Home Blog Page 128

Deepfakes: A Growing Cybersecurity Concern

Cybercriminals Abuse AI and ML for Launching Sophisticated Cyberattacks

In tandem with developments in cybersecurity technology, cybercriminals have started getting more innovative with their attacking techniques. Threat actors are leveraging advanced technologies like Artificial Intelligence (AI) and Machine Learning (ML) to launch Deepfake attacks.

What is a Deepfake?

Deepfakes are specially crafted images, audio, and video content using AI and ML technologies to look like legitimate content. With Deepfake technology, threat actors can replace the voice/image of a particular person’s speech to manipulate information. Deepfakes confuse and spread disinformation campaigns, targeting popular personalities.

In addition to spreading disinformation, Deepfake technology is often misused for malicious purposes, including scams, election manipulation, social-engineering attacks, identity theft, and financial frauds.

Deepfake Attack – A Growing Cybersecurity Threat

According to security researchers from CyberCube, the spread of deep fake video and audio content could become a major security threat to businesses globally within the next two years. It is also anticipated that the increased dependence of organizations on video-based communication could motivate cybercriminals to focus on Deepfake attacks.

“As the availability of personal information increases online, criminals are investing in technology to exploit this trend. New and emerging social engineering techniques like deep fake video and audio will fundamentally change the cyber threat landscape and are becoming both technically feasible and economically viable for criminal organizations of all sizes,” said Darren Thomson, CyberCube’s Head of cybersecurity strategy.

“There is no silver bullet that will translate into zero losses. However, underwriters should still try to understand how a given risk stacks up to information security frameworks. Training employees to be prepared for deep fake attacks will also be important,” Darren added.

WhatsApp vs Signal vs Telegram: Which is More Viable and Secure?

WhatsApp vs Signal vs Telegram, WhatsApp alternatives

WhatsApp recently introduced an updated privacy policy, which mandates all users to share their data with its parent company Facebook. As per the ominous-sounding notification, users failing to accept the updated privacy policy will no longer be allowed to enjoy the services of the platform from February 8, 2021. In simpler words, they will be forced to uninstall the app if they fail to accept the policy changes.

Experts, including privacy pundits and governments, have raised concerns with WhatsApp’s stubbornness towards the new privacy policy.

WhatsApp vs Signal vs Telegram

It is a known fact that “one person’s loss is another person’s gain,” and this seems to be completely true in the current scenario. WhatsApp has nearly 200 million users that span across the globe. However, its latest move has forced most of them to rethink whether sharing data with Facebook is necessary. Confused and perplexed, users are seeking alternatives for WhatsApp. Given the number of options available on Android’s Google Play and Apple’s App Store, the competition is tough. But this race has two frontrunners fighting it out for the top spot: Signal and Telegram.

Let us have a look at the best possible alternatives for a secured messaging application.

The Winner: Experts Recommend Signal

Currently touted as the best WhatsApp alternative, Signal has been ordained by the experts for its polished security features. It is run by a non-profit led by Moxie Marlinspike, an American cryptographer and the current CEO of the company. The app was developed by the Signal Foundation and Signal Messenger, whose co-founder, Brian Acton, also happens to be the former WhatsApp co-founder.

 Security Features 
  • Developed by Marlinspike, Signal has end-to-end (e2e) encryption based on the Signal protocol. Thus, no third-party or even Signal’s developers can read its users’ messages.
  • It has an open-source protocol, which means there is transparency.
  • It does not support third-party backups like storing in Google Drive or iCloud storage. All data is stored locally on the device itself. Your chat history is lost if you lose and/or change your device.

Signal also supports other basic security features like screen lock, fingerprint unlock, and an incognito keyboard option that does not store your typed words in the auto-suggest.

 Our Verdict 

Signal has been recommended by privacy experts, known personalities like Elon Musk and, by well-known whistleblower Edward Snowden, mainly because of three reasons:

  1. End-to-end encryption.
  2. No third-party and cloud storage of backups.
  3. Complete user privacy. As per the privacy header of Signal in the App store, it does not collect any user data.

Telegram – An Older Yet Unique War Horse

Telegram is another app that has been around for quite some time now. Learning from WhatsApp’s mistakes, it has bettered itself over time and has slowly gained popularity providing certain features that even WhatsApp lacks. With Telegram, users can send large files up to 1.5GB, add up to 200,000 users in a single group, and so on.

 Security Features 
  • Telegram also has end-to-end (e2e) encryption, but it is available only for “Secret Chats” and all types of Calls (voice, video, and group).
  • Instead of e2e encryption, it has distributed cross-jurisdictional encrypted cloud storage, which the Telegram CEO, Pavel Durov says, “is much more protected.”
  • Chat Backups are synced only with Telegram Cloud.

Although it has a host of security features, there is a downside to Telegram. It collects users’ data, including name, phone number, contacts, and user ID. It is tagged under PII and could be a problem in case of a future breach.

 Our Verdict 

Telegram is popular among the masses mainly because of its ability to accommodate 200,000 users in a single group at a given time. Apart from that, it surprisingly provides e2e encryption for one-on-one and group video calls, which is a rarity. However, it does collect users’ PII, and thus, if you are ready for a trade-off in exchange for the additional feature that it provides, nothing like it.

Closing Notes

Amid the chaos surrounding the WhatsApp data privacy policy and data sharing with Facebook, the former has issued another notification on Twitter to clear the air.

The issuance clearly states that neither WhatsApp nor Facebook can “see your private messages or hear your calls,” but how true could this be? Would users be convinced?  Will this be a start to the end of WhatsApp? Or will the tech giant pull through this crisis and emerge yet again? All we can do is sit back and wait; maybe better answers are waiting to be found. If not, then as experts suggested, we always have something to fall back on: Signal and Telegram.

Related News:

WhatsApp Discloses Six Bugs in its First Security Advisory

WhatsApp rolls out Biometric Security Lock for Android Devices

CISO MAG Writer - Mihir Bagwe
 About the Author 
Mihir Bagwe is a Tech Writer and part of the editorial team at CISO MAG. He writes news features, technical blogs, and conducts interviews on latest cybersecurity technologies.

 

UN Data Breach Exposes Over 100,000 UN Employees’ Details

Data breach

A group of cybersecurity researchers from Sakura Samurai accessed around 100,000 personal records and login credentials of United Nations’ (UN) employees that were exposed in a data breach. Sakura Samurai is an ethical hacking and security research group appointed to report security flaws to the UN under its vulnerability disclosure program and a Hall of Fame.

During the vulnerability discovery, the research team found an open subdomain for the UN body, the International Labor Organization (ilo.org), which gave them access to Git credentials. The researchers then exfiltrated the Git credentials tool, git-dumper, to take over a legacy MySQL database and a survey management platform. Sakura Samurai group also discovered an exposed subdomain of the UN Environment Program (UNEP), which was also exposing Git credentials.

Exposed Personal Data

According to researcher John Jackson, a massive amount of Personally Identifiable Information (PII) was exposed, including:

Two documents containing more than 102,000 travel records, including employee IDs, numbers, names, employee groups, travel justification, start and end dates, length of stay, approval status, and destinations.

Two documents that contain more than 7,000 records related to HR Nationality Demographics, including employee name, ID numbers, person’s nationality, Gender, employee pay grade, organization work unit Identification number and unit text tags.

One document of Generalized Employee Records (contained more than 1,000 records)

Project and Funding Source Records (more than 4,000 records)

Evaluation Reports (contained details of 283 projects)

Data Breach Impact

The Sakura Samurai team claimed they were able to download a lot of private password-protected GitHub projects and found multiple sets of database and application credentials for the UNEP production environment. In total, they found seven additional credential-pairs, which could have resulted in unauthorized access to multiple databases.

“We decided to stop and report this vulnerability once we were able to access PII that was exposed via Database backups that were in the private projects,” Sakura Samurai said.

Bitdefender Takes Victims of DarkSide Ransomware Towards Light

Harness Your System, Free Decryptor, federal government, cybersecurity

Encryption and decryption are two sides of the same coin. And ransomware operators often use encryption to take users to the dark side; however, Bitdefender is taking users towards the light. The cybersecurity firm has released a decryption tool that allows organizations to recover files encrypted by DarkSide ransomware operators without paying any ransom. The free decryptor tool automatically scans the systems for encrypted files and decrypts them.

A Light into the DarkSide Ransomware

Active since August 2020, DarkSide is a ransomware-as-a-service (RaaS) group that made millions in ransom payouts by encrypting critical files on compromised systems. According to Digital Shadows, the group earned over one million dollars via their hacking operations. The DarkSide group also made headlines for donating $10,000 in Bitcoin to charities from their profits.

Traits of DarkSide

  • Uses a highly targeted approach to attack their victims.
  • Custom ransomware executables are carefully prepared for each target.
  • Corporate-like method of communication throughout their attacks.

How to Download the Decryptor Tool

Bitdefender made the free decryption tool available for download on its official site. To install:

Bitdefender Free Decryption Tool

“If you have checked the backup option, you will see both the encrypted and decrypted files. You can also find a log of the decryption process in the %temp%\BDRemovalTool folder. To remove the encrypted files left behind, you should search for files matching the extension and mass-remove them. We do not encourage you to do this until you made sure that your files can be opened safely and there is no damage to the decrypted files,” Bitdefender explained.

Biden to Appoint Cybersecurity Veteran Anne Neuberger to NSC

Anne Neuberger

If diversity were a feather, Joe Biden’s pick for staffers would look like a bird. The incoming President of the U.S. has plans of appointing Anne Neuberger to the newly formed National Security Council (NSC). According to reports from Politico, Neuberger will be departing from her role as the director of cybersecurity of NSA and will take on a senior position at the NSC. Neuberger is a decedent from a Jewish Orthodox community-based in Baltimore.

Prior to her role as the director of cybersecurity at the NSA, she led NSA’s Election Security effort and served as Assistant Deputy Director of NSA’s Operations Directorate, where she led NSA’s foreign intelligence and cybersecurity operations.

Her previous roles also include NSA’s first Chief Risk Officer; Director of NSA’s Commercial Solutions Center; the Navy’s Deputy Chief Management Officer; and a White House Fellow, working for Secretary of Defense Robert Gates. Prior to joining government service, Anne was Senior Vice President of Operations at American Stock Transfer & Trust Company (AST), where she was responsible for directing operations, including dividend distributions, complex mergers, and acquisition processing for approximately 2,000 publicly traded companies. In 2017, Anne was awarded a Presidential Rank Award for her service at the National Security Agency.

The appointment also highlights the President-elect’s posture on cybersecurity. Earlier, the outgoing president Donald J. Trump had eliminated the role of cybersecurity coordinator in 2018. With this new appointment, it can be safely said that cybersecurity might be re-elevated as a national security priority in the coming years.

“The National Security Council plays a critical role in keeping our nation safe and secure. These crisis-tested, deeply experienced public servants will work tirelessly to protect the American people and restore America’s leadership in the world. They will ensure that the needs of working Americans are front and center in our national security policymaking, and our country will be better for it,” said President-elect Joe Biden.

Recently, Biden and Vice President-elect Kamala Harris had announced a slew of cybersecurity appointments for the NSC. These included:

  • Yohannes Abraham, Chief of Staff and Executive Secretary
  • Sasha Baker, Senior Director for Strategic Planning
  • Ariana Berengaut, Senior Advisor to the National Security Advisor
  • Tanya Bradsher, Senior Director for Partnerships and Global Engagement
  • Rebecca Brocato, Senior Director for Legislative Affairs
  • Elizabeth Cameron, Senior Director for Global Health Security and Biodefense
  • Tarun Chhabra, Senior Director for Technology and National Security
  • Caitlin Durkovich, Senior Director for Resilience and Response
  • Jon Finer, Principal Deputy National Security Advisor
  • Juan Gonzalez, Senior Director for Western Hemisphere
  • Sumona Guha, Senior Director for South Asia
  • Ryan Harper, Deputy Chief of Staff and Deputy Executive Secretary
  • Peter Harrell, Senior Director for International Economics and Competitiveness
  • Emily Horne, Senior Director for Press and NSC Spokesperson
  • Shanthi Kalathil, Coordinator for Democracy and Human Rights
  • Andrea Kendall-Taylor, Senior Director for Russia and Central Asia
  • Ella Lipin, Senior Advisor to the Principal Deputy National Security Advisor
  • Brett H. McGurk, Coordinator for the Middle East and North Africa
  • Melanie Nakagawa, Senior Director for Climate and Energy
  • Carlyn Reichel, Senior Director for Speechwriting and Strategic Initiatives
  • Amanda Sloat, Senior Director for Europe

“This outstanding team of dedicated public servants will be ready to hit the ground running on day one to address the transnational challenges facing the American people — from climate to cyber. They reflect the very best of our nation, and they have the knowledge and experience to help build our nation back better for all Americans,” said Kamala Harris.

Even during his election campaign, as the presumptive Democratic nominee for President, Biden had hired former White House cybersecurity official Chris DeRusha as the CISO for his campaign and Jacky Chang as Chief Technology Officer.

New Zealand’s Reserve Bank Data System Hacked; Critical Data at Risk

New Zealand Reserve Bank hacked

New Zealand’s top bank, the Reserve Bank, has acknowledged that a malicious actor has reportedly hacked and accessed one of its data systems, which stored sensitive information. The cybercriminal behind this breach is not yet disclosed, but the Governor informed that the investigation is underway.

New Zealand – An Emerging Threat Landscape

In a country that is known for its scenic landscape and friendlier citizens, cybercriminals are now attempting to change it into a cyberthreat landscape. It all began with a DDoS attack on the New Zealand Stock Exchange on August 25, 2020, which forced the NZX to halt operations for three consecutive days. To counter the growing menace of the looming cyberthreats, CERT-NZ proposed several steps to build cyber resilience. However, it was not enough as the attacks on the financial and banking sector have only been growing larger and more complex by the day.

In a statement issued by the Reserve Bank of New Zealand, an illegal data breach through a third-party file sharing service potentially led to the access of critical banking information. However, quick response to the incident meant that the breach was contained and taken offline almost immediately.

New Zealand’s Governor, Adrian Orr, stated that the breach incident is given the highest priority and has asked the domestic and international authorities to work on this urgently. He said, “We are working closely with domestic and international cybersecurity experts and other relevant authorities as part of our investigation and response to this malicious attack. The nature and extent of information that has been potentially accessed are still being determined, but it may include some commercially and personally sensitive information.”

Orr assured, “The system has been secured and taken offline until we have completed our initial investigations. It will take time to understand the full implications of this breach, and we are working with system users whose information may have been accessed. Our core functions remain sound and operational.”

New Zealand’s Other Cybersecurity Measures

New Zealand is taking its cybersecurity and data privacy issues very seriously with its two recent offerings – OPC’s “NotifyUs” tool and the New Privacy Act 2020 (NZ).

Related News:

Notify Data Breaches Using New Zealand OPC’s NotifyUs

Everything You Need to Know About NZ’s New Privacy Act 2020

New Year Brings New Ransomware Strain “Babuk Locker”

ransomware, fonix, fonix ransomware, Cybereason Partners with Intel for Hardware-Enabled Ransomware Prevention, Kronos

While the world is reeling from the aftereffects of the pandemic, cyberspace is getting infected with the first ransomware strain of 2021. Dubbed as Babuk Locker, the new ransomware appears to have allegedly compromised the corporate networks of some companies globally. According to security researcher Chuong Dong, Babuk Locker ransomware is encrypting victims’ sensitive information and demanding a ransom of $60,000 to $85,000 in Bitcoins.

Babuk Locker Traits

Chuong Dong claimed that Babuk Locker uses new techniques like multi-threading encryption and abuses the Windows Restart Manager. The ransomware implements SHA256 hashing, ChaCha8 encryption, and Elliptic-curve Diffie–Hellman (ECDH) key generation for encrypting scheme. It also can spread its encryption via available networks and uses an exchange algorithm to safeguard its keys and encrypt files from detection.

“Similar to Conti or REvil ransomware, Babuk utilizes the Windows Restart Manager to terminate any process that is using files. This ensures that nothing prevents it from opening and encrypting the files. This is accomplished through the calls RmStartSession, RmRegisterResources, and RmGetList to get a list of processes that are using a specified file. If the process is not explorer.exe or a critical process, then Babuk will call TerminateProcess to kill it,” Dong said.

How Babuk Locker Encryption Works?

For encryption, Babuk Locker ransomware uses two ChaCha8 keys generated from the ECDH shared secret’s SHA256 hash and the first 12 bytes of the shared secret as encryption keys.

Babuk’s file encryption is of two different types — Small File Encryption and Large File Encryption. Small files (around 41 MB) are mapped entirely and encrypted with ChaCha8 two times. Whereas, the encryption process is different in large files. They are divided into three equally large regions, and for each of these regions, only the first 10 MB is encrypted.

Ransom Note 

Image Courtesy: chuongdong.com

Other Findings

  • Despite the amateur coding practices used, Babuk’s strong encryption scheme utilizes the Elliptic-curve Diffie–Hellman algorithm, which has proven effective in attacking a lot of companies so far.
  • Because the malware authors are using one private key for each Babuk sample, it’s clear that their main target is large corporations instead of normal computer users.
  • As per the website embedded in the ransom note and the leaks on Raidforums, they have successfully compromised five different companies in the world.

Indicators of Compromise

MD5: e10713a4a5f635767dcd54d609bed977

SHA256: 8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9

Babuk ransomware comes in the form of a 32-bit .exe file.

Ryuk Ransomware Gang Made More Than $150 Mn in Ransom

BlackMatter Group, Volvo Cars ransomware attack

Ransomware attacks were the most observed security incidents in 2020. Multiple attacks and new ransomware variants were reported. Recently, a series of Ryuk ransomware attacks targeted multiple hospitals in the U.S. Cybercriminals compromised critical network systems across six hospitals in a single day. Joint research from threat intelligence company Advanced Intelligence (AdvIntel) and security firm HYAS claimed that the Ryuk ransomware operators earned more than $150 million worth of Bitcoins from ransom payments after their cyber intrusions globally. Research found that the payments to 61 Bitcoin addresses were attributed and linked to Ryuk ransomware attacks.

The companies stated that ransomware operators transferred their ransom payments to money laundering services, distributed in hacking forums, or cashed out in cryptocurrency exchanges.

“Ryuk receives a significant amount of their ransom payments from a well-known broker that makes payments on behalf of the ransomware victims. These payments sometimes amount to millions of dollars and typically run in the hundreds of thousands range,” AdvIntel and HYAS said in a statement.

Ryuk’s Bitcoin Circuit

AdvIntel and HYAS claimed that Ryuk operators converted their Bitcoins into currency by using fake accounts on two cryptocurrency portals – Binance and Huobi. One of the largest transactions involving a Ryuk wallet found during this investigation was above $5 million (365 Bitcoins).

“In addition to Huobi and Binance, which are large and well-established exchanges, there are significant flows of crypto currency to a collection of addresses that are too small to be an established exchange and probably represent a crime service that exchanges the cryptocurrency for local currency or another digital currency,” AdvIntel and HYAS added.

Ryuk ransomware has been active for two years targeting various organizations globally, focused mostly on the health care sector. The ransomware operators succeeded in economic terms and made their disruptive impact on many industries.

2021 Security Predictions: Endpoint Security is of Utmost Importance

2021 Security Predictions

2020 has been an unforgettable year – from a virus upending the world to a sudden shift to remote workforce, we have seen it all. However, our reliance on technology will be more than ever.

The following predictions offer insights into how cybersecurity will evolve in 2021:

By Jason Lee, CISO, Zoom

1. Data protection for the hybrid workforce will become increasingly complex.

  • Many companies have embraced a fully remote workforce during this challenging time. Next year, many of these same companies will need to adapt to a hybrid workforce with some employees re-entering the office, and others staying remote.
  • Security leaders will need to reevaluate their network security posture, maintain an effective data protection strategy on endpoints, and consider mobile device management (MDM). Corporate network congestion could also become a big issue for companies that have a lot of employees heading back to the office in addition to a large remote workforce.
  • Companies with many remote employees will also need to support more endpoints than ever before. Protection of the data on these endpoints will be critical. Programs like BYOD will offer those employees secure access to the tools they need to stay productive.

2. Companies will move toward personal device authentication.

As we continue to practice social distancing in 2021, companies will move away from shared/communal computers, and shift toward supporting employees on their personal devices. Security teams will also need to deploy consistent authentication practices that support both in-office employees and those staying remote. Multi-factor authentication for corporate-owned and/or BYOD-supported mobile phones will be the most popular solution. Additionally, we will see a move toward passwordless access and leveraging other factors.

3. The war for cybersecurity talent will continue to heat up.

  • This past year, many companies began hiring cybersecurity professionals remotely–no matter where they live. In 2021, cybersecurity pros will continue to be able to work from wherever they want. In particular, Zoom will continue hiring employees in the office and remotely for its cybersecurity team.
  • One of the most effective ways to increase an organization’s security capabilities is to arm its development teams with rich training. Zoo m will be significantly investing in security training for its developers. The company supports continuous learning via secure code training, “capture the flag” competitions, and other gamification techniques to train its development organization on security.

4. The Zero Trust security model will be a primary focus in 2021.

With the Zero Trust model, employees must be authenticated and validated before given access to appropriate applications and the right level of data. As companies look to support a hybrid workforce, this approach will become even more attractive for security leaders, as it provides continuous checks as to whether employees need access at that time to sensitive data. Companies will also double down on endpoint controls to ensure their rapidly growing remote workforce stays secure.

About Jason Lee

Jason Lee is the Chief Information Security Officer at Zoom with 20 years of experience in technology, with a specialization in information security and operating mission-critical services. He was recently the Senior Vice President of Security Operations at Salesforce where he was accountable for the global organization delivering critical end-to-end security operations to customers and employees including company-wide network and system security, incident response, threat intel, data protection, vulnerability management, intrusion detection, identity and access management, and the offensive security team. Before Salesforce, he held the position of Principal Director of Security Engineering for the Windows and Devices division in Microsoft.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Episode #7: CISO Culture is All About Focusing on the Negatives

Adam Palmer Tenable

In an industry focused on catching and reporting the bad guys, the good elements of a solid cybersecurity program can easily go unnoticed. CISO culture focuses so much on finding threats and identifying risks that they forget to learn from what is working successfully or how to use positive data to encourage business units that are doing well.  At the same time, finding good data can demonstrate the value and results of their program, but they may struggle to show substantive evidence. Reporting success is equally as important as reporting risk. So, how can CISOs effectively communicate the good initiatives/results to the board?

In this newest podcast episode from CISO MAG, we have Adam Palmer, Chief Cybersecurity Strategist, Tenable, who explains in-depth both the metrics for evaluating cybersecurity and how the CISO culture is based on the concept of cybersecurity Tetris.

Palmer has over 20 years of experience in cybersecurity, which includes executive positions at large cybersecurity vendors, leading the U.N. Global Program against Cybercrime, and working as the Global Director for IT & Cyber Risk at one of the largest EU banks.  His diverse global background perfectly positions him to understand and advise security leaders to be successful.

As Tenable’s Chief Cybersecurity Strategist, Palmer focuses on advising senior leaders (CISO/CIO/CTO) on cybersecurity strategy. Before joining Tenable, he was the Global Director, Cybersecurity Risk & Controls for Banco Santander – the largest bank in the EU and Latin America.  This role provided him with deep global experience with comprehension for a large, advanced cybersecurity program.

Palmer began his career as a U.S. military officer focused on cybercrime cases.  After the military, he worked in a senior operational role by creating the .ORG top-level Internet domain cybersecurity program.  This program has been cited by leading industry groups as a major success for reducing cyber risk.  Palmer later created and led the United Nations Global Program Against Cybercrime, delivering anti-cybercrime capacity building programs to global governments.

Palmer also has significant experience as an advisor working at leading cybersecurity vendors.  In these roles, he advised both large and medium-size organizations on cybersecurity best practices.  He has published numerous articles and is regularly invited to speak about cybersecurity.

Palmer (JD, MBA, CISSP, CIPP) is originally from the U.S.  He has worked across the U.S., Asia-Pacific, Europe, and the Middle East., and is currently based in Dublin, Ireland.

Listen to our previous podcast episodes here.

Augustin Kurian

About the Host 

Augustin Kurian is part of the editorial team at CISO MAG and writes interviews and features.

 

1...127128129...410Page 128 of 410