done by API and that can be instrumented to police and monitor security.”

He says it all depends on perspective. “It’s really the lens you look through,” he says. “The traditional enterprise architect has thought of visibility as the instrumentation to see into ports and packets.”

But the problem is that public cloud “can’t provide span ports and access to layer 2. So they see public cloud and say there’s no visibility,” he says.

The public cloud, however, provides a better management tool. The management plane of the cloud can allow a security professional to track every interface and every record – every query, every response. The hard part is that the security professionals must re-think the means to the end of infrastructure security.

Security Hurdles

There are two huge hurdles standing between organizations and security in the cloud. The first is a human component that lies between security professionals’ ears. “It makes the professional uncomfortable,” Jefferson says, referring to security using APIs. “They want the tools they’ve always used.”

The second hurdle may be higher because it involves money. Jefferson says that the traditional licensing model for firewalls and other network security appliances just doesn’t work in a cloud environment where best practice is to spin up many federated instances rather than a handful of highly vertical compute centers.

“Now that things are federated and people may want to deploy hundreds of firewalls, vendors can’t charge vast sums per license,” Jefferson says. If they do, they “end up deploying bad things because they feel they can’t afford the licenses.”

Ultimately, in order to move security to a point where companies feel that cloud security is on a par with or better than on-premises security, both the deployment model and the licensing structure must be based on what works best for the application – not just what the licenses force a company to do.

Following genuine best practices in the cloud provides better security for an organization than pure on-premise environments, he says.

Related Content:

• 5 Ways to Get Ready for Public Cloud Deployment
• Azure Guest Agent Design Enables Plaintext Password Theft
• Microsoft Report: Cybersecurity’s Top 3 Threats Intertwine
• Who Does What in Cybersecurity at the C-Level

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/cloud/new-survey-illustrates-real-world-difficulties-in-cloud-security/d/d-id/1331352?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

BLACK HAT ASIA – Singapore – Nation-state threats dominated the themes of this week’s keynotes at Black Hat Asia, where experts dug into past and current cyberattacks, efforts to mitigate nation-state attacks, and the broad and evolving realm of cyber warfare.

Bill Woodcock, executive director at Packet Clearing House, took attendees back to the 1980s and 1990s, when the Internet was a closed community of interests and hadn’t yet gained popularity. At the time, cyberattacks were few and far between, he said in his day one keynote.

“We were doing it because it was fascinating,” he said. “Nobody thought there was any money in it … and because there weren’t a lot of security incidents back then, we had time to investigate.” By the mid-1990s, he continued, nation-state attacks on Internet service providers started to appear, coming from the US and Russian military.

Over time, incidents continued to escalate with Russia attacking Estonia in 2007, for example, and the United States’ 2009 Stuxnet attack against Iran. Cyber offensive military personnel adopted the strategy of buying zero-days and getting their lawyers to say nothing would go wrong. Their idea was to focus on offensive strategies at the expense of ignoring defense.

“We see it play out over and over,” Woodcock explained: militaries thinking they’re the smartest people in the room; believing they’ll be able to use the attacks they purchased any nobody will ever put it on them. “But none of that works out the way they think,” he added.

Nation-state attacks escalated, often with players targeting private-sector trust in tech vendors and the relationship between businesses and consumers. In the 2010 Flame attack, the US government impersonated a Microsoft certificate to claim a fake Windows update was legitimate. China’s 2011 attack on RSA stole SecurID two-factor authentication tokens, he noted.

Woodcock pointed to the grave implications of cyberthreats in the physical world with the 2015-2016 power grid attack targeting Ukraine’s critical infratstructure.

“It’s the kind of thing that causes lives to be lost, through accident or poor preparation,” he said. “As a modern society we’re not prepared to live without power for extended periods of time … saying cyber has no consequence – it’s a little late for that.”

The rapid growth of back-and-forth cyber events drove efforts to curtail attacks. In 1998, Russia proposed a treaty on cyber conflict, which made people skeptical because Russia had been the principal instigator for the problem, Woodcock pointed out. Between 2004 and 2017, there were five efforts to come up with a consensus about how cyberattacks should be addressed. By 2017 it was recognized that nothing was working, and a handful of countries were to blame.

The problem, he explained, was there were three nations, maybe four or five with the additions of Israel and Iran, which value their ability to attack other parts of the Internet more highly than the safety and economic stability of the Internet in their home countries.

“The US, Russia, and China don’t want to agree to any treaty that will limit their ability to conduct offensive cyber operations … because they would do it anyway, and then look bad for violating the treaty they signed,” Woodcock said. It’s tough to get countries to agree to a treaty, he continued, because they have to turn it into local law, which will be different in each place.

Changing the Game in Cyber Warfare

A reflection on past cyber operation efforts is interesting but does little to help build effective strategies for future attacks, said The Grugq, vice president of threat intelligence at Comae. “You can’t expect that what worked last time is going to work the next time,” he explained.

In his keynote on day two of Black Hat, the Grugq dug into the realm of cyber warfare, breaking several misconceptions people often have about fighting in cyberspace – for example, the idea that cyberwar is about skill. He compared cyber warfare with air warfare, noting how planes were created with maneuverability so skilled pilots could beat less-skilled pilots.

That’s not the way you win, he said. The way you win is showing up with more adversaries and overwhelming the target. “It’s not about skill. That doesn’t actually matter,” he emphasized.

Fighting cyberattacks is a team effort, said The Grugq, and teams should prioritize adaptability, agility, speed, creativity, and cohesion. It’s more effective to operate in small teams than in large “megateams.” Small teams provie a “range of capacity,” from elite workers to whose who rely on simple offensive attacks like large-scale phishing campaigns.

“Adaptability is the ability to take a new technology and exploit it for cyber conflict,” he explained, pointing to the example of Facebook as a weapon. “The US has proven itself as very good at developing new technologies, but they have been fairly poor at adapting those technologies for offensive purposes.”

Agility is the ability to take your current situation and make it where you want to be. With respect to speed, the teams with fewer meetings will be the teams who get ahead. Creativity is the ability to create new attacks based on those that exist, and cohesion is the ability to collaborate. The Grugq framed these traits in the context of different nation-states.

The DPRK, for example, has low agility and adaptability; they typically use attacks used by others in the past. They’re cohesive because they all do what their leader wants but they fall short on creativity by reusing the same attacks and copying others’ attacks.

China is “complicated and changing,” he continued. It has loose cohesion for security and deniability reasons, with low adaptability, medium speed, and mixed creativity.

Related Content:

• Criminals Using Web Injects to Steal Cryptocurrency
• 7 Ways to Protect Against Cryptomining Attacks
• Supply Chain Cyberattacks Surged 200% in 2017
• Critical Infrastructure: Stop Whistling Past the Cyber Graveyard

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/looking-back-and-thinking-ahead-on-cyberwar-nation-state-attacks/d/d-id/1331355?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Organizations today face an unprecedented volume of increasingly sophisticated threats as they conduct online operations. As the potential attack surface expands and attack volumes increase, it is imperative to track the most popular and successful strategies of cybercriminals to stay ahead of their malicious intentions.

The quarterly Fortinet Global Threat Landscape Report gathers the collective intelligence drawn from FortiGuard Labs’ large array of sensors deployed in live production environments. The research data in the most recent report focuses on three aspects of the threat landscape: application exploits, malicious software, and botnets. It also examines important zero-day vulnerabilities and infrastructure trends to add context about the trajectory of cyberattacks affecting organizations over time.

What the Data Reveals
Below are the key findings from the latest “Threat Landscape Report” that organizations need to know about in order to prepare for what’s ahead.

Application exploits, malicious software, and botnets:

• Historic Volume: The number of malware families detected in the fourth quarter of 2017 increased by 25% over the third quarter, to 3,317, and unique variants grew 19%, to 17,671. An average of 274 attacks per firm were also detected, a staggering increase of 82% over the previous quarter.
• Mining for Cryptocurrency: Cryptomining malware increased in the fourth quarter, which seems to be intertwined with the changing price of bitcoin. Cybercriminals recognize the growth in digital currencies and are using a trick called cryptojacking to mine cryptocurrencies on computers using CPU resources in the background without a user knowing. Cryptojacking involves loading a script into a web browser; nothing is installed or stored on the computer.
• Everything Old Is New Again: Steganography is an attack that embeds malicious code in images. The Sundown exploit kit uses steganography to steal information, and while it has been around for some time, it was reported by more organizations than any other exploit kit in the fourth quarter. It was found dropping multiple ransomware variants.
• A Ransomware Explosion: Ransomware continues to grow in both volume and sophistication. Several strains of ransomware topped the list of malware variants. Locky was the most prevalent malware variant, and GlobeImposter was second. A new strain of Locky emerged, tricking recipients with spam before requesting a ransom. In addition, there was a shift on the darknet from only accepting bitcoin for payment to other forms of digital currency.
• Swarm-Based Cyberattacks: The sophistication of attacks targeting organizations is accelerating at an unprecedented rate. For example, they are developing new Internet of Things (IoT)-based botnets with swarm-like capabilities that simultaneously target multiple vulnerabilities, devices, and access points.
• An Increase in IoT Attacks: Three of the top 20 attacks identified in the quarter targeted IoT devices. New IoT botnets such as Reaper and Hajime target multiple vulnerabilities simultaneously. This multivector approach is much harder to combat. In addition, Reaper’s new flexible framework, built around a Lua engine and scripts, means that Reaper’s code can be easily updated to swarm faster by running new and more malicious attacks as they become available. Exploit volumes associated with Reaper exhibited an early October jump from 50,000 to 2.7 million over just a few days, before dropping back to normal.
• Sophisticated Industrial Malware: An uptick in exploit activity against industrial control systems and safety instrumental systems suggests these under-the-radar attacks might be climbing higher on attackers’ radar. An example is an attack code-named Triton. It is sophisticated in nature and has the ability to cover its tracks by overwriting the malware itself with garbage data to thwart forensic analysis. Because these platforms affect vital critical infrastructures, they are enticing for threat actors. Successful attacks can cause significant damage with far-reaching impact.

Infrastructure trends:
When it comes to the cyber threat landscape, infrastructure statistics offer a powerful overview because strong correlations exist between infrastructure usage and threat frequency. For example, firms that use a lot of peer-to-peer and proxy apps report seven to nine times as many botnets and malware as those that don’t use them.

In the fourth quarter of 2017, firms also appear to have used more bandwidth and encrypted more web traffic than ever before, but they are actually visiting fewer sites and using fewer applications. There is also a special interest in keeping tabs on the ratio of HTTPS traffic in the network. It’s continuing to trend up.

While helpful for maintaining privacy, higher encryption rates also present challenges to threat monitoring and detection. Inspecting Secure Sockets Layer traffic has a significant impact on the performance of firewalls, which means it can affect the amount of network traffic that is actually being inspected. And organizations — especially those with higher HTTPS ratios — cannot afford to ignore threats that might be lurking within encrypted communications.

Best Practices for Stronger Security
With the volume, velocity, and variety of modern threats increasing, standalone point devices and platforms are rapidly becoming inadequate and ineffective. Organizations need a more unified approach that makes it practical for security teams, large or small, to achieve and maintain a competent security posture.

To protect the network against application exploits, malicious software, botnets, and zero-day vulnerabilities, organizations need to stay abreast of and track popular and successful threats. In addition, automated security measures can help pit swarm against swarm in order to effectively counter and repel an attack.

A unified defense posture can also help companies by detecting known and unknown threats at multiple layers throughout the environment. Growing your capability to detect and sever botnet communications at key choke points in your network is another solid strategy. Additionally, an internal network segmentation strategy will help detect and automatically contain all kinds of threats.

Looking back at data from 2017 reveals that to effectively combat today’s ever-evolving threats, you need to break down siloes and bring many security tools together for a collaborative approach that can help you see everything that’s coming at your network.

Related Content:

• 7 Key Stats that Size Up the Cybercrime Deluge
• Voice-Operated Devices, Enterprise Security the ‘Big Truck’ Attack
• Segmentation: The Neglected (Yet Essential) Control
• A Secure Enterprise Starts with a Cyber-Aware Staff

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Early Bird Rates Expire Friday March 23. Use Promo Code DR200 save $200 .

Derek Manky formulates security strategy with more than 15 years of cyber security experience behind him. His ultimate goal to make a positive impact in the global war on cybercrime. Manky provides thought leadership to industry, and has presented research and strategy … View Full Bio

Article source: https://www.darkreading.com/endpoint/looking-back-to-look-ahead-cyber-threat-trends-to-watch-/a/d-id/1331286?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple