SecureNet Consulting

How mobile 4G LTE internet can provide your Wi-Fi solution

noreply@blogger.com (Securenet Consulting) — Tue, 13 Dec 2022 12:20:00 +0000

How mobile 4G LTE internet can provide your Wi‑Fi solution

Internet Service Provider (ISP) speed too low? Don’t worry you can still get online – 4G or 5G can be the answer

Upgrading to managed switches will give you the network you want

noreply@blogger.com (Securenet Consulting) — Tue, 13 Dec 2022 12:12:00 +0000

Upgrading to managed switches will give you the network you want

Best mobile hotspot & usb c multiport adapter - essential mobile warrior kit

noreply@blogger.com (Securenet Consulting) — Tue, 29 Mar 2022 14:11:00 +0000

Essential mobile warrior kit - we look at some of the best and much needed mobile hotspot & usb-c multiport adapter gadgets to keep you connected.

Back on the road again - indispensable mobile hotspot & multi-hub port adaptor. Never be disconnected, ever again.

Hyperconverged Infrastructure: HCI benefits for workload mobility

noreply@blogger.com (Securenet Consulting) — Tue, 06 Oct 2020 12:01:00 +0000

Can HCI ease Hybrid IT (on-premise and cloud / multi-cloud) deployments and workload mobility

Organisations thinking about adopting or migrating to the cloud or are already using cloud need to think ahead to the future - for example optimising workloads across your hybrid environment (on-premise and external cloud systems). Enterprises already on the cloud model cite a number of concerns around the longevity, for example high long term costs of public cloud, coupled with the advancement of technology such as cloud-as-a-services for on-premise datacentres, have triggered strong interest in traditional hybrid and multi-cloud cloud alternatives.

The need for speed: why you need to arm your teams with AI now

noreply@blogger.com (Securenet Consulting) — Tue, 29 Sep 2020 14:45:00 +0000

Artificial Intelligence as part of your cyber-security strategy

Choosing the right disaster recovery for your business

noreply@blogger.com (Securenet Consulting) — Thu, 05 Mar 2020 14:29:00 +0000

Choosing the right disaster recovery for your business

Follow link to Computer Weekly article
https://www.computerweekly.com/feature/Choosing-the-right-disaster-recovery-for-your-business

By Paul Rummery, Securenet Consulting

Coronavirus: Remote Working

noreply@blogger.com (Securenet Consulting) — Thu, 05 Mar 2020 14:22:00 +0000

COVID-19 is a new virus that has not previously been observed in humans. According to data compiled by Johns Hopkins CSSE, there are currently over 91,000 confirmed cases across the globe.
The virus is now also disrupting businesses, who are reconsidering how they do business and the increasing value of remote work.

Google and Twitter told thousands of their employees to work from home as a precautionary measure to help stop the spread of the virus. Analysts believe that the coronavirus could lead to employee absenteeism as high as 40 percent, with severe operational consequences. In heavily infected areas, numerous workplaces have shut down altogether and public transportation is being avoided.

IT leaders must seriously think about the ability of their employees to productively work from home during an emergency.

Many will already have a business continuity plan in place, with tried and tested technologies and processes in place for just such an event. If not, its not too late to act and implement a working solution. Below we will cover some of these proven solutions, taking into account data security and systems that actual help improve business efficiency and savings on the long term bottom line.

Many of these solutions are not new, in fact you can provide your employees with secure access to their work files from home through a simple, familiar experience from their laptops, mobile devices, or a web interface using home internet access – mimicking the experience they have in the office.

Secure enterprise solutions make users more productive and gives IT complete control over business content to ensure security, maintain compliance, and enable BYOD.

Many of the solutions can be deployed and managed centrally either on-premise or private cloud.

Collaboration

File sharing - Your users want to access their data from wherever they are and they want to share that data with their peers in a simple manner. This is causing many organisations to struggle with security and IT compliance challenges as multi-device users are turning to consumer file sync services (Google, Box, DropBox...). Additionally, the move to flexible working is causing users to become frustrated with the complexity of accessing existing file storage locations from tablets, smartphones, and Macs.
The problem is, how do you deliver highly flexible, secure data access and sharing in a cost effective way?
File sync and share services are adapting to not only protect company data but to aid in remote workplace collaboration. Some file sync and share tools now provide users with tools to preview and edit files in-browser, search and find specific company documents and versions, and keep all employees on the same version of a document.

File sync and share features are now part of many cloud-based endpoint data backup solutions.

Endpoint backup

Centrally control the of backup data on endpoint devices (or laptops, smart phones and tablets). Access file, data storage and business applications either residing on your on-premise or cloud-based platforms.

File services anywhere – Organisations are beginning to see the workday less as a clock-in/clock-out office environment, and have adopted an environment that supports the various schedules and lifestyles of their employees. With secure file-sync and share, employees are no longer constrained to a single corporate-owned device to be productive. Files can be accessed and shared with anyone from any Windows, iOS, or Linux device. Users enjoy desktop access to any number of cloud-based folders and files, helping enterprises maximise productivity regardless of the physical storage on users’ laptops.

Secure file backup – File transfer with password, expiry times, download limits, and tracking. Data is backed up / replicated using built-in VPN, providing AES-256 encrypted access to the enterprise’s private cloud that no third party can access. Work from home or from the coffee shop: your files are protected, to address governance and compliance requirements.

Data loss prevention and disaster recovery – When corporate data is centrally stored, it’s better protected against data leakage. This includes data lost to a cyber attack, employee error, or a lost or stolen device. With an enterprise-grade file sync and share solution, sensitive corporate data is kept secure and protected.

Secure access

Remote work devices - There are two major considerations when it comes to devices. Either a) workers can use their own, which is a bigger security risk, but quite a bit cheaper and faster to deploy if their devices are up to the task, or b) a company can provide the devices that are needed. Given that the prevalence of Shadow IT (workers using unsanctioned, unofficial apps to get their work done) is generally higher than most enterprise IT departments are willing to admit -- meaning that company data is already on many personal devices anyway.

Many IT solutions will have inherent data security features built-in, which will actually serve to improve and mitigate otherwise risky traditional or legacy systems that in-office systems might still be using. The solutions we cover can either act as a secure layer over existing systems or once implemented, serve to replace and lend to a better, more efficient and secure way of working.

> Manage endpoint compliance
> Provide a seamless user experience and reduce user support
> Contextual Security and zero trust

Secure access control – In general, the worker should never do any work for the organization without the VPN on their device(s) being turned on. Typically this is provided by a virtual private network (VPN) solution, which sits on the PC, laptop, or mobile device and creates an encrypted network connection that makes it safe for the worker to access IT resources within the organisation and elsewhere on the Internet or other networks. To protect application servers and other resources from unauthorised access, organisations turn to strong authentication and authorisation. This requires the implementation of identity-based access controls.

Identity and Access Management (IAM) solutions help ensure this necessary asset protection while certifying regulatory compliance. This key technique is used to determine whether access should be granted to each individual client. These solutions must also support custom and standardised internal applications as well as Software-as-a-Service (SaaS) applications.

With built-in features like VPN, single sign-on and two factor authentication. Gateways can provide secure access to Virtual Apps and Desktops applications, giving users access to all applications and virtual desktops through a single URL. Many gateway solutions can be integrated with combined MDM solutions (Mobile Device Management) which allow a certain level of access to data from mobile devices (see below). IT administrators can apply contextual security policies to control access to applications based on the state and posture of the end user device, to strengthen access before the user reaches the backend resource.

Two Factor / Mutli Factor Authentication - Single factor authentication such as password authentication is in many cases no longer considered as secure, as users like to use "easy-to-remember" and hence "easy-to-guess" passwords.

Cyber attackers use countless techniques to get the information they need to hack into your enterprise applications. But nearly all of them ultimately break in using the same method – they take over legitimate user accounts using stolen or cracked user IDs and passwords.

Provide transparent two / multi factor authentication to keep hackers out while granting easy, friction-less access to legitimate users. 2FA fobs (hardware devices that provide PINs to further authenticate users) are inexpensive now. Workers can also use their mobile devices as a 2FA authenticator.

Mobile access – Secure Mobile app completes the continuum of simple user access, with full data control from any Android, iOS or Windows mobile device. Even if users use personal smartphones to work, the centralised Mobile Device Management (MDM) platform ensures complete data privacy. Access gateway and MDM solutions deliver data protection features;

* Enable easy on-boarding of devices, but granular control of access
* Prevent unauthorised devices connecting and copying data
* Control the use of corporate and non-corporate apps (shadow IT)
* Containerise corporate apps and data,
* Controls and blocks types of files, of a certain size or content. Assigns limits copying data, print, screen shot etc.
* Remote wipe can selectively delete only corporate app data (users personal data not touched).
* Troubleshoot device and app issues.
* Kill Pill: Built-in option 'Kill Pill' allows remote clearing of entire contents of device disk / container and block or change the password.
* DCR - Data Content Reporting gives you the ability to remotely inventory and make a detailed verification of the contents of USB drives.

Network efficiency and uptime

Many enterprise organisations will have global office with thousands of employees. Moving a large volume of people to remote working and access will present performance challenges to backend systems serving the applications and data in an efficient and user friendly manner. For example Video traffic is accelerating, and for home working, video meetings are key within team, suppliers, partners and customers. You must ensure seamless, high-quality delivery. Scale globally, but optimise to ensure the highest possible customer satisfaction.

Load-balancing and deduplication/network optimisation - technologies, which means your users don’t need high-powered home modems and internet connections to work productively.

Whether you host your applications and content on premises, in the cloud or in content delivery networks (CDNs), Intelligent Traffic Management allows you to globally load balance all traffic, dynamically optimizing the user experience and lowering service costs. Using real-time machine learning to direct user requests to the most suitable content source.

Deliver VDI (Virtual Desk Top) experience - Instead of building and operating your own infrastructure, you can simply deploy desktops on demand with a DaaS solution (Desktop-As-a-service). With DaaS, you manage your images and users, while the infrastructure is managed for you by a service provider, on a pay-as-you-go basis.

Anti scam, malware and phising attacks

Coronavirus scams are popping up everywhere. As you can imagine, there are a lot of email messages and websites sharing information about COVID-19. Because of this overwhelming amount of information that you will be getting through email and other channels, it’s a good time to brush up on phishing and malware attacks. Criminals always find opportunity in tragedy, and this is no different. So far, we've seen a handful of attackers posing as authorities and using the Coronavirus as the basis of a scam.

Some of the most common scams are fake cures and fake fundraising messages. The World Health Organization and the Better Business Bureau have warned against both of these. There are currently no U.S. Food and Drug Administration-approved vaccines, and when a cure or vaccine becomes available, you probably shouldn't try to purchase it through an email link or website.

On-premise and cloud managed content filtering solutions and services can track and block malicious content before reaching your endpoint devices, such as desktops and laptops. It is good practise to not rely on a single line of defense in these case, so implementing malware protection software on endpoint devices is advised. Protection policies can be managed centrally by your in-house IT team or trusted third party managed service security providers.

By Paul Rummery, Securenet Consulting

Wireless Mobility Solutions

noreply@blogger.com (Securenet Consulting) — Wed, 04 Mar 2020 16:31:00 +0000

By Paul Rummery, Securenet Consulting

Wireless Network offers a way to meet new network demands

Whether deployment is a campus, business, outdoor or smart cities wireless has you covered

High-performance, enterprise-class WLAN capable of handling all your voice / video / data traffic needs – scalable small and large deployments

With the latest Wi-Fi technologies including OFDMA, MU-MIMO, and software-defined dual 5 GHz radios, WiFi access points deliver uncompromising performance in the most demanding environments.

The Challenges

The rise in popularity of smartphones and tablets, combined with enterprise Bring Your Own Device (BYOD) programs in the workplace, has seen a dramatic demand for enterprise-grade Wi-Fi connectivity.

Broad adoption of wireless 802.11n has created a complex Wireless landscape with proliferating mobile devices and applications. It is no longer sufficient to treat all wireless users and applications alike.

BYOD means employees and people bringing non-controlled devices onto your network, which require access to corporate resources / data. But these devices often have many non-corporate ‘mobile apps’ enable the user to access online internet spaces via wireless or 4/5G, for example web mail, file sharing sites, social media like outlook, Google, Dropbox, Facebook…

Other consumer apps also require access to the devices contact lists, storage, pictures, files, and general device functionality.

Therefore you are presented with the problem of what happens to your data once someone has accessed you network with one of these devices.

Wi-Fi networks are not built the same: each wireless network has a unique set of capacity, coverage and performance requirements that grow and change with your business. Building and maintaining a high-performing, reliable network requires an understanding of the business requirements, the underlying Wi-Fi technology, as well as the overarching IT infrastructure.

When searching for a wireless access infrastructure solution, network leaders should look for the following key attributes:

Features & Benefits

> Latest Wi-Fi technologies provide support for demanding voice / video / data applications to enhance mobile worker productivity and convenience

> Better control over your network infrastructure, from wherever they are, at any time.

> No need for a local controller, reducing cost and complexity while streamlining network infrastructure.

> Increase Performance, Increase Security.

Wi-Fi 6 & 5G
Both 5G and Wi-Fi 6 bring a promise of dramatically better performance to mobile workers and the enterprise. Since they are complementary technologies, they will provide higher data rates to support new applications and increases in network capacity with the ability to connect more devices.

High efficiency, high capacity Wi-Fi that utilises the latest technologies to optimise and protect bandwidth in all environments.

Designed to address connectivity issues for high density networks, the new 802.11ax (Wi-Fi 6) standard improves the performance of the entire network. New features allow multiple clients to transmit simultaneously, increasing network capacity by up to 4 times compared to 802.11ac.

Cloud Driven
Combine the leading Wi-Fi hardware appliances with cloud management to simplify every aspect of IT operations from deployment to support.
Centralised management for multi-site and user deployments.
Access anywhere, configuration backup in the cloud.
24 / monitoring, alerts and reporting.

Machine Learning
Make the network work for you instead of the other way around with self-driving Wi-Fi powered by millions of actionable insights to continually adapt and adjust performance.

Role based group
Role-based grouping of users, devices, and applications to deliver priority, QoS, and security in accordance with business needs.

Unify wireless and wired
Multi-tenant structure allows deployment across multiple sites.

Advanced traffic reporting and data analysis tools provide business owners and IT professionals with real-time insights.

Create policies that leverage user roles, device profiling and authentication sources across any multi-vendor wireless and wired network environment.

WLAN (Wireless Access Points) Indoor & Outdoor /Industrial Access
Centrally managed wireless network access. Deploy wireless network access points to manage security and service / network performance.

Scan continuously for rogue sensors or unknown devices.

Automatically find, locate, optionally triangulate and block on the wire and wirelessly.

Quality of Service
Consistent protection, Bandwidth management, seamless roaming for Workflows and Applications (e.g. Voice of IP)

Identify and load-balance specific apps across access points, adjust roaming settings for latency-sensitive apps.

OFDMA allows many low-bandwidth streams to transmit in parallel, reducing latency and jitter. Reduced latency is an important requirement for some IoT, video, and factory automation applications that 802.11ax can now address.

Deployments Made Simple
Auto Provision, Auto Configure, Auto Optimise.

Dynamic Network Management
Reduce load on the WAN

Depending on the size of the WLAN deployment and how much data is carried over the network, significant congestion may result.

Network administrators can select how traffic will be handled, so that the wireless LAN infrastructure can adapt to business requirements and applications. A fully distributed deployment eliminates backhauling traffic to a wireless appliance but increases the processing complexity for real-time mobile applications that require seamless cross-subnet roaming (e.g. VoWLAN). This can force IT managers to either create a large broadcast domain or apply many VLANs.

Improve responsiveness and ensures that traffic does not unnecessarily traverse costly WANs or contribute to bottlenecks at aggregating switches.

Provides role-based policies providing security, NAC, mobility, and QoS priority that can be implemented on a per user and per application basis.

Deep network insight enabling smarter network management
Visibility / location analytics
Band/client steering, load balancing
Multi site, tiered / multi campus

Legacy devices will also see a benefit
Although legacy 11n and 11ac Wi-Fi devices won’t directly see any range or performance improvement of their connections to 11ax APs or wireless routers, they can see an indirect benefit. Remember, Wi-Fi is all about airtime: the faster any device is served, the more time there is for other devices. If newer technologies like MU-MIMO and OFDMA can help serve supported devices quicker, there's more airtime for other devices, including legacy ones.

Integrated Security

Protects against new threat vectors that tap into wireless access vulnerabilities.

Security and networking are tied together, changes to the network infrastructure automatically include changes to security.

Without appropriate threat protections in place, organisations place their customers, employees, and business partners at risk when they use access points. In addition, applications and sensitive data must be fully protected to comply with regulations, for example Health Insurance Portability and Accountability Act (HIPAA) to the Payment Card Industry Data Security Standard (PCI DSS). And organisations must demonstrate that compliance through tracking and reporting.

From a network perspective, a wireless access solution should feature plug-and-play deployment and ease of management. Core capabilities include application security, visibility, and control across on-premises and cloud infrastructures. Management of access points should also be integrated into the broader security architecture. In addition to improving efficiencies and minimising the number of manual touch points, this architectural approach improves an organisation’s security posture. This ensures that wireless access points are visible from a centralised console and that threat intelligence can be shared with and from other security areas in real time.

Intrusion Prevention System (IPS), full packet inspection, adaptive signature pattern matching, protocol analysis, and behavioral anomaly detection are delivered for both wired and wireless users. Identity based policy privileges are unified across the wired and wireless infrastructure to deliver role-based access control – regardless of connectivity method.

Network Access Control
Define security policies based on users, device type, ownership, location and schedules.

Businesses can now support BYOD or allow guest access while ensuring highest levels of network security.

Remote and Public Wireless / WiFi security

Enforce authorisation and encryption on open (public) networks

Wi-Fi hotspots are a convenient means for remote employees and professionals who travel to stay connected to enterprise resources. Unfortunately, many of these hotspots are vulnerable to a variety of cyber threats and man-in-the-middle attacks.

Ensure that each guest sessions is encrypted and thus invisible to anyone trying to sniff Wi-Fi packets.

Wireless Authentication / On-boarding
Certificate-based network access ensures safe, encrypted wireless access.

Some example use cases

Guest Wi-Fi Portal/Hotspot Support

Easy customisation options for guest portals include authentication, hotspot setup, and the ability to use your own external portal server. Apply different bandwidth rates (download/upload), limit total data usage, and limit duration of use.
All Wi-Fi APs include hotspot functionality:

Built-in support for billing integration using major credit cards.
Built-in support for voucher-based authentication.
Built-in hotspot manager for voucher creation, guest management, and payment refunds.
Full customisation and branding of hotspot portal pages.

Temporary installations = deploy mesh models for outdoor installations requiring quick setup and takedown, such as a street fair, music festival, or concert venue.

Light-Up Branch Offices Faster
Cloud-based and managed wireless network controller, and 'zero-touch' pre-configured wireless access points enable instant connectivity and access for new branch offices faster.

Remote User Wireless Access Points For at home and on the road workers

Pre-configured / plug and play remote network (WLAN) access points
Allow you to ship pre-configured APs to remote employees.
Issue to road-warriors, executives or employees working from a home office,
Shipping pre-provisioned APs allows you to save time and reduce helpdesk calls by eliminating the need to assist remote users with network access problems.

Once plugged in, the AP (access point) automatically discovers your enterprise wireless controller over the Internet, downloads its configuration and broadcasts the same wireless SSIDs used in the corporate office.

Acting as an extension of the corporate LAN, this enables remote employees to seamlessly gain secure encrypted network access to the enterprise, without the need to configure or manage complex client VPN connections.

Run presentations straight from your laptop or tablet via wireless direct to board room screen

Power savings from owning and running less equipment (no projector equipment)

Kr00k vulnerability

noreply@blogger.com (Securenet Consulting) — Wed, 04 Mar 2020 11:39:00 +0000

New Kr00k vulnerability enables attackers decrypt WiFi packets

Audio Visual Solutions

noreply@blogger.com (Securenet Consulting) — Sun, 13 Oct 2019 12:33:00 +0000

Connect remote users and collaborate with ease: Audio Visual solutions

RANSOMWARE: StalinLocker deletes data if you don't enter the right code in time

noreply@blogger.com (Securenet Consulting) — Fri, 18 May 2018 08:40:00 +0000

StalinLocker Ransomware gives you ten minutes to comply.

Ransomware is under development that gives victims 10 minutes to enter a code and will delete the contents of a hard drive in the event of failure.

StalinLocker deletes data if you don't enter the right code in time.
Ransomware is under development that gives victims 10 minutes to enter a code and will delete the contents of a hard drive in the event of failure.

When the malware is run, it plays the Soviet national anthem, which is copied to the %UserProfile%\AppData\Local
As an mp3 file.

The malware will also copy itself to the same folder as stalin.exe. It then creates an autorun file called Stalin which, when run, locks the screen and starts off the wiping process.

Also created is %UserProfile%\AppData\Local\fl.dat. This decreases the time left to enter a code each time the computer is restarted.

It also attempts to taskmgr.exe and explorer.exe but leaves Skype or Discord alone. Also created is a scheduled task called "Driver Update" that launches Stalin.exe.

When infected the malware shows a lock screen and a 10-minute timer. Victims are expected to enter a code, which is calculated by subtracting the date 30/12/1922 from the current date. If the correct code is entered, StalinLocker exits and deletes the autorun.

Should a victim fail to enter the code by the time the countdown reaches zero, the malware deletes all files on each drive attached to the computer.

The malware came with “no money demand, no contact, nothing”. They added that the malware is “not a variant of anything known” and was first seen some days ago.
They said that if a user gets infected, “best thing he can do is shutdown PC and contact someone who can clean”.

“For the average end user they will neither have the time or the inclination to find and enter the correct code, so the file wipe will almost certainly be a done deal. Their only protection is going to be good multi-layered internet security software that will detect and delete the offending malware,” he said.

These kinds of attacks aren't necessarily for profit, the impact is no less. Therefore, enterprises should take all these threats just as serious and invest in security controls that can detect such attacks, so that the appropriate measures can be taken.

CONTACT: paul@securenetconsulting.co.uk

Credit: MalwareHunterTeam, SCmedia

New HNS Botnet

noreply@blogger.com (Securenet Consulting) — Thu, 25 Jan 2018 08:18:00 +0000

New Hide ‘N Seek IoT Botnet spotted in the wild

New Hide ‘N Seek IoT Botnet using custom-built Peer-to-Peer communication spotted in the wild.

Bitdefender researchers have uncovered an emerging botnet that uses advanced communication techniques to exploit victims and build its infrastructure. The bot, dubbed HNS, was intercepted by our IoT honeypot system following a credentials dictionary attack on the Telnet service.

The bot was first spotted on Jan. 10 then faded away in the following days, only to re-emerge on Jan. 20 in a significantly improved form.

Impact

The HNS botnet communicates in a complex and decentralized manner and uses multiple anti-tampering techniques to prevent a third party from hijacking/poisoning it. The bot can perform web exploitation against a series of devices via the same exploit as Reaper (CVE-2016-10401 and other vulnerabilities against networking equipment).

The bot embeds a plurality of commands such as data exfiltration, code execution and interference with a device’s operation.

Operation

The bot features a worm-like spreading mechanism that randomly generates a list of IP addresses to get potential targets. It then initiates a raw socket SYN connection to each host in the list and continues communication with those that answer the request on specific destination ports (23 2323, 80, 8080). Once the connection has been established, the bot looks for a specific banner (“buildroot login:”) presented by the victim. If it gets this login banner, it attempts to log in with a set of predefined credentials. If that fails, the botnet attempts a dictionary attack using a hardcoded list.

Once a session is established with a new victim, the sample will run through a “state machine” to properly identify the target device and select the most suitable compromise method. For example, if the victim has the same LAN as the bot, the bot sets up TFTP server to allow the victim to download the sample from the bot. If the victim is located on the internet, the bot will attempt a specific remote payload delivery method to get the victim to download and run the malware sample. These exploitation techniques are preconfigured and are located in a memory location that is digitally signed to prevent tampering. This list can be updated remotely and propagated among infected hosts.

The samples identified in our honeypots on Jan. 10 revolved around IP cameras manufactured by a Korean company. These devices seemed to play a major role in the botnet as, out of the 12 IP addresses hardcoded in the sample, 10 used to belong to Focus H&S devices. The new version, observed on Jan. 20, dropped the hardcoded IPs.

Like other IoT bots, the newly discovered HNS bot cannot achieve persistence, and a reboot would bring the compromised device back to its clean state. It is the second known IoT botnet to date, after the notorious Hajime botnet, that has a decentralized, peer-to-peer architecture. However, if in the case of Hajime, the p2p functionality was based on the BitTorrent protocol, here we have a custom-built p2p communication mechanism.

UDP communication mechanism

The bot opens a random port on the victim, and adds firewall rules to allow inbound traffic for the port. It then listens for connections on the open port and only accepts the specific commands described below. Our initial look at the sample revealed an elliptic curve key inside the file that is used to authenticate the command which updates the memory zone where configuration settings are stored, to prevent infiltration or poisoning attempts against the botnet.

Conclusions

While IoT botnets have been around for years, mainly used for DDoS attacks, the discoveries made during the investigation of the Hide and Seek bot reveal greater levels of complexity and novel capabilities such as information theft – potentially suitable for espionage or extortion.

It is also worth noting that the botnet is undergoing constant redesign and rapid expansion.

credit: BitDefender

news: Intel testing new Spectre fixes, tells everyone to hold off on deploying current firmware updates

noreply@blogger.com (Securenet Consulting) — Tue, 23 Jan 2018 10:28:00 +0000

Intel tells everyone to hold off on deploying current firmware updates

Shortly after Red Hat stopped providing microcode to address variant 2 (branch target injection) of the Spectre attack, Intel has advised OEMs, cloud service providers, system manufacturers, software vendors and end users stop deployment of current firmware updates that fix the same vulnerability (CVE-2017-5715).

Red Hat’s decision
“Red Hat is no longer providing microcode to address Spectre, variant 2, due to instabilities introduced that are causing customer systems to not boot. The latest microcode_ctl and linux-firmware packages are reverting these unstable microprocessor firmware changes to versions that were known to be stable and well tested, released prior to the Spectre/Meltdown embargo lift date on Jan 3rd,” Red Hat announced last week.

The microcode that Red Hat stopped providing is not of their making. These patches are provided and developed by CPU makers (Intel, AMD, Arm, etc.).

“The microcode that was supplied to us did not cover all of the microprocessors that our customers possibly could use. It appears, subsequently, there may have been two versions that could have some regressions,” Christopher Robinson, product security manager at Red Hat.

Intel’s update on the situation

And now Intel instructed all customers to hold off on deploying current versions of the firmware updates, “as they may introduce higher than expected reboots and other unpredictable system behavior.”

“We have now identified the root cause for Broadwell and Haswell platforms, and made good progress in developing a solution to address it. Over the weekend, we began rolling out an early version of the updated solution to industry partners for testing, and we will make a final release available once that testing has been completed,” Navin Shenoy, Intel VP and general manager of the Data Center Group at Intel Corporation, announced on Monday.

He asked industry partners to focus efforts on testing early versions of the updated solution so Intel can accelerate its release.

Intel also provided a handy table that shows which microcode updates should be avoided, depending on the underlying processors.

HP has reacted quickly to the announcement and removed system ROMs that include impacted microcodes from the HPE Support Site. They advised users to revert to earlier System ROM versions while they wait for new ones that include new Intel microcodes.

news: Sensitive medical records on AWS bucket found publicly accessible

noreply@blogger.com (Securenet Consulting) — Tue, 23 Jan 2018 10:25:00 +0000

A large cache of sensitive medical records handled by a US-based digital records management company was found stored in an Amazon S3 storage bucket without adequate protection.

The storage bucket containing sensitive medical records could be accessed by anyone possessing the unique URL name associated with the bucket. According to security researchers, there are proprietary tools available in the market that can decipher unique URL names associated with Amazon S3 storage buckets.

While conducting their investigation, the researchers noted that the said medical records were stored in a large PDF file which in turn was stored in an Amazon S3 storage bucket. Using a proprietary tool, the researchers were able to obtain the unique URL name associated with the bucket, thereby bypassing AWS' data encryption. Using this technique, they were also able to copy direct links to files and folders that could be accessed via the link.

'The unfortunate part of so many patient records being exposed is that it was likely a human error and not a malicious actor or cyber-criminal,'.

'The repositories contained a wide range of sensitive details about patients that are protected under HIPAA laws. HIPAA violations can carry large financial penalties in the event of willful neglect or purposely leaking patient information online,'

RubyMiner Monero Cryptominer affected 30% of networks worldwide in only 24 hours

noreply@blogger.com (Securenet Consulting) — Thu, 18 Jan 2018 10:51:00 +0000

Security researchers have spotted a malware family dubbed RubyMiner that is targeting web servers worldwide in an attempt to exploit their resources to mine Monero cryptocurrency.

RubyMiner, was first spotted last week when a massive campaign targeted web servers worldwide, most of them in the United States, Germany, United Kingdom, Norway, and Sweden.

The experts believe that a single lone attacker is behind the attacks, in just one day he attempted to compromise nearly one-third of networks globally.

“In the last 24 hours, 30% of networks worldwide have experienced compromise attempts by a crypto-miner targeting web servers.” read the analysis from Check Point.

“During that period, the lone attacker attempted to exploit 30% of all networks worldwide to find vulnerable web servers in order to mobilize them to his mining pool. Among the top countries targeted are the United States, Germany, United Kingdom, Norway and Sweden, though no country has gone unscathed.”

Having entered 2018, it seems that actors are again attempting to recruit any available machine for the sole purpose of self-profit. What was previously seen as a minor annoyance has turned into a huge wave of attack attempts across the globe, for it seems attackers are no longer satisfied with just personal computers and are now targeting powerful web servers to increase their computational resources.

With a new attack vector, aiming to install a Monero miner on web servers, the attacker in this case was looking to get more bang for his buck by using the extended computation power of web servers.

Surprisingly, by using old vulnerabilities published and patched in 2012 and 2013, it doesn’t seem that stealth was part of the attacker’s agenda either. Instead, the attacker chose to exploit multiple vulnerabilities in HTTP web servers, to distribute an open source Monero miner – XMRig.

In fact, XMRig usually sends a donation of 5% of the revenue gained from the mining process to the code’s author. However, even this amount was too much for the attacker to part with as that ‘donation element’ was deleted from the code, giving the enthusiast 100% of the profit.

Up to the moment of publication, approximately 700 servers worldwide have been successfully enslaved to this mining pool, making our villain for now only $540 richer…but this is just day one.

Credit: Check Point

Hackers Exploit Three Microsoft Office Flaws to Spread Zyklon Malware

noreply@blogger.com (Securenet Consulting) — Thu, 18 Jan 2018 10:09:00 +0000

Security researchers have spotted a new malware campaign in the wild that spreads an advanced botnet malware by leveraging at least three recently disclosed vulnerabilities in Microsoft Office.

Dubbed Zyklon, the fully-featured malware has resurfaced after almost two years and primarily found targeting telecommunications, insurance and financial services.

Active since early 2016, Zyklon is an HTTP botnet malware that communicates with its command-and-control servers over Tor anonymising network and allows attackers to remotely steal keylogs, sensitive data, like passwords stored in web browsers and email clients.

Zyklon malware is also capable of executing additional plugins, including secretly using infected systems for DDoS attacks and cryptocurrency mining.

Different versions of the Zyklon malware has previously been found being advertised on a popular underground marketplace for $75 (normal build) and $125 ( Tor-enabled build).

According to a recently published report by FireEye, the attackers behind the campaign are leveraging three following vulnerabilities in Microsoft Office that execute a PowerShell script on the targeted computers to download the final payload from its C&C server.

1) .NET Framework RCE Vulnerability (CVE-2017-8759)—this remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, allowing an attacker to take control of an affected system by tricking victims into opening a specially crafted malicious document file sent over an email. Microsoft already released a security patch for this flaw in September updates.

2) Microsoft Office RCE Vulnerability (CVE-2017-11882)—it’s a 17-year-old memory corruption flaw that Microsoft patched in November patch update allows a remote attacker to execute malicious code on the targeted systems without requiring any user interaction after opening a malicious document.

3) Dynamic Data Exchange Protocol (DDE Exploit)—this technique allows attackers to leverage a built-in feature of Microsoft Office, called DDE, to perform code execution on the targeted device without requiring Macros to be enabled or memory corruption.

As explained by the researchers, attackers are actively exploiting these three vulnerabilities to deliver Zyklon malware using spear phishing emails, which typically arrives with an attached ZIP file containing a malicious Office doc file.

Once opened, the malicious doc file equipped with one of these vulnerabilities immediately runs a PowerShell script, which eventually downloads the final payload, i.e., Zyklon HTTP malware, onto the infected computer.

"In all these techniques, the same domain is used to download the next level payload (Pause.ps1), which is another PowerShell script that is Base64 encoded," the FireEye researchers said.

"The Pause.ps1 script is responsible for resolving the APIs required for code injection. It also contains the injectable shellcode."

"The injected code is responsible for downloading the final payload from the server. The final stage payload is a PE executable compiled with .Net framework."

Interestingly, the PowerShell script connects to a dotless IP address (example: http://3627732942) to download the final payload.

What is Dotless IP Address? If you are unaware, dotless IP addresses, sometimes referred as 'Decimal Address,' are decimal values of IPv4 addresses (represented as dotted-quad notation). Almost all modern web browsers resolve decimal IP address to its equivalent IPV4 address when opened with "http://" following the decimal value.

For example, Google's IP address 216.58.207.206 can also be represented as http://3627732942 in decimal values (Try this online converter).

The best way to protect yourself and your organisation from such malware attacks are always to be suspicious of any uninvited document sent via an email and never click on links inside those documents unless adequately verifying the source.

Most importantly, always keep your software and systems up-to-date, as threat actors incorporate recently discovered, but patched, vulnerabilities in popular software—Microsoft Office, in this case—to increase the potential for successful infections.

36 malicious apps advertised as security tools spotted in Google Play

noreply@blogger.com (Securenet Consulting) — Wed, 10 Jan 2018 09:33:00 +0000

The malicious apps were advertised under names such as Security Defender, Security Keeper, Smart Security, Advanced Boost, and other cyber-security sounding names, but their true purpose was to steal user information and bombard them with ads, according to Trend Micro blog post.

Many of the apps boost a variety of features such as scanning, cleaning junk, saving battery, cooling the CPU, locking apps, as well as message security, and WiFi security. While the apps are actually able to perform the advertised tasks, they also secretly harvest user data, tracked user location, and aggressively pushed advertisements on nearly every action a user performs.

The apps collect information such as the user's Android ID, Mac address, IMSI, information about the OS, brand and model of the device, device specifics, language, location information, and data on installed apps like Google Play and Facebook to sends to a remote server. The malware is also capable of uploading installed app information, as well as attachments, user operational information, and data on activated events as well.

When the apps are first launched they won't appear on the device launcher's list of applications, shortcuts will also not appear on the device screen and users will only be able to see notifications sent by the apps.

The “hide” function is designed to not run on specified devices including the Google Nexus 6P, Xiaomi MI 4LTE, ZTE N958St and LGE LG-H525n, presumably to avoid being checked by Google Play during inspection periods, researchers said.

Once installed, users are bombarded with false security notifications and other messages from the malware while the app is running. Most of the notifications are false although they are designed to be believable. Notifications include“10.0 GB files are being wasted” or “Fraud SMS Broadcast Vulnerability” which will prompt some kind of action.

If a user clicks the displayed button on the prompt the app will show a simple animation illustrating that the problem was resolved. In addition to the security prompts, users are bombarded with different advertisements in many different scenarios such as after the app sends notices to unlock the device screen or if the user is told to connect to a charger.

“Users are actually asked to sign and agree to a EULA (end-user license agreement) which describes the information that will be gathered and used by the app,” researchers said in the report. “But we can still say that the app abuses privacy because the collection and transmission of personal data is unrelated to the functionality of the app.”

Researchers spotted the malicious apps in December 2017 and said the apps have since been removed by the time the blog was written. In order to secure and protect devices, researcher recommend users keep their devices updated, download apps from trusted sources and check reviews or comments on app pages to ensure the apps are legitimate regardless of the source.

Microsoft Office memory corruption vulnerability and 16 critical flaws

noreply@blogger.com (Securenet Consulting) — Wed, 10 Jan 2018 09:10:00 +0000

Patch Tuesday updates for 2018. This included fixes for a total of 56 CVEs affecting Microsoft Windows, Microsoft Office, Internet Explorer, Microsoft Edge, ChakraCore, ASP.NET, and the .NET Framework. One flaw has been exploited.

Of these 56 vulnerabilities, 16 were ranked Critical, 38 Important, one Moderate and one Low severity. Today's release includes guidance for mitigating speculative execution side-channel vulnerabilities following the news of Meltdown and Spectre attacks.

The exploited bug patched today, CVE-2018-0802, is a Critical remote code execution vulnerability in Microsoft Office that exists when software doesn't properly handle objects in memory. An attacker who successfully exploited this could run code in the context of the current user, which would let them install programs, view and edit data, or create new accounts with full user rights. It's more dangerous for victims with administrative rights.

Exploitation would require a user to open a specially crafted file with an affected version of Microsoft Office or WordPad. A threat actor could conduct a phishing attack by sending the file via email and convincing the target to open it. In a web-based attack, the attacker could host a website (or compromise a website) with a file to exploit the Office bug.

Crypto Miners The Silent CPU Killer

noreply@blogger.com (Unknown) — Fri, 05 Jan 2018 11:34:00 +0000

Crypto Miners The Silent CPU Killer

The Pirate Bay, the world’s largest BitTorrent indexer, is a massive online source for digital content– movies, games and software—and is among the top 100 most popular websites globally, according to Alexa. No stranger to controversy for its role in illegal downloads, a few weeks ago it was discovered that The Pirate Bay operators have begun using the website users’ computer resources to mine the Monero cryptocurrency, using a hidden JavaScript-based miner called CoinHive.

Until recently, websites that provide free services earned almost all their revenue through advertisements. Is the Pirate Bay example signaling that cryptocurrency mining may soon take over as the main revenue source?

How does the rising popularity of cryptocurrency miners affect the cyber security landscape? In which cases is it a legitimate tool, and in which is it considered malware? In this report, we will answer these questions.

The first cryptocurrency that gained popularity and triggered the growth of the market and mining communities was BitCoin – the first decentralized coin. As time passed and BitCoin mining gained popularity, the computational resources required in order to stay in the game grew higher. The use of specialized hardware made it even harder for miners that used personal computers, be it threat actors using malware or solo miners, at a certain point, mining BitCoin and other leading cryptocurrencies such as Ethereum became non-profitable, taking into consideration the costs of the hardware and electricity. At this point, new miners entered the game – the new miners required far less CPU resources as they were a lot less popular and were mined by much smaller communities. Some of them, such as Monero, attempted to outgrow BitCoin by avoiding the coin’s biggest flaw – the lack of privacy. Naturally, new cryptocurrencies led to new crypto miners – both tools for the mining community, and malware.

Nowadays, a new use for crypto mining tools is taking over the internet – Javascript-based mining tools, which can be injected into popular websites both by the website owners and by threat actors.

The Birth of Crypto Miners, and Crypto Cyber Campaigns

The rising popularity of cryptocurrency, for both purchasing and for mining, has led to a significant growth of the mining community and cryptocurrency market worldwide. These in turn have produced a new kind of tool used to generate revenue: Crypto Miners.

While the term ‘crypto miner’ refers to tools that are available online, and can be used by the mining community, tools used by malicious actors upon infection are called ‘crypto mining malware’.

As with any new technology or advancement that has potential gain in it, the birth of cryptocurrencies also became a fertile ground for financially motivated cyber actors. To avoid the costs of expensive hardware, cybercriminals infect multiple systems in order to consume the victims’ CPU or GPU power and existing resources for crypto mining. By using different attack vectors, such as spam campaigns and Exploit Kits, they are able to turn the infected machines into troops of cryptocurrency miners.

Cryptocurrency mining is a computationally intensive task which requires powerful resources from specialized hardware and dedicated processors, and incurs significant electricity costs and investments in hardware. The BitCoin network generates a new block every 10 minutes, regardless of the number of active miners. This means that the entrance of new miners into the game does not necessarily accelerate the mining process, but may actually slow it down, as this increases the complexity of the mining operation.

As expected, the first cryptocurrency miners were designed to mine BitCoin, and emerged in 2011, shortly after BitCoin began gaining attention and popularity. One such miner was the Otorun worm. The infamous Kelihos, one of the largest botnets which was taken down by the FBI in April 2017, was also used for BitCoin mining. The recent development of tens of new cryptocurrencies has led to a variety of new crypto miners, with each one designed to mine a specific currency. All of the crypto miners leverage their victims’ computer resources, causing the infected machines to run abnormally slow.

Miners for the ‘Ethereum’, ‘Zcash’ and ‘Dogecoin’ currencies can currently be observed in the wild, though some sources say that mining these currencies using personal computers, even if a large number of bots is involved, is no longer profitable. Without a doubt, the top currency mined by threat actors these days is the Monero currency (see Appendix).

Crypto miners’ growing role in the treat landscape

Let’s take another look at the Pirate Bay Monero Miner case, and review the concerning role of web-based crypto miners in the treat landscape.

Currently, websites which do not provide paid services rely on advertisements for revenue. Many websites are loaded with ads, which heavily impact the user experience and accessibility of the actual content. Replacing the ads with a crypto miner, which uses a limited percentage of the CPU power of the website users, can be a good trade-off for website owners – it generates revenue for the owners and provides an improved and less intrusive experience for the end users.

The use of a web crypto miner such as CoinHive is as simple as it gets – the service provides a JavaScript which can be loaded into a website. When users access the website, the script mines the Monero currency based on the users’ CPU resources.

However, the security community must remain alert in light of such developments, as the crypto miners would have a clear interest to increase the percentage of the computer resources consumed, and perhaps even leverage their access and elevate their privileges over the users’ machines.

The Pirate Bay case immediately made headlines and led to a stream of customer questions and complaints. An online search for similar cases yielded no results. Does this mean The Pirate Bay case is an outlier, or is it actually just one of many examples of a trend currently flying under the radar?

An investigation conducted by Check Point researchers reveals that cryptocurrency miners have knowingly been injected into some top websites, mostly media streaming and file sharing services, without notifying the users. According to our research, those miners regularly use as much as 65% of the end-users’ CPU power.

Example 1: Uptobox.com is a file hosting service ranked 70 in France and 672 globally according to Alexa. The website uses its users’ CPU power to mine the Monero cryptocurrency without notification.

Example 2: Vidzi.tv is a video sharing service ranked 659 in the US and 788 globally. The website uses its users’ CPU power to mine the Monero cryptocurrency without notification.

Using movie streaming websites for mining is the ultimate way to consume clients’ computer resources while remaining under the radar. Normally, users select their preferred content and watch the movie, leaving the browser unmonitored for at least an hour. It’s easy and convenient, and the top movie streaming websites can generate some fine revenue for the operation’s owners.

The CPU Usage of an ordinary laptop while accessing the movie streaming service WatchFree.to, ranked 1,076 in the US and 1,625 by Alexa. The overall CPU usage of the machine while accessing the website is 69%.

The brains behind such an operation can be either the website owners themselves who want to generate revenue without resorting to copious advertisements, or threat actors who inject a code to enable the mining activity via a popular website’s user base.

The above example demonstrates the use of a separate JavaScript file for the mining operation. In the example below, we see how to inject the CoinHive Monero miner into a webpage, which is most likely done by the website owner.

uptostream.com is a movie streaming service, ranked 573 in France and 7,698 globally. This service mines the Monero currency while using its users’ computer resources without notification.

When we examine the integration of the cryptocurrency miner into the vidzi.tv page, we can see the use of a non-official method – one that is different than the one CoinHive offers for use on their official website. This page was most likely compromised by malicious actors and was surreptitiously injected with the miner.

The injection of the CoinHive Monero miner into vitzi.tv, using a non-official method

The examples presented above are only a few out of tens of cases observed during one week of research in September 2017. Each of these examples demonstrates a different way to integrate the miner into the website. All of them consume a significant percentage of CPU power, yet only in some cases can the percentage and number of threads be controlled by the website owner. Some websites were found to be related to each other, which may imply that an organized mining operation is taking place. In other cases, inactive domains, which according to Alexa remain highly popular, were found to be mining cryptocurrency. This might mean that several other websites are silently redirecting their users to this page.

The Case of the Adylkuzz Monero Miner

One of the most noticeable cryptocurrency miners of 2017 is Adylkuzz, a malware which mines the Monero currency on its victims’ machines. While it may have been active in late April or early May, Adylkuzz notably emerged on May 15, 2017, only three days after the start of the global spread of the WannaCry ransomware campaign. Adylkuzz shares some similarities with WannaCry. It uses the EternalBlue exploit, which was made available to the public as part of the Shadow Brokers hacking group leak of NSA tools, to locate vulnerable machines and spread laterally within infected networks. It also uses the DoublePulsar backdoor to install its payload. Interestingly, an Adylkuzz attack shuts down SMB networking to prevent infection with other malware. Therefore, the Adylkuzz attack may have had an effect on the WannaCry ransomware spread. The close proximity of these two large-scale campaigns and the publicity gained by the WannaCry ransomware may have caused the Adylkuzz attacks to be attributed to WannaCry. What we saw in Adylkuzz demonstrates that cryptocurrency miners are now using similar attack vectors and increasing their share of the cyber landscape.

An examination of the malware’s infection statistics through the Check Point ThreatCloud shows that Adylkuzz had a clear spike in its attack rate right when it first emerged and in parallel to the WannaCry campaign. It is still active.

Adylkuzz Malware Activity – The graph presents the Adylkuzz malware’s attack rate as of May 15, 2017

As the WannaCry ransomware and Adylkuzz miner campaigns, which use similar tools and techniques, began at the same time, they are believed to share similar targets. The top countries attacked by WannaCry include Russia, Ukraine, India and Taiwan.

Now, let’s examine the top countries infected by Adylkuzz malware:

As shown above, Adylkuzz targets are spread all over the world, with no clear orientation to a specific region.

WannaCry had no predefined targets. The ransomware was spread to a random C-Class IP range, while seeking vulnerable public facing SMB ports against which it could leverage the EternalBlue exploit. Therefore, we can estimate that Adylkuzz was spread in a similar way.

Summary

According to CNBC, as of August 2017, the cryptocurrency market was worth about $141 billion. While BitCoin was the first prominent cryptocurrency accepted by online markets and used by cybercriminals, today, tens of cryptocurrencies are widely used for both legitimate purposes, and by threat actors for non-legitimate and often fraudulent purposes.

The popularity of the various currencies among cryptocurrency miners is determined mostly based on the profitability that lies in mining the coin. As the use of a digital currency rises, so does the need to mine it. This is why in recent months we see an increase in the number of Crypto Mining malware campaigns making headlines.

The Adylkuzz campaign’s use of EternalBlue and DoublePulsar highlights another increasing trend: Crypto Mining malware leveraging attack tools and vectors used by other malware and threat actors.

As the public is not yet fully aware of the prevalence of this new malware type, it is often harder to detect, as was the case of Adylkuzz and WannaCry. We have no doubt that a new, silent yet significant actor, has slowly entered the threat landscape, letting threat actors monetise while victims’ endpoints and networks suffer from latency and decreased performance. This new threat is here to stay.

News: Linux Monero crypto-miner botnet dubbed PyCryptoMiner spreading over the SSH protocol

noreply@blogger.com (Securenet Consulting) — Fri, 05 Jan 2018 10:27:00 +0000

PyCryptoMiner, a new Linux-based botnet is spreading over the SSH protocol.

On Wednesday, researchers from F5 Networks revealed their findings on PyCryptoMiner, a new Linux-based botnet which is spreading over the SSH protocol.

The botnet is based on the Python scripting language which allows for obfuscation and appears to be "spreading silently," according to the team.

PyCryptoMiner is also executed by a legitimate binary, which may be an interpreter shipped with the majority of Linux and Windows distributions.

F5 Networks says that the botnet scans for potentially vulnerable Linux machines and guesses SSH login credentials -- a practice made simple if victims use basic, easy-to-crack phrases and letter combinations.

Once scanning is complete, the botnet deploys a simple base64-encoded spearhead Python script which connects to a command-and-control (C&C) server to be issued additional commands and execute other Python payloads.

If the original C&C server is down, the botnet trawls through Pastebin to find new assignments.

Rather than hardcoding a C&C address into the system, the botnet's creator publishes alternative addresses through the Pastebin website, increasing the potential longevity of PyCryptoMiner.

"Many of these adversaries use "bullet-proof" hosting services, however, a more sophisticated approach that attackers are now using is public file hosting services like Dropbox.com and Pastebin.com, which cannot be easily blacklisted or taken down," the researchers say. "This technique also allows the attacker to update the address of the C&C server whenever they need to."

The threat actor works under the Pastebin username "WHATHAPPEN," and this name has been linked to a number of C&C servers as well as the online identity "Xinqian Rhys."

The registrant has been connected to over 36,000 domains, some of which are associated with scams, gambling, and adult websites.

PyCryptoMiner downloads the main controller from the C&C server or a directed source, and this system registers itself as a cron job to maintain persistence.

The Host or DNS name, details relating to the OS and accompanying architecture, CPU numbers and CPU usage data are all collected. The bot then checks to see whether the system has already been infected by the malware before sending a report to the C&C server and accepting additional instructions.

The botnet then harnesses the victim system for mining Monero. As of December 2017, the botnet has made roughly $46,000 for its creator.

It appears that PyCryptoMiner, however, is in a constant state of evolution. As the researchers were gathering information on the botnet, new scanner functionality was bolted-on by the operator.

The scanner hunts for vulnerable JBoss servers by exploiting CVE-2017-12149, a deserialised data vulnerability in the Red Hat Enterprise Application Platform 5.2 disclosed only a few months ago.

At the time of writing, the C&C servers supporting the botnet have been disabled. However, it would only take the threat actor to update the addresses to reinvigorate PyCryptoMiner. As cryptocurrency captures the interest of consumer and cyberattacker alike, these kinds of botnets are likely to become a common threat in the future.

Critical security vulnerability in phpMyAdmin used for managng SQL Database

noreply@blogger.com (Securenet Consulting) — Fri, 05 Jan 2018 08:58:00 +0000

A critical security vulnerability has been reported in phpMyAdmin

One of the most popular applications for managing the MySQL database which could allow remote attackers to perform dangerous database operations just by tricking administrators into clicking a link.

Discovered by an Indian security researcher, Ashutosh Barot, the vulnerability is a cross-site request forgery (CSRF) attack and affects phpMyAdmin versions 4.7.x (prior to 4.7.7).

Cross-site request forgery vulnerability, also known as XSRF, is an attack wherein an attacker tricks an authenticated user into executing an unwanted action.

According to an advisory released by phpMyAdmin, "by deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables, etc."

phpMyAdmin is a free and open source administration tool for MySQL and MariaDB and is widely used to manage the database for websites created with WordPress, Joomla, and many other content management platforms.

Moreover, a lot of hosting providers use phpMyAdmin to offer their customers a convenient way to organize their databases.

Barot has also released a video, demonstrating how a remote attacker can make database admins unknowingly delete (DROP) an entire table from the database just by tricking them into clicking a specially crafted link.

"A feature of phpMyAdmin was using a GET request and after that POST request for Database operations such as DROP TABLE table_name; GET requests must be protected against CSRF attacks. In this case, POST requests were used which were sent through URL (for bookmarking purpose may be); it was possible for an attacker to trick a database admin into clicking a button and perform a drop table database query of the attacker’s choice."

phpMyAdmin 4.7.7 to address this issue. So administrators are highly recommended to update their installations as soon as possible.

Contact SecureNet Consulting today for solutions advice, engineering, support, professional services for SQL Database administration.

News: Intel, AMD Chip Vulnerabilities Put Billions of Devices at Risk

noreply@blogger.com (Securenet Consulting) — Thu, 04 Jan 2018 17:22:00 +0000

Intel, AMD Chip Vulnerabilities Put Billions of Devices at Risk

Researchers have disclosed technical details of two new attack methods that exploit critical flaws in CPUs from Intel, AMD and other vendors. They claim billions of devices are vulnerable, allowing malicious actors to gain access to passwords and other sensitive data without leaving a trace.

The flaws exploited by the Meltdown and Spectre attacks, tracked as CVE-2017-5715, CVE-2017-5753 and CVE-2017-5754, allow malicious applications to bypass memory isolation mechanisms and access data as it’s being processed. This can include passwords, photos, documents, emails, and data from instant messaging apps.

Billions of PCs, smartphones and cloud instances are affected, and while there is no evidence of attacks in the wild, researchers said exploitation attempts are unlikely to be detected.

Researchers had initially planned on disclosing the security holes on January 9, but disclosure was moved up due to media reports and speculation surrounding the topic. Affected tech companies have already started informing users about the risks and the availability of patches and mitigations.

MicrosoftMicrosoft started implementing protections in Windows a few months ago. The company informed customers on Wednesday that it released several updates to help mitigate the vulnerabilities in Windows client and server products. It has also released a tool designed to tell customers if protections are enabled.

Microsoft is also working to ensure that customers of its Azure cloud platform are not vulnerable to Meltdown and Spectre attacks.

“The majority of Azure infrastructure has already been updated to address this vulnerability. Some aspects of Azure are still being updated and require a reboot of customer VMs for the security update to take effect,” the company said.

Intel, AMD and ARM

Initial reports claimed only Intel CPUs were affected by the vulnerabilities. While Intel was hit the hardest, some of the flaws affect AMD and ARM as well.

Intel has informed customers that it’s working with manufacturers and operating system vendors to address the issues. The company also reassured customers that performance penalties will not affect regular computer users and will be mitigated over time.

AMD is apparently only affected by the Spectre vulnerabilities (CVE-2017-5753 and CVE-2017-5715), and the company claims the risk to its processors is “near zero” thanks to their architecture.

In the case of ARM, the company says only its Cortex-A75 processors are affected by all three vulnerabilities. Cortex R7, R8, A8, A9, A15, A17, A57, A72 and A73 processors are vulnerable to Meltdown attacks and affected by the CVE-2017-5715 Spectre flaw. Other existing products and future processors are not affected, the company said.

ARM has provided kernel patches for Linux users and advised customers using Android and other OSs to check for updates from their respective vendor.Google
Google has patched the vulnerabilities in its Cloud platform, but some users may need to manually perform some tasks.

“Google Compute Engine used VM Live Migration technology to perform host system and hypervisor updates with no user impact, no forced maintenance windows, and no mass reboots required. However, all guest operating systems and versions must be patched to protect against this new class of attack regardless of where those systems run,” Google said.

The company has informed Android users that while the risk of attacks is small, the latest Android security updates do provide additional protection against Spectre and Meltdown.

Apple
Apple has yet to make any public statements, but security expert Alex Ionescu reportedthat version 10.13.2 of macOS High Sierra, which Apple released on December 6, does fix the vulnerabilities.

Xen, Amazon Web Services (AWS), DigitalOcean, Rackspace
The Xen Project said systems running any version of the Xen hypervisor are affected. Due to the accelerated disclosure, the organization has not had time to create patches, and mitigations are available for only one of the security holes.

AWS, which uses Xen, told customers, “All but a small single-digit percentage of instances across the Amazon EC2 fleet are already protected. The remaining ones will be completed in the next several hours, with associated instance maintenance notifications.

Rackspace, which also uses Xen, is currently investigating the issue. DigitalOcean has also launched an investigation, but the company has blamed Intel’s embargo for not determining potential impact sooner.

Mozilla
Mozilla has conducted some internal experiments and found that it is possible to use techniques similar to Meltdown and Spectre from web content to read private date between different origins. The full extent of the issue has yet to be determined, but some partial mitigations have already been added to Firefox

Red Hat
Red Hat has classified the vulnerabilities as important and it has already developed kernel updates for affected versions of Red Hat Enterprise Linux.

“We are working with our customers and partners to make these updates available, along with the information our customers need to quickly secure their physical systems, virtual images, and container-based deployments,” said Chris Robinson, manager of Product Security Assurance at Red Hat.

nVIDIA
nVIDIA said its GPU hardware does not appear to be impacted by Meltdown and Spectre, but some system-on-a-chip (SoC) products using ARM CPUs are vulnerable. The company is working on identifying affected products and preparing mitigations.

Happy New Year SecureNet Consulting January 2018 Newsletter

noreply@blogger.com (Securenet Consulting) — Thu, 04 Jan 2018 12:39:00 +0000

Wishing You A Very
Happy New Year 2018

SECURENET CONSULTING
Services and Solutions for Cyber Security & Data Protection

IT Technical Engineering, Support & Professional Services

January 2018

Security News & Trends from 2017 - what will we learn for 2018?

Malware Outbreaks
Data Breaches & Massive Data Loss
Government Hacking Tools
Attacks Against Crypto-currency Exchanges

Review cyber security news and add SecureNet to your news feed for daily security news updates

Technology Solutions & Service Focus

A better approach to network security

Protecting key cloud and business application performance

Keeping ransomware and advanced threats out of your network

Next generation security intelligence and analytics

Are you prepared to respond to a security breach?

Password security to prevent data breaches

Effective security starts with visibility

Stay compliant - secure your data in Office 365

Identify and protect your data in the cloud

Book Technical Engineering and Professional Services

Using anti virus tools to search for classified documents

noreply@blogger.com (Unknown) — Tue, 02 Jan 2018 17:22:00 +0000

Former NSA hacker, demonstrated how to subvert the Kaspersky Lab antivirus and turn it into a powerful search tool for classified documents.

The Kaspersky case demonstrated that security software can be exploited by intelligence agencies as a powerful spy tool.

Patrick Wardle, chief research officer at Digita Security and former NSA hacker, demonstrated it by subverting the Kaspersky Lab antivirus and turning it into a powerful search tool for classified documents.

“In the battle against malicious code, antivirus products are a staple,” Patrick Wardle told the New York Times. “Ironically, though, these products share many characteristics with the advanced cyberespionage collection implants they seek to detect.”

“I wanted to know if this was a feasible attack mechanism,” Mr. Wardle added. “I didn’t want to get into the complex accusations. But from a technical point of view, if an antivirus maker wanted to, was coerced to, or was hacked or somehow subverted, could it create a signature to flag classified documents?”

In December, US President Donald Trump signed a bill that bans the use of Kaspersky Lab products and services in federal agencies.

According to a draft of a top-secret report leaked by Edward J. Snowden, the NSA at least since 2008 was targeting antivirus software (i.e. Checkpoint and Avast) to collect sensitive information stored in the target machines.

Mr. Wardle conducted a reverse-engineering of Kaspersky Lab antivirus software to explore the possibility to abuse it for intelligence purposes. The expert’s goal was to compose a signature that is able to detect classified documents.

Mr. Wardle discovered that the code incredibly complex, unlike traditional antivirus software, Kaspersky’s malware signatures are easily updated. This feature can be tweaked to automatically scan the victim’s machine and steal classified documents.

“Modern anti-virus products are incredibly complex pieces of software and Kaspersky is likely one of the most complex. Thus, merely gaining a reasonable understanding of its signatures and scanning logic is a challenging task.” wrote Wardle.

“Though the installer ships with built-in signatures, as is the case with any anti-virus program, Kaspersky’s anti-virus engine regularly checks for, and automatically installs any new signatures” “When new signatures are available, they are downloaded by the kav daemon from Kaspersky’s update servers”

Wardle found antivirus scanning could be the used for cyberespionage activities.

The expert pointed out that officials routinely classify top secret documents with the marking “TS/SCI,” (“Top Secret/Sensitive Compartmented Information),” then he added a rule to Kaspersky’s antivirus program to flag any documents that contained the “TS/SCI” marker.

To test the new rule, the researcher edited a document on his computer containing text from the Winnie the Pooh children’s book series and added “TS/SC” marker.

As soon as the Winnie the Pooh document was saved to his machine, the Kaspersky’s antivirus software flagged and quarantined the document.

The successive phase of Wardle’s test was on discovering how flagged documents are managed, but it normal that an antivirus software send data back to the company for further analysis.

Kaspersky Lab explained that Wardle’s research is not corrected because the company is not able to deliver a specific signature or update to only one user in a stealthy way.

“It is impossible for Kaspersky Lab to deliver a specific signature or update to only one user in a secret, targeted way because all signatures are always openly available to all our users; and updates are digitally signed, further making it impossible to fake an update,” Kaspersky said in a statement.

Anyway, Wardle’s research demonstrated that hacking vendor’s platforms it is possible to use the antivirus as a search tool.

“However, a malicious or willing insider within any anti-virus company, who could tactically deployed such a signature, would likely remain undetected. And of course, in a hypothetical scenario; any anti-virus company that is coerced to, or is willing to work with a larger entity (such as a governemnt) would equally be able to stealthily leverage their product to detect and exfilitrate any files of interest.” concluded the expert.
“Sometimes the line between what is good and evil, comes down to a signal signature… “

Incident Response Service

noreply@blogger.com (Securenet Consulting) — Wed, 13 Dec 2017 15:00:00 +0000

Be pro-active: plan and prepare to reduce chances of breach incidents

Turn your incident response plan into a proactive program

Incident response & security services here for you and your team, when an unforeseen incident occurs

SecureNet Consulting

How mobile 4G LTE internet can provide your Wi-Fi solution

How mobile 4G LTE internet can provide your Wi‑Fi solution

Upgrading to managed switches will give you the network you want

Upgrading to managed switches will give you the network you want

Best mobile hotspot & usb c multiport adapter - essential mobile warrior kit

Essential mobile warrior kit - we look at some of the best and much needed mobile hotspot & usb-c multiport adapter gadgets to keep you connected. Back on the road again - indispensable mobile hotspot & multi-hub port adaptor. Never be disconnected, ever again.

Hyperconverged Infrastructure: HCI benefits for workload mobility

Can HCI ease Hybrid IT (on-premise and cloud / multi-cloud) deployments and workload mobility

The need for speed: why you need to arm your teams with AI now

Choosing the right disaster recovery for your business

Choosing the right disaster recovery for your business

By Paul Rummery, Securenet Consulting

Coronavirus: Remote Working

Wireless Mobility Solutions

Kr00k vulnerability

New Kr00k vulnerability enables attackers decrypt WiFi packets

Audio Visual Solutions

Connect remote users and collaborate with ease: Audio Visual solutions

RANSOMWARE: StalinLocker deletes data if you don't enter the right code in time

StalinLocker Ransomware gives you ten minutes to comply.

New HNS Botnet

New Hide ‘N Seek IoT Botnet spotted in the wild

news: Intel testing new Spectre fixes, tells everyone to hold off on deploying current firmware updates

Intel tells everyone to hold off on deploying current firmware updates

news: Sensitive medical records on AWS bucket found publicly accessible

A large cache of sensitive medical records handled by a US-based digital records management company was found stored in an Amazon S3 storage bucket without adequate protection.

RubyMiner Monero Cryptominer affected 30% of networks worldwide in only 24 hours

Security researchers have spotted a malware family dubbed RubyMiner that is targeting web servers worldwide in an attempt to exploit their resources to mine Monero cryptocurrency.

Hackers Exploit Three Microsoft Office Flaws to Spread Zyklon Malware

36 malicious apps advertised as security tools spotted in Google Play

Microsoft Office memory corruption vulnerability and 16 critical flaws

Patch Tuesday updates for 2018. This included fixes for a total of 56 CVEs affecting Microsoft Windows, Microsoft Office, Internet Explorer, Microsoft Edge, ChakraCore, ASP.NET, and the .NET Framework. One flaw has been exploited.

Crypto Miners The Silent CPU Killer

Crypto Miners The Silent CPU Killer

News: Linux Monero crypto-miner botnet dubbed PyCryptoMiner spreading over the SSH protocol

PyCryptoMiner, a new Linux-based botnet is spreading over the SSH protocol.

Critical security vulnerability in phpMyAdmin used for managng SQL Database

A critical security vulnerability has been reported in phpMyAdmin

News: Intel, AMD Chip Vulnerabilities Put Billions of Devices at Risk

Happy New Year SecureNet Consulting January 2018 Newsletter

Wishing You A Very Happy New Year 2018 SECURENET CONSULTING Services and Solutions for Cyber Security & Data Protection IT Technical Engineering, Support & Professional Services

January 2018

A better approach to network security

Keeping ransomware and advanced threats out of your network

Next generation security intelligence and analytics

Password security to prevent data breaches

Stay compliant - secure your data in Office 365

Identify and protect your data in the cloud

Using anti virus tools to search for classified documents

Former NSA hacker, demonstrated how to subvert the Kaspersky Lab antivirus and turn it into a powerful search tool for classified documents.The Kaspersky case demonstrated that security software can be exploited by intelligence agencies as a powerful spy tool.

Patrick Wardle, chief research officer at Digita Security and former NSA hacker, demonstrated it by subverting the Kaspersky Lab antivirus and turning it into a powerful search tool for classified documents.

In December, US President Donald Trump signed a bill that bans the use of Kaspersky Lab products and services in federal agencies.

According to a draft of a top-secret report leaked by Edward J. Snowden, the NSA at least since 2008 was targeting antivirus software (i.e. Checkpoint and Avast) to collect sensitive information stored in the target machines.

Mr. Wardle conducted a reverse-engineering of Kaspersky Lab antivirus software to explore the possibility to abuse it for intelligence purposes. The expert’s goal was to compose a signature that is able to detect classified documents.

Mr. Wardle discovered that the code incredibly complex, unlike traditional antivirus software, Kaspersky’s malware signatures are easily updated. This feature can be tweaked to automatically scan the victim’s machine and steal classified documents.

To test the new rule, the researcher edited a document on his computer containing text from the Winnie the Pooh children’s book series and added “TS/SC” marker.

Incident Response Service

Essential mobile warrior kit - we look at some of the best and much needed mobile hotspot & usb-c multiport adapter gadgets to keep you connected.

Back on the road again - indispensable mobile hotspot & multi-hub port adaptor. Never be disconnected, ever again.

Wishing You A Very
Happy New Year 2018

SECURENET CONSULTING
Services and Solutions for Cyber Security & Data Protection

IT Technical Engineering, Support & Professional Services

Former NSA hacker, demonstrated how to subvert the Kaspersky Lab antivirus and turn it into a powerful search tool for classified documents.

The Kaspersky case demonstrated that security software can be exploited by intelligence agencies as a powerful spy tool.