InfoSecHotSpotTwitterFeedRSS

Leonardo DRZ wins first ever TCG CodeGen Developer Challenge

Paul Roberts — Thu, 23 Dec 2021 19:19:50 GMT

President and Chairman of Trusted Computing Group (TCG), Dr. Joerg Borchert, shares the news regarding TCG's first ever CodeGen Developer Challenge.

The post Leonardo DRZ wins first ever TCG CodeGen Developer Challenge appeared first on The Security Ledger with Paul F. Roberts.

4-Year-Old Microsoft Azure Zero-Day Exposes Web App Source Code

Tara Seals — Thu, 23 Dec 2021 19:04:13 GMT

The security vulnerability could expose passwords and access tokens, along with blueprints for internal infrastructure and finding software vulnerabilities.

The cool retro phone with a REAL DIAL… plus plenty of IoT problems

Paul Ducklin — Thu, 23 Dec 2021 17:58:34 GMT

You know you want one, because this retro phone is NOT A TOY... except when it comes to cybersecurity.

Telegram Abused to Steal Crypto-Wallet Credentials

Elizabeth Montalbano — Thu, 23 Dec 2021 16:00:22 GMT

Attackers use the Telegram handle “Smokes Night” to spread the malicious Echelon infostealer, which steals credentials for cryptocurrency and other user accounts, researchers said.

‘Spider-Man: No Way Home’ Download Installs Cryptominer

Becky Bracken — Thu, 23 Dec 2021 15:00:19 GMT

The origin of the Monero cryptominer file has been traced to a Russian torrent website, researchers report.

The Future of Work Has Changed, and Your Security Mindset Needs to Follow

Mark Guntrip, Senior Director, Cybersecurity Strategy, Menlo Security — Thu, 23 Dec 2021 15:00:00 GMT

VPNs have become a vulnerability that puts organizations at risk of cyberattacks.

7 of the Most Impactful Cybersecurity Incidents of 2021

Jai Vijayan, Contributing Writer — Thu, 23 Dec 2021 14:00:00 GMT

There was a lot to learn from breaches, vulnerabilities, and attacks this year.

Examining Log4j Vulnerabilities in Connected Cars and Charging Stations

Sébastien Dudek — Thu, 23 Dec 2021 00:00:00 GMT

In this entry we look into how Log4j vulnerabilities affect devices or properties embedded in or used for connected cars, specifically chargers, in-vehicle infotainment systems, and digital remotes for opening cars.

Microsoft Customer Source Code Exposed via Azure App Service Bug

Kelly Sheridan, Senior Editor — Wed, 22 Dec 2021 22:05:00 GMT

Researchers found an insecure default behavior in Azure App Service exposing source code of some customer applications deployed using "Local Git."

Nearly 50% of People Will Abandon Sites Prohibiting Password Reuse

Steve Zurier, Contributing Writer — Wed, 22 Dec 2021 21:26:44 GMT

A new study investigating consumer password use found 25% of online shoppers would abandon their carts of $100 if prompted to reset a password at checkout.

CISA's New Log4j Scanner Aims to Find Vulnerable Apps

Dark Reading Staff, Dark Reading — Wed, 22 Dec 2021 20:40:00 GMT

The open-sourced scanner was derived from scanners built by members across the open source community, CISA reports.

Plundered bitcoins recovered by FBI – all 3,879-and-one-sixth of them!

Paul Ducklin — Wed, 22 Dec 2021 19:57:02 GMT

Phew! An audacious crime... that didn't work out.

PYSA Emerges as Top Ransomware Actor in November

Becky Bracken — Wed, 22 Dec 2021 18:39:08 GMT

Overtaking the Conti ransomware gang, PYSA finds success with government-sector attacks.

All in One SEO Plugin Bug Threatens 3M Websites with Takeovers

Tara Seals — Wed, 22 Dec 2021 18:24:07 GMT

A critical privilege-escalation vulnerability could lead to backdoors for admin access nesting in web servers.

Log4j Reveals Cybersecurity's Dirty Little Secret

Mark Manglicmot, Vice President of Security Services, Arctic Wolf — Wed, 22 Dec 2021 18:00:00 GMT

Once the dust settles on Log4j, many IT teams will brush aside the need for the fundamental, not-exciting need for better asset and application management.

Critical Apache HTTPD Server Bugs Could Lead to RCE, DoS

Lisa Vaas — Wed, 22 Dec 2021 17:59:55 GMT

Don't freak: It's got nothing to do with Log4Shell, except it may be just as far-reaching as Log4j, given HTTPD's tendency to tiptoe into software projects.

Stolen Bitcoins Returned

Bruce Schneier — Wed, 22 Dec 2021 16:20:57 GMT

The US has returned $154 million in bitcoins stolen by a Sony employee.

However, on December 1, following an investigation in collaboration with Japanese law enforcement authorities, the FBI seized the 3879.16242937 BTC in Ishii’s wallet after obtaining the private key, which made it possible to transfer all the bitcoins to the FBI’s bitcoin wallet.

Why We Need to Consolidate Digital Identity Management Before Zero Trust

Wes Wright, CTO, Imprivata — Wed, 22 Dec 2021 15:30:00 GMT

Zero trust may be one of the hottest trends in cybersecurity, but just eliminating trust from networks isn’t enough to prevent successful organizational data breaches, says Wes Wright, CTO of Imprivata.

Future of Identity-Based Security: All-in-One Platforms or Do-It-Yourself Solutions?

Mark Settle, Seven-Time CIO — Wed, 22 Dec 2021 15:00:00 GMT

The functionality of all-in-one platforms is being deconstructed into a smorgasbord of services that can be used to develop bespoke end-user security procedures for specific work groups, lines of businesses, or customer communities.

Four Bugs in Microsoft Teams Left Platform Vulnerable Since March

Elizabeth Montalbano — Wed, 22 Dec 2021 14:03:05 GMT

Attackers exploiting bugs in the “link preview” feature in Microsoft Teams could abuse the flaws to spoof links, leak an Android user’s IP address and launch a DoS attack.

5 online scam red flags | Kaspersky official blog

Roman Dedenok — Wed, 22 Dec 2021 11:33:58 GMT

No one — gamer, cryptocurrency investor, or online shopper — is safe from scammers. But no matter who the victim is or how sophisticated the scheme may be, there is always a way to sniff out fraud before it’s too late. Today we’re looking at five common signs of online scams to help you avoid danger.

1. Stick or carrot

Scammers often play on greed or fear. In the first case, they promise a potential victim the moon and the stars — for example, a large government payout or free cryptocurrency. The second involves intimidation, such as a threat to send a video of the victim watching porn to all of their contacts or to ruin the reputation of their company’s website.

In both cases, cybercriminals are trying to short-circuit their victim’s ability to respond rationally. If, after reading such an e-mail, you feel inclined to do exactly what the sender asks (follow a link, send money, call a number, etc.), that’s actually a warning sign. Take a deep breath and read the message again. Most likely, you’ll see it for what it is — a trick.

2. Ticking clock

If emotionally charged situations can cause people to lose the power of critical thinking, then being in a hurry only heightens the problem. Scammers exploit that as well, for example by setting tight deadlines. If a message says you have only a couple of days, hours, or even minutes to claim a prize or buy sought-after equipment before it sells out, again, it’s probably a scam.

3. Amateurish design

Obvious errors in the message are another red flag. Some may be intentional misspellings or substitution of letters with similar-looking numbers or optical counterparts from other alphabets so as to fool spam filters. In some cases, the sender might simply be illiterate, which is not uncommon among scammers, as opposed to employees of respectable organizations.

Whatever the reason for the typos, promises of “0ne мilIion d0llars” are a sure sign of danger.

4. Searching the database

When a potential victim goes to a fraudulent website from an e-mail or chat message, the scammers usually try to draw them in through a series of simple tasks. They might involve taking a short survey or selecting a number of boxes supposedly containing prizes, for example. Quite often, the victim is shown an animation supposedly indicating a database search (for their prizewinning status, for example) or asked to fill out a form. Sometimes they might be invited to read (fake) reviews or comments from “past winners.” More recently, we’ve seen chats with a bot posing as a lawyer, consultant, or support employee.

Regardless of the details, the overall purpose is simple and clear: Getting the person to invest a bit of time and effort keeps them on the page, and the more invested they feel, the less likely they are to close the page when it asks for payment, which it certainly will. Feel like a website promising a big payday is playing for time? Probably not a good sign.

5. Small fee

Another favorite trick after hooking a victim is to request a small fee, a transfer for card verification purposes or payment for registration in some database. Without it, the scammers insist, it will not be possible to receive the promised reward.

The asked-for amount is usually quite small and insignificant against the prospect of untold riches, and may even come with an assurance of payback at a later date. This fee is the first thing that gets stolen, of course. There will be no prize, only the likelihood of losing even more after sharing credit card details with the scammers.

To be continued

Cybercriminals are constantly inventing new ways to monetize your trust and weaknesses. Simply by looking for these five red flags, you can avoid falling prey to most scams. We will, of course, continue to keep you posted on how to protect yourself, your data, and your money from intruders.

UK Security Agency Shares 225M Passwords With 'Have I Been Pwned'

Dark Reading Staff, Dark Reading — Tue, 21 Dec 2021 22:25:00 GMT

The UK's NCA and NCCU have shared 225 million stolen emails and passwords with HIBP, which tracks stolen credentials.

Meta Files Federal Lawsuit Against Phishing Operators

Jai Vijayan, Contributing Writer — Tue, 21 Dec 2021 22:09:03 GMT

The Facebook parent company seeks court's help in identifying the individuals behind some 39,000 websites impersonating its brands to collect login credentials.

Time to Ditch Big-Brother Accounts for Network Scanning

Yaron Kassner — Tue, 21 Dec 2021 22:08:01 GMT

Yaron Kassner, CTO and co-founder of Silverfort, discusses why using all-seeing privileged accounts for monitoring is bad practice.

Java Code Repository Riddled with Hidden Log4j Bugs; Here’s Where to Look

Becky Bracken — Tue, 21 Dec 2021 20:46:35 GMT

There are 17,000 unpatched Log4j packages in the Maven Central ecosystem, leaving massive supply-chain risk on the table from Log4Shell exploits.

93% of Tested Networks Vulnerable to Breach, Pen Testers Find

Robert Lemos, Contributing Writer — Tue, 21 Dec 2021 20:13:48 GMT

Data from dozens of penetration tests and security assessments suggest nearly every organization can be infiltrated by cyberattackers.

Half-Billion Compromised Credentials Lurking on Open Cloud Server

Tara Seals — Tue, 21 Dec 2021 20:08:42 GMT

A quarter-billion of those passwords were not seen in previous breaches that have been added to Have I Been Pwned.

Apache’s other product: Critical bugs in ‘httpd’ web server, patch now!

Paul Ducklin — Tue, 21 Dec 2021 19:57:39 GMT

The Apache web server just got an update - this one is nothing to do with Log4j!

How Modern Log Management Strengthens Enterprises’ Security Posture

Simon Simonsen, Sr. Security Architect, CrowdStrike — Tue, 21 Dec 2021 19:42:28 GMT

If security teams are not logging everything, they are increasing security risk and making it more difficult to investigate and recover from a data breach. Modern log management goes beyond just a SIEM.

Preemptive Strategies to Stop Log4j and Its Variants

Oded Gonda, VP of Technology & Innovation, Check Point Software Technologies — Tue, 21 Dec 2021 18:00:00 GMT

Zero trust is key to not falling victim to the next big vulnerability.

What’s new with Matrix security in Resurrections | Kaspersky official blog

Nikolay Pankov — Tue, 21 Dec 2021 16:33:41 GMT

In December 2021, the creators of the Matrix rolled out a massive update, The Matrix Resurrections, perhaps to address the dire state of security in the system. As often happens with system bug fixes, the update resolves some but not all issues — and adds some new ones in the process.

What’s changed in the Matrix in the 18 years since the last update? Today, we’re evaluating the latest installment from a cybersecurity perspective. As usual, spoiler alert!

Fighting pirate avatars

As before, external hackers have infiltrated the Matrix. In the original trilogy, whether the system was serious about fighting the Zion Resistance or just pretending to be was never entirely clear (and the Matrix is hardly the only fictional universe that’s convoluted). The new movie creates the impression that the Matrix programs genuinely do not want outsiders in their system, that countermeasures are in full force but simply not effective enough.

Pirate signal from hacker ships

Hacker ships continue to transmit pirate signals to the Matrix, as they did before in “real reality.” No firewall was ever implemented at the entrance to the Matrix, though that would have been logical. Using a Zero Trust approach from the start would have prevented a lot of hassle.
Status: Unsolved

Pirate avatar transfer system

Either the Matrix defeated the system that broadcast pirate avatars through simulated telephone landlines and the hackers had to invent something new, or the hackers improved their methods and abandoned wire telephony. Either way, the system is different now: The new breed of rebel uses a complex system of dynamic redirects. In other words, the rebels can now turn doors and mirrors into portals both for quickly transporting pirate avatars from place to place and for logging in to the system. That’s very similar to the work of the Keymaker in the second movie — perhaps the hackers managed to replicate (or borrow) part of his code.
Status: Worse than before

Pirate avatar tracking system

The Matrix has become far more responsive to outside avatars’ actions. Countermeasures are now applied (and much more quickly) in almost every case of rebel infiltration — perhaps the creators of the Matrix followed our recommendations for the original trilogy and finally implemented EDR. Moreover, hackers are now forced to obfuscate their tracks constantly, for example by opening portals in a moving train to keep their activity hidden from the agents for longer.
Status: Greatly improved

Matrix agents

The Matrix has abandoned its unique and probably resource-intensive agents. They remain as code, but they exist exclusively within a looped, double-virtual simulation. The Matrix, you see, has learned to switch the avatar of any connected human to bot mode, acting for the system. Visually, the difference is that, whereas an Agent previously replaced a person’s avatar, now the avatar outwardly remains the same but is taken over by the AI.

By comparison with agents, bots act more primitively, but they can operate in swarm mode, synchronously and (subjectively) more efficiently. Physical laws still govern the bots’ behavior, however, and the result is essentially the same. Hackers can still get the job done; they just have to work a little harder for it.
Status: Different, not better

Rogue programs

The Matrix used to be full of unnecessary programs that had no useful system functions. Along with the update, the AI purged obsolete software throughout the system, destroying the vast majority of rogue programs — not all, of course, but precious few remain. Some have emigrated to the physical world (we won’t say how; that would be one spoiler too many). In any event, getting rid of outdated software is the right move.

Status: Greatly improved

Network segmentation

The Matrix’s attitude toward isolating subnets remains poor. From the outside, the rebels manage to break in —not only to the Matrix, but also to a simulation of the Matrix, deployed inside on double-virtual servers. In other words, the simulation is on the same thoroughfare, so to speak; once inside the network, an intruder can go anywhere — say, accounts or R&D. In short, the implementation is very sloppy, especially given the absence of an entrance firewall or Zero Trust system.

Status: About the same

Anomaly control system

The original trilogy’s system for controlling anomalies in the code (by means of the One) no longer works. Instead, we have a new system, in which the One and Zion no longer go through cycles of recreation; rather, the Matrix tries to manipulate the reconnected Neo through Trinity and colleagues.

The result is even more deplorable than before. Instead of one human with some avatar code anomalies, they get two — and that might not be all.
Status: Much worse

The problem of ex-Agent Smith

The Matrix did not destroy the code of former Agent Smith, but instead took control of it and tried to implement it in a complex new anomaly control system. The AI is likely interested in that part of the code that retains elements of Neo’s code.

The part responsible for uncontrolled replication seems to have been deleted. However, by the end of the movie, Smith frees himself (as usual, thanks to Neo’s intervention), and he remains in the Matrix. What’s more, he can now jump from avatar to avatar, an ability the Matrix can’t control. In other words, if before Smith was a rather stupid virus, it has now morphed into a full-fledged APT.

Status: Much worse

New problems

The balance of power has changed significantly. First, Zion was not destroyed at the end of the original trilogy, which greatly strengthens humanity. Second, following a split on the machine side, some AI carriers — both intelligent machines and purely software-based personalities — are now on humanity’s side. The result is several fundamentally new issues.

Data leaks

The AI carriers absconded with a fair amount of information, some of which is sensitive. The humans now know a lot more about the architecture of the Matrix and various critical systems.

Critical infrastructure security

The hackers are far more active in the “real reality” and now periodically attack critical infrastructure at the physical level. Moreover, the renegade machines actively help humanity hack into other machines at the hardware level, for example, by breaking into the harvester control system and other protected objects. As a result, the Zion rebels can continue stealing the bodies of humans connected to the Matrix.

General takeaways

To sum up, the Matrix update has worsened the overall security of the machines, not improved it. If the AI had not turned enslaved humans into batteries, perhaps people could have helped out with an independent vulnerability analysis — well worth the effort before rolling out a massive update.

The Future of Ransomware

Dave Meltzer, Chief Technology Officer, Tripwire — Tue, 21 Dec 2021 15:00:00 GMT

Focusing on basic security controls and executing them well is the best way to harden your systems against an attack.

UK hands over 585 million compromised passwords to 'Have I been pwned' service

Tue, 21 Dec 2021 12:41:41 GMT

Of those, 225 million are new passwords that were not part of the database previously

Facebook's internal messages reveal plans to ignore European privacy laws

Tue, 21 Dec 2021 12:30:44 GMT

How Is Zero Trust Evolving to Be More Continuous in Verifying Trust?

Ash Devata, General Manager, Cisco Zero Trust and Duo Security — Tue, 21 Dec 2021 11:33:29 GMT

For zero trust to be successful, organizations need to be able to check user identity, device posture, and overall behavior without adding friction to the experience.

Belgian defence ministry suffers cyber attack through Log4j exploitation

Tue, 21 Dec 2021 08:05:38 GMT

Multiple threat groups are currently leveraging Log4j bugs in their operations

How to detect Apache HTTP Server Exploitation

Nitesh Surana — Tue, 21 Dec 2021 00:00:00 GMT

With recent news of the critical, zero-day vulnerability Apache Log4Shell, we explore how to detect and protect your Apache HTTP servers.

What to Do About Log4j

William Malik — Tue, 21 Dec 2021 00:00:00 GMT

Learn more about some tactical measures people are already taking, and some strategic guidance for what to do after the immediate crisis abates.

Russian National Extradited for Illegal Hacking & Trading

Dark Reading Staff, Dark Reading — Mon, 20 Dec 2021 22:55:00 GMT

Vladislav Klyushin was allegedly involved in a global operation to trade on nonpublic data stolen from US computer networks.

New Log4j Attack Vector Discovered

Jai Vijayan, Contributing Writer — Mon, 20 Dec 2021 22:53:50 GMT

Meanwhile, Apache Foundation releases third update to logging tool in 10 days to address yet another flaw.

Brillio Acquires Cedrus Digital to Strengthen Their Digital Transformation Service Capabilities

Mon, 20 Dec 2021 20:59:47 GMT

The acquisition of Cedrus Digital, with its consulting-led model and over 150 cloud, data and product engineers, primarily in the United States, will further augment Brillio’s nearshore digital transformation capabilities offered for Fortune 500 clients.

NetSPI Adds IoT Penetration Testing to its Suite of Offensive Security Services

Mon, 20 Dec 2021 20:52:42 GMT

Led by IoT security expert Larry Trowell, the IoT pen-testing services focus on securing ATMs, automotive, medical devices, operational technology, and other embedded systems.

Log4Shell: The Movie… a short, safe visual tour for work and home

Paul Ducklin — Mon, 20 Dec 2021 19:20:19 GMT

Be happy that your sysadmins are taking one (three, actually!) for the team right now... here's why!

SAIC Launches Rugged Apps to Provide Secure Commercial Apps to Government Users

Mon, 20 Dec 2021 16:40:00 GMT

Rugged Apps ensures mobile apps are NIAP-compliant.

BlackBerry Launches New Managed Extended Detection and Response (XDR) Service

Mon, 20 Dec 2021 16:32:00 GMT

Company partners with Exabeam to launch update to its BlackBerry Guard managed detection and response (MDR) service.

SecurityScorecard Research Reveals Cyber Vulnerabilities Pose a Threat to U.S. Maritime Security

Mon, 20 Dec 2021 16:30:00 GMT

While the shipping industry's cyber posture was better than companies in the Forbes Global 2000, the industry performed lower in key risk group factors.

Trend Micro Crowns Champions of 2021 Capture the Flag Competition

Mon, 20 Dec 2021 16:28:00 GMT

Challenges were designed to address critical areas of cybersecurity, including reversing, cloud, IoT, open source intelligence, forensics, and machine learning.

Reblaze Appoints New CEO

Mon, 20 Dec 2021 16:20:00 GMT

Ziv Oren previously held the position of chief operations officer at the company.

Four Out of Five Organizations Are Increasing Cybersecurity Budgets for 2022

Mon, 20 Dec 2021 16:15:00 GMT

Half of security decision makers also say the cyber skills gap will significantly impact their 2022 strategy, according to new research from Neustar.

More on NSO Group and Cytrox: Two Cyberweapons Arms Manufacturers

Bruce Schneier — Mon, 20 Dec 2021 15:17:41 GMT

Citizen Lab published another report on the spyware used against two Egyptian nationals. One was hacked by NSO Group’s Pegasus spyware. The other was hacked both by Pegasus and by the spyware from another cyberweapons arms manufacturer: Cytrox.

We haven’t heard a lot about Cytrox and its Predator spyware. According to Citzen Lab:

We conducted Internet scanning for Predator spyware servers and found likely Predator customers in Armenia, Egypt, Greece, Indonesia, Madagascar, Oman, Saudi Arabia, and Serbia.

Cytrox was reported to be part of Intellexa, the so-called “Star Alliance of spyware,” which was formed to compete with NSO Group, and which describes itself as “EU-based and regulated, with six sites and R&D labs throughout Europe.”

In related news, Google’s Project Zero has published a detailed analysis of NSO Group’s zero-click iMessage exploit: FORCED ENTRY.

Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we’ve ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states.

By the way, this vulnerability was patched on 13 Sep 2021 in iOS 14.8.

Zero Trust Shouldn’t Mean Zero Trust in Employees

Josh Yavor, CISO, Tessian — Mon, 20 Dec 2021 15:00:00 GMT

Some think zero trust means you cannot or should not trust employees, an approach that misses the mark and sets up everyone for failure.

Lights Out: Cyberattacks Shut Down Building Automation Systems

Kelly Jackson Higgins, Executive Editor — Mon, 20 Dec 2021 15:00:00 GMT

Security experts in Germany discover similar attacks that lock building engineering management firms out of the BASes they built and manage — by turning a security feature against them.

How to detect hidden video cameras | Kaspersky official blog

Leonid Grustniy — Mon, 20 Dec 2021 14:00:54 GMT

To the average person, directional microphones, hidden cameras, and other surveillance equipment are the stuff of spy movies. Yet such devices can be found everywhere: from small rented apartments to expensive hotel rooms, from the office to the gym, even in your own home. Today, we explore ways to find them.

Big Brother’s little siblings

Miniature cameras are inexpensive (at the time of this writing, prices start at about $4), and they connect to regular Wi-Fi to transfer data — say, to the cloud. That means pretty much anyone can play at being a spy in real life. Why would they?

In some cases, owners of rental apartments install them in case of theft or damage to property. Suspicious spouses and unscrupulous rivals have other reasons. As do pranksters. Then, there are professional extortionists. Simply put, loads of people have loads of excuses.

How likely are you to encounter surveillance in everyday, private life? A survey of Airbnb users revealed that 11% of respondents had come across a hidden camera in rented accommodations. And those are just the ones who found something; not every renter carefully inspects the furnishings. What’s more, finding such cameras is not always easy. Lenses may be as small as 2 millimeters in diameter, and the box is usually hidden or camouflaged. How are you supposed to know you’re being spied on?

Method 1. Hire an expert

The most reliable way to find hidden spy equipment is to entrust the search to a qualified technician with professional equipment. Today, you can find such experts in almost any city; for example, on Craigslist or another website with classified ads.

Pros:

Efficiency
Reliable results
Minimal personal effort

Cons:

Price
Potential wait time
Hotel or apartment restrictions

Summary

If you are worried and plan to stay somewhere for a while, or if you’re moving in, hiring an expert may be worth the time and money.

Method 2. Use dedicated equipment

You can buy electromagnetic radiation detectors, optical detectors, and other equipment for detecting hidden cameras and use them to check each room yourself. The cheapest ones, with a detection radius of only a few feet, start at $3; professional and more powerful ones are obviously more expensive.

Incidentally, the simplest optical detector can be assembled manually; all you need are some red LEDs and a red-light filter. Direct the light at the suspected camera site and look through the filter — any camera lens in view will appear as a bright dot. Bear in mind that the range of such a device will not exceed ten meters (about 30 feet).

If you decide to check for yourself, pay particular attention to the bathroom and bedroom, where compromising footage might be filmed, as well as smoke detectors and household appliances, common hiding spots. Also check paintings, clocks, flower pots, and even toys.

Pros:

Independence
Option for regular checks
DIY potential

Cons:

Short effective range
Price
Time and skill requirements

Summary

If you’re the only person you trust — and especially if you aren’t afraid of soldering some LEDs —this method is for you.

Method 3. Use a smartphone

Sometimes you can do without special equipment and just use your smartphone camera and a flashlight. Turn off the lights and draw the curtains (the room must be dark), turn on both the flashlight and phone camera, and point them where you think a hidden device might be lurking. If your suspicions are correct, you will see a glare on the smartphone screen. If you can’t use the phone’s camera and flashlight simultaneously, use a separate flashlight.

In some cases, you can even do without a flashlight. Many spy cameras use infrared illumination for filming in the dark. It is invisible to the human eye but not to a smartphone camera. When filming in the dark, the infrared light source will appear on the screen as a pulsing dot. Keep in mind that your smartphone’s main camera may not do the trick, because it probably has an IR-light filter, so the front camera is a better bet. You can experiment with a TV remote to find out if your smartphone is good for the job.

Pros:

Free
No special skills required
No special equipment required

Cons:

Not all phone models are up to the job
Time-consuming
Inefficient — false positives are possible, and cameras without infrared radiation are not visible

Summary

This method is suitable only for a superficial inspection; it’s likely to miss something. Still, it’s better than nothing.

Method 4. Trust an app

Mobile apps for finding spy cameras and other hidden devices fall into two categories. The first group finds devices by the lens glare, as in the above-described method. Examples include Glint Finder, which detects the glare (or glint) when the light of a flashlight hits a lens. Once that happens, you just have to check the areas for any hidden devices.

Apps of the second group are designed to search for wireless spy devices. For them to work, you need to connect to the local Wi-Fi. After scanning the router, the app displays a list of connected devices. Check any you’re not completely sure about, such as your smartphone and laptop. A dedicated tool can help you distinguish harmless equipment from tracking devices by the identifier.

Pros:

Reasonably efficient
Minimal costs
No equipment required beyond a compatible smartphone

Cons:

Inferior to specialized devices
Unsuitable for smart homes with many connected devices
Unsuitable for hotel Wi-Fi and other public routers with many connected devices

Summary
Specialist software occupies the middle ground between professional equipment and improvised means. It’s probably the best option for cautious travelers, provided they use a trusted app.

What to do if you detect a spying device

If you find something that looks like a camera or other tracking device, take a photo of it and do an image search to find out what it might be. It may be harmless.

But if your fears are confirmed, you should contact the police, hotel administration, or the booking service you used. For example, AirBnB rules explicitly prohibit hidden cameras, so at least some affected guests have gotten refunds or different accommodations.

Better safe than sorry

We’ve discussed a few ways to make sure that no extortionist, TikTok prankster, or landlord is filming you without permission. But hidden cameras are not the only danger when traveling. Here are some general tips to help you stay safe in unfamiliar surroundings:

Take an external battery to stay connected at all times;
Download apps to help your trip go more smoothly, such as maps, dictionaries, and translators;
Don’t leave valuables unattended;
Never use public computers or terminals for private messaging, logging in to accounts, or online shopping;
Use a VPN app to protect your data from hackers, as well as to have access to content that’s not available in the country you are visiting.

Third Log4j vulnerability uncovered, Apache releases version 2.17.0

Mon, 20 Dec 2021 12:56:39 GMT

'High severity' bug fixed is an uncontrolled recursion flaw

A fifth of all employees will fall for a phishing message, study finds

Mon, 20 Dec 2021 12:15:00 GMT

And of those redirected to a spoofed web site, almost a quarter will enter their details into a form

2022 Cybersecurity Trends for DevSecOps

Mon, 20 Dec 2021 00:00:00 GMT

Trying to adopt DevSecOps culture? Or already in the thick of it? Trend Research explores the cybersecurity trends for 2022 to enhance your security strategy and get the most out of DevSecOps.

Are Endpoints at Risk for Log4Shell Attacks?

Sat, 18 Dec 2021 00:00:00 GMT

We created a free assessment tool for scanning devices to know whether it is at risk for Log4Shell attacks.

Friday Squid Blogging: UK Recognizes Squid as Sentient Beings

Bruce Schneier — Fri, 17 Dec 2021 22:01:29 GMT

This seems big:

The UK government has officially included decapod crustaceans–including crabs, lobsters, and crayfish–and cephalopod mollusks–including octopuses, squid, and cuttlefish–in its Animal Welfare (Sentience) Bill. This means they are now recognized as “sentient beings” in the UK.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

How Risky Is the Log4J Vulnerability?

Edge Editors, Dark Reading — Fri, 17 Dec 2021 20:53:22 GMT

Security teams around the world are on high alert dealing with the Log4j vulnerability, but how risky is it, really?

Serious Security: OpenSSL fixes “error conflation” bugs – how mixing up mistakes can lead to trouble

Paul Ducklin — Fri, 17 Dec 2021 19:57:52 GMT

Have you ever seen the message "An error occurred"? Even worse, the message "This error cannot occur"? Facts matter!

Meta Acts Against 7 Entities Found Spying on 50,000 Users

Dark Reading Staff, Dark Reading — Fri, 17 Dec 2021 19:10:00 GMT

The parent company of Facebook and Instagram has warned some 50,000 account holders they are targets of surveillance.

Executive Partnerships Are Critical for Cybersecurity Success

Sakshi Udavant, Freelance Writer — Fri, 17 Dec 2021 18:30:00 GMT

One leader alone can't protect an organization from cyber threats, C-suite leaders agree.

Timely Questions for Log4j Response Now — And for the Future

Katie Moussouris, Founder & CEO, Luta Security — Fri, 17 Dec 2021 17:40:09 GMT

EXPERT INSIGHT: How to assess your exposure to the vulnerability with a combination of asset inventory, testing, solid information sources, and software bills of materials (SBOMs).

PseudoManuscrypt Malware Targeted Government & ICS Systems in 2021

Robert Lemos, Contributing Writer — Fri, 17 Dec 2021 17:15:58 GMT

The "PseudoManuscrypt" operation infected some 35,000 computers with cyber-espionage malware and targeted computers in both government and private industry.

Time to Reset the Idea of Zero Trust

Kapil Raina, VP Zero Trust & Identity Marketing, CrowdStrike — Fri, 17 Dec 2021 17:02:32 GMT

CISOs are increasingly drawn to the zero trust security model, but implementing a frictionless experience is still a challenge.

CISA Issues Emergency Directive on Log4j

Dark Reading Staff, Dark Reading — Fri, 17 Dec 2021 16:27:11 GMT

The Cybersecurity Infrastructure and Security Agency orders federal agencies to take actions to mitigate vulnerabilities to the Apache Log4j flaw and attacks exploiting it.

Cyberattacks on industrial systems | Kaspersky official blog

Enoch Root — Fri, 17 Dec 2021 16:14:38 GMT

In June 2021, our specialists discovered new malware called PseudoManuscrypt. PseudoManuscrypt’s methods are fairly standard for spyware. It functions as a keylogger, gathers information about established VPN connections and saved passwords, steals clipboard contents, records sound using the built-in microphone (if the computer has one), and captures images. One variant can also steal the credentials of QQ and WeChat messengers, capture screen video and has a function that attempts disabling security solutions. Then it sends the data to the attackers’ server.

For the technical details of the attack and indicators of compromise, see our ICS CERT report.

Origin of the name

Our experts found some similarities between the new attack and the already known Manuscrypt campaign, but analysis revealed that a completely different actor, the APT41 group, had previously used part of the malware code in its attacks. We have yet to establish responsibility for the new attack, and for now we’re calling it PseudoManuscrypt.

How PseudoManuscrypt infects a system

Successful infection rests on a rather complex chain of events. The attack on a computer usually begins when the user downloads and executes a malware that imitates pirated install package for popular software.

You can find PseudoManuscrypt bait by searching the Internet for a pirated software. Websites that distribute malicious code matching popular queries rank high in search engine results, a metric attackers seem to monitor.

Here you can clearly see why there have been so many attempts to infect industrial systems. In addition to providing malware posing as popular software (such as office suites, security solutions, navigation systems, and 3D first-person shooters), the attackers also offer fake install packages for professional software, including certain utilities for interacting with programmable logic controllers (PLC) using the ModBus. The result: an abnormally high number of infected industrial control system (ICS) computers (7.2% of the total).

Search results for pirated software. PseudoManuscrypt can be found at the very first link. Sourse.

The example in the screenshot above features software for system administrators and network engineers. Theoretically such an attack vector could provide attackers with full access to the company’s infrastructure.

The attackers also use a Malware-as-a-Service (MaaS) delivery mechanism, paying other cybercriminals to distribute PseudoManuscrypt. That practice gave rise to an interesting feature our experts found when analyzing the MaaS platform: Sometimes PseudoManuscrypt was bundled with other malware that the victim installed as a single package. The purpose of PseudoManuscrypt is to spy, but other malicious programs seek other objectives, such as data encryption for money extortion.

Who is PseudoManuscrypt targeting?

The largest number of PseudoManuscrypt detections have occurred in Russia, India, Brazil, Vietnam, and Indonesia. Of the huge number of attempts to run malicious code, users at industrial organizations account for a significant share. Victims in this sector include managers of building automation systems, energy companies, manufacturers, construction companies, and even service providers for water treatment plants. In addition, an unusually large number of affected computers were involved in engineering processes, and in the production of new products in industrial companies.

Methods for defending against PseudoManuscrypt

For protection against PseudoManuscrypt you must have reliable and regularly updated protective solutions, and they must be installed on 100% of a company’s systems. In addition, we recommend instituting policies that make disabling protection difficult.

For IT systems in industry, we also offer a specialized solution, Kaspersky Industrial CyberSecurity, which both protects computers (including specialized ones) and monitors data transfers that use specific protocols.

Also keep in mind the importance of raising personnel awareness of cybersecurity risks. You can’t totally rule out the possibility of clever phishing attacks, but you can help staff stay alert, and also educate them about the danger of installing unauthorized (and especially pirated) software on computers with access to industrial systems.

Is Data Security Worthless if the Data Life Cycle Lacks Clarity?

François Amigorena, Founder & CEO, IS Decisions — Fri, 17 Dec 2021 15:00:00 GMT

If you cannot track, access, or audit data at every stage of the process, then you can't claim your data is secure.

How to respond if your firm is victim to a ransomware attack

Fri, 17 Dec 2021 13:30:06 GMT

Of cyberattack cases reported to Kroll in 2020, over a third involved ransomware

Meta bans seven private surveillance groups for using Facebook to spy on people worldwide

Fri, 17 Dec 2021 11:41:46 GMT

Targets include journalists, dissidents, human rights activists and critics of authoritarian regimes and their families

Khonsari ransomware exploiting Log4j bug to target Minecraft servers, Microsoft confirms

Fri, 17 Dec 2021 08:26:37 GMT

Researchers observe multiple attempts to deploy a Khonsari ransomware that hits Windows machines by making use of Log4Shell bug

Mobile App Developers Keep Fraudulent Traffic at Bay with Anti-Fraud API

Fahmida Y. Rashid, Features Editor, Dark Reading — Fri, 17 Dec 2021 00:32:02 GMT

The new API and SDK from Pixalate helps mobile developers avoid getting their apps delisted from app stores by detecting and blocking fraudulent traffic.

Episode 232: Log4j Won’t Go Away (And What To Do About It.)

Paul Roberts — Fri, 17 Dec 2021 00:02:00 GMT

In this episode of the podcast (#232), Tomislav Peričin of the firm ReversingLabs joins us to talk about Log4Shell, the vulnerability in the ubiquitous Log4j Apache library. Tomislav tells us why issues related to Log4j won’t be going away anytime soon and how organizations must adapt to deal with the risk it poses.

The post Episode 232: Log4j...

Read the whole entry... »

Click the icon below to listen.

Staging a Quack: Reverse Analyzing a Fileless QAKBOT Stager

Abraham Camba — Fri, 17 Dec 2021 00:00:00 GMT

We analyzed a fileless QAKBOT stager possibly connected to the recently reported Squirrelwaffle campaign.

Oracle WebLogic Detection and Mitigation

Jiri Sykora — Fri, 17 Dec 2021 00:00:00 GMT

We review 2020 and 2021 Oracle WebLogic vulnerabilities and how using a unified SaaS platform can help you detect and mitigate these sophisticated risks.

This Week in Security News - December 17, 2021

Jon Clay — Fri, 17 Dec 2021 00:00:00 GMT

This week, read on Purple Fox’s infection chain observed by Trend Micro’s Managed XDR. Also, learn about the Log4j vulnerability that has the potential to cause ‘incalculable’ damage.

Why Log4j Mitigation Is Fraught With Challenges

Jai Vijayan, Contributing Writer — Thu, 16 Dec 2021 23:15:00 GMT

The Log4j flaw exists in a component that is not always easy to detect and is widely used beyond an organization's own networks and systems.

Phorpiex Botnet Variant Spread Across 96 Countries

Dark Reading Staff, Dark Reading — Thu, 16 Dec 2021 21:15:00 GMT

A new variant dubbed "Twizt" has hijacked 969 transactions and stolen the equivalent of nearly $500,000 USD.

S3 Ep63: Log4Shell (what else?) and Apple kernel bugs [Podcast+Transcript]

Paul Ducklin — Thu, 16 Dec 2021 19:41:40 GMT

Latest episode - listen now! (Yes, there are plenty of critical things to go along with Log4Shell.)

The flawed cybersecurity of The Matrix | Kaspersky official blog

Nikolay Pankov — Thu, 16 Dec 2021 18:12:38 GMT

The Matrix trilogy (The Matrix, The Matrix Reloaded, The Matrix Revolutions) told of the successful implementation of the metaverse before the idea went mainstream. The creator of this virtual world (or, rather, neural-interactive simulation), we learn, was an artificial intelligence that once defeated and enslaved humanity. The process was not without bugs, which brings us to today’s topic.

For starters, between the limited data human characters have and the constant misinformation from the AI, viewers never know precisely what’s true, or how realistic their view of the world is at any given moment.

But we are not interested in philosophical subtext here; our focus is on information security, so we will rely on what are considered the established facts at the end of the third movie. Spoiler alert for anyone who hasn’t watched the whole trilogy but intends to.

Fighting the Zion Resistance

At the trilogy’s finale, it becomes clear that the struggle with rebels infiltrating the Matrix is all staged. For the latest cycle of rebellion to succeed, the Matrix needs a certain number of external enemies, so we don’t know for sure whether the agents are really trying to catch Morpheus and his team, or if they’re just simulating a frenzy of activity. From a cybersecurity perspective, it’s not clear whether we’re seeing bugs or features — a design flaw or something deliberately introduced into the Matrix (perhaps as a sort of honeypot).

Pirate signal from Resistance ships

The Matrix’s population consists of avatars of enslaved humans who are wired to the system, and of programs that originally existed in the form of code. Why remote broadcasting of signals from outside the system was initially implemented, allowing third-party avatars to be uploaded, remains unclear.

Such anomalies are usually a result of some sort of debug access that someone forgot to close, but in this case the developers were not human, so that explanation doesn’t fit. Anyway, even if they implemented remote connection on purpose — if it was a feature, not a bug — why didn’t the auto-programmers implement a firewall to block any pirate signals?

Uncontrolled avatar transmission system

Inside the Matrix, pirate avatars can appear and disappear only through phone cables (although how mobile and landline phones differ inside a virtual reality framework is not explained). Moreover, Matrix agents are, in principle, able to deactivate the line — at least, they cut it when Morpheus was captured. But if it is so critical for Matrix infiltration and exfiltration, why don’t the agents ban it, or at least disable it throughout the operation zone?

Incomplete addressing system

Despite the objective need for such information, the Matrix lacks precise location data for each specific object inside virtual reality. We can assume that pirate avatars are able to hide their location in virtual space, but to stay on the tail of the still-connected Neo in the system, agents needed an additional tracking device. There’s obviously a fault in the addressing system.

That raises questions about Morpheus’ notorious red pill. In his words, it is a tracking program “designed to disrupt your input/output carrier signals, so we can pinpoint your location.” Why isn’t the Matrix monitoring for such anomalies? Being able to intercept the “rescue team” seems pretty important.

Artificial constraints on Matrix Agents

Matrix agents are AIs that can temporarily replace the avatar of any human connected to the system. They can violate the conventional laws of physics, but only up to a point. The twins from the second part of the trilogy are far less impeded by physics, so why can’t such conditional constraints be lifted, at least temporarily, during the operation to capture perpetrators?
Adding to the mounting errors in their code, for some reason agents have the ability to disconnect from the Matrix information system simply by removing their earpieces, a clear vulnerability if ever there was one.

Zion mainframe codes

The whole point of the machines’ hunt for Morpheus in the first movie was to gain the access codes to the Zion mainframe, which every captain knows. That raises a host of questions about why the person with the access codes to the rebels’ critical infrastructure would also be the one who goes into the Matrix.

That point is especially strange if one recalls that there are people on board without any interface for connecting to the Matrix. Entrusting valuable information to them would obviously be far safer. It’s a misstep by the liberated humans, plain and simple: equivalent in today’s real world to attaching a sticky note with passwords to your monitor and then giving a TV interview with it in the background.

Rogue software

For some reason, the Matrix is unable to effectively get rid of programs that are no longer required. Lurking deep inside are various smart apps from old versions of the Matrix: information smugglers, semiphysical militants, a program called Seraph that defines its function as “I protect that which matters most” (a predictable slogan for any information security company).

According to the Oracle, they should all have been removed, but instead they chose to disconnect from the system and live autonomously inside the virtual reality. The existence of uncontrolled obsolete software is a clear vulnerability, just as it is in real life. They literally help hackers attack the Matrix!

Software smuggling

Some programs exist exclusively in the “world of machines” yet can be smuggled in to the virtual world of the Matrix, which human avatars can inhabit. The ability to bring in such programs highlights some serious system segmentation issues. In particular, a direct communication channel should not exist between two segments designed to be isolated.

Backdoor corridor

Among the exiles is the Keymaker program, which creates keys for backdoors. We don’t know to what extent the Keymaker actually is an exile — perhaps he, like the Oracle, is part of the system to control the rebels through the Chosen One. Not only does the Keymaker cut access keys using a file and a lathe, but it also informs hackers of the existence of a whole corridor of backdoors granting access to different parts of the Matrix, from the Core Network to the Source, the heart of the system. Both the Keymaker and the corridor pose a fundamental security threat to the entire system, especially considering how it’s protected against outsiders.

The main problem with the corridor’s security is that for some reason it exists according to the notional laws of the virtual world, depending on emulated power plants (that do not actually produce power) and computers at these virtual stations. And these laws in the Matrix, as we know, are notoriously easy to break. Even putting an agent in the corridor would be more effective — so why didn’t they? No money to pay its salary?

Clones of Agent Smith

Matrix agents originally had a feature that let them replace the avatar code of any hardwired human. However, agents have always existed as individual copies. At the end of the first movie, Neo, having acquired anomalous abilities, infiltrates Agent Smith and tries to destroy him from the inside, with some part of the code of Neo’s avatar being transferred into the agent’s code. After that, Smith goes haywire and gains the ability to bypass artificial constraints, both the laws of the physical world and the ban on existing in one copy. In other words, he becomes a full-fledged virus.

By all appearances, Smith is the first virus in the Matrix; otherwise, there is no explanation for why the system has no antivirus solution for tracking software anomalies, isolating and removing dangerous applications that threaten the security of the system. Considering that most of the people freed from the Matrix are hackers, we find that very odd.

Be that as it may, the existence of Smith, now able to copy his code into any avatar or program, serves as an argument in Neo’s negotiations with the AI. In the end, Neo physically connects to the Matrix, allows Smith to “infect” his avatar, connects to the Smith-net, and destroys all of the Smiths.

As a result, the machines agree to a truce, to stop exterminating humans, and even to release those who don’t want to live in the Matrix. But they could have just built a secure operating system from the start, or at least used a reliable security solution in combination with an EDR system capable of tracking network anomalies!

Log4Shell: The Big Picture

Richard Ford, Chief Technology Officer, Praetorian — Thu, 16 Dec 2021 18:00:00 GMT

A look at why this is such a tricky vulnerability and why the industry response has been good, but not great.

NY Man Pleads Guilty in $20 Million SIM Swap Theft

BrianKrebs — Thu, 16 Dec 2021 17:52:03 GMT

A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using fraudulent “SIM swaps,” scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identities.

Truglia admitted to a New York federal court that he let a friend use his account at crypto-trading platform Binance in 2018 to launder more than $20 million worth of virtual currency stolen from Michael Terpin, a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts.

Following the theft, Terpin filed a civil lawsuit against Truglia with the Los Angeles Superior court. In May 2019, the jury awarded Terpin a $75.8 million judgment against Truglia. In January 2020, a New York grand jury criminally indicted Truglia (PDF) for his part in the crypto theft from Terpin.

A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider’s network. Customers can legitimately request a SIM swap when their mobile device has been damaged or lost, or when they are switching to a different phone that requires a SIM card of another size.

Nicholas Truglia, holding bottle. Image: twitter.com/erupts

But fraudulent SIM swaps are frequently abused by scam artists who trick mobile providers into tying a target’s service to a new SIM card and mobile phone controlled by the scammers. Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target’s password, as many financial institutions and online services rely on text messages to send users a one-time code for multi-factor authentication.

Compounding the threat, many websites let customers reset their passwords merely by clicking a link sent via SMS to the mobile phone number tied to the account, meaning anyone who controls that phone number can reset the passwords for those accounts.

Reached for comment, Terpin said his assailant got off easy.

“I am outraged that after nearly four years and hundreds of pages of evidence that the best the prosecutors could recommend was a plea bargain for a single, relatively minor count of the unauthorized use of a Binance exchange account, when all the evidence points toward Truglia being one of two masterminds of a wide-ranging criminal conspiracy to steal crypto from me and others,” Terpin told KrebsOnSecurity.

Terpin said public court records already show Truglia bragging about stealing his funds and using it to finance a lavish lifestyle.

“He at the very least withdrew 100 bitcoin (worth $1.6 million at the time and nearly $5 million today) from my theft into his wallet at a separate, US-based exchange, and then moved or spent it,” Terpin said. “The fact is that the intentional theft of $24 million, whether taken at the point of a gun in a bank or through a SIM card swap, is a major felony. Truglia should be prosecuted to the fullest extent of the law.”

Nicholas Truglia, showing off a diamond-studded Piaget watch while aboard a private jet. Image: twitter.com/erupts.

Terpin also is waging an ongoing civil lawsuit against 18-year-old Ellis Pinsky, who’s accused of working with Truglia as part of a SIM swapping crew that has stolen more than $100 million in cryptocurrency. According to Terpin, Pinsky was 15 when he took part in the $24 million 2018 SIM swap, but he returned $2 million worth of cryptocurrency after being confronted by Terpin’s investigators.

“On the surface, Pinsky is an ‘All American Boy,'” Terpin’s civil suit charges. “The son of privilege, he is active in extracurricular activities and lives a suburban life with a doting mother who is a prominent doctor.”

“Despite their wholesome appearances, Pinsky and his other cohorts are in fact evil computer geniuses with sociopathic traits who heartlessly ruin their innocent victims’ lives and gleefully boast of their multi-million-dollar heists,” the lawsuit continues. “Pinsky is reputed to have used his ill-gotten gains to purchase multi-million-dollar watches and is known to go on nightclub sprees at high end clubs in New York City, and Truglia rented private jets and played the part of a dashing playboy with young women pampering him.”

Pinksy could not be immediately reached for comment. But a review of the latest filings in the lawsuit show that Pinsky’s attorneys stopped representing him because he no longer had the funds to pay for their services. The most recent entry in the New York Southern District’s docket asks the court to give Pinsky additional time to seek counsel, and hints that barring that he may end up representing himself.

Ellis Pinsky, in a photo uploaded to his social media profile.

Truglia is still being criminally prosecuted in Santa Clara, Calif., the home of the REACT task force, which pursues SIM-swapping cases nationwide. In November 2018, REACT investigators and New York authorities arrested Truglia on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from Robert Ross, a San Francisco father of two who later went on to found the victim advocacy website stopsimcrime.org.

According to published reports, Truglia and his accomplices also perpetrated SIM swaps against the CEO of the blockchain storage service 0Chain; hedge-funder Myles Danielson, vice president of Hall Capital Partners; and Gabrielle Katsnelson, the co-founder of the startup SMBX.

Truglia is currently slated to be sentenced in April 2022 for his guilty plea in New York. He faces a maximum sentence of up to 20 years in prison.

Erin West, deputy district attorney for Santa Clara County, told KrebsOnSecurity that SIM swapping remains a major problem. But she said many of the victims they’re now assisting are relatively new cryptocurrency investors for whom a SIM swapping attack can be financially devastating.

“Originally, the SIM swap targets were the early adopters of crypto,” West said. “Now we’re seeing a lot more of what I would call normal people trying their hand at crypto, and that makes a lot more people a target. It makes people who are unfamiliar with their personal security online vulnerable to hackers whose entire job is to figure out how to part people from their money.”

West said REACT continues to train state and local law enforcement officials across the country on how to successfully investigate and prosecute SIM swapping cases.

“The good news is our partners across the nation are learning how to conduct these cases,” she said. “Where this was a relatively new phenomenon three years ago, other smaller jurisdictions around the country are now learning how to prosecute this crime.”

All of the major wireless carriers let customers add security against SIM swaps and related schemes by setting a PIN that needs to be provided over the phone or in person at a store before account changes should be made. But these security features can be bypassed by incompetent or corrupt mobile store employees.

For some tips on how to minimize your chances of becoming the next SIM swapping victim, check out the “What Can You Do?” section at the conclusion of this story.

Free eBook! Ransomware – how to stop it, and how to survive an attack

Graham Cluley — Thu, 16 Dec 2021 16:10:07 GMT

Graham Cluley Security News is sponsored this week by the folks at Recorded Future. Thanks to the great team there for their support! Ransomware attacks dominate the cybersecurity news headlines, with businesses all over the world wondering if they will be the next victim. It’s a legitimate, and growing fear, as the attackers get more … Continue reading

More Log4j News

Bruce Schneier — Thu, 16 Dec 2021 15:50:29 GMT

Log4j is being exploited by all sorts of attackers, all over the Internet:

At that point it was reported that there were over 100 attempts to exploit the vulnerability every minute. “Since we started to implement our protection we prevented over 1,272,000 attempts to allocate the vulnerability, over 46% of those attempts were made by known malicious groups,” said cybersecurity company Check Point.

And according to Check Point, attackers have now attempted to exploit the flaw on over 40% of global networks.

And a second vulnerability was found, in the patch for the first vulnerability. This is likely not to be the last...

Dear Congress: It's Complicated. Please Consider This When Crafting New Cybersecurity Legislation

Lyndon Brown, Chief Strategy Officer, Pondurance — Thu, 16 Dec 2021 15:00:00 GMT

As mandatory reporting bills work their way through the halls of Congress, what should businesses do to prepare for this pending legislation?

The DHS is inviting hackers to break into its systems, but there are rules of engagement

Graham Cluley — Thu, 16 Dec 2021 14:45:51 GMT

The United States Department of Homeland Security (DHS) is inviting security researchers to uncover vulnerabilities and hack into its systems, in an attempt to better protect itself from malicious attacks. Read more in my article on the Tripwire State of Security blog.

Fat finger sells NFT for fraction of price | Kaspersky official blog

Jeffrey Esposito — Thu, 16 Dec 2021 11:55:41 GMT

This week on the Kaspersky Transatlantic Cable podcast, our good friend Ahmed is a bit under the weather, so we return temporarily to our original podcast lineup.

We jump right in with the story everyone’s been talking about: Log4J. We start out with an overview of what is going on there and then hop into a second story about botnets leveraging the vulnerability. After that, we discuss a case of fat fingers causing an NFT to be sold for $3,000 — sounds like no big deal, but it was valued at $300,000. Once that cheap sales went through, the item was flipped for a whole lot more money. Talk about an oopsie.

This log4j (CVE-2021-44228) vulnerability is extremely bad. Millions of applications use Log4j for logging, and all the attacker needs to do is get the app to log a special string. So far iCloud, Steam, and Minecraft have all been confirmed vulnerable.

— Marcus Hutchins (@MalwareTechBlog) December 10, 2021

From there, our discussion shifts to Instagram. Prior to its grilling by the US Congress, the social network announced some changes to the platform. The changes aim to improve users’ experiences and avoid some of the associated harms such as bullying, damage to self-image, and more. Dave and I debate a bit whether it’s just a PR stunt or something that will really benefit society.

Our fourth story has us diving into a lawsuit Google filed against some hackers. The problem is that it appears largely symbolic.

For our final story, we head to China, where a man stole more than $20,000 from an ex-girlfriend by unlocking her phone and bank account while she was sleeping — creepy! And to close out the podcast for the year, we offer some tips for anyone who gets new electronics over the holidays.

If you liked what you heard, please consider subscribing and sharing with your friends. For more information on the stories we covered, see the links below:

Irish health service missed several chances to stop devastating ransomware attack

Thu, 16 Dec 2021 09:30:48 GMT

Service has 'a very low level of cybersecurity maturity' finds PwC

Rise in API-Based Attacks Underscore Investments in New Tools

Fahmida Y. Rashid, Features Editor, Dark Reading — Thu, 16 Dec 2021 01:30:32 GMT

Noname Security's Series C fundraising tips the startup to over $1 billion in valuation -- a sign that organizations are beginning to look for API security tools and investors are looking for innovation in the space.

Smashing Security podcast #256: Virgin Media just won’t take no for an answer, NFT apes, and bad optics

Graham Cluley — Thu, 16 Dec 2021 00:08:09 GMT

After a brief discussion of the Log4Shell vulnerability panic, we chat about how Virgin Media has got itself into hot water, a fat-fingered fumble at the Bored Ape Yacht Club, and how to hack around your sleeping girlfriend's facial recognition. All this and more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Mark Stockley.

Original Fix for Log4j Flaw Fails to Fully Protect Against DoS Attacks, Data Theft

Jai Vijayan, Contributing Writer — Wed, 15 Dec 2021 23:11:32 GMT

Organizations should upgrade ASAP to new version of logging framework released Tuesday by the Apache Foundation, security experts say.

Companies Must Assess Threats to AI & ML Systems in 2022: Microsoft

Robert Lemos, Contributing Writer — Wed, 15 Dec 2021 23:09:30 GMT

Most companies lack the proper tools to assess their vulnerability to threats facing their AI systems and ML pipelines, prompting Microsoft to release a risk assessment framework.

Dept. of Homeland Security Launches 'Hack DHS' Program

Dark Reading Staff, Dark Reading — Wed, 15 Dec 2021 21:30:00 GMT

A new bug bounty program aims to find potential security flaws within certain DHS systems and strengthen the department's security posture.

Analysis: Log4j Vulnerability Highlights the Value of Defense-in-Depth, Accurate Inventory

Fernando Montenegro, Senior Principal Analyst, Omdia — Wed, 15 Dec 2021 20:13:59 GMT

The early lessons from Log4j indicate that key security principles can help better handle these high-risk software supply chain security incidents if teams have proper support.

Meta Expands Bug-Bounty Program to Include Data Scraping

Kelly Sheridan, Senior Editor — Wed, 15 Dec 2021 19:50:00 GMT

Scraping bugs and scraped databases are two new areas of research for the company's bug-bounty and data-bounty programs.

Cybereason Announces Availability of AI-Driven Cybereason XDR and EDR on Google Cloud Marketplace

Wed, 15 Dec 2021 19:35:00 GMT

Cloud-native platform automates prevention, detection, and response to cyberattacks.

Kroll Acquires Security Compass Advisory

Wed, 15 Dec 2021 19:30:00 GMT

Combined capabilities will help clients address the growing complexity of securing public, private and hybrid cloud, 5G, IoT, and industrial control systems

Privacy and Safety Issues With Facebook's New 'Metaventure'

Wed, 15 Dec 2021 18:00:00 GMT

With access to a user's 3D model and full-body digital tracking, attackers can recreate the perfect replica of a C-level executive to trick employees.

What Are the Pros and Cons of a SASE Architecture?

Shaila Shankar, SVP and General Manager, Cisco Cloud Network and Security — Wed, 15 Dec 2021 17:35:00 GMT

SASE is a promising and burgeoning networking architecture approach, but it's not without some challenges.

Why We Need "Developer-First" Application Security

Wed, 15 Dec 2021 15:36:12 GMT

The way to improve the security of the modern software development life cycle and reduce the number of application-based breaches is to re-center app security around the needs of developers.

Why Cloud Storage Isn't Immune to Ransomware

Shai Morag, CEO, Ermetic — Wed, 15 Dec 2021 15:00:00 GMT

Cloud security is a shared responsibility. which sometimes leads to security gaps and complexity in risk management.

Kryptowire Collaborates With Orange and Finds Vulnerabilities in Mobile Devices

Wed, 15 Dec 2021 14:00:00 GMT

Kryptowire’s end-to-end cybersecurity engine identified vulnerabilities granting system user-level privileges for arbitrary shell script execution.

Another Java Log4j vulnerability discovered

Wed, 15 Dec 2021 12:25:33 GMT

New flaw is much less severe than the Log4jshell vulnerability, but admins are advised to update Log4j once again

Norway fines Grindr £5.5 million for personal data sharing

Wed, 15 Dec 2021 11:31:02 GMT

From 2018-2020, users were forced to consent to a new privacy policy to continue using the app - which the Norwegian regulator has ruled as invalid

Securing NHS Trusts: what cyber solutions should be prioritised?

Wed, 15 Dec 2021 11:01:46 GMT

Four security vendors give their view on staffing issues, zero trust and threat intelligence

Microsoft fixes six zero-days in December Patch Tuesday update

Wed, 15 Dec 2021 08:11:06 GMT

One zero-day addressed has been observed in active attacks

Cisco's Ash Devata on Securing the Hybrid Workforce With Zero Trust

Edge Editors, Dark Reading — Wed, 15 Dec 2021 02:19:25 GMT

Hybrid work is here to stay, and organizations can apply zero trust's three core principles to ensure a secure workforce, Devata says.

Volatile and Adaptable: Tracking the Movements of Modern Ransomware

Trend Micro Research — Wed, 15 Dec 2021 00:00:00 GMT

Trend Micro's tracking of modern ransomware, as well as of older families, shows which attacks are gaining momentum and which families are particularly dangerous for enterprises and private users.

Tufin Introduces Security Policy Builder (SPB) App to Marketplace

Tue, 14 Dec 2021 23:54:22 GMT

Automates security policy design to ensure compliance and reduce likelihood of breach announcing significant updates to other marketplace apps.

Ground Labs Research Reveals 71% of American Consumers are Unaware of Data Protection Laws

Tue, 14 Dec 2021 23:52:11 GMT

Google Survey of 1,000 U.S. consumers uncovers data privacy disconnect, a call to action for businesses.

Attackers Target Log4j to Drop Ransomware, Web Shells, Backdoors

Jai Vijayan, Contributing Writer — Tue, 14 Dec 2021 23:18:58 GMT

Amid the increase in Log4j attack activity, at least one Iranian state-backed threat group is preparing to target the vulnerability, experts say.

Propane Gas Distributor Hit With Ransomware

Dark Reading Staff, Dark Reading — Tue, 14 Dec 2021 22:48:48 GMT

North America-based Superior Plus "temporarily disabled" some of its systems in the wake of the attack.

Ransomware Hits Virginia Legislative Agencies

Dark Reading Staff, Dark Reading — Tue, 14 Dec 2021 22:40:00 GMT

The attack forced a shutdown of computer systems and websites for Virginia legislative agencies and commissions, reports state.

Microsoft Patch Tuesday, December 2021 Edition

BrianKrebs — Tue, 14 Dec 2021 22:23:44 GMT

Microsoft, Adobe, and Google all issued security updates to their products today. The Microsoft patches include six previously disclosed security flaws, and one that is already being actively exploited. But this month’s Patch Tuesday is overshadowed by the “Log4Shell” 0-day exploit in a popular Java library that web server administrators are now racing to find and patch amid widespread exploitation of the flaw.

Log4Shell is the name picked for a critical flaw disclosed Dec. 9 in the popular logging library for Java called “log4j,” which is included in a huge number of Java applications. Publicly released exploit code allows an attacker to force a server running a vulnerable log4j library to execute commands, such as downloading malicious software or opening a backdoor connection to the server.

According to researchers at Lunasec, many, many services are vulnerable to this exploit.

“Cloud services like Steam, Apple iCloud, and apps like Minecraft have already been found to be vulnerable,” Lunasec wrote. “Anybody using Apache Struts is likely vulnerable. We’ve seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach. An extensive list of responses from impacted organizations has been compiled here.”

“If you run a server built on open-source software, there’s a good chance you are impacted by this vulnerability,” said Dustin Childs of Trend Micro’s Zero Day Initiative. “Check with all the vendors in your enterprise to see if they are impacted and what patches are available.”

Part of the difficulty in patching against the Log4Shell attack is identifying all of the vulnerable web applications, said Johannes Ullrich, an incident handler and blogger for the SANS Internet Storm Center. “Log4Shell will continue to haunt us for years to come. Dealing with log4shell will be a marathon,” Ullrich said. “Treat it as such.” SANS has a good walk-through of how simple yet powerful the exploit can be.

John Hultquist, vice president of intelligence analysis at Mandiant, said the company has seen Chinese and Iranian state actors leveraging the log4j vulnerability, and that the Iranian actors are particularly aggressive, having taken part in ransomware operations that may be primarily carried out for disruptive purposes rather than financial gain.

“We anticipate other state actors are doing so as well, or preparing to,” Hultquist said. “We believe these actors will work quickly to create footholds in desirable networks for follow-on activity, which may last for some time. In some cases, they will work from a wish list of targets that existed long before this vulnerability was public knowledge. In other cases, desirable targets may be selected after broad targeting.”

Researcher Kevin Beaumont had a more lighthearted take on Log4Shell via Twitter:

“Basically the perfect ending to cybersecurity in 2021 is a 90s style Java vulnerability in an open source module, written by two volunteers with no funding, used by large cybersecurity vendors, undetected until Minecraft chat got pwned, where nobody knows how to respond properly.”

The Cybersecurity and Infrastructure Security Agency (CISA) has joined with the FBI, National Security Agency (NSA) and partners abroad in publishing an advisory to help organizations mitigate Log4Shell and other Log4j-related vulnerabilities.

A half-dozen of the vulnerabilities addressed by Microsoft today earned its most dire “critical” rating, meaning malware or miscreants could exploit the flaws to gain complete, remote control over a vulnerable Windows system with little or no help from users.

The Windows flaw already seeing active exploitation is CVE-2021-43890, which is a “spoofing” bug in the Windows AppX installer on Windows 10. Microsoft says it is aware of attempts to exploit this flaw using specially crafted packages to implant malware families like Emotet, Trickbot, and BazaLoader.

Kevin Breen, director of threat research for Immersive Labs, said CVE-2021-43905 stands out of this month’s patch batch.

“Not only for its high CVSS score of 9.6, but also because it’s noted as ‘exploitation more likely’,” Breen observed.

Microsoft also patched CVE-2021-43883, an elevation of privilege vulnerability in Windows Installer.

“This appears to be a fix for a patch bypass of CVE-2021-41379, another elevation of privilege vulnerability in Windows Installer that was reportedly fixed in November,” Satnam Narang of Tenable points out. “However, researchers discovered that fix was incomplete, and a proof-of-concept was made public late last month.”

Google issued five security fixes for Chrome, including one rated critical and three others with high severity. If you’re browsing with Chrome, keep a lookout for when you see an “Update” tab appear to the right of the address bar. If it’s been a while since you closed the browser, you might see the Update button turn from green to orange and then red. Green means an update has been available for two days; orange means four days have elapsed, and red means your browser is a week or more behind on important updates. Completely close and restart the browser to install any pending updates.

Also, Adobe issued patches to correct more than 60 security flaws in a slew of products, including Adobe Audition, Lightroom, Media Encoder, Premiere Pro, Prelude, Dimension, After Effects, Photoshop, Connect, Experience Manager and Premiere Rush.

Standard disclaimer: Before you update Windows, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.

So do yourself a favor and backup before installing any patches. Windows 10 even has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.

And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see this guide.

If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.

Additional reading:

SANS ISC listing of each Microsoft vulnerability patched today, indexed by severity and affected component.

Tool Overload & Attack Surface Expansion Plague SOCs

Robert Lemos, Contributing Writer — Tue, 14 Dec 2021 22:15:43 GMT

Security professionals are burning out from handling too many tools and facing a growing number of threats, and more than 40% see lack of leadership as the main problem.

Microsoft Patches Zero-Day Spreading Emotet Malware

Kelly Sheridan, Senior Editor — Tue, 14 Dec 2021 21:30:00 GMT

The December rollout includes 67 security patches and addresses one zero-day and five more publicly known vulnerabilities.

Apple security updates are out – and not a Log4Shell mention in sight

Paul Ducklin — Tue, 14 Dec 2021 19:55:30 GMT

Get 'em while they're hot!

Malicious module in IIS Web server | Kaspersky official blog

Kaspersky Team — Tue, 14 Dec 2021 19:08:46 GMT

A malicious Internet Information Services (IIS) module is turning Outlook on the web into a tool for stealing credentials and a remote access panel. Unknown actors have used the module, which our researchers call OWOWA, in targeted attacks.

Why Outlook on the web attracts attackers

Outlook on the web (previously known as Exchange Web Connect, Outlook Web Access, and Outlook Web App, or simply OWA) is a Web-based interface for accessing Microsoft’s Personal Information Manager service. The app is deployed on Web servers running IIS.

Many companies use it to provide employees with remote access to corporate mailboxes and calendars without having to install a dedicated client. There are several methods of implementing Outlook on the web, one of which involves using Exchange Server on site, which is what cybercriminals are drawn to. In theory, gaining control of this app gives them access to all corporate correspondence, along with endless opportunities to expand their attack on the infrastructure and launch additional BEC campaigns.

How OWOWA works

OWOWA loads on compromised IIS Web servers as a module for all compatible apps, but its purpose is to intercept credentials entered into OWA. The malware checks requests and responses on Outlook on the Web login page, and if it sees a user has entered credentials and received an authentication token in response, it writes the username and password to a file (in encrypted form).

In addition, OWOWA allows attackers to control its functionality directly through the same authentication form. By entering certain commands into the username and password fields, an attacker can retrieve the harvested information, delete the log file, or execute arbitrary commands on the compromised server through PowerShell.

For a more detailed technical description of the module with indicators of compromise, see Securelist’s post.

Who are the victims of OWOWA attacks?

Our experts detected OWOWA-based attacks on servers in several Asian countries: Malaysia, Mongolia, Indonesia, and the Philippines. However, our experts have reason to believe the cybercriminals are also interested in organizations in Europe.

The majority of targets were government agencies, with at least one being a transport company (also state-owned).

How to guard against OWOWA

You can use the appcmd.exe command — or the regular IIS configuration tool — to detect the malicious OWOWA module (or any other third-party IIS module) on the IIS Web server. Keep in mind, however, that any Internet-facing server, like any computer, needs protection.

Upcoming Speaking Engagements

Schneier.com Webmaster — Tue, 14 Dec 2021 18:05:47 GMT

This is a current list of where and when I am scheduled to speak:

I’m speaking at the RSA Conference 2022 in San Francisco on February 8, 2022.
I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022.
I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn, Estonia on June 3, 2022.

The list is maintained on this page.

Source Code Leaks: The Real Problem Nobody Is Paying Attention To

Mackenzie Jackson, Developer Advocate, GitGuardian — Tue, 14 Dec 2021 18:00:00 GMT

Source code is a corporate asset like any other, which makes it an attractive target for hackers.

On the Log4j Vulnerability

Bruce Schneier — Tue, 14 Dec 2021 15:55:34 GMT

It’s serious:

The range of impacts is so broad because of the nature of the vulnerability itself. Developers use logging frameworks to keep track of what happens in a given application. To exploit Log4Shell, an attacker only needs to get the system to log a strategically crafted string of code. From there they can load arbitrary code on the targeted server and install malware or launch other attacks. Notably, hackers can introduce the snippet in seemingly benign ways, like by sending the string in an email or setting it as an account username.

Threat advisory from Cisco. Cloudflare found it in the wild before it was disclosed. CISA is very concerned, saying that hundreds of millions of devices are likely affected.

Combat Misinformation by Getting Back to Security Basics

Dan Spurling, Senior Vice President, Product Engineering, Teradata — Tue, 14 Dec 2021 15:00:00 GMT

One volley of fake news may land, but properly trained AI can shut down similar attempts at their sources.

Kronos ransomware restoration may take 'weeks'

Tue, 14 Dec 2021 07:29:36 GMT

The current guidance is to use 'alternative business continuity protocols'

Inside Ireland’s Public Healthcare Ransomware Scare

BrianKrebs — Tue, 14 Dec 2021 02:13:34 GMT

The consulting firm PricewaterhouseCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland’s public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial intrusion and the launching of the ransomware. It also found affected hospitals had tens of thousands of outdated Windows 7 systems, and that the health system’s IT administrators failed to respond to multiple warning signs that a massive attack was imminent.

PWC’s timeline of the days leading up to the deployment of Conti ransomware on May 14.

Ireland’s Health Service Executive (HSE), which operates the country’s public health system, got hit with Conti ransomware on May 14, 2021. A timeline in the report (above) says the initial infection of the “patient zero” workstation happened on Mar. 18, 2021, when an employee on a Windows computer opened a booby-trapped Microsoft Excel document in a phishing email that had been sent two days earlier.

Less than a week later, the attacker had established a reliable backdoor connection to the employee’s infected workstation. After infecting the system, “the attacker continued to operate in the environment over an eight week period until the detonation of the Conti ransomware on May 14, 2021,” the report states.

According to PWC’s report (PDF), there were multiple warnings about a serious network intrusion, but those red flags were either misidentified or not acted on quickly enough:

On Mar. 31, 2021, the HSE’s antivirus software detected the execution of two software tools commonly used by ransomware groups — Cobalt Strike and Mimikatz — on the Patient Zero Workstation. But the antivirus software was set to monitor mode, so it did not block the malicious commands.”
On May 7, the attacker compromised the HSE’s servers for the first time, and over the next five days the intruder would compromise six HSE hospitals. On May 10, one of the hospitals detected malicious activity on its Microsoft Windows Domain Controller, a critical “keys to the kingdom” component of any Windows enterprise network that manages user authentication and network access.
On 10 May 2021, security auditors first identified evidence of the attacker compromising systems within Hospital C and Hospital L. Hospital C’s antivirus software detected Cobalt Strike on two systems but failed to quarantine the malicious files.
On May 13, the HSE’s antivirus security provider emailed the HSE’s security operations team, highlighting unhandled threat events dating back to May 7 on at least 16 systems. The HSE Security Operations team requested that the Server team restart servers.

By then it was too late. At just after midnight Ireland time on May 14, the attacker executed the Conti ransomware within the HSE. The attack disrupted services at several Irish hospitals and resulted in the near complete shutdown of the HSE’s national and local networks, forcing the cancellation of many outpatient clinics and healthcare services. The number of appointments in some areas dropped by up to 80 percent.”

Conti initially demanded USD $20 million worth of virtual currency in exchange for a digital key to unlock HSE servers compromised by the group. But perhaps in response to the public outcry over the HSE disruption, Conti reversed course and gave the HSE the decryption keys without requiring payment.

Still, the work to restore infected systems would take months. The HSE ultimately enlisted members of the Irish military to bring in laptops and PCs to help restore computer systems by hand. It wasn’t until September 21, 2021 that the HSE declared 100 percent of its servers were decrypted.

As bad as the HSE ransomware attack was, the PWC report emphasizes that it could have been far worse. For example, it is unclear how much data would have been unrecoverable if a decryption key had not become available as the HSE’s backup infrastructure was only periodically backed up to offline tape.

The attack also could have been worse, the report found:

if there had been intent by the Attacker to target specific devices within the HSE environment (e.g. medical devices);
if the ransomware took actions to destroy data at scale;
if the ransomware had auto-propagation and persistence capabilities, for example by using an exploit to propagate across domains and trust-boundaries to medical devices (e.g. the EternalBlue exploit used by the WannaCry and NotPetya15 attacks);
if cloud systems had also been encrypted such as the COVID-19 vaccination system

The PWC report contains numerous recommendations, most of which center around hiring new personnel to lead the organization’s redoubled security efforts. But it is clear that the HSE has an enormous amount of work ahead to grow in security maturity. For example, the report notes the HSE’s hospital network had over 30,000 Windows 7 workstations that were deemed end of life by the vendor.

“The HSE assessed its cybersecurity maturity rating as low,” PWC wrote. “For example, they do not have a CISO or a Security Operations Center established.”

PWC also estimates that efforts to build up the HSE’s cybersecurity program to the point where it can rapidly detect and respond to intrusions are likely to cost “a multiple of the HSE’s current capital and operation expenditure in these areas over several years.”

One idea of a “security maturity” model.

In June 2021, the HSE’s director general said the recovery costs for the May ransomware attack were likely to exceed USD $600 million.

What’s remarkable about this incident is that the HSE is publicly funded by the Irish government, and so in theory it has the money to spend (or raise) to pay for all these ambitious recommendations for increasing their security maturity.

That stands in stark contrast to the healthcare system here in the United States, where the single biggest impediment to doing security well continues to be lack of making it a real budget priority. Also, most healthcare organizations in the United States are private companies that operate on razor-thin profit margins.

I know this because in 2018 I was asked to give the keynote at an annual gathering of the Healthcare Information Sharing and Analysis Group (H-ISAC), an industry group centered on sharing information about cybersecurity threats. I almost didn’t accept the invitation: I’d written very little about healthcare security, which seemed to be dominated by coverage of whether healthcare organizations complied with the letter of the law in the United States. That compliance centered on the Health Insurance Portability and Accountability Act (HIPAA), which prioritizes protecting the integrity and privacy of patient data.

To get up to speed, I interviewed over a dozen of the healthcare security industry’s best and brightest minds. A common refrain I heard from those interviewed was that if it was security-related but didn’t have to do with compliance, there probably wasn’t much chance it would get any budget.

Those sources unanimously said that however well-intentioned, it’s not clear that the “protect the data” regulatory approach of HIPPA was working from an overall threat perspective. According to HealthcareIT News, more than 40 million patient records have been compromised in incidents reported to the federal government in 2021 so far alone.

During my 2018 talk, I tried to emphasize the primary importance of being able to respond quickly to intrusions. Here’s a snippet of what I told that H-ISAC audience:

“The term ‘Security Maturity’ refers to the street smarts of an individual or organization, and this maturity generally comes from making plenty of mistakes, getting hacked a lot, and hopefully learning from each incident, measuring response times, and improving.

Let me say up front that all organizations get hacked. Even ones that are doing everything right from a security perspective get hacked probably every day if they’re big enough. By hacked I mean someone within the organization falls for a phishing scam, or clicks a malicious link and downloads malware. Because let’s face it, it only takes one screw up for the hackers to get a foothold in the network.

Now this is in itself isn’t bad. Unless you don’t have the capability to detect it and respond quickly. And if you can’t do that, you run the serious risk of having a small incident metastasize into a much larger problem.

Think of it like the medical concept of the ‘Golden Hour:’ That short window of time directly following a traumatic injury like a stroke or heart attack in which life-saving medicine and attention is likely to be most effective. The same concept holds true in cybersecurity, and it’s exactly why so many organizations these days are placing more of their resources into incident response, instead of just prevention.”

The United States’ somewhat decentralized healthcare system means that many ransomware outbreaks tend to be limited to regional or local healthcare facilities. But a well-placed ransomware attack or series of attacks could inflict serious damage on the sector: A December 2020 report from Deloitte says the top 10 health systems now control a 24 percent market share and their revenue grew at twice the rate of the rest of the market.

In October 2020, KrebsOnSecurity broke the story that the FBI and U.S. Department of Homeland Security had obtained chatter from a top ransomware group which warned of an “imminent cybercrime threat to U.S. hospitals and healthcare providers.” Members associated with the Russian-speaking ransomware group known as Ryuk had discussed plans to deploy ransomware at more than 400 healthcare facilities in the United States.

Hours after that piece ran, I heard from a respected H-ISAC security professional who questioned whether it was worth getting the public so riled up. The story had been updated multiple times throughout the day, and there were at least five healthcare organizations hit with ransomware within the span of 24 hours.

“I guess it would help if I understood what the baseline is, like how many healthcare organizations get hit with ransomware on average in one week?” I asked the source.

“It’s more like one a day,” the source confided.

In all likelihood, the HSE will get the money it needs to implement the programs recommended by PWC, however long that takes. I wonder how many U.S.-based healthcare organizations could say the same.

XDR: What It Is, What It Isn't

Zeki Turedi, CTO for EMEA, CrowdStrike — Tue, 14 Dec 2021 01:26:57 GMT

The three must-haves in eXtended Detection and Response are: making data accessible, facilitating real-time threat detection, and providing remediation strategies.

Collecting In the Dark: Tropic Trooper Targets Transportation and Government

Nick Dai — Tue, 14 Dec 2021 00:00:00 GMT

Our long-term monitoring of the cyberespionage group Earth Centaur (aka Tropic Trooper) shows that the threat actors are equipped with new tools and techniques. The group seems to be targeting transportation companies and government agencies related to transportation.

Tales from the Dark Web: Fingerprinting Access Brokers on Criminal Forums

Mon, 13 Dec 2021 23:52:24 GMT

Every high-profile breach leaves a trail of bread crumbs, and defenders who monitor access brokers can connect the dots and detect attacks as they unfold.

Log4Shell: The race is on to fix millions of systems and internet-connected devices

Graham Cluley — Mon, 13 Dec 2021 23:37:43 GMT

Everyone is talking about Log4Shell, a zero-day remote code execution exploit in versions of log4j, the popular open source Java logging library.

Why Classifying Ransomware as a National Security Threat Matters

Fahmida Y. Rashid, Features Editor, Dark Reading — Mon, 13 Dec 2021 23:10:59 GMT

Government actions help starve attack groups of the resources - money, ability to recruit, and time.

How Do I Find My Servers With the Log4j Vulnerability?

Fahmida Y. Rashid, Features Editor, Dark Reading — Mon, 13 Dec 2021 22:41:20 GMT

This Tech Tip outlines how enterprises can use Canarytokens to find servers in their organization vulnerable to CVE-2021-44228.

Volvo Confirms R&D Data Stolen in Breach

Dark Reading Staff, Dark Reading — Mon, 13 Dec 2021 22:15:00 GMT

The company confirmed last week that one of its file repositories was accessed by a third party.

Kronos Suffers Ransomware Attack, Expects Full Restoration to Take 'Weeks'

Dark Reading Staff, Dark Reading — Mon, 13 Dec 2021 21:45:00 GMT

Customers advised to adopt alternative internal processes to support the affected human resources services.

40% of Corporate Networks Targeted by Attackers Seeking to Exploit Log4j

Jai Vijayan, Contributing Writer — Mon, 13 Dec 2021 21:25:41 GMT

More than 60 variants of the original exploit were introduced over the last day alone.

Bug-Bounty Programs Shift Focus to Most Critical Flaws

Robert Lemos, Contributing Writer — Mon, 13 Dec 2021 21:10:58 GMT

The number of bug bounty programs jumped by a third, the median payout for a critical vulnerability report rose to $3,000, but rewards for easier-to-find lower-severity flaws stagnated in 2021.

Log4Shell explained – how it works, why you need to know, and how to fix it

Paul Ducklin — Mon, 13 Dec 2021 19:41:01 GMT

Find out how to deal with the Log4Shell vulnerability right across your estate. Yes, you need to patch, but that helps everyone else along with you!

Name That Toon: Modern-Day Frosty

John Klossner, Cartoonist — Mon, 13 Dec 2021 19:05:00 GMT

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Darktrace Reports Information Technology and Communications Sector Most Targeted by Cyberattackers in 2021

Mon, 13 Dec 2021 17:38:34 GMT

Most targeted industry shifts from the financial and insurance sector in 2020.

Kaspersky Opens Doors to New Transparency Center in North America

Mon, 13 Dec 2021 17:35:59 GMT

The opening marks the fifth center opened globally, fulfilling a key milestone within the Global Transparency Initiative.

2 Website Threats to Address for the Holiday Shopping Rush

Pedro Fortuna, CTO and Co-Founder, Jscrambler — Mon, 13 Dec 2021 15:15:00 GMT

Some tips for effectively combating Web supply chain attacks and customer hijacking via browser extensions.

Why the Private Sector Is Key to Stopping Russian Hacking Group APT29

Shmulik Yehezkel, Chief Critical Cyber Operations Officer & CISO, CYE — Mon, 13 Dec 2021 15:00:00 GMT

Left unchecked, these attacks could have devastating effects on government and military secrets and jeopardize the software supply chain and the global economy.

Why Cloud Service Providers Are a Single Point of Failure

Marc Wilczek, Digital Strategist & COO, Link11 — Mon, 13 Dec 2021 15:00:00 GMT

In a matter of days, a large-scale outage of cloud and other online services could cause $15 billion in losses.

Kaspersky opens Transparency Center in North America | Kaspersky official blog

Jeffrey Esposito — Mon, 13 Dec 2021 14:00:59 GMT

At the tail end of 2017, Eugene Kaspersky made a bold announcement: that we would be launching our Global Transparency Initiative. The program has since given our prospective customers, governments, and partners the unprecedented ability to inspect our source code.

Trust in cybersecurity being vital, the company knew transparency needed to be more than just words — and that revealing our source code in any way meant we needed extra levels of security. To address the first part, we decided to open up Transparency Centers around the world where the folks listed above could inspect our code in a safe and secure location. In addition to satisfying any concerns they had, they could also help further debunk media myths about backdoors or other nonsense. The first of the centers was in Zurich, Switzerland; others opened elsewhere in Europe as well as Latin America and Asia.

The latest is in Fredericton, New Brunswick, Canada. As a US citizen, I’m excited about this opening it’s just a short flight and drive away. To get a good look at any other centers would involve flying across the Atlantic! Aside from my general interest in checking out the center, I was pleased to sit down recently with Robert Cataldo, Kaspersky North America’s managing director, to discuss why our newest center is so important to the company’s business.

Jeff Esposito: Rob, can you tell us a bit about why transparency is important to Kaspersky?

Robert Cataldo: Transparency should be an important principle for every organization, but especially for those in cybersecurity. Industry, academia, government, and consumers trust us to protect their most precious and confidential information. To maintain and build this trust, we consider it essential to clearly communicate the transparency measures we’re taking and to allow interested stakeholders the opportunity to evaluate all aspects of our business practices and development procedures.

JE: This is the first Transparency Center on this side of the Atlantic; why is it important for the business — and why Canada?

RC: Our global vision for the formal transparency initiative established about four years ago included a physical transparency center in North America where interested parties could come and conduct code reviews or even be trained on what to look for during such reviews. We felt it important to deliver on this vision to ensure that we have accessible transparency centers for all the major regions around the world where we operate. We considered many factors when choosing the location for North America, but a big driver for being in New Brunswick became the partnership we could enter into with CyberNB, which now hosts our facility in its brand new Cyber Centre.

JE: What does this center mean for the business in the Americas?

RC: The center is a big step toward setting the right example in North America and creating a high standard of openness in our industry.

JE: What will a verified customer or partner get to experience in the Transparency Center?

RC: In addition to conducting a full review of our source code, rules, and code base updates, customers and partners can also be trained on the important elements to look for as part of our Cyber Capacity Building Program. Moreover, while there, we can also arrange for product briefings and/or demonstrations for anyone interested.

JE: What can we expect from our partnership with CyberNB? How does it help further the message of the GTI?

RC: CyberNB fosters collaboration, sharing, and improved cybermeasures among critical infrastructure, industry, academia, and government and holds a common vision with Kaspersky concerning the importance of transparency in our industry. They have their own transparency center in the Cyber Centre, which creates an opportunity for us to compare notes and help each other improve. CyberNB has also created a member program referred to as CIPNet, short for Critical Infrastructure Protection Network. Kaspersky is a proud member of CIPNet and we’ve already begun exploring synergies with other members to proliferate our transparency principles and further our mission of building a safer world for our partners and customers.

JE: Talk a bit about the Cyber Centre, the building that our Transparency Center is housed in. I heard you were able to visit and tour the facility. Is that correct?

RC: The Cyber Centre in Fredericton, New Brunswick is brand-new, and I was fortunate enough to be invited to tour the facility in early December. The center is a modern, world-class building with a well-planned layout for large briefings, small business collaborations, transparency reviews, product certifications, trainings, and all kinds of business events. The center also houses CyberNB’s critical infrastructure SOC, which features large displays of the various forms of threat intelligence — including Kaspersky’s own threat data feeds — and security tools CIPNet members can take advantage of.

Access to the Transparency Center is available on request. To learn more about Kaspersky’s Global Transparency Initiative, please visit its website.

Indian PM Narendra Modi's Twitter account hacked to declare bitcoin legal tender

Mon, 13 Dec 2021 12:25:03 GMT

The incident comes at the time when the government is reportedly working on a Bill to ban 'all private cryptocurrencies' in the country with 'certain exceptions'

NSO Group’s Pegasus Spyware Used Against US State Department Officials

Bruce Schneier — Mon, 13 Dec 2021 12:16:44 GMT

NSO Group’s descent into Internet pariah status continues. Its Pegasus spyware was used against nine US State Department employees. We don’t know which NSO Group customer trained the spyware on the US. But the company does:

NSO Group said in a statement on Thursday that it did not have any indication their tools were used but canceled access for the relevant customers and would investigate based on the Reuters inquiry.

“If our investigation shall show these actions indeed happened with NSO’s tools, such customer will be terminated permanently and legal actions will take place,” said an NSO spokesperson, who added that NSO will also “cooperate with any relevant government authority and present the full information we will have.”...

Germany's new government vows to support end-to-end encryption while UK looks to undermine it

Mon, 13 Dec 2021 10:18:24 GMT

Germany's approach is the opposite to what British government thinks about the use of encryption on digital platforms

Patch Now: Apache Log4j Vulnerability Called Log4Shell Actively Exploited

Ranga Duraisamy — Mon, 13 Dec 2021 00:00:00 GMT

Log4Shell., also known as CVE-2021-44228, was first reported privately to Apache on November 24 and was patched with version 2.15.0 of Log4j on December 9. It affects Apache Struts, Apache Solr, Apache Druid, Elasticsearch, Apache Dubbo, and VMware vCenter.

A Look Into Purple Fox’s Server Infrastructure

Jay Yaneza — Mon, 13 Dec 2021 00:00:00 GMT

By examining Purple Fox’s routines and activities, both with our initial research and the subject matter we cover in this blog post, we hope to help incident responders, security operation centers (SOCs), and security researchers find and weed out Purple Fox infections in their network.

Why You Need XDR in Today's Threat Landscape

Jon Clay — Mon, 13 Dec 2021 00:00:00 GMT

Trend Micro's VP of Threat Intelligence, Jon Clay, explores the latest trends in today's threat landscape and why XDR is key to enabling more resilience.

Log4Shell: critical vulnerability in Apache Log4j | Kaspersky official blog

Nikolay Pankov — Sat, 11 Dec 2021 14:47:22 GMT

Various information security news outlets reported on the discovery of critical vulnerability CVE-2021-44228 in the Apache Log4j library (CVSS severity level 10 out of 10). Millions of Java applications use this library to log error messages. To make matters worse, attackers are already actively exploiting this vulnerability. For this reason, the Apache Foundation recommends all developers to update the library to version 2.15.0, and if this is not possible, use one of the methods described on the Apache Log4j Security Vulnerabilities page.

Why CVE-2021-44228 is so dangerous

CVE-2021-44228, also named Log4Shell or LogJam, is a Remote Code Execution (RCE) class vulnerability. If attackers manage to exploit it on one of the servers, they gain the ability to execute arbitrary code and potentially take full control of the system.

What makes CVE-2021-44228 especially dangerous is the ease of exploitation: even an inexperienced hacker can successfully execute an attack using this vulnerability. According to the researchers, attackers only need to force the application to write just one string to the log, and after that they are able to upload their own code into the application due to the message lookup substitution function.

Working Proofs of Concept (PoC) for the attacks via CVE-2021-44228 are already available on the Internet. Therefore, it’s not surprising that cybersecurity companies are already registering massive network scans for vulnerable applications as well as attacks on honeypots.

This vulnerability was discovered by Chen Zhaojun of Alibaba Cloud Security Team.

What is Apache Log4J and why is this library is so popular?

Apache Log4j is part of the Apache Logging Project. By and large, usage of this library is one of the easiest ways to log errors, and that is why most Java developers use it.

Many large software companies and online services use the Log4j library, including Amazon, Apple iCloud, Cisco, Cloudflare, ElasticSearch, Red Hat, Steam, Tesla, Twitter, and many more. Because of the library being so popular, some information security researchers expect a significant increase in the attacks on vulnerable servers over the coming days.

#Log4Shell pic.twitter.com/1bKDwRQBqt

— Florian Roth ⚡️ (@cyb3rops) December 10, 2021

Which versions of the Log4j library is vulnerable and how can you protect your servers from attack?

Almost all versions of Log4j are vulnerable, starting from 2.0-beta9 to 2.14.1. The simplest and most effective protection method is to install the most recent version of the library, 2.15.0. You can download it on the project page.

If for some reason updating the library is not possible, Apache Foundation recommends using one of the mitigation methods. In case of Log4J versions from 2.10 to 2.14.1, they advise setting the log4j2.formatMsgNoLookups system property, or setting the LOG4J_FORMAT_MSG_NO_LOOKUPS environment variable to true.

To protect earlier releases of Log4j (from 2.0-beta9 to 2.10.0), the library developers recommend removing the JndiLookup class from the classpath: zip -q -d log4j-core – *. Jar org / apache / logging / log4j / core / lookup / JndiLookup .class.

In addition, we recommend to install security solutions on your servers — in many cases this will allow you to detect the launch of malicious code and stop the attack’s development.

You can find more information about Log2shell vulnerabilities here:

The Log4Shell Vulnerability – explained: how to stay secure from Kaspersky

What to Do While Waiting for the Log4j Updates

Fahmida Y. Rashid, Features Editor, Dark Reading — Sat, 11 Dec 2021 04:06:54 GMT

This Tech Tip outlines how enterprise defenders can mitigate the risks of the Log4j vulnerabilities for the short-term while waiting for updates.

Friday Squid Blogging: The Far Side Squid Comic

Bruce Schneier — Fri, 10 Dec 2021 22:05:35 GMT

The Far Side is always good for a squid reference. Here’s a recent one.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

Security Experts Sound Alarm on Zero-Day in Widely Used Log4j Tool

Jai Vijayan, Contributing Writer — Fri, 10 Dec 2021 22:00:00 GMT

A remote code execution vulnerability in Log4j presents a bigger threat to organizations than even the infamous 2017 Apache Struts vulnerability that felled Equifax, they say.

NIST Cyber-Resiliency Framework Extended to Include Critical Infrastructure Controls

Edge Editors, Dark Reading — Fri, 10 Dec 2021 21:47:43 GMT

The latest NIST publication outlines how organizations can build systems that can anticipate, withstand, recover from, and adapt to cyberattacks.

Russian National Sentenced for Role in Kelihos Botnet

Dark Reading Staff, Dark Reading — Fri, 10 Dec 2021 20:50:00 GMT

Oleg Koshkin was sentenced for running a crypting service used to hide the Kelihos malware from antivirus software.

Episode 231: Solving the US’s Endemic Cybersecurity Worker Shortage

Paul Roberts — Fri, 10 Dec 2021 19:30:07 GMT

Rodney Petersen, the director of the National Initiative for Cybersecurity Education (NICE) talks about the massive shortage of information security workers at the United States - estimated at more than 400,000 workers.

The post Episode 231: Solving the US’s Endemic Cybersecurity Worker Shortage appeared first on The Security Ledger with Paul F....

Read the whole entry... »

Click the icon below to listen.

“Log4Shell” Java vulnerability – how to safeguard your servers

Paul Ducklin — Fri, 10 Dec 2021 19:22:03 GMT

Just when you thought it was safe to relax for the weekend... a critical bug showed up in Apache's Log4j product

Identity Authentication Access Market Set to Hit $28.9B in 2021

Don Tait, Senior Analyst, Omdia — Fri, 10 Dec 2021 18:48:59 GMT

With more staff working remotely, identity, authentication, and access (IAA) has never been more important. Market forecasts, drivers, and trends are explored.

Five steps to prevent burnout in SOC teams | Kaspersky official blog

Sergey Soldatov — Fri, 10 Dec 2021 17:37:23 GMT

Between the monotony of painstakingly searching for anomalies and the enormous responsibility of ensuring a company’s security, security operations center (SOC) employees endure constant stress. My hope is that sharing my experience as the head of a SOC that provides managed detection and response (MDR) service can help shed some light on SOCs in general, so I’d like to share my five steps to minimize stress and prevent burnout in the SOC.

Step one: Complete the team

Organizing your team is key. You need enough people to keep up with the work but not so many that they end up bored. You’re looking for a balance, and finding it is no mystery.

To begin, define the scope of the work you need and then break down the roles you need to fill: what security services you need in house and what to outsource. Use that breakdown to sketch out your target head count, keeping in mind that you’ll need internal professionals to manage outsourced functions;

Start with six people, which is really the minimum a SOC needs to operate. That’s two for monitoring, one for investigation, one to function as architect and engineer, an administrator, and a SOC manager;
Think in advance about mitigating the negative impact of turnover to minimize the effects of workload increases on team members.

Step two: Make work rewarding

Effective work tends to require motivation. Of course, you need to provide the conditions for growth and comfortable work, but also consider the very obtrusive potential of demotivating factors — so, for example, think about ways to make goals transparent and assessments clear and reasonable. People strive to reach new professional heights, and they excel when they find the work rewarding.

Encourage leaders and reward effort rather than silencing newcomers or punishing failure;
Ensure good working conditions, including adequate wages and benefits, social programs, time for physical activities, and healthy team relationships;
Clarify goals, objectives, and the metrics by which you and the company measure employees’ work;
Specify a transparent career path, making sure colleagues understand which team is responsible for what and how to achieve promotions or transfers.

Step three: Relieve stress

The job of a SOC analyst is stressful all by itself, making any pressure reduction particularly important. You can’t make the job a cakewalk, but you can take a few simple steps to help ease SOC workers’ loads.

Let employees manage their own time. As long as having flexible hours doesn’t affect performance — which you addressed in step two — it shouldn’t cause any trouble;
Exchange feedback with your team. Transparency and trust go both ways;
Support your team. Workers should feel confident in the face of difficult situations and expect help from management or dedicated experts.

Step four: Inspire your teammates

Working in a SOC means being part of a team. Devote some time to analyzing the team, seeking optimal combinations of employees, understanding what tasks each of them performs best, and bolstering team spirit.

Give employees varied, nonstandard tasks from time to time. That serves the dual purpose of keeping them interested and helping you learn each team member’s strengths and preferences;
Give each team member a sphere of responsibility so they know their contributions are important and valuable;
Provide opportunities for professional development, including networking and participation in training courses or webinars;
Conduct collaborative team-building activities. As a manager, you may find the different structure of collaboration outside of a work environment reveals qualities that contribute to the team’s productivity.

Step five: Minimize routine

Overreliance on routine is a major contributor to burnout. Now, as I said at the start, monotony is part of the job, and you cannot get rid of most routine processes. That said, you can at least minimize the harm with a bit of intelligent outsourcing and task automation.

Engage outside specialists in routine activities or tasks where sensible and productive;
Implement tools and services to facilitate common IT security practices;
Continuously research new areas, and automate everything you can.

Reallocating resources and tasks is never easy or automatic. Although offloading work sounds appealing, first consider the importance of keeping employees interested and motivated. Some functions may need to stay in-house for legal or other reasons, and for those that can move outside, you’ll need to ensure contracts clarify liability and consequences, not just responsibility. And before automating certain tasks, analyze the relevant work processes, consider user feedback, and identify any problems on the team to develop a realistic and appropriate plan.

You can find more advice on achieving a better balance between employee well-being, productivity and safety in our study Employee wellbeing 2021: Learning from the new reality.

Dark Reading Reflects on a Legacy and Life Well-Written: Tim Wilson

Dark Reading Staff, Dark Reading — Fri, 10 Dec 2021 17:00:00 GMT

The Dark Reading editorial team, along with contributing writers and editors, share their favorite stories and memories of co-founder and editor-in-chief Tim Wilson, an influential editor and well-respected thought leader in the cybersecurity industry.

'Especially dangerous' Java zero day discovered, same type as used in Equifax breach

Fri, 10 Dec 2021 15:27:53 GMT

Patch Log4j urgently admins urged, as memories of 2017 Equifax hack loom large

The Vulnerability Lag: Cut Ransomware Risks Resulting From Digital Transformation

Sonya Duffin, Ransomware and Data Protection Expert, Veritas Technologies — Fri, 10 Dec 2021 15:00:00 GMT

Exploring ransomware and other data integrity risks from accelerated digital transformation in the wake of COVID-19.

New Firefox Sandbox Isolates Third-Party Libraries

Fahmida Y. Rashid, Features Editor, Dark Reading — Fri, 10 Dec 2021 12:38:27 GMT

RLBox can be used to protect web browsers and other software applications from vulnerabilities in subcomponents and libraries.

Law Enforcement Access to Chat Data and Metadata

Bruce Schneier — Fri, 10 Dec 2021 12:37:29 GMT

A January 2021 FBI document outlines what types of data and metadata can be lawfully obtained by the FBI from messaging apps. Rolling Stone broke the story and it’s been written about elsewhere.

I don’t see a lot of surprises in the document. Lots of apps leak all sorts of metadata: iMessage and WhatsApp seem to be the worst. Signal protects the most metadata. End-to-end encrypted message content can be available if the user uploads it to an unencrypted backup server.

EDITED TO ADD (12/13): Here’s a more legible copy of the text.

...

Hackers are targeting over a million WordPress sites in ongoing attacks

Fri, 10 Dec 2021 12:37:01 GMT

They are exploiting security bugs in four WordPress plugins and 15 Epsilon Framework themes

This Week in Security News - December 10, 2021

Jon Clay — Fri, 10 Dec 2021 00:00:00 GMT

This week, read about Trend Micro’s predictions for security in the coming year. Also, learn about the Biden administration’s latest initiatives for curtailing attacks on the transport infrastructure.

New Yanluowang Ransomware Found to be Code-Signed, Terminates Database-Related Processes

Don Ovid Ladores — Fri, 10 Dec 2021 00:00:00 GMT

We analyzed new samples of the Yanluowang ransomware. One interesting aspect of these samples is that the files are code-signed. They also terminate various processes which are related to database and backup management.

How Zero Trust and XDR Work Together

Fri, 10 Dec 2021 00:00:00 GMT

As the Zero Trust approach gains momentum, more organizations are looking to apply it to their security strategy. Learn how XDR and Zero Trust work together to enhance your security posture.

Broadcom Inc. Announces $10 Billion Share Repurchase Authorization

Thu, 09 Dec 2021 23:58:26 GMT

The authorization is effective until December 31, 2022.

Emotet Is Back and More Dangerous Than Before

Jai Vijayan, Contributing Writer — Thu, 09 Dec 2021 23:30:22 GMT

Volume of traffic associated with the malware is now back at 50% of the volume before law enforcement took the botnet operation down in January 2021, security vendor says.

Why Red Teaming While Black Can Be Risky

Williesha Morris, Contributing Writer — Thu, 09 Dec 2021 23:27:18 GMT

Penetration audits can be dangerous for people of color. Here is how to keep Black and brown cybersecurity professionals safe during red team engagements.

Researchers Explore Microsoft Outlook Phishing Techniques

Kelly Sheridan, Senior Editor — Thu, 09 Dec 2021 22:30:53 GMT

Outlook features intended to improve collaboration and productivity may make social engineering attacks more effective, researchers find.

Lack of Patching Leaves 300,000 Routers at Risk for Attack

Robert Lemos, Contributing Writer — Thu, 09 Dec 2021 22:25:49 GMT

A significant percentage of the 2 million consumer and small-business routers produced by a Latvian firm are vulnerable and being used by attackers, a security firm says.

S3 Ep62: The S in IoT stands for security (and much more) [Podcast+Transcript]

Paul Ducklin — Thu, 09 Dec 2021 19:40:01 GMT

Listen now or read as an article! (Full transcript inside.)

One-Third of Phishing Pages Active Less Than a Day

Dark Reading Staff, Dark Reading — Thu, 09 Dec 2021 18:15:34 GMT

Security experts say the first hours in a phishing page's life are the most dangerous for users.

LastPass Announces New Integration with Google Workspace

Thu, 09 Dec 2021 16:47:51 GMT

The latest integration furthers the company’s mission to provide an unmatched security model for businesses, without adding complexity for users.

Google Shuts Down Glupteba Botnet, Sues Operators

Bruce Schneier — Thu, 09 Dec 2021 15:36:22 GMT

Google took steps to shut down the Glupteba botnet, at least for now. (The botnet uses the bitcoin blockchain as a backup command-and-control mechanism, making it hard to get rid of it permanently.) So Google is also suing the botnet’s operators.

It’s an interesting strategy. Let’s see if it’s successful.

How to Build a Better Internal Fraud Protection Program

Timothy Ball, Executive Vice President, The Bonadio Group — Thu, 09 Dec 2021 14:00:00 GMT

Fraud awareness training is just the beginning.

The Executive Women's Forum on Information Security, Risk Management & Privacy Presents the Leadership Scholarship

Thu, 09 Dec 2021 13:50:00 GMT

Scholarship's goal is to advance women in cybersecurity, risk, and privacy.

IRONSCALES Raises $64 Million in Series C Funding Round Led by PSG

Thu, 09 Dec 2021 13:45:00 GMT

Investment aims to accelerate growth through continued product innovation and global expansion.

Intel 471 Forms Tech Alliance With CyCognito

Thu, 09 Dec 2021 13:40:00 GMT

Enterprises will see improved access to data and more relevant insights that will enable them to further strengthen their cybersecurity postures.

(ISC)² Welcomes Students to Apply for its Undergraduate, Graduate, and Women's Cybersecurity Scholarships

Thu, 09 Dec 2021 13:35:00 GMT

Scholarships are part of an effort to bridge the cybersecurity workforce gap.

Zscaler Extends Zero Trust Exchange Platform to Deliver Zero Trust for Workloads

Thu, 09 Dec 2021 13:30:00 GMT

Solution secures cloud-to-Internet, cloud-to-cloud, cloud-to-data center, and intra-cloud communications.

Smashing Security podcast #255: Revolting receipts, a Twitter fandango, and shopkeeper cyber tips

Graham Cluley — Thu, 09 Dec 2021 13:13:38 GMT

"Demonically" possessed devices print out antiwork propaganda, advice on how to secure your store, and is Twitter's new photo privacy policy practical? All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Dinah Davis.

UK and US seek to develop deeper data-sharing partnership

Thu, 09 Dec 2021 12:59:49 GMT

Nations want to collaborate on the creation of next-gen tools that shape new global rules on data use

Ransomware damages expected to exceed £15 billion by end of year, report

Thu, 09 Dec 2021 10:27:38 GMT

Cybercriminals now try to use MSPs' own internal tools against them

Microsoft seizes control of 42 domains used by China-based Nickel hacking group

Thu, 09 Dec 2021 07:50:06 GMT

The company is now directing Nickel's traffic to its own servers

The Evolution of IoT Linux Malware Based on MITRE ATT&CK TTPs

Veronica Chierzi — Thu, 09 Dec 2021 00:00:00 GMT

In our study, we relied on the tactics, techniques, and procedures of MITRE ATT&CK to define the malware capabilities and characteristics of IoT Linux malware. We describe our findings and how IoT malware has been evolving.

Top 10 Azure Cloud Configuration Mistakes

Thu, 09 Dec 2021 00:00:00 GMT

Trend Micro Research determined the top 10 Azure services with the highest configuration rates.

Canada Charges Its “Most Prolific Cybercriminal”

BrianKrebs — Wed, 08 Dec 2021 23:27:40 GMT

A 31-year-old Canadian man has been arrested and charged with fraud in connection with numerous ransomware attacks against businesses, government agencies and private citizens throughout Canada and the United States. Canadian authorities describe him as “the most prolific cybercriminal we’ve identified in Canada,” but so far they’ve released few other details about the investigation or the defendant. Helpfully, an email address and nickname apparently connected to the accused offer some additional clues.

Matthew Philbert, in 2016.

Matthew Philbert of Ottawa, Ontario was charged with fraud and conspiracy in a joint law enforcement action by Canadian and U.S. authorities dubbed “Project CODA.” The Ontario Provincial Police (OPP) on Tuesday said the investigation began in January 2020 when the U.S. Federal Bureau of Investigation (FBI) contacted them regarding ransomware attacks that were based in Canada.

“During the course of this investigation, OPP investigators determined an individual was responsible for numerous ransomware attacks affecting businesses, government agencies and private individuals throughout Canada as well as cyber-related offenses in the United States,” reads an OPP statement.

“A quantity of evidentiary materials was seized and held for investigation, including desktop and laptop computers, a tablet, several hard drives, cellphones, a Bitcoin seed phrase and a quantity of blank cards with magnetic stripes,” the statement continues.

The U.S. indictment of Philbert (PDF) is unusually sparse, but it does charge him with conspiracy, suggesting the defendant was part of a group. In an interview with KrebsOnSecurity, OPP Detective Inspector Matt Watson declined to say whether other defendants were being sought in connection with the investigation, but said the inquiry is ongoing.

“I will say this, Philbert is the most prolific cybercriminal we’ve identified to date in Canada,” Watson said. “We’ve identified in excess of a thousand of his victims. And a lot of these were small businesses that were just holding on by their fingernails during COVID.”

A DARK CLOUD

There is a now-dormant Myspace account for a Matthew Philbert from Orleans, a suburb of Ottawa, Ontario. The information tied to the Myspace account matches the age and town of the defendant. The Myspace account was registered under the nickname “Darkcloudowner,” and to the email address dark_cl0ud6@hotmail.com.

A search in DomainTools on that email address reveals multiple domains registered to a Matthew Philbert and to the Ottawa phone number 6138999251 [DomainTools is a frequent advertiser on this site]. That same phone number is tied to a Facebook account for a 31-year-old Matthew Philbert from Orleans, who describes himself as a self-employed “broke bitcoin baron.”

Mr. Philbert did not respond to multiple requests for comment.

According to cyber intelligence firm Intel 471, that dark_cl0ud6@hotmail.com address has been used in conjunction with the handle “DCReavers2” to register user accounts on a half-dozen English-language cybercrime forums since 2008, including Hackforums, Blackhatworld, and Ghostmarket.

Perhaps the earliest and most important cybercrime forum DCReavers2 frequented was Darkode, where he was among the first two-dozen members. Darkode was taken down in 2015 as part of an FBI investigation sting operation, but screenshots of the community saved by this author show that DCReavers2 was already well known to the Darkode founders when his membership to the forum was accepted in May 2009.

DCReavers2 was just the 22nd account to register on the Darkode cybercrime forum.

Most of DCReavers’s posts on Darkode appear to have been removed by forum administrators early on (likely at DCReavers’ request), but the handful of posts that survived the purge show that more than a decade ago DCReavers2 was involved in running botnets, or large collections of hacked computers.

“My exploit pack is hosted there with 0 problems,” DCReaver2 says of a shady online provider that another member asked about in May 2010.

Searching the Web on “DCreavers2” brings up a fascinating chat conversation allegedly between DCReavers2 and an individual in Australia who was selling access to an “exploit kit,” commercial crimeware designed to be stitched into hacked or malicious sites and exploit a variety of Web-browser vulnerabilities for the purposes of installing malware of the customer’s choosing.

In that 2009 chat, indexed by the researchers behind the website exposedbotnets.com, DCReavers2 uses the Dark_Cl0ud6 email address and actually shares his real name as Matthew Philbert. DCReavers2 also says his partner uses the nickname “The Rogue,” which corresponds to a former Darkode administrator who was the second user ever registered on the forum (see screenshot above).

In that same conversation, DCReavers2 discusses managing a botnet built on ButterFly Bot. Also known as “Mariposa,” ButterFly was a plug-and-play malware strain that allowed even the most novice of would-be cybercriminals to set up a global operation capable of harvesting data from thousands of infected PCs, and using the enslaved systems for crippling attacks on Web sites. The ButterFly Bot kit sold for prices ranging from $500 to $2,000.

An advertisement for the ButterFly Bot.

The author of ButterFly Bot — Slovenian hacker Matjaz “Iserdo” Skorjanc — was Darkode’s original founder back in 2008. Arrested in 2010, Skorjanc was sentenced to nearly five years in prison for selling and supporting Mariposa, which was used to compromise millions of Microsoft Windows computers.

Upon release from prison, Skorjanc became chief technology officer for NiceHash, a cryptocurrency mining service. In December 2017, $52 million worth of Bitcoin mysteriously disappeared from NiceHash coffers. In October 2019, Skorjanc was arrested in Germany in response to a U.S.-issued international arrest warrant for his extradition.

The indictment (PDF) tied to Skorjanc’s 2019 arrest also names several other alleged founding members of Darkode, including Thomas “Fubar” McCormick, a Massachusetts man who was allegedly one of the last administrators of Darkode. Prosecutors say McCormick also was a reseller of the Mariposa botnet, the ZeuS banking trojan, and a bot malware he allegedly helped create called “Ngrbot.” The U.S. federal prosecution against Skorjanc and McCormick is ongoing.

At the time the FBI dismantled Darkode in 2015, the Justice Department said that out of 800 or so crime forums worldwide, Darkode was the most sophisticated English-language forum, and that it represented “one of the gravest threats to the integrity of data on computers in the United States and around the world.”

Some of Darkode’s core members were either customers or sellers of various “locker” kits, which were basically web-based exploits that would lock the victim’s screen into a webpage spoofing the FBI or Justice Department and warning that victims had been caught accessing child sexual abuse material. Victims who agreed to pay a “fine” of several hundred dollars worth of GreenDot prepaid cards could then be rid of the PC locker program.

A 2012 sales thread on Darkode for Rev Locker.

In many ways, lockers were the precursors to the modern cybercrime scourge we now know as ransomware. The main reason lockers never took off as an existential threat to organizations worldwide was that there is only so much money locker users could reasonably demand via GreenDot cards.

But with the ascendance and broader acceptance of virtual currencies like Bitcoin, suddenly criminal hackers could start demanding millions of dollars from victims. And it stands to reason that a great many Darkode members who were never caught have since transitioned from lockers, exploit kits and GreenDot cards to doing what every other self-respecting cybercrook seems to be involved with these days: Locking entire companies and industries for ransomware payments.

One final observation about the Philbert indictment: It’s good to see the Canadian authorities working closely with the FBI on important cybercrime cases. Indeed, this investigation is remarkable for that fact alone. For years I’ve been wondering aloud why more American cybercriminals don’t just move to Canada, because historically there has been almost no probability that they will ever get caught — let alone prosecuted there. With any luck, this case will be the start of something new.

How to Stop Hackers From Turning Your Systems Against You

Oakley Cox, Director of Analysis, Darktrace — Wed, 08 Dec 2021 22:55:00 GMT

Cybercriminals are increasingly adopting "living-off-the-land’ techniques, leveraging commonly used tools to fly under the radar of conventional detection tools. But with AI, thousands of organizations have regained the upper hand.

Claroty Raises $400M More, Acquires Healthcare IoT Security Firm Medigate

Dark Reading Staff, Dark Reading — Wed, 08 Dec 2021 22:04:32 GMT

Industrial control systems security firm reaches $635M in funding with this Series E round.

How to Overcome Threat Detection and Response Challenges

Jack Naglieri — Wed, 08 Dec 2021 17:50:44 GMT

In this Expert Insight, Jack Naglieri, the founder and CEO of Panther Labs, talks about the many challenges of enterprise-scale threat detection and response. Jack provides some steps organizations can take to prepare themselves for the future.

The post How to Overcome Threat Detection and Response Challenges appeared first on The Security Ledger...

Read the whole entry... »

Leaked Downing Street video footage exposes staff laughing about party

Graham Cluley — Tue, 07 Dec 2021 19:16:16 GMT

Once again video has leaked from inside the UK Government that has put it in hot water.

Ransomware hits Spar supermarkets and petrol stations

Graham Cluley — Tue, 07 Dec 2021 18:32:05 GMT

Supermarket chain Spar has had more than 300 of its convenience stores in the UK affected by a ransomware attack, which has forced some to close their doors or only accept cash payments.

Spar forced to close a number of stores following cyber attack

Tue, 07 Dec 2021 08:01:32 GMT

More than 300 branches have been affected as a result of the attack

Cambridge Quantum launches cloud key generation service, with claim of perfect randomness

Tue, 07 Dec 2021 05:16:02 GMT

Never been done before, the company says

Virtual Patching 101

Tue, 07 Dec 2021 00:00:00 GMT

Get the lowdown on virtual patching: a simplified, automated solution to shielding vulnerabilities from exploits.

Ransomware – how to stop it, and how to survive an attack. Free eBook by Recorded Future

Graham Cluley — Mon, 06 Dec 2021 11:12:14 GMT

NSO spyware used to hack US State Department phones

Mon, 06 Dec 2021 10:22:29 GMT

The officials targeted were either based in Uganda or worked on matters related to the country

Criminals now phishing verified Twitter accounts

Mon, 06 Dec 2021 05:02:43 GMT

It follows Twitter's recent removal of checkmarks from many verified accounts

Who Is the Network Access Broker ‘Babam’?

BrianKrebs — Fri, 03 Dec 2021 21:53:44 GMT

Rarely do cybercriminal gangs that deploy ransomware gain the initial access to the target themselves. More commonly, that access is purchased from a cybercriminal broker who specializes in acquiring remote access credentials — such as usernames and passwords needed to remotely connect to the target’s network. In this post we’ll look at the clues left behind by “Babam,” the handle chosen by a cybercriminal who has sold such access to ransomware groups on many occasions over the past few years.

Since the beginning of 2020, Babam has set up numerous auctions on the Russian-language cybercrime forum Exploit, mainly selling virtual private networking (VPN) credentials stolen from various companies. Babam has authored more than 270 posts since joining Exploit in 2015, including dozens of sales threads. However, none of Babam’s posts on Exploit include any personal information or clues about his identity.

But in February 2016, Babam joined Verified, another Russian-language crime forum. Verified was hacked at least twice in the past five years, and its user database posted online. That information shows that Babam joined Verified using the email address “operns@gmail.com.” The latest Verified leak also exposed private messages exchanged by forum members, including more than 800 private messages that Babam sent or received on the forum over the years.

In early 2017, Babam confided to another Verified user via private message that he is from Lithuania. In virtually all of his forum posts and private messages, Babam can be seen communicating in transliterated Russian rather than by using the Cyrillic alphabet. This is common among cybercriminal actors for whom Russian is not their native tongue.

Cyber intelligence platform Constella Intelligence told KrebsOnSecurity that the operns@gmail.com address was used in 2016 to register an account at filmai.in, which is a movie streaming service catering to Lithuanian speakers. The username associated with that account was “bo3dom.”

A reverse WHOIS search via DomainTools.com says operns@gmail.com was used to register two domain names: bonnjoeder[.]com back in 2011, and sanjulianhotels[.]com (2017). It’s unclear whether these domains ever were online, but the street address on both records was “24 Brondeg St.” in the United Kingdom. [Full disclosure: DomainTools is a frequent advertiser on this website.]

A reverse search at DomainTools on “24 Brondeg St.” reveals one other domain: wwwecardone[.]com. The use of domains that begin with “www” is fairly common among phishers, and by passive “typosquatting” sites that seek to siphon credentials from legitimate websites when people mistype a domain, such as accidentally omitting the “.” after typing “www”.

A banner from the homepage of the Russian language cybercrime forum Verified.

Searching DomainTools for the phone number in the WHOIS records for wwwecardone[.]com — +44.0774829141 — leads to a handful of similar typosquatting domains, including wwwebuygold[.]com and wwwpexpay[.]com. A different UK phone number in a more recent record for the wwwebuygold[.]com domain — 44.0472882112 — is tied to two more domains – howtounlockiphonefree[.]com, and portalsagepay[.]com. All of these domains date back to between 2012 and 2013.

The original registration records for the iPhone, Sagepay and Gold domains share an email address: devrian26@gmail.com. A search on the username “bo3dom” using Constella’s service reveals an account at ipmart-forum.com, a now-defunct forum concerned with IT products, such as mobile devices, computers and online gaming. That search shows the user bo3dom registered at ipmart-forum.com with the email address devrian27@gmail.com, and from an Internet address in Vilnius, Lithuania.

Devrian27@gmail.com was used to register multiple domains, including wwwsuperchange.ru back in 2008 (notice again the suspect “www” as part of the domain name). Gmail’s password recovery function says the backup email address for devrian27@gmail.com is bo3*******@gmail.com. Gmail accepts the address bo3domster@gmail.com as the recovery email for that devrian27 account.

According to Constella, the bo3domster@gmail.com address was exposed in multiple data breaches over the years, and in each case it used one of two passwords: “lebeda1” and “a123456“.

Searching in Constella for accounts using those passwords reveals a slew of additional “bo3dom” email addresses, including bo3dom@gmail.com. Pivoting on that address in Constella reveals that someone with the name Vytautas Mockus used it to register an account at mindjolt.com, a site featuring dozens of simple puzzle games that visitors can play online.

At some point, mindjolt.com apparently also was hacked, because a copy of its database at Constella says the bo3dom@gmail.com used two passwords at that site: lebeda1 and a123456.

A reverse WHOIS search on “Vytautas Mockus” at DomainTools shows the email address devrian25@gmail.com was used in 2010 to register the domain name perfectmoney[.]co. This is one character off of perfectmoney[.]com, which is an early virtual currency that was quite popular with cybercriminals at the time. The phone number tied to that domain registration was “86.7273687“.

A Google search for “Vytautas Mockus” says there’s a person by that name who runs a mobile food service company in Lithuania called “Palvisa.” A report on Palvisa (PDF) purchased from Rekvizitai.vz — an official online directory of Lithuanian companies — says Palvisa was established in 2011 by a Vytautaus Mockus, using the phone number 86.7273687, and the email address bo3dom@gmail.com. The report states that Palvisa is active, but has had no employees other than its founder.

Reached via the bo3dom@gmail.com address, the 36-year-old Mr. Mockus expressed mystification as to how his personal information wound up in so many records. “I am not involved in any crime,” Mockus wrote in reply.

A rough mind map of the connections mentioned in this story.

The domains apparently registered by Babam over nearly 10 years suggest he started off mainly stealing from other cybercrooks. By 2015, Babam was heavily into “carding,” the sale and use of stolen payment card data. By 2020, he’d shifted his focus almost entirely to selling access to companies.

A profile produced by threat intelligence firm Flashpoint says Babam has received at least four positive feedback reviews on the Exploit cybercrime forum from crooks associated with the LockBit ransomware gang.

The ransomware collective LockBit giving Babam positive feedback for selling access to different victim organizations. Image: Flashpoint

According to Flashpoint, in April 2021 Babam advertised the sale of Citrix credentials for an international company that is active in the field of laboratory testing, inspection and certification, and that has more than $5 billion in annual revenues and more than 78,000 employees.

Flashpoint says Babam initially announced he’d sold the access, but later reopened the auction because the prospective buyer backed out of the deal. Several days later, Babam reposted the auction, adding more information about the depth of the illicit access and lowering his asking price. The access sold less than 24 hours later.

“Based on the provided statistics and sensitive source reporting, Flashpoint analysts assess with high confidence that the compromised organization was likely Bureau Veritas, an organization headquartered in France that operates in a variety of sectors,” the company concluded.

In November, Bureau Veritas acknowledged that it shut down its network in response to a cyber attack. The company hasn’t said whether the incident involved ransomware and if so what strain of ransomware, but its response to the incident is straight out of the playbook for responding to ransomware attacks. Bureau Veritas has not yet responded to requests for comment; its latest public statement on Dec. 2 provides no additional details about the cause of the incident.

Flashpoint notes that Babam’s use of transliterated Russian persists on both Exploit and Verified until around March 2020, when he switches over to using mostly Cyrillc in his forum comments and sales threads. Flashpoint said this could be an indication that a different person started using the Babam account since then, or more likely that Babam had only a tenuous grasp of Russian to begin with and that his language skills and confidence improved over time.

Lending credence to the latter theory is that Babam still makes linguistic errors in his postings that suggest Russian is not his original language, Flashpoint found.

“The use of double “n” in such words as “проданно” (correct – продано) and “сделанны” (correct – сделаны) by the threat actor proves that this style of writing is not possible when using machine translation since this would not be the correct spelling of the word,” Flashpoint analysts wrote.

“These types of grammatical errors are often found among people who did not receive sufficient education at school or if Russian is their second language,” the analysis continues. “In such cases, when someone tries to spell a word correctly, then by accident or unknowingly, they overdo the spelling and make these types of mistakes. At the same time, colloquial speech can be fluent or even native. This is often typical for a person who comes from the former Soviet Union states.”

UK Government fined £500,000 after revealing home addresses in New Year honours data breach

Graham Cluley — Fri, 03 Dec 2021 14:47:43 GMT

The UK Government has been fined £500,000 after the addresses of over 1,000 New Years Honours recipients were mistakenly published online, potentially putting some of them at serious risk.

Man charged with Ubiquiti data breach and extortion was employee assigned to investigate hack

Graham Cluley — Fri, 03 Dec 2021 10:26:13 GMT

A former employee of Ubiquiti Networks has been arrested and charged in connection with a hack that stole gigabytes of data and attempted to extort US $2 million from the firm. Read more in my article on the Hot for Security blog.

Cabinet Office fined £500,000 by ICO over New Year Honours data breach

Fri, 03 Dec 2021 03:28:47 GMT

Sir Elton John and cricketer Ben Stokes are among individuals affected by the breach

This Week in Security News - December 3, 2021

Jon Clay — Fri, 03 Dec 2021 00:00:00 GMT

This week, learn about how Squirrelwaffle utilized ProxyLogon and ProxyShell to hack email chains. Also, read on a recent data breach of the Los Angeles Planned Parenthood Network.

Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify

Nitesh Surana — Fri, 03 Dec 2021 00:00:00 GMT

We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.

FluBot malware warning after 70,000 attacks launched over SMS

Graham Cluley — Thu, 02 Dec 2021 17:09:50 GMT

Finland’s National Cyber Security Centre has issued a warning about malicious SMS messages that have been spammed out to mobile users, directing iPhone owners to phishing sites and Android users to download malware. Read more in my article on the Tripwire State of Security blog.

1Password 8 for Windows – improved productivity, and enhanced security & privacy

Graham Cluley — Thu, 02 Dec 2021 17:05:13 GMT

Graham Cluley Security News is sponsored this week by the folks at 1Password. Thanks to the great team there for their support! 1Password 8 for Windows is the most modern, productive, and secure version of 1Password yet, helping you manage, access, and protect your sensitive information more easily and securely than ever before. Modern Design … Continue reading

Ubiquiti Developer Charged With Extortion, Causing 2020 “Breach”

BrianKrebs — Thu, 02 Dec 2021 16:11:07 GMT

In January 2021, technology vendor Ubiquiti Inc. [NYSE:UI] disclosed that a breach at a third party cloud provider had exposed customer account credentials. In March, a Ubiquiti employee warned that the company had drastically understated the scope of the incident, and that the third-party cloud provider claim was a fabrication. On Wednesday, a former Ubiquiti developer was arrested and charged with stealing data and trying to extort his employer while pretending to be a whistleblower.

Federal prosecutors say Nickolas Sharp, a senior developer at Ubiquiti, actually caused the “breach” that forced Ubiquiti to disclose a cybersecurity incident in January. They allege that in late December 2020, Sharp applied for a job at another technology company, and then abused his privileged access to Ubiquiti’s systems at Amazon’s AWS cloud service and the company’s GitHub accounts to download large amounts of proprietary data.

Sharp’s indictment doesn’t specify how much data he allegedly downloaded, but it says some of the downloads took hours, and that he cloned approximately 155 Ubiquiti data repositories via multiple downloads over nearly two weeks.

On Dec. 28, other Ubiquiti employees spotted the unusual downloads, which had leveraged internal company credentials and a Surfshark VPN connection to hide the downloader’s true Internet address. Assuming an external attacker had breached its security, Ubiquiti quickly launched an investigation.

But Sharp was a member of the team doing the forensic investigation, the indictment alleges.

“At the time the defendant was part of a team working to assess the scope and damage caused by the incident and remediate its effects, all while concealing his role in committing the incident,” wrote prosecutors with the Southern District of New York.

According to the indictment, on January 7 a senior Ubiquiti employee received a ransom email. The message was sent through an IP address associated with the same Surfshark VPN. The ransom message warned that internal Ubiquiti data had been stolen, and that the information would not be used or published online as long as Ubiquiti agreed to pay 25 Bitcoin.

The ransom email also offered to identify a purportedly still unblocked “backdoor” used by the attacker for the sum of another 25 Bitcoin (the total amount requested was equivalent to approximately $1.9 million at the time). Ubiquiti did not pay the ransom demands.

Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads.

When FBI agents raided Sharp’s residence on Mar. 24, he reportedly maintained his innocence and told agents someone else must have used his Paypal account to purchase the Surfshark VPN subscription.

Several days after the FBI executed its search warrant, Sharp “caused false or misleading news stories to be published about the incident,” prosecutors say. Among the claims made in those news stories was that Ubiquiti had neglected to keep access logs that would allow the company to understand the full scope of the intrusion. In reality, the indictment alleges, Sharp had shortened to one day the amount of time Ubiquiti’s systems kept certain logs of user activity in AWS.

“Following the publication of these articles, between Tuesday, March 30, 2021 and Wednesday March 31, [Ubiquiti’s] stock price fell approximately 20 percent, losing over four billion dollars in market capitalization,” the indictment states.

Sharp faces four criminal counts, including wire fraud, intentionally damaging protected computers, transmission of interstate communications with intent to extort, and making false statements to the FBI.

News of Sharp’s arrest was first reported by BleepingComputer, which wrote that while the Justice Department didn’t name Sharp’s employer in its press release or indictment, all of the details align with previous reporting on the Ubiquiti incident and information presented in Sharp’s LinkedIn account. A link to the indictment is here (PDF).

What one thing should you do to secure your Kubernetes environment?

Thu, 02 Dec 2021 11:11:10 GMT

Lack of resources is a massive blocker, so you'll need to prioritise

FBI seized Bitcoins worth $2.3 million from REvil affiliate

Thu, 02 Dec 2021 07:11:39 GMT

The cash comes from ransomware payouts to mitigate REvil attacks

Smashing Security podcast #254: A dead hamster, a brass pen, and The Beatles

Graham Cluley — Thu, 02 Dec 2021 00:37:03 GMT

Cryptocurrency traders suffer a hamster-related loss, beware of charity scammers this holiday season, and do you have the patience to sit through Peter Jackson's eight-hour Beatles documentary? All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault.

Spotlight: How Secrets Sprawl Undermines Software Supply Chain Security

Paul Roberts — Wed, 01 Dec 2021 20:40:36 GMT

Mackenzie Jackson, the Developer Advocate at GitGuardian joins Paul to discuss how “secrets sprawl” on sites like GitHub threatens software supply chains.

The post Spotlight: How Secrets Sprawl Undermines Software Supply Chain Security appeared first on The Security Ledger with Paul F. Roberts.

Click the icon below to listen.

MI6 chief seeks help from tech firms to counter hostile state threats

Wed, 01 Dec 2021 10:02:28 GMT

Unlike James Bond's Q, the spy agency cannot develop all the technologies it needs in-house

Analyzing How TeamTNT Used Compromised Docker Hub Accounts

Nitesh Surana — Wed, 01 Dec 2021 00:00:00 GMT

Following our previous disclosure of compromised Docker hub accounts delivering cryptocurrency miners, we analyze these accounts and discover more malicious actions that you need to be aware of.

What to do at AWS re:Invent 2021 - Day 3

Wed, 01 Dec 2021 00:00:00 GMT

Welcome to your complete guide to AWS re:Invent 2021 Day 3, where you will find tips on how to get the most out of your conference experience both in Las Vegas and virtually.

Panasonic confirms data breach, says hackers accessed the company's internal network

Tue, 30 Nov 2021 12:41:58 GMT

The breach reportedly started on 22 June and ended on 3 November

The state of DevSecOps - where are we at with application security?

Tue, 30 Nov 2021 11:00:25 GMT

Merging the security function into DevOps won't happen overnight, but it's a vital step and the barriers aren't as high as sometimes believed

Clearview AI faces possible £17m fine for violating Britain's privacy laws

Tue, 30 Nov 2021 10:01:51 GMT

The ICO has issued a provisional notice to the company to stop further processing of the personal data of people in the UK

What You Can Do to Mitigate Cloud Misconfigurations

Aaron Ansari — Tue, 30 Nov 2021 00:00:00 GMT

Cloud misconfigurations can become opportunities for cyberattacks or lead to data breaches. Organizations must mitigate them before incurring significant and costly consequences.

ESG Economic Value Validation of XDR

Tue, 30 Nov 2021 00:00:00 GMT

Hear leading analyst firm ESG and Chase Renes, system administrator at Vision Bank, discuss the operational, business, and financial value of Trend Micro’s industry-leading XDR solution.

Top 10 AWS Security Misconfiguration

Tue, 30 Nov 2021 00:00:00 GMT

Misconfigurations pose the biggest threat to cloud security. We compiled the top 10 AWS services with the highest misconfiguration rates.

Social media firms will be forced to unmask online trolls, says Australia

Graham Cluley — Mon, 29 Nov 2021 10:32:14 GMT

The Prime Minister of Australia has said his government will introduce legislation which will compel social media companies to "unmask anonymous online trolls," and allow victims to launch defamation proceedings. Read more in my article on the Hot for Security blog.

IKEA's email system under attack, report

Mon, 29 Nov 2021 10:06:39 GMT

Reply-chain attacks allow hackers to send malicious emails from genuine accounts

AWS re:Invent 2021 Guide: Checklist & Key Sessions

Aaron Ansari — Mon, 29 Nov 2021 00:00:00 GMT

Welcome to your complete guide to AWS re:Invent 2021, where you will find tips on how to get the most out of your conference experience both in Las Vegas and virtually.

Trend Micro Cloud One Network Security-as-a-Service

Laura Roantree — Mon, 29 Nov 2021 00:00:00 GMT

Trend Micro, alongside Amazon Web Services, provides the latest in cloud-native deployment options. We have simplified network security, protecting customers across Virtual Private Clouds (VPCs) without needing agents to be installed on instances.

Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites

Jaromir Horejsi — Mon, 29 Nov 2021 00:00:00 GMT

We have been tracking a campaign involving the SpyAgent malware that abuses well-known remote access tools (RATs) for some time now. While previous versions of the malware have been covered by other researchers, our blog entry focuses on the malicious actor’s latest attacks.

Couple arrested for secretly installing cryptomining software on department store PCs

Graham Cluley — Fri, 26 Nov 2021 20:41:32 GMT

Police in Tarragona, Spain, have arrested a man and a woman after they allegedly infected computers at high-street stores with malware with the intention of mining cryptocurrency on them. Read more in my article on the Hot for Security blog.

The Internet is Held Together With Spit & Baling Wire

BrianKrebs — Fri, 26 Nov 2021 19:03:53 GMT

A visualization of the Internet made using network routing data. Image: Barrett Lyon, opte.org.

Imagine being able to disconnect or redirect Internet traffic destined for some of the world’s biggest companies — just by spoofing an email. This is the nature of a threat vector recently removed by a Fortune 500 firm that operates one of the largest Internet backbones.

Based in Monroe, La., Lumen Technologies Inc. [NYSE: LUMN] (formerly CenturyLink) is one of more than two dozen entities that operate what’s known as an Internet Routing Registry (IRR). These IRRs maintain routing databases used by network operators to register their assigned network resources — i.e., the Internet addresses that have been allocated to their organization.

The data maintained by the IRRs help keep track of which organizations have the right to access what Internet address space in the global routing system. Collectively, the information voluntarily submitted to the IRRs forms a distributed database of Internet routing instructions that helps connect a vast array of individual networks.

There are about 70,000 distinct networks on the Internet today, ranging from huge broadband providers like AT&T, Comcast and Verizon to many thousands of enterprises that connect to the edge of the Internet for access. Each of these so-called “Autonomous Systems” (ASes) make their own decisions about how and with whom they will connect to the larger Internet.

Regardless of how they get online, each AS uses the same language to specify which Internet IP address ranges they control: It’s called the Border Gateway Protocol, or BGP. Using BGP, an AS tells its directly connected neighbor AS(es) the addresses that it can reach. That neighbor in turn passes the information on to its neighbors, and so on, until the information has propagated everywhere [1].

A key function of the BGP data maintained by IRRs is preventing rogue network operators from claiming another network’s addresses and hijacking their traffic. In essence, an organization can use IRRs to declare to the rest of the Internet, “These specific Internet address ranges are ours, should only originate from our network, and you should ignore any other networks trying to lay claim to these address ranges.”

In the early days of the Internet, when organizations wanted to update their records with an IRR, the changes usually involved some amount of human interaction — often someone manually editing the new coordinates into an Internet backbone router. But over the years the various IRRs made it easier to automate this process via email.

For a long time, any changes to an organization’s routing information with an IRR could be processed via email as long as one of the following authentication methods was successfully used:

-CRYPT-PW: A password is added to the text of an email to the IRR containing the record they wish to add, change or delete (the IRR then compares that password to a hash of the password);

-PGPKEY: The requestor signs the email containing the update with an encryption key the IRR recognizes;

-MAIL-FROM: The requestor sends the record changes in an email to the IRR, and the authentication is based solely on the “From:” header of the email.

Of these, MAIL-FROM has long been considered insecure, for the simple reason that it’s not difficult to spoof the return address of an email. And virtually all IRRs have disallowed its use since at least 2012, said Adam Korab, a network engineer and security researcher based in Houston.

All except Level 3 Communications, a major Internet backbone provider acquired by Lumen/CenturyLink.

“LEVEL 3 is the last IRR operator which allows the use of this method, although they have discouraged its use since at least 2012,” Korab told KrebsOnSecurity. “Other IRR operators have fully deprecated MAIL-FROM.”

Importantly, the name and email address of each Autonomous System’s official contact for making updates with the IRRs is public information.

Korab filed a vulnerability report with Lumen demonstrating how a simple spoofed email could be used to disrupt Internet service for banks, telecommunications firms and even government entities.

“If such an attack were successful, it would result in customer IP address blocks being filtered and dropped, making them unreachable from some or all of the global Internet,” Korab said, noting that he found more than 2,000 Lumen customers were potentially affected. “This would effectively cut off Internet access for the impacted IP address blocks.”

The recent outage that took Facebook, Instagram and WhatsApp offline for the better part of a day was caused by an erroneous BGP update submitted by Facebook. That update took away the map telling the world’s computers how to find its various online properties.

Now consider the mayhem that would ensue if someone spoofed IRR updates to remove or alter routing entries for multiple e-commerce providers, banks and telecommunications companies at the same time.

“Depending on the scope of an attack, this could impact individual customers, geographic market areas, or potentially the [Lumen] backbone,” Korab continued. “This attack is trivial to exploit, and has a difficult recovery. Our conjecture is that any impacted Lumen or customer IP address blocks would be offline for 24-48 hours. In the worst-case scenario, this could extend much longer.”

Lumen told KrebsOnSecurity that it continued offering MAIL-FROM: authentication because many of its customers still relied on it due to legacy systems. Nevertheless, after receiving Korab’s report the company decided the wisest course of action was to disable MAIL-FROM: authentication altogether.

“We recently received notice of a known insecure configuration with our Route Registry,” reads a statement Lumen shared with KrebsOnSecurity. “We already had mitigating controls in place and to date we have not identified any additional issues. As part of our normal cybersecurity protocol, we carefully considered this notice and took steps to further mitigate any potential risks the vulnerability may have created for our customers or systems.”

Level3, now part of Lumen, has long urged customers to avoid using “Mail From” for authentication, but until very recently they still allowed it.

KC Claffy is the founder and director of the Center for Applied Internet Data Analysis (CAIDA), and a resident research scientist of the San Diego Supercomputer Center at the University of California, San Diego. Claffy said there is scant public evidence of a threat actor using the weakness now fixed by Lumen to hijack Internet routes.

“People often don’t notice, and a malicious actor certainly works to achieve this,” Claffy said in an email to KrebsOnSecurity. “But also, if a victim does notice, they generally aren’t going to release details that they’ve been hijacked. This is why we need mandatory reporting of such breaches, as Dan Geer has been saying for years.”

But there are plenty of examples of cybercriminals hijacking IP address blocks after a domain name associated with an email address in an IRR record has expired. In those cases, the thieves simply register the expired domain and then send email from it to an IRR specifying any route changes.

While it’s nice that Lumen is no longer the weakest link in the IRR chain, the remaining authentication mechanisms aren’t great. Claffy said after years of debate over approaches to improving routing security, the operator community deployed an alternative known as the Resource Public Key Infrastructure (RPKI).

“The RPKI includes cryptographic attestation of records, including expiration dates, with each Regional Internet Registry (RIR) operating as a ‘root’ of trust,” wrote Claffy and two other UC San Diego researchers in a paper that is still undergoing peer review. “Similar to the IRR, operators can use the RPKI to discard routing messages that do not pass origin validation checks.”

However, the additional integrity RPKI brings also comes with a fair amount of added complexity and cost, the researchers found.

“Operational and legal implications of potential malfunctions have limited registration in and use of the RPKI,” the study observed (link added). “In response, some networks have redoubled their efforts to improve the accuracy of IRR registration data. These two technologies are now operating in parallel, along with the option of doing nothing at all to validate routes.”

[1]: I borrowed some descriptive text in the 5th and 6th paragraphs from a CAIDA/UCSD draft paper — IRR Hygiene in the RPKI Era (PDF).

Reduce Friction Between IT Leaders and C-suite

Fri, 26 Nov 2021 00:00:00 GMT

As we creep toward a post-pandemic world, organizations need to plan accordingly. Explore Trend Micro’s latest cyber risk research to enable your business to maximize its growth and potential.

Try out 1Password 8 for Windows, where security meets productivity

Graham Cluley — Thu, 25 Nov 2021 17:49:09 GMT

Graham Cluley Security News is sponsored this week by the folks at 1Password. Thanks to the great team there for their support! 1Password 8 for Windows has been reimagined with productivity improvements, enhanced security and privacy features, and a new, modern design. 1Password 8 helps you manage, access, and protect your sensitive information more easily … Continue reading

Sophisticated Tardigrade malware launches attacks on vaccine manufacturing infrastructure

Graham Cluley — Thu, 25 Nov 2021 16:54:04 GMT

Security researchers are warning biomanufacturing facilities around the world that they are being targeted by a sophisticated new strain of malware, known as Tardigrade. Read more in my article on the Tripwire State of Security blog.

Smashing Security podcast #253: Cybercrime unicorns, HVAC hacks, and NFT piracy – with Mikko Hyppönen

Graham Cluley — Thu, 25 Nov 2021 13:26:24 GMT

Heating systems are left vulnerable to attack in the high courts, cybercrime unicorns have become a reality (but what are they?), over 15 Terabytes of NFTs are made available for anyone to download ... and Carole reveals her Pick of the Year. All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Mikko Hyppönen.

New UK IoT law means huge fines and a ban on default passwords

Graham Cluley — Thu, 25 Nov 2021 13:22:58 GMT

The United Kingdom government has introduced new legislation designed to improve the security of "smart" internet-connected devices used in people's homes. Read more in my article on the Hot for Security blog.

Exchange Server admins advised to patch vulnerable machines after POC exploit released for high-severity bug

Wed, 24 Nov 2021 12:37:32 GMT

Microsoft has described the flaw as having a high impact on data integrity, confidentiality and availability

Apple sues NSO Group for targeting its users with spyware

Wed, 24 Nov 2021 10:06:46 GMT

Seeks to bar the Israeli firm from using its products

NCSC alerts 4,000 online retailers about Magecart attacks

Wed, 24 Nov 2021 07:41:59 GMT

Hackers will attempt to target online shoppers on Black Friday and Cyber Monday, it warns

GoDaddy data breach affects nearly 1.2 million WordPress users

Tue, 23 Nov 2021 09:59:19 GMT

The attacker used a compromised password to access the company's provisioning system for Managed WordPress

GoDaddy hack exposes accounts of 1.2 million customers

Graham Cluley — Tue, 23 Nov 2021 08:29:16 GMT

Web-hosting firm and domain registrar GoDaddy has revealed that it has suffered cyber attack which saw a hacker gain access to details of over one million customers. Read more in my article on the Hot for Security blog.

A Complete Guide to Cloud-Native Application Security

Melanie Tafelski — Tue, 23 Nov 2021 00:00:00 GMT

Explore this comprehensive guide to application security, which provides an overview of the importance of embedding runtime application security controls in the application build workflow to protect cloud-native web applications and APIs.

BazarLoader Adds Compromised Installers, ISO to Arrival and Delivery Vectors

Ian Kenefick — Tue, 23 Nov 2021 00:00:00 GMT

We observed BazarLoader adding two new arrival mechanisms to their current roster of malware delivery techniques.

Defend Against Cyber Espionage Attacks

Tue, 23 Nov 2021 00:00:00 GMT

Explore Trend Micro’s latest research into Void Balaur, a prolific cybermercenary group, to learn how to defend against attacks launched by this growing group of threat actors.

COP26 Backs Electric Vehicles to Reduce Climate Change

Tue, 23 Nov 2021 00:00:00 GMT

The 26 United Nations Climate Change Conference pushes for countries of parties to adopt more widespread EV use in order to reduce the looming threats of climate change.

Arrest in ‘Ransom Your Employer’ Email Scheme

BrianKrebs — Mon, 22 Nov 2021 21:57:18 GMT

In August, KrebsOnSecurity warned that scammers were contacting people and asking them to unleash ransomware inside their employer’s network, in exchange for a percentage of any ransom amount paid by the victim company. This week, authorities in Nigeria arrested a suspect in connection with the scheme — a young man who said he was trying to save up money to help fund a new social network.

Image: Abnormal Security.

The brazen approach targeting disgruntled employees was first spotted by threat intelligence firm Abnormal Security, which described what happened after they adopted a fake persona and responded to the proposal in the screenshot above.

“According to this actor, he had originally intended to send his targets—all senior-level executives—phishing emails to compromise their accounts, but after that was unsuccessful, he pivoted to this ransomware pretext,” Abnormal’s Crane Hassold wrote.

Abnormal Security documented how it tied the email back to a Nigerian man who acknowledged he was trying to save up money to help fund a new social network he is building called Sociogram. In June 2021, the Nigerian government officially placed an indefinite ban on Twitter, restricting it from operating in Nigeria after the social media platform deleted tweets by the Nigerian president.

Reached via LinkedIn, Sociogram founder Oluwaseun Medayedupin asked to have his startup’s name removed from the story, although he did not respond to questions about whether there were any inaccuracies in Hassold’s report.

“Please don’t harm Sociogram’s reputation,” Medayedupin pleaded. “I beg you as a promising young man.”

After he deleted his LinkedIn profile, I received the following message through the “contact this domain holder” link at KrebsOnSecurity’s domain registrar [curiously, the date of that missive reads “Dec. 31, 1969.”]. Apparently, Mr. Krebson is a clout-chasing monger.

A love letter from the founder of the ill-fated Sociogram.

Mr. Krebson also heard from an investigator representing the Nigeria Finance CERT on behalf of the Central Bank Of Nigeria. While the Sociogram founder’s approach might seem amateurish to some, the financial community in Nigeria did not consider it a laughing matter.

On Friday, Nigerian police arrested Medayedupin. The investigator says formal charges will be levied against the defendant sometime this week.

KrebsOnSecurity spoke with a fraud investigator who is performing the forensic analysis of the devices seized from Medayedupin’s home. The investigator spoke on condition of anonymity out of concern for his physical safety.

The investigator — we’ll call him “George” — said the 23-year-old Medayedupin lives with his extended family in an extremely impoverished home, and that the young man told investigators he’d just graduated from college but turned to cybercrime at first with ambitions of merely scamming the scammers.

George’s team confirmed that Medayedupin had around USD $2,000 to his name, which he’d recently stolen from a group of Nigerian fraudsters who were scamming people for gift cards. Apparently, he admitted to creating a phishing website that tricked a member of this group into providing access to the money they’d made from their scams.

Medayedupin reportedly told investigators that for almost a week after he started emailing his ransom-your-employer scheme, nobody took him up on the offer. But after his name appeared in the news media, he received thousands of inquiries from people interested in his idea.

George described Medayedupin as smart, a quick learner, and fairly dedicated to his work.

“He seems like he could be a fantastic [employee] for a company,” George said. “But there is no employment here, so he chose to do this.”

What’s interesting about this case — and indeed likely why anyone thought this guy worthy of arrest — is that the Nigerian authorities were fairly swift to take action when a domestic cybercriminal raised the specter of causing financial losses for its own banks.

After all, the majority of the cybercrime that originates from Africa — think romance scams, Business Email Compromise (BEC) fraud, and unemployment/pandemic loan fraud — does not target Nigerian citizens, nor does it harm African banks. On the contrary: This activity pumps a great deal of Western money into Nigeria.

How much money are we talking about? The financial losses from these scams dwarf other fraud categories — such as identity theft or credit card fraud. According to the FBI’s Internet Crime Complaint Center (IC3), consumers and businesses reported more than $4.2 billion in losses tied to cybercrime in 2020, and BEC fraud and romance scams alone accounted for nearly 60 percent of those losses.

Source: FBI/IC3 2020 Internet Crime Report.

If the influx of a few billion US dollars into the Nigerian economy each year from cybercrime seems somehow insignificant, consider that (according to George) the average police officer in the country makes the equivalent of less than USD $100 a month.

Ronnie Tokazowski is a threat researcher at the security firm Cofense. Tokazowski maintains he has been one of the more vocal proponents of the idea that trying to fight these problems by arresting those involved is something of a Sisyphean task, and that it makes way more sense to focus on changing the economic realities in places like Nigeria.

Nigeria has the world’s second-highest unemployment rate — rising from 27.1 percent in 2019 to 33 percent in 2020, according to the National Bureau of Statistics. The nation also is among the world’s most corrupt, according to 2020 findings from Transparency International.

“Education is definitely one piece, as raising awareness is hands down the best way to get ahead of this,” Tokazowski said, in a June 2021 interview. “But we also need to think about ways to create more business opportunities there so that people who are doing this to put food on the table have more legitimate opportunities. Unfortunately, thanks to the level of corruption of government officials, there are a lot of cultural reasons that fighting this type of crime at the source is going to be difficult.”

Meta delays plans to encrypt messages on Facebook and Instagram until 2023

Mon, 22 Nov 2021 12:59:23 GMT

Meanwhile WhatsApp has published a new privacy policy for users in Ireland and across Europe

The ‘Zelle Fraud’ Scam: How it Works, How to Fight Back

BrianKrebs — Fri, 19 Nov 2021 21:36:30 GMT

One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim’s funds via Zelle, a “peer-to-peer” (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family. Naturally, a great deal of phishing schemes that precede these bank account takeovers begin with a spoofed text message from the target’s bank warning about a suspicious Zelle transfer. What follows is a deep dive into how this increasingly clever Zelle fraud scam typically works, and what victims can do about it.

Last week’s story warned that scammers are blasting out text messages about suspicious bank transfers as a pretext for immediately calling and scamming anyone who responds via text. Here’s what one of those scam messages looks like:

Anyone who responds “yes,” “no” or at all will very soon after receive a phone call from a scammer pretending to be from the financial institution’s fraud department. The caller’s number will be spoofed so that it appears to be coming from the victim’s bank.

To “verify the identity” of the customer, the fraudster asks for their online banking username, and then tells the customer to read back a passcode sent via text or email. In reality, the fraudster initiates a transaction — such as the “forgot password” feature on the financial institution’s site — which is what generates the authentication passcode delivered to the member.

Ken Otsuka is a senior risk consultant at CUNA Mutual Group, an insurance company that provides financial services to credit unions. Otsuka said a phone fraudster typically will say something like, “Before I get into the details, I need to verify that I’m speaking to the right person. What’s your username?”

“In the background, they’re using the username with the forgot password feature, and that’s going to generate one of these two-factor authentication passcodes,” Otsuka said. “Then the fraudster will say, ‘I’m going to send you the password and you’re going to read it back to me over the phone.'”

The fraudster then uses the code to complete the password reset process, and then changes the victim’s online banking password. The fraudster then uses Zelle to transfer the victim’s funds to others.

An important aspect of this scam is that the fraudsters never even need to know or phish the victim’s password. By sharing their username and reading back the one-time code sent to them via email, the victim is allowing the fraudster to reset their online banking password.

Otsuka said in far too many account takeover cases, the victim has never even heard of Zelle, nor did they realize they could move money that way.

“The thing is, many credit unions offer it by default as part of online banking,” Otsuka said. “Members don’t have to request to use Zelle. It’s just there, and with a lot of members targeted in these scams, although they’d legitimately enrolled in online banking, they’d never used Zelle before.” [Curious if your financial institution uses Zelle? Check out their partner list here].

Otsuka said credit unions offering other peer-to-peer banking products have also been targeted, but that fraudsters prefer to target Zelle due to the speed of the payments.

“The fraud losses can escalate quickly due to the sheer number of members that can be targeted on a single day over the course of consecutive days,” Otsuka said.

To combat this scam Zelle introduced out-of-band authentication with transaction details. This involves sending the member a text containing the details of a Zelle transfer – payee and dollar amount – that is initiated by the member. The member must authorize the transfer by replying to the text.

Unfortunately, Otsuka said, the scammers are defeating this layered security control as well.

“The fraudsters follow the same tactics except they may keep the members on the phone after getting their username and 2-step authentication passcode to login to the accounts,” he said. “The fraudster tells the member they will receive a text containing details of a Zelle transfer and the member must authorize the transaction under the guise that it is for reversing the fraudulent debit card transaction(s).”

In this scenario, the fraudster actually enters a Zelle transfer that triggers the following text to the member, which the member is asked to authorize: For example:

“Send $200 Zelle payment to Boris Badenov? Reply YES to send, NO to cancel. ABC Credit Union . STOP to end all messages.”

“My team has consulted with several credit unions that rolled Zelle out or are planning to introduce Zelle,” Otsuka said. “We found that several credit unions were hit with the scam the same month they rolled it out.”

The upshot of all this is that many financial institutions will claim they’re not required to reimburse the customer for financial losses related to these voice phishing schemes. Bob Sullivan, a veteran journalist who writes about fraud and consumer issues, says in many cases banks are giving customers incorrect and self-serving opinions after the thefts.

“Consumers — many who never ever realized they had a Zelle account – then call their banks, expecting they’ll be covered by credit-card-like protections, only to face disappointment and in some cases, financial ruin,” Sullivan wrote in a recent Substack post. “Consumers who suffer unauthorized transactions are entitled to Regulation E protection, and banks are required to refund the stolen money. This isn’t a controversial opinion, and it was recently affirmed by the CFPB here. If you are reading this story and fighting with your bank, start by providing that link to the financial institution.”

“If a criminal initiates a Zelle transfer — even if the criminal manipulates a victim into sharing login credentials — that fraud is covered by Regulation E, and banks should restore the stolen funds,” Sullivan said. “If a consumer initiates the transfer under false pretenses, the case for redress is more weak.”

Sullivan notes that the Consumer Financial Protection Bureau (CFPB) recently announced it was conducting a probe into companies operating payments systems in the United States, with a special focus on platforms that offer fast, person-to-person payments.

“Consumers expect certain assurances when dealing with companies that move their money,” the CFPB said in its Oct. 21 notice. “They expect to be protected from fraud and payments made in error, for their data and privacy to be protected and not shared without their consent, to have responsive customer service, and to be treated equally under relevant law. The orders seek to understand the robustness with which payment platforms prioritize consumer protection under law.”

Anyone interested in letting the CFPB know about a fraud scam that abused a P2P payment platform like Zelle, Cashapp, or Venmo, for example, should send an email describing the incident to BigTechPaymentsInquiry@cfpb.gov. Be sure to include Docket No. CFPB-2021-0017 in the subject line of the message.

In the meantime, remember the mantra: Hang up, Look Up, and Call Back. If you receive a call from someone warning about fraud, hang up. If you believe the call might be legitimate, look up the number of the organization supposedly calling you, and call them back.

Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains

Mohamed Fahmy — Fri, 19 Nov 2021 00:00:00 GMT

Squirrelwaffle is known for using the tactic of sending malicious spam as replies to existing email chains. We look into how by investigating its exploit of Microsoft Exchange Server vulnerabilities, ProxyLogon and ProxyShell.

Ransomware as a Service 101

Fri, 19 Nov 2021 00:00:00 GMT

To help you enhance your defense against ransomware, Trend Micro Research shares key insights on how ransomware as a service (RaaS) operators work.

N-Day Exploit Protection Strategies

Fri, 19 Nov 2021 00:00:00 GMT

Over two years, Trend Micro Research scoured the underground forums for insight into the N-day exploit market. Discover their findings and how you can secure your organization against exploits.

This Week in Security News - November 19, 2021

Jon Clay — Fri, 19 Nov 2021 00:00:00 GMT

This week, learn about how the QAKBOT Loader malware has evolved its techniques and strategies over time. Also, read about the most recent initiative by the legislation to further cybersecurity protection.

Cybercriminals discuss 'Exploit-as-a-Service' model to lower the barrier for accessing dangerous zero-day exploits

Thu, 18 Nov 2021 12:51:06 GMT

Ransomware gangs have amassed big fortunes to compete with traditional buyers of zero-days, researchers find

A Guide to Ransomware: Prevention and Response

Melanie Tafelski — Thu, 18 Nov 2021 00:00:00 GMT

This article will provide guidelines aimed at helping readers understand how to detect and prevent ransomware and limit its effect.

Tech CEO Pleads to Wire Fraud in IP Address Scheme

BrianKrebs — Wed, 17 Nov 2021 23:56:07 GMT

The CEO of a South Carolina technology firm has pleaded guilty to 20 counts of wire fraud in connection with an elaborate network of phony companies set up to obtain more than 735,000 Internet Protocol (IP) addresses from the nonprofit organization that leases the digital real estate to entities in North America.

In 2018, the American Registry for Internet Numbers (ARIN), which oversees IP addresses assigned to entities in the U.S., Canada, and parts of the Caribbean, notified Charleston, S.C. based Micfo LLC that it intended to revoke 735,000 addresses.

ARIN said they wanted the addresses back because the company and its owner — 38-year-old Amir Golestan — had obtained them under false pretenses. A global shortage of IPv4 addresses has massively driven up the price of these resources over the years: At the time of this dispute, a single IP address could fetch between $15 and $25 on the open market.

Micfo responded by suing ARIN to try to stop the IP address seizure. Ultimately, ARIN and Micfo settled the dispute in arbitration, with Micfo returning most of the addresses that it hadn’t already sold.

But the legal tussle caught the attention of South Carolina U.S. Attorney Sherri Lydon, who in May 2019 filed criminal wire fraud charges against Golestan, alleging he’d orchestrated a network of shell companies and fake identities to prevent ARIN from knowing the addresses were all going to the same buyer.

Each of those shell companies involved the production of notarized affidavits in the names of people who didn’t exist. As a result, Lydon was able to charge Golestan with 20 counts of wire fraud — one for each payment made by the phony companies that bought the IP addresses from ARIN.

Amir Golestan, CEO of Micfo.

On Nov. 16, just two days into his trial, Golestan changed his “not guilty” plea, agreeing to plead guilty to all 20 wire fraud charges. KrebsOnSecurity interviewed Golestan about his case at length last year, but he has not responded to requests for comment on his plea change.

By 2013, a number of Micfo’s customers had landed on the radar of Spamhaus, a group that many network operators rely upon to help block junk email. But shortly after Spamhaus began blocking Micfo’s IP address ranges, Micfo shifted gears and began reselling IP addresses mainly to companies marketing “virtual private networking” or VPN services that help customers hide their real IP addresses online.

In a 2020 interview, Golestan told KrebsOnSecurity that Micfo was at one point responsible for brokering roughly 40 percent of the IP addresses used by the world’s largest VPN providers. Throughout that conversation, Golestan maintained his innocence, even as he explained that the creation of the phony companies was necessary to prevent entities like Spamhaus from interfering with his business going forward.

Stephen Ryan, an attorney representing ARIN, said Golestan changed his plea after the court heard from a former Micfo employee and public notary who described being instructed by Golestan to knowingly certify false documents.

“Her testimony made him appear bullying and unsavory,” Ryan said. “Because it turned out he had also sued her to try to prevent her from disclosing the actions he’d directed.”

Golestan’s rather sparse plea agreement (first reported by The Wall Street Journal) does not specify any sort of leniency he might gain from prosecutors for agreeing to end the trial prematurely. But it’s worth noting that a conviction on a single act of wire fraud can result in fines and up to 20 years in prison.

The courtroom drama comes as ARIN’s counterpart in Africa is embroiled in a similar, albeit much larger dispute over millions of African IP addresses. In July 2021, the African Network Information Centre (AFRINIC) took back more than six million IP addresses from Cloud Innovation, a company incorporated in the African offshore entity haven of Seychelles (pronounced, quite aptly — “say shells”).

AFRINIC revoked the addresses — valued at around USD $120 million — after an internal review found that most of them were being used outside of Africa by various entities in China and Hong Kong. Like ARIN, AFRINIC’s policies require those who are leasing IP addresses to demonstrate that the addresses are being used by entities within their geographic region.

But just weeks later, Cloud Innovation convinced a judge in AFRINIC’s home country of Mauritius to freeze $50 million in AFRINIC bank accounts, arguing that AFRINIC had “acted in bad faith and upon frivolous grounds to tarnish the reputation of Cloud Innovation,” and that it was obligated to protect its customers from disruption of service.

That financial freeze has since been partially lifted, but the legal wrangling between AFRINIC and Cloud Innovation continues. The company’s CEO is also suing the CEO and board chair of AFRINIC in an $80 million defamation case.

Ron Guilmette is a security researcher who spent several years tracing how tens of millions of dollars worth of AFRINIC IP addresses were privately sold to address brokers by a former AFRINIC executive. Guilmette said Golestan’s guilty plea is a positive sign for AFRINIC, ARIN and the three other Regional Internet Registries (RIRs).

“It’s good news for the rule of law,” Guilmette said. “It has implications for the AFRINIC case because it reaffirms the authority of all RIRs, including AFRINIC and ARIN.”

Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR

Mohamed Fahmy — Wed, 17 Nov 2021 00:00:00 GMT

In this blog entry, we will take a look at the ProxyShell vulnerabilities that were being exploited in these events, and dive deeper into the notable post-exploitation routines that were used in four separate incidents involving these web shell attacks.

Application Security 101

Wed, 17 Nov 2021 00:00:00 GMT

Everything DevOps teams need to know about web application security risks and best practices.

Global Operations Lead to Arrests of Alleged Members of GandCrab/REvil and Cl0p Cartels

Tue, 16 Nov 2021 00:00:00 GMT

A total of 13 suspects believed to be members of two prolific cybercrime rings were arrested as a global coalition across five continents involving law enforcement and private partners, including Trend Micro, sought to crack down on big ransomware operators.

Post-pandemic growth starts with understanding risk

Bharat Mistry — Tue, 16 Nov 2021 00:00:00 GMT

The digital transformations that accompanied the pandemic are here to stay. To succeed in the post-pandemic era, organizations must come to a shared understanding about cybersecurity as a critical element of business risk.

Groups Target Alibaba ECS Instances for Cryptojacking

David Fiser — Mon, 15 Nov 2021 00:00:00 GMT

We looked at how some malicious groups disable features in Alibaba Cloud ECS instances for illicit mining of Monero.

QAKBOT Loader Returns With New Techniques and Tools

Ian Kenefick — Sat, 13 Nov 2021 00:00:00 GMT

QAKBOT operators resumed email spam operations towards the end of September after an almost three-month hiatus. QAKBOT detection has become a precursor to many critical and widespread ransomware attacks. Our report shares some insight into the new techniques and tools this threat is using.

This Week in Security News - November 12, 2021

Jon Clay — Fri, 12 Nov 2021 00:00:00 GMT

This week, learn about the prolific cybermercenaries, Void Balaur, and their recent attacks. Also, read on the 80-country agreement to mobilize safeguards against cyberattacks.

Private 5G Security Risks in Manufacturing Part 4

Yohei Ishihara — Fri, 12 Nov 2021 00:00:00 GMT

We can see signs of increased activity in areas of business that use 5G around the world. 5G technology will usher in new personal services through smartphones, and it will also play a large part in industry.

Episode 230: Are Vaccine Passports Cyber Secure?

Paul Roberts — Thu, 11 Nov 2021 17:37:37 GMT

In this episode of the podcast (#230) Siddarth Adukia, a regional Director at NCC Group, joins host Paul Roberts to talk about the (cyber) risks and (public health) rewards of vaccine passport systems: how they work, how they can be compromised and what to do about it.

The post Episode 230: Are Vaccine Passports Cyber Secure? appeared first on ...

Read the whole entry... »

Click the icon below to listen.

TeamTNT Upgrades Arsenal, Refines Focus on Kubernetes and GPU Environments

David Fiser — Thu, 11 Nov 2021 00:00:00 GMT

Using a new batch of campaign samples, we take a look at its more recent cybercrime contributions and compare them with its previous deployments to demonstrate the group’s use of upgraded tools and payloads.

Void Balaur and the Rise of the Cybermercenary Industry

Trend Micro Research — Wed, 10 Nov 2021 00:00:00 GMT

One of the most prolific cybermercenaries is Void Balaur, a Russian-speaking threat actor group that has launched attacks against different sectors and industries all over the world.

November Continues Streak of Quiet Patch Tuesdays

Wed, 10 Nov 2021 00:00:00 GMT

November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.

Episode 229: BugCrowd’s Casey Ellis On What’s Hot In Bug Hunting

Paul Roberts — Wed, 03 Nov 2021 13:59:41 GMT

We talk with Casey Ellis, founder and CTO of BugCrowd about how the market for software bugs has changed since the first bug bounty programs emerged nearly 20 years ago, and what’s hot in bug hunting in 2021.

The post Episode 229: BugCrowd’s Casey Ellis On What’s Hot In Bug Hunting appeared first on The Security Ledger with Paul F. Roberts.

Click the icon below to listen.

Spotlight: Your IoT Risk Is Bigger Than You Think. (And What To Do About It.)

Paul Roberts — Thu, 28 Oct 2021 21:38:33 GMT

In this Spotlight edition of the podcast, we’re joined by Curtis Simpson, the Chief Information Security Officer at Armis. Curtis and I discuss the growing cyber risks posed by Internet of Things devices within enterprise networks. IoT and OT (operation technology) deployments are growing and pose challenges to organizations that are still...

Read the whole entry... »

Click the icon below to listen.

Spotlight: Automation Beckons as DevOps, IoT Drive PKI Explosion

Paul Roberts — Thu, 21 Oct 2021 13:57:53 GMT

Brian Trzupek of DigiCert joins Paul to talk about the findings of a recent State of PKI Automation survey and the challenges of managing fast-growing population of tens of thousands of PKI certificates.

The post Spotlight: Automation Beckons as DevOps, IoT Drive PKI Explosion appeared first on The Security Ledger with Paul F. Roberts.

Click the icon below to listen.

Episode 228: CISA’s Eric Goldstein on being Everyone’s Friend in Cyber

Paul Roberts — Mon, 18 Oct 2021 20:01:19 GMT

Eric Goldstein, Executive Assistant Director for Cybersecurity for the Cybersecurity and Infrastructure Security Agency (CISA), says the agency is all about helping companies and local government to keep hackers at bay. But are organizations ready to ask for help?

The post Episode 228: CISA’s Eric Goldstein on being Everyone’s Friend in Cyber...

Read the whole entry... »

Click the icon below to listen.

Hackers Can Now Bypass PIN Codes on Mastercard and Maestro Contactless Cards

Softpedia News (George Dascalu) — Tue, 31 Aug 2021 15:15:20 GMT

Contacless Mastercard and Maestro PINs can be bypasses due to a new vulnerability discovered by Swiss College of Engineering in Zurich, according to Cybersecurity News.

The key aspect of the flaw is that it allows thieves to use a hacked Mastercard or Maestro card to make contactless payments without having to input the PIN to complete the transaction, if properly exploited.

Properly in this case entails first installing dedicated software on two Android smartphones. One device is used to simulate a point of sale terminal being installed, while the other acts as a card emulator that allows the modified transaction information to be transmitted to a real point-of-sale device. Once the card initiates a transaction, it reveals all related information.

To avert further attacks, security experts will not reveal the app in question

Experts from ETH Zu... (read more)

Google, Microsoft To Invest $30B in Cybersecurity

Softpedia News (George Dascalu) — Tue, 31 Aug 2021 14:58:00 GMT

Following sophisticated cyberattacks that targeted critical infrastructure, organizations and governments around the world, Microsoft, Amazon, Apple, IBM and Google pledged to invest a total of $30 billion in cybersecurity advances over the next 5 years, according to The Hacker News.

US plans to develop a framework to improve the supply chain technologies and broaden CISA's role in safeguarding natural gas pipelines. A meeting was held in this sense at the While House that included top representatives from various US companies who agreed to help improve cybersecurity.

The pledges come following repeated high-profile cyberattacks on SolarWinds, Microsoft, Colonial Pipeline, read more)

Microsoft Warns of Widespread Open Redirects Phishing Attacks

Softpedia News (George Dascalu) — Tue, 31 Aug 2021 14:43:59 GMT

Microsoft issued a warning about a huge phishing campaign that uses open email links to steal credentials, according to The Hacker News.

An old idiom advises us to work smart, not hard and nobody applies it better than modern hackers. Using something as common as URLs, threat actors manage to trick numerous users into introducing sensitive information that could grant access to an organization's network, steal credit card information or personal data that can be used for blackmailing. Nowadays, some manage to perfect their campaigns to the point where they are not even detected by advanced and up-to-date anti-malware solutions.

Microsoft 365 Defender Threat Intelligence Team explained in a report "Attackers co... (read more)

Legal Consequences Possible by Cybersecurity Standards Non-Compliance

Softpedia News (George Dascalu) — Tue, 31 Aug 2021 14:27:41 GMT

With an average cost of a data breach reaching an all-time high of $4.24 million, still some companies fail to see the full picture and don't meet modern cybersecurity standards, according to Tripwire.

Despite the fact that online threats are increasing on a daily basis, numerous firms fail to recognize the importance of proper cybersecurity. Interestingly enough, many companies are not aware that they are bound by state, industry, and international laws. Although there is no uniform national or global cybersecurity law in place, companies that fail to meet certain legislation can face legal consequences.

As cybersecurity becomes more of a serious concern, the need for online defense is starting to worry more governments around the world. Aside from the potential data loss, companies that... (read more)

Critical Cosmos Database Flaw Affecting Microsoft Azure Customers

Softpedia News (George Dascalu) — Tue, 31 Aug 2021 14:02:30 GMT

Microsoft sent out a warning to thousands of cloud computing customers regarding threat actors that can view, modify, or even delete master databases if they gain access to their systems, according to Reuters.

Wiz announced that Microsoft Azure's flagship Cosmos database contain a vulnerability that allows access to keys that control access to the databases of hundreds of companies. Unable to update those keys itself, Microsoft sent an email to its customers Thursday asking them to create new keys. The software giant compensated Wiz with $40,000 in cash for discovering and reporting the security flaw.

Microsoft said, "Microsoft recently became aware of a vulnerability in Azure Cosmos DB that could potentially allow a user to gain access to another customer's resources by using the account's primary read-w... (read more)

Chinese Developers Reveal Android Gamers' Data

Softpedia News (George Dascalu) — Tue, 31 Aug 2021 13:57:42 GMT

A vpnMentor investigation found that a 134 GB server owned by EskyFun is exposed and user data was leaked for game titles such as Metamorph M, The Three Kingdoms Legend, Adventure Story, Rainbow Story, and Fantasy MMORPG.

The aforementioned games were downloaded 1.6 million times, whereas the leaked information had more than 365 million records. An intriguing aspect is that developers increased the amount of analytics, monitoring and authorization options available for the games, some needing more permissions even before they were installed.

Data disclosed includes IP and IMEI numbers, mobile device event logs, device information, phone numbers, EskyFun network passwords, current operating system, rooted or otherwise rooted phones, player acquisition and transaction reports, mailing, and support requests. Various data points were also used to identify profile individuals as well as tw... (read more)

Kaspersky: Kanye's Upcoming Album is a Scam Magnet

Softpedia News (George Dascalu) — Tue, 31 Aug 2021 13:41:17 GMT

Cybercriminals are launching a new scam to take advantage of the release of Kanye West's Donda album by distributing malicious fake downloads on the Internet, according to Tech Republic.

Cybersecurity firm Kaspersky proactively studied the event to see if threat actors were spreading any malware across the Internet. They emphasized that one of the scams is to target the release of highly anticipated media (movies, music), as they can place the malicious code in fake files that can be easily downloaded.

This particular scam attempt involves the uploading of fake malicious files to the Internet that are similar to those that were identified prior to the introduction of Black Widow. Kanye's fans are given a link to download the album and then asked to participate in a survey to confirm they are not robots. Afterwards, customers are redirected to a... (read more)

Work from Home Increased Worldwide Phishing Attacks

Softpedia News (George Dascalu) — Sat, 28 Aug 2021 05:40:47 GMT

Over the course of September 2019 to April 2021, Palo Alto Network's Unit 42 monitored firewall traffic and phishing sites detected by URL filters. The number of new phishing pages per week increased significantly when individuals began working from home.

Threat actors improved and intensified their phishing attacks by exploiting remote work environments where employees were not protected by corporate firewalls. Cybersecurity experts noticed a sudden and significant drop in traffic between March and April 2020, when COVID began spreading across the United States, forcing companies to switch to remote work.

Education and high-tech industries saw significant declines in traffic during this period, with the latter having the steepest drop: education (a 46% drop), most likely due to school closures, and high-tech (a 35% drop), probably because more employees starting working from home... (read more)

Kaseya Patches New 0-Day Vulnerabilities Affecting Unitrends Servers

Softpedia News (George Dascalu) — Fri, 27 Aug 2021 11:00:03 GMT

Two zero-day vulnerabilities affecting Unitrends backup and continuity service have been patches by Kaseya recently, according to The Hacker News.

Dutch Institute for Vulnerability Disclosure (DIVD) informed that the provider of IT infrastructure management solutions has solved server software bugs 10.5.5-2 reported on August 12. Both vulnerabilities are part of a trio of flaws discovered and reported on July 3, 2021. The issues encompass both an authenticated vulnerability to remote code execution and a privilege escalation fault on Unitrends servers from the read-only user to the administrator.

Users of unpatched software should avoid connecting the affected servers to the Internet

A previously unknown client vulnerability in Kaseya Unitrends has not yet been patched. Then again, the company issues some firewall rules recommendations to... (read more)

Engineering PCs Are Concerning Initial Access Vector in OT Attacks

Softpedia News (George Dascalu) — Fri, 27 Aug 2021 10:46:00 GMT

A new report titled SANS 2021 OT/ICS Cybersecurity Report contains alarming information gathered from 480 individuals in various industries. Organizations that use operational technology (OT) and industrial control systems (ICS) are very concerned about cyber attacks.

The findings highlight the need for businesses to improve the ability to anticipate and respond to emerging threats and opportunities. While many are taking precautions to reduce risks, they are unaware if the breaches already occurred within their organization. To summarize the findings:

Approximately 70% of respondents indicated that the risk to their operational technology environment was high or severe.
With many companies concerned about cyber risk in their operating environment, 48% of respondents did not know whether they had encountered a breach of o... (read more)

Top Linux Vulnerabilities Exploited by Hackers

Softpedia News (George Dascalu) — Thu, 26 Aug 2021 13:29:00 GMT

Linux-based machines that are directly connected to the Internet can be targets for attackers who can quickly push potentially dangerous web-based shells, ransomware, Trojans, and other malicious software, according to The Hacker News.

Trend Micro produced a comprehensive analysis of the Linux threat landscape, highlighting the barriers and vulnerabilities that have plagued the operating system in the first half of the year. The information was gathered using honeypots, sensors and anonymous telemetry.

According to the company, which has detected about 15 million malware attacks targeting Linux-based cloud environments, ransomware and coin miners account for 54% of all malware, while web shells represent 29% of all recorded events.

Researchers evaluated over 50 million events from 100,000 unique Linux servers and identified 15 separate vulnerabilities used in th... (read more)

Personal Information of Entire Swiss Town Leaked Following Cyberattack

Softpedia News (George Dascalu) — Thu, 26 Aug 2021 12:48:26 GMT

Following reports of personal data leaked online from the entire population, a small Swiss town revealed that it had misjudged the seriousness of the cyber attack late in the day before, according to Security Week.

Rolle, a small, lovely town on the beaches of Lake Geneva, acknowledged that it had been targeted by a ransomware attack and that sensitive information on some administrative systems had been compromised. The attack took place on May 30 and the city government said that only modest amounts of data were compromised at the time. Moreover, all information was restored from backup copies of the original files. However, according to an investigation published Wednesday by the French daily Le Temps, the attack was considerably larger.

Cybercriminals stole names, residences, and social security numbers

Le Temps cites an unidentified ... (read more)

Top IT Firms CEOs to Attend White House Cybersecurity Meeting

Softpedia News (George Dascalu) — Thu, 26 Aug 2021 12:32:38 GMT

On Wednesday, President Joe Biden will meet with top executives from some of the country's largest technology and financial companies, as the White House seeks private sector backing for a unified cyber defense against emerging threats, according to MCU Times.

The gathering comes amid an increase in ransomware attacks on critical infrastructure, extorting multi-million dollar payments from large corporations, and other illicit cyber operations linked to foreign hackers by US authorities. According to a senior government official, the purpose of the conversation is to identify the root causes of hostile cyber activity as well as ways in which the private sector may contribute to enhancing cybersecurity.

The President Biden proposed an infrastructure bill would provide about $1 trillion in cybersecurity subsidies to state, local and tribal governmen... (read more)

New SideWalk Backdoor Targeting U.S. Computer Retailers

Softpedia News (George Dascalu) — Thu, 26 Aug 2021 11:31:55 GMT

Chinese advanced persistent threat (APT) gangs have resumed their hacking activities, with one of the attacks targeting an American computer retailer using an unknown backdoor referred to as Sidewalk, according to The Hacker News.

In a report, ESET Cybersecurity Researchers Mathieu Tartare and Thibaut Passilly describe the fresh backdoor as modular, allowing the dynamic loading of additional modules from specific control and command servers. The malware is also designed to target Cloudflare workers as C&C servers and Google Docs as dead drop resolvers.

Security researchers describe SideWalk as "responsible for reading the encrypted shellcode from disk, decrypting it and injecting it into a legitimate process using the process hollowing techniqu... (read more)

FluBot Malware Strikes Again

Softpedia News (George Dascalu) — Thu, 26 Aug 2021 11:28:17 GMT

FluBot Android malware is back and already launched several attacks outside the regular geographical region of impact, according to Cyware.

Recently conducted research into the FluBot banking malware has revealed an upsurge in the number of dangerous distribution pages in a variety of Australian, Polish, and German financial institutions.

Numerous intriguing elements were incorporated by the threat actors in the new operations that now collected user credentials by overlaying several popular banking applications. The design of the malicious web pages is devised to disseminate text messages that appear to be voicemail notifications or shipment tracking information, but are actually scams.

It is worth noting that the cybercriminals were able to accomplish all of this while remaining undetected during the infection process thanks to a Domain Generation Algorithm (D... (read more)

Medical Data for 12,000 Patients Leaked Following Revere Health Attack

Softpedia News (George Dascalu) — Thu, 26 Aug 2021 05:11:59 GMT

A mistake by a health care worker resulted in the leaking of medical information of about 12,000 patients. The phishing attack took place on June 21 and lasted only 45 minutes, according to The Spectrum.

While he breach exposed medical record numbers, birth dates, procedures, and insurance provider names, provider names, the two-month investigation determined that the breach posed a negligible risk to the patients affected. Moreover, Revere Health believes that the hacker is not attempting to publish the patient medical information, but rather is using the incident as a platform to conduct more sophisticated phishing email attacks against other employees.

Bob Freeze, the director of marketing and communications, stated that the stolen data affected patients of the Heart of Dixie Cardiology Department in St. Georg... (read more)

38 Million Records Exposed from Microsoft Power Apps

Softpedia News (George Dascalu) — Thu, 26 Aug 2021 02:55:33 GMT

In an unexpected data leak, more than 38 million records from 47 organizations using Microsoft's gateway platform Power Apps were accidentally published online, according to The Hacker News.

The unfortunate incident resulted in the leakage of sensitive information on servers of corporations such as Microsoft, J.B. Hunt, and American Airlines along with government agencies from Indiana, Maryland, and New York City.

Power Apps are mostly used for developing custom low-code applications for mobile devices as well as websites. The programs created by Microoft have a number of advantages, such as APIs that allow other applications to access data, templates as well as managing and collecting information and storage.

Key information that went missing:

The misconfiguration of a port could lead to making the stored data public and this is what happened h... (read more)

Mr. White Returns All $610 Crypto Assets Stolen in Cyberattack

Softpedia News (George Dascalu) — Tue, 24 Aug 2021 16:53:08 GMT

The hacker known as Mr. White found a way to resolve one of the biggest cryptocurrency thefts of all time, according to CNBC.

Earlier this week, Poly Network, a decentralized financial network, announced that about $600 million in bitcoin had been stolen from its vaults due to a coding error. The sum was changed immediately to other cryptocurrencies, namely a total of $273 million in Ethereum tokens, $253 million in Binance Smart Chain tokens, and $85 million in USDC.

Surprisingly, the thief known as Mr. White Hat, began recovering assets almost shortly after the discovery and distributed t... (read more)

WhatsApp New Modified Version Installs Triada Trojan

Softpedia News (George Dascalu) — Tue, 24 Aug 2021 16:43:47 GMT

A customized version of the WhatsApp Messaging App for Android has been found to display full-screen advertising, register device users for unwanted premium subscriptions without their agreement and deliver dangerous payloads, says The Hacker News.

Generally speaking, modifications of legitimate Android apps are launched to perform functions that were not originally intended. For instance, you can customize icons, disable video calls, add themes or hide features like Recently Seen with FMWhatsApp. Then again, not all mods are launched with good intentions and this is another case of why you should be wary of too-good-to-be-true free services.

The FMWhatsApp version discovered by read more)

Researchers Warn of 4 Emerging Ransomware Groups

Softpedia News (George Dascalu) — Tue, 24 Aug 2021 16:14:00 GMT

Researchers identified 4 new ransomware gangs that are targeting businesses and key infrastructure, according to The Hacker News.

Ransomware attacks nowadays did not only increase in frequency and intensity, but went beyond financial gain, posing a threat to the national security of firms, hospitals, schools, and governments worldwide. Palo Alto Networks' Unit 42 threat intelligence team notes "While the ransomware crisis appears poised to get worse before it gets better, the cast of cybercrime groups that cause the most damage is constantly changing".

While we did not hear too much of them lately compared to previous years, Unit 42 says this is just the calm before the storm. Let's explore the latest ransomware kits on the market and the groups behind them.

AvosLocker

AvosLocker is a late-June ransomware company that exploits press announce... (read more)

Singapore and the U.S. Will Work More Closely on Cybersecurity

Softpedia News (George Dascalu) — Tue, 24 Aug 2021 15:15:26 GMT

Singapore and the U.S. signed several Memorandums of Understanding (MOUs) to expand their cybersecurity cooperation in areas such as defense, banking, and research and development, according to ZDNet. These activities include increased information sharing, team building, training and skills development.

Three MOUs were signed on Monday during the US' three-day visit to Asia Vice President Kamala Harris. One was an agreement between Singapore and the U.S. Cyber Security and Infrastructure Security Agency (CISA) aimed at expanding the cybersecurity partnership beyond data sharing and exchange. Both government agencies will explore new areas of cooperation, such as important technological research and development.

The first MOU will allow both partners to strengthen existing partnerships between the countries so that they are able to work clo... (read more)

State Department Allegedly Hit by Cyberattack

Softpedia News (George Dascalu) — Mon, 23 Aug 2021 14:46:14 GMT

The Department of Defense's Cyber Command issued warnings about a possibly significant cyberattack against the United States Department of State that may have occurred in recent weeks.

According to yesterday's report from Fox News, it is still unclear how much damage has been done following the security incident, who the perpetrator was and whether the operations of the institutions have been affected. Given the nature of the Department, the information cannot be divulged, making things more complicated.

A department spokesperson told Fox News, "The Department takes seriously its responsibility to safeguard its information and continuously takes steps to ensure information is protected" [...] "For security reasons, we are not in a position to discuss the nature or scope of any alleged cybersecurity incidents at this time".

T... (read more)

T-Mobile Customers Sueing the Company Over Data Breach

Softpedia News (George Dascalu) — Mon, 23 Aug 2021 14:28:57 GMT
With each passing day, the fallout from T-Mobile's recent data breach grows more serious. An update released Friday suggests hacking firms unlawfully obtained the personal information of another 5.3 million postpaid customers, including names, addresses, birthdates, IMSIs, IMEIs, and phone numbers, according to Fox Business.

The firm recently declared it discovered an additional 667,000 accessible user accounts that included addresses, phone numbers, customer names, and dates of birth. The latest figures put the total number of people affected by the security breach at more than 50 million, an increase from... (read more)

Report: Cyberattacks on Education Increased by 29% Worldwide

Softpedia News (George Dascalu) — Mon, 23 Aug 2021 14:15:52 GMT
Cybersecurity firm Check Point discovered disturbing statistics concerning the significant growth in the weekly number of cyber attacks directed against firms and organizations in the world of education, according to Times of Israel.

Schools, colleges, and research institutions are among the organizations that have been targeted. In July 2021, there was an average of 1,739 attacks per organization per week, a 29% increase from the same month last year. The top 3 countries affected by the issue include:

India - average of 5,196 assaults and 29% increase from 2020

Italy - average of 5,016 assaults and 70% increase from 2020

Israel - average o... (read more)

Indra Group and Iran Railway Attacks May Be Related

Softpedia News (George Dascalu) — Mon, 23 Aug 2021 14:06:28 GMT
The cyberattack that crippled Iranian trains last month was recently attributed to the cybercriminal group Indra. The group is known for a series of attacks on several Syrian organizations using a wiper on the hacked networks, according to Cyware.

As expected, Indra denies any involvement in the latest attack on Iran. Then again, a large body of evidence suggests that the attackers were aware and had prior knowledge of the targeted networks. The attackers have distributed three different versions of Comet, Stardust, and Meteor wipers across victims' social media networks in the past couple of years.

According to CheckPoint<... (read more)

New Links Between Diavol Ransomware and TrickBot Gang Revealed

Softpedia News (George Dascalu) — Mon, 23 Aug 2021 14:04:53 GMT
IBM X-Force published the specifics of an early variant of an emerging ransomware strain dubbed Diavol, according to Security Intelligence.

Several months ago, Fortinet discovered an unsuccessful ransomware attempt employing the Diavol payload that was targeting a client of the firm. When the experts from the security business investigated the incident, they discovered a ransomware strain that was capable of launching successful attacks. However, IBM's security specialists disagree, stating that the malware is still in the early stages of development and that it was built solely for the purpose of research and development.

The Diavol ransomware sample uses RSA encryption, an algorithm that can prioritize the file types ... (read more)

More Than 600 ICS Flaws Spotted in H1 2021

Softpedia News (George Dascalu) — Sat, 21 Aug 2021 06:31:24 GMT
In the first six months of this year, 600 vulnerabilities were discovered in ICS products (Industrial Control Systems), impacting 76 vendors. The number of vulnerabilities increased by 41% in the same period, according to Claroty's ICS Risk & Vulnerability Report: H1 2021.

As the need to connect devices to the internet increases, so does the risk of being attacked by cybercriminals. Companies need to drive their business and invest in Operational Technology (OT) devices, and threat actors are using this growth to their advantage, seeking to launch hacking campaigns by taking advantage of companies that have vulnerable IT systems.

Advantech (22), WAGO (23), Rockwell Automation (35), Schneider Electric (65) and Siemens (146 vulnerabilities) are the most affected manufacturers. An important aspect is that the list of affected manufacturers also includes 20 companies whose product... (read more)

Hackers Steal More Than $97M from Liquid Crypto Exchange

Softpedia News (George Dascalu) — Sat, 21 Aug 2021 06:11:46 GMT
In recent months, more crypto exchange platforms have been targeted by hackers. The most recent attack resulted in the theft of $97 million worth of digital assets from the Japanese cryptocurrency exchange Liquid, according to ZDNet.

Liquid did not provide an estimate of damages because it is subject to analyses of the Financial Services Agency from Japan. Nevertheless, the attack affected many users, as Liquid is among the top 20 crypto exchanges in the world in terms of daily trading volume, sums estimated at more than $133 million per day on CoinMarketCap.

On the other hand. blockchain analytics firm Elliptic, claimed hackers obtained more than $97 million in cryptoc... (read more)

Pakistani Military Targeted by Confucius with Pegasus Spyware Lures

Softpedia News (George Dascalu) — Sat, 21 Aug 2021 05:45:33 GMT
Trend Micro spotted recent malicious activity conducted by cybercriminal group Confucius. The hackers launched a spear-phishing campaign using Pegasus lures to trick users into clicking on a malicious document that downloads a data theft code.

The attack begins with a clean email that contains a text copied from a legitimate Pakistani newspaper article.Two days later, the victim receives a new email with a warning from a Pakistani military official about the Pegasus spyware that includes a cutt.ly link to encrypted Word document and a decryption password.

Regardless of the action taken by the victim, clicking on either of the links leads to downloading the Word document. If the target makes the mistake of entering... (read more)

CISA Issues Ransomware Defense and Response Guidance

Softpedia News (George Dascalu) — Fri, 20 Aug 2021 06:30:42 GMT
Following a series of disruptive and headline-grabbing ransomware attacks on corporations in the United States over the past several months, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) has released a list of suggestions to prevent and respond to these sorts of attacks.

The information sheet called Protecting Sensitive and Personal Information from Ransomware-Caused Data Breaches contains numerous recommendations. In addition, the paper advises companies not to pay a ransom if they are the target of a ransomware attack.

The fact sheet reads “Ransomware is a serious and increasing threat to all government and private sector organizations, including critical infrastructure organizations. In response, the U.S. government launched... (read more)

Fisher Price's Bluetooth reboot of pre-school play phone has adult privacy flaw

Simon Sharwood

‘Chatter’ can be bugged thanks to kindergarten-grade security

A Bluetooth phone designed to evoke the carefree days of early childhood has been found to instead threaten the very adult prospect of being surveilled in your home.…

Alibaba Cloud slapped by Chinese ministry for mishandling Log4j

Laura Dobberstein

Beijing's not saying what cloudy contender did wrong

China's Ministry of Industry and Information Technology has suspended Alibaba Cloud's membership of an influential security board to protest its handling of the Log4j flaw.…

Of course a Bluetooth-using home COVID test was cracked to fake results

Simon Sharwood

The Ellume COVID-19 Home Test was connected to the internet of woefully insecure things for a while

Security vendor F-Secure has faked a COVID test result on a Bluetooth-equipped home COVID Test. Thankfully the vendor’s since fixed the device.…

How to tackle hybrid cloud security and DevSecOps

John E Dunn

Putting the Sec into DevOps is key, says Red Hat

Paid Feature Of all the ideas to surface in the 20-year history of cloud computing, few have proved as compelling as the hybrid cloud. Organizations understand on-premises data centers and how computing power can be rented through public clouds or accessed through dedicated private clouds.…

Belgian defence ministry admits attackers accessed its computer network by exploiting Log4j vulnerability

Gareth Corfield

Perpetrators' ID unknown, however

The Belgian Ministry of Defence has suffered a cyber attack after miscreants exploited one of the vulnerabilities in Log4j. The attack marks the first occasion that a NATO country's defence ministry has fallen victim to the flaws.…

UK National Crime Agency finds 225 million previously unexposed passwords

Simon Sharwood

Shares them with Troy Hunt’s Have I Been Pwned after sweeping them up from ‘compromised cloud storage’

The United Kingdom’s National Crime Agency and National Cyber Crime Unit have uncovered a colossal trove of stolen passwords.…

US bags Russian accused of stealing millions after stealing pre-release financial filings

Thomas Claburn

Swiss cough up accused crim while Russia is 'deeply disappointed'

The US Attorney's Office of Massachusetts on Monday announced the extradition of Vladislav Klyushin, a Russian business executive with ties to the Kremlin, on charges of hacking US computer networks and committing securities fraud by trading on undisclosed financial data.…

Police National Computer not pwned by Clop ransomware crims, insists Home Office

Gareth Corfield

Scottish MSP Dacoll was hit, however

The Clop ransomware gang pwned a managed service provider with access to the UK's Police National Computer, dumping data on its dark web leaks site – but officials deny that police data was compromised.…

How to keep on top of cloud security best practices

John E Dunn

Trend Micro outlines common misconfigurations and how to avoid them

Paid Feature In an era beset by hackers at every turn, it’s no small irony that the fastest growing security threat to business data might now be the self-inflicted wound of cloud service misconfiguration.…

VMware 2FA flaw can divulge that vital second credential to malicious actors

Iain Thomson

Plus: Deep dive into the NSO Group's zero-click exploit and 'Hack the DHS!'

In Brief VMware has warned users a flaw in its VMware Verify two-factor authentication product could allow a malicious actor with a first-factor authentication credential to obtain a second factor from its VMware Verify product.…

Bad things come in threes: Apache reveals another Log4J bug

Simon Sharwood

Third major fix in ten days is an infinite recursion flaw rated 7.5/10

The Apache Software Foundation (ASF) has revealed a third bug in its Log4 Java-based open-source logging library Log4j.…

US distrust of Huawei linked in part to malicious software update in 2012

Thomas Claburn

Report claims Huawei techs working for Chinese intelligence compromised Australian telco

Suspicions about the integrity of Huawei products among US government officials can be attributed in part to a 2012 incident involving a Huawei software update that compromised the network of a major Australian telecom company with malicious code, according to a report published by Bloomberg.…

CISA issues emergency directive to fix Log4j vulnerability

Thomas Claburn

Federal agencies have a week to get their systems patched

The US government's Cybersecurity and Infrastructure Security Agency (CISA) on Friday escalated its call to fix the Apache Log4j vulnerability with an emergency directive requiring federal agencies to take corrective action by 5 pm EST on December 23, 2021.…

RAF shoots down 'terrorist drone' over US-owned special ops base in Syria

Gareth Corfield

£200k Anglo-French heat-seeking missile does its thing

The RAF has scored its first air-to-air "kill" – where an aircraft downs an enemy aircraft – for almost 40 years after shooting down a drone over Syria.…

Over Log4j? VMware has another critical flaw for you to patch

Simon Sharwood

Workspace ONE Unified Endpoint Management can leak info via server-side request forgery

VMware customers have probably had a busy week because more than 100 of the IT giant's products are impacted by the Log4j bug.…

Facebook locks out 1,500 fake accounts used by cyber-spy firms to snoop on people, alerts 50k potential targets

Thomas Claburn

Meta adverse to internet mercenaries using its social networks to help governments violate human rights

Facebook successor Meta on Thursday said it canceled 1,500 social media accounts used by seven surveillance-for-hire firms to conduct online attacks against government critics and members of civil society.…

Why ransomware attacks happen out of hours or during the holidays

Robin Birtstone

Security teams have a choice to make – and doing nothing is not an option

Paid Feature Time waits for no one. But ransomware attackers do. Increasingly, cybercriminals are timing their attacks, detonating them when their victims are out of the office. This gives them the chance to inflict maximum damage, and explains why ransomware attacks surge on public holidays like Thanksgiving and Christmas. How do they do it, and what can under-staffed security teams do about it?…

East Londoners nicked under Computer Misuse Act after NHS vaccine passport app sprouted clump of fake entries

Gareth Corfield

App runs off a database, and databases are run by humans

British police have made a series of arrests over the past few months after people with apparent access to NHS databases allegedly sold fake vaccination status entries on the NHS vaccine passport app.…

Move fast, break security: Why CISOs must push back against Agile IT

The Masked CISO

The Vectra Masked CISO series gives security leaders a place to expose the biggest issues in security and advise peers on how to overcome them

Advertorial The Vectra Masked CISO series gives security leaders a place to expose the biggest issues in security and advise peers on how to overcome them.…

National Cyber Strategy will lead to BritChip for mobile devices by 2025, claims UK.gov

Gareth Corfield

And potentially an increase in UK state-backed hacks

The British government has launched a £2.6bn National Cyber Strategy, intended to steer the state's thinking on cyber attack, defence and technology for the next three years – and there's some good news if you run a tech company.…

Japan draws a LINE: web giants must reveal where they store user data

Laura Dobberstein

Looks a lot like a response to messaging services passing data through China

Social media and search engine operators in Japan will be required to specify the countries in which users' data is physically stored, under a planned tweak to local laws.…

Facebook expands bug bounty program to include scraping attacks, two years after it was scraped – hard

Simon Sharwood

But still allows limited harvesting

Meta has expanded its bug bounty program to include payouts for reports of scraping attacks on Facebook – but hold your applause.…

As CISA tells US govt agencies to squash Log4j bug by Dec 24, fingers start pointing at China, Iran, others

Chris Williams

Microsoft says cyber-spies linked to Beijing, Tehran are getting busy with security flaw along with world + dog

Microsoft reckons government cyber-spies in China, Iran, North Korea, and Turkey are actively exploiting the Log4j 2.x remote-code execution hole.…

US lawmakers want to put NSO Group, 3 other spyware makers out of business with fresh severe sanctions

Thomas Claburn

Export controls aren't enough, Dems say: Bring on the Global Magnitsky Act

Eighteen US Democratic lawmakers have asked the Treasury Department and State Department to punish Israel-based spyware maker NSO Group and three other surveillance software firms for enabling human rights abuses.…

Pen Test Partners: Anyone could view Gumtree users' GPS location by pressing F12

Gareth Corfield

And online flea market had IDOR in an iOS-focused API

UK online used goods bazaar Gumtree exposed its users' home addresses in the source code of its webpages, and then tried to squirm out of a bug bounty after infosec bods alerted it to the flaw.…

Microsoft closes installer hole abused by Emotet malware, Google splats Chrome bug exploited in the wild

Chris Williams

Round off the year with a large crop of fixes for programming blunders

Patch Tuesday It's not just Log4j you need to worry about this week. It's the final Patch Tuesday of the year.…

Apache takes off, nukes insecure feature at the heart of Log4j from orbit with v2.16

Gareth Corfield

Now open-source logging library's JNDI disabled entirely by default, message lookups removed

Last week, version 2.15 of the widely used open-source logging library Log4j was released to tackle a critical security hole, dubbed Log4Shell, which could be trivially abused by miscreants to hijack servers and apps over the internet.…

You may have cracked serverless development, but it’s almost certain you haven’t solved serverless security

David Gordon

Here’s how to secure that ever-expanding attack surface

Paid Post Serverless is revolutionizing software development, allowing organizations to produce applications which consume cloud resources only when they need to. Developing applications this way also dramatically reduces the amount of code to write while increasing the velocity of completed applications.…

Popular password manager LastPass to be spun out from LogMeIn

Jude Karabus

Private equity owners play pass the parcel

One of the biggest beasts in the password management world, LastPass, is being spun out from parent LogMeIn as a "standalone cloud security" organisation.…

MPs charged with analysing Online Safety Bill say end-to-end encryption should be called out as 'specific risk factor'

Gareth Corfield

Too far? Committee thinks it doesn't go far enough

Britain's Online Safety Bill is being enthusiastically endorsed in a "manifesto" issued today by MPs who were tasked with scrutinising its controversial contents.…

Log4j RCE latest: In case you hadn't noticed, this is Really Very Bad, exploited in the wild, needs urgent patching

Gareth Corfield

This might be the bug that deserves the website, logo and book deal

Updated Miscreants are wasting no time in using the widespread Log4j vulnerability to compromise systems, with waves and waves of live exploit attempts focused mainly – for now – on turning infected devices into cryptocurrency-mining botnet drones.…

When disaster strikes, data recovery really is a race against time

David Gordon

But exactly how much time are we talking about?

Webinar When it comes to recovering after a catastrophic event such as a ransomware attack or data center failure, time is necessarily of the essence.…

Is VPOTUS Bluetooth-phobic or sensible? The answer's pretty clear

Iain Thomson

Plus: bugs found on Mars! Of the software kind, of course

In Brief The vice-president of the United States, Kamala Harris, was mocked by commentators this week for her aversion to Bluetooth on security grounds. Security professionals think she has a point – given her position.…

Timekeeping biz Kronos hit by ransomware and warns customers to engage biz continuity plans

Gareth Corfield

Big implications for millions of staffers' Christmas pay packets

Updated Kronos Private Cloud has been hit by a ransomware attack. The company, also known as Ultimate Kronos Group (UKG), provides timekeeping services to companies employing millions of people across the world.…

Ooh, an update. Let's install it. What could possibly go wro-

Richard Speed

Patching the patch

Who, Me? Welcome to another Who, Me? confession from the Register readership, and a reminder of the unexpected side effects of software updates.…

Irish Health Service ransomware attack happened after one staffer opened malware-ridden email

Gareth Corfield

PWC report shows long list of missed opportunities to shut out extortion crims

Ireland's Health Service Executive (HSE) was almost paralysed by ransomware after a single user opened a malicious file attached to a phishing email, a consultancy's damning report has revealed.…

Log4j RCE: Emergency patch issued to plug critical auth-free code execution hole in widely used logging utility

Gareth Corfield

Prepare to have a very busy weekend of mitigating and patching

Updated An unauthenticated remote code execution vulnerability in Apache's Log4j Java-based logging tool is being actively exploited, researchers have warned after it was used to execute code on Minecraft servers.…

Revealed: Remember the Sony rootkit rumpus? It was almost oh so much worse

Richard Speed

That time Rootkitting for Dummies might as well have been in Microsoft's Plus! Pack

Retired Microsoft engineer, Dave Plummer, offered a blast from the past last week with a look back at the infamous Sony Windows "rootkit" scandal.…

Ransomwared payroll provider leaks data on 38,000 Australian government workers

Simon Sharwood

Frontier Software admitted attack three weeks ago, said data was safe … now it's on the dark web

Personal information describing names, addresses, bank account details, and taxation IDs of 38,000 Australian government employees has been leaked to the dark web after a ransomware attack.…

A third of you slackers out there still aren't using HTTPS by default

Gareth Corfield

And it's really bad news for EV cert vendors in Top 1 Million report

Almost a third of the world wide web's top million sites are still not using HTTPS by default, according to infosec researcher Scott Helme's analysis.…

Resistance is ... cheap? Cloudflare, Mandiant, and pals form incident response 'n' cyber insurance borg

Gareth Corfield

Trust us with everything, croons septuple-strong partnership

Cyber insurance premiums are increasing and so is infosec's determination to get a slice of that pie: Cloudflare is partnering with Mandiant, Secureworks, and Crowdstrike in a "rapid referral" partnership for under-attack companies.…

Ransomware giving you sleepless nights? Here’s how to insure a good night’s sleep

David Gordon

This guide to cyber insurance will help you rest easy

Paid Post Why do CISOs and CIOs endure so many sleepless nights? Because they’re either worrying about cyber attacks in general, and ransomware in particular, or because they’re actually dealing with them.…

Oz Feds reveal distribution model behind backdoored 'An0m' chat app spread by crims

Simon Sharwood

Resellers were given exclusive territories to target, and offered tech support

Australia's Federal Police force has revealed more about how it distributed a backdoored chat app to criminals.…

Canadian charged with running ransomware attack on US state of Alaska

Gareth Corfield

Cross-border op nabbed our man, boast cops and prosecutors

A Canadian man is accused of masterminding ransomware attacks that caused "damage" to systems belonging to the US state of Alaska.…

Not all tech disasters are ‘all hands’ events. But how do you tell which is which?

David Gordon

This webinar shows you how to measure the blast radius

Webinar This isn’t surprising. The prospect of having all your data and applications compromised, whether due to ransomware or other cyberattacks, or any of the more traditional disaster scenarios is so horrifying, that it’s natural to throw everything you have at it.…

Virgin Media fined £50,000 after spamming 451,000 who didn't want marketing emails

Gareth Corfield

Data watchdog shows it's keeping its PECR up

British telco Virgin Media is facing a £50k financial penalty after spamming more than 400,000 opted-out customers urging them to sign back up to receive marketing bumf.…

What’s the right amount of trust to build into your network? Less than Zero

Joseph Martins

It’s tricky but manageable, says Iomart

Paid Feature “The trust of the innocent is the liar's most useful tool,” Stephen King wrote. At least that’s what the internet claims.…

Microsoft extends Secured-core concept to servers

Simon Sharwood

Certifies hardware with malware-crimping spec, already common in PCs, for Azure Stack and Windows Server

Microsoft has extended the Secured-core concept it applied to PCs in 2019 to servers, and to Windows Server and Azure Stack HCI.…

Cryptominers aren't just a headache – they're a big neon sign that Bad Things are on your network

Gareth Corfield

So says Sophos in warning about Tor2Mine Monero malware

Cryptominer malware removal is a routine piece of the cybersecurity landscape these days. Yet if criminals are hijacking your compute cycles to mine cryptocurrencies, chances are there's something worse lurking on your network too.…

Foreign Office IT chaos: Shocking testimony reveals poor tech support hindered Afghan evac attempts

Lindsay Clark

Contributed to dysfunction as diplomats and soldiers struggled to get Afghan helpers out of reach of Taliban

Diplomats and soldiers were left grappling with appallingly inadequate IT and secure communications support as thousands of Afghans struggled to get help from the UK during the fall of the capital Kabul in August.…

InfoSecHotSpotTwitterFeedRSS

Leonardo DRZ wins first ever TCG CodeGen Developer Challenge

Related Stories

4-Year-Old Microsoft Azure Zero-Day Exposes Web App Source Code

The cool retro phone with a REAL DIAL… plus plenty of IoT problems

Telegram Abused to Steal Crypto-Wallet Credentials

‘Spider-Man: No Way Home’ Download Installs Cryptominer

The Future of Work Has Changed, and Your Security Mindset Needs to Follow

7 of the Most Impactful Cybersecurity Incidents of 2021

Examining Log4j Vulnerabilities in Connected Cars and Charging Stations

Microsoft Customer Source Code Exposed via Azure App Service Bug

Nearly 50% of People Will Abandon Sites Prohibiting Password Reuse

CISA's New Log4j Scanner Aims to Find Vulnerable Apps

Plundered bitcoins recovered by FBI – all 3,879-and-one-sixth of them!

PYSA Emerges as Top Ransomware Actor in November

All in One SEO Plugin Bug Threatens 3M Websites with Takeovers

Log4j Reveals Cybersecurity's Dirty Little Secret

Critical Apache HTTPD Server Bugs Could Lead to RCE, DoS

Stolen Bitcoins Returned

Why We Need to Consolidate Digital Identity Management Before Zero Trust

Future of Identity-Based Security: All-in-One Platforms or Do-It-Yourself Solutions?

Four Bugs in Microsoft Teams Left Platform Vulnerable Since March

5 online scam red flags | Kaspersky official blog

1. Stick or carrot

2. Ticking clock

3. Amateurish design

4. Searching the database

5. Small fee

To be continued

UK Security Agency Shares 225M Passwords With 'Have I Been Pwned'

Meta Files Federal Lawsuit Against Phishing Operators

Time to Ditch Big-Brother Accounts for Network Scanning

Java Code Repository Riddled with Hidden Log4j Bugs; Here’s Where to Look

93% of Tested Networks Vulnerable to Breach, Pen Testers Find

Half-Billion Compromised Credentials Lurking on Open Cloud Server

Apache’s other product: Critical bugs in ‘httpd’ web server, patch now!

How Modern Log Management Strengthens Enterprises’ Security Posture

Preemptive Strategies to Stop Log4j and Its Variants

What’s new with Matrix security in Resurrections | Kaspersky official blog

Fighting pirate avatars

Pirate signal from hacker ships

Pirate avatar transfer system

Pirate avatar tracking system

Matrix agents

Rogue programs

Network segmentation

Anomaly control system

The problem of ex-Agent Smith

New problems

Data leaks

Critical infrastructure security

General takeaways

The Future of Ransomware

UK hands over 585 million compromised passwords to 'Have I been pwned' service

Facebook's internal messages reveal plans to ignore European privacy laws

How Is Zero Trust Evolving to Be More Continuous in Verifying Trust?

Belgian defence ministry suffers cyber attack through Log4j exploitation

How to detect Apache HTTP Server Exploitation

What to Do About Log4j

Russian National Extradited for Illegal Hacking & Trading

New Log4j Attack Vector Discovered

Brillio Acquires Cedrus Digital to Strengthen Their Digital Transformation Service Capabilities

NetSPI Adds IoT Penetration Testing to its Suite of Offensive Security Services

Log4Shell: The Movie… a short, safe visual tour for work and home

SAIC Launches Rugged Apps to Provide Secure Commercial Apps to Government Users

BlackBerry Launches New Managed Extended Detection and Response (XDR) Service

SecurityScorecard Research Reveals Cyber Vulnerabilities Pose a Threat to U.S. Maritime Security

Trend Micro Crowns Champions of 2021 Capture the Flag Competition

Reblaze Appoints New CEO

Four Out of Five Organizations Are Increasing Cybersecurity Budgets for 2022

More on NSO Group and Cytrox: Two Cyberweapons Arms Manufacturers

Zero Trust Shouldn’t Mean Zero Trust in Employees

Lights Out: Cyberattacks Shut Down Building Automation Systems

How to detect hidden video cameras | Kaspersky official blog

Big Brother’s little siblings

Method 1. Hire an expert

Method 2. Use dedicated equipment

Method 3. Use a smartphone

Method 4. Trust an app

What to do if you detect a spying device