Home Blog Page 162

COVID-19 Becomes an Enabler for Better Cybersecurity for SMBs

CISOs in remote working

Even though COVID-19 saw an unprecedented number of layoffs and budget cuts for enterprises across the world, cybersecurity remained to be one of the key areas of investments, especially for SMBs. A new report by Kaspersky titled “Investment adjustment: aligning IT budgets with changing security priorities” suggested that SMBs on average spent $275k for cybersecurity in 2020, which was $8000 more than the previous year.

The report highlighted that 71% of SMBs and bigger enterprises are planning to increase their cybersecurity spending in the next three years, while only 17% plans to keep its spending unchanged.  “For those SMBs looking to increase their security spend, one of the top three drivers was cited as wanting to increase security spend in response to the increased complexity of IT infrastructure (43% compared to 36% the previous year),” the report added. “This is followed by the need to improve internal specialist security expertise (39%) and for a third (34%) of SMBs, senior-level management wants to increase budgets to improve company defenses.”

The report also found that the share of security in overall IT budgets has grown from 23% in 2019 to 26% in 2020 within SMBs, and from 26% in 2019 to 29% in 2020 for enterprises. Another key finding was that the average cost of data breaches decreased to $101k for SMBs and $1.09 million for enterprises in 2020, compared to $108k and $1.41 million in 2019. While for companies and SMBs who were looking at reducing their cybersecurity spending, the only driving factors were senior management within enterprises who had no reason to invest so much in the future at 32%, while SMBs which are cutting down their overall expenses at 29%.

“MSMEs are doing the best they can but having to account for a suddenly expanded network to manage employees who will be using a mix of home and corporate devices for their role. They must rely more upon the security awareness of users to prevent the spread of malware, but this is a challenge,” Laurence Pitt, Global Security Strategy Director at Juniper Networks, told CISO MAG in a recent interview.

To conclude, COVID-19 has brought cybersecurity into the limelight even for many SMBs.

“SilentFade” Chinese Malware Campaign Targets Facebook’s Ads Platform

Malware and Vulnerability Trends Report, Mobile malware threats

Security experts from Facebook disclosed details about a sophisticated malware campaign “SilentFade” linked to Chinese actors that targeted Facebook’s ad platform between late 2018 and February 2019. In a security conference, the researchers stated that SilentFade exploited a vulnerability in Facebook’s ad platform by leveraging a combination of a Windows Trojan and browser injections to stay undetected; however, it was patched soon after. Facebook also took legal action against the threat group in December 2019.

The hacker group used a malware Trojan to compromise the users’ browsers and steal passwords and browser cookies to eventually obtain authorized access to their Facebook accounts. They mainly targeted for accounts that had the payment method linked to their profiles. The malware campaign ran ads from compromised Facebook accounts and used cloaking elements to escape detection.

“Our investigation uncovered a number of interesting techniques used to compromise people with the goal to commit ad fraud. The attackers primarily ran malicious ad campaigns, often in the form of advertising pharmaceutical pills and spam with fake celebrity endorsements. The attackers also created detection challenges. They cloaked their landing pages and made purchases appear valid by using the legitimate credit cards and PayPal accounts linked to the compromised user accounts. Industry investigators are rarely able to see an end-to-end picture of credential compromise directly leading to abuse on a particular platform,” the researchers said.

Facebook Takes Down Hundreds of Fake Accounts

Recently, Facebook took down two separate networks that originated from China and the Philippines for violating its Coordinated Inauthentic Behavior (CIB) policy. In an official release, the social networking giant stated that it has removed 155 fake accounts, 11 pages, 9 groups, and 6 Instagram accounts for breaching its guidelines against foreign or government interference. Facebook stated that state-sponsored actors from China are using these accounts to influence public opinion across the Philippines, the U.S., and Southeast Asia. The actors behind this network posted global news and current events in Chinese, Filipino, and English languages.

VMware Delivers Digital First Security Solutions for Securing the Remote Workforce

VMware digital infrastructure
Image Credit: VMware

Experts had anticipated a pandemic-like situation for long, but what they never expected was the degree of impact it would have on human life and businesses. In the months gone by, businesses scampered towards digitization through the rapid adoption of the cloud technology for ensuring business continuity. As cloud computing scaled to new heights, corresponding vulnerabilities also increased. In response to this proportionate growth, VMware has unveiled new innovations to deliver ingrained security solutions to the world’s digital infrastructure.

VMware’s Security Solutions for Digital Infrastructure

Attacker sophistication, security threats, breaches, and exploits are currently more prevalent than ever. Security strategies are taking into account the increasing attacks on modern cloud workloads. Therefore, VMware’s solutions are designed for the public and private clouds, security operations, distributed workforces, and future-ready digital infrastructure.

At the recently concluded VMworld 2020, the company announced a range of solutions and services to help customers survive and thrive in the most turbulent times.

 Security for the Private and Public Cloud 

As businesses continue their journey towards cloud transformation and application modernization, they require modern security solutions that are both powerful and easy to operationalize. To fulfill this requirement, VMware, in collaboration with Carbon Black, introduced the VMware Carbon Black Cloud WorkloadTM.

The solution combines Carbon Black’s security expertise with VMware’s deep knowledge of data centers to build security directly into workloads. It delivers advanced protection by providing prioritized vulnerability reporting and foundational workload hardening with comprehensive prevention, detection, and response capabilities to protect workloads running in virtualized, private, and hybrid cloud environments. This unified solution enables security and infrastructure teams to automatically help secure new and existing workloads at every point in the security lifecycle.

Workload security is complicated in the hybrid data center architectures that employ everything from physical, on-premises machines to multiple public cloud infrastructure as a service (IaaS) environment to container-based application architectures. For security teams, VMware Carbon Black Cloud Workload will offer the following:

  • Visibility to Identify Risk and Harden Workloads: This solution will help security and infrastructure teams to focus on the most high-risk vulnerabilities and common exploits across their environments. It enables them to prioritize vulnerabilities based on a combination of the Common Vulnerability Scoring System (CVSS), real-life exploitability and real-life frequency of attack, and increase patching efficiency.
  • Prevention, Detection and Response to Advanced Attacks: Security teams often lack visibility and control in highly dynamic virtualized data center environments. However, Carbon Black Cloud Workload protects workloads running in these environments by combining vulnerability assessment and workload hardening with next-generation antivirus (NGAV), workload behavioral monitoring, and endpoint detection and response (EDR) for workloads.
  • Simplified Operations for IT and Security Teams: The VMware’s intrinsic approach builds security directly into the virtual fabric, enabling protection wherever workloads are deployed, eliminating the trade-off between security and operational simplicity. Carbon Black Workload accomplishes the same level of security risk visibility into VMware vCenter, as seen in Carbon Black Cloud – giving them a single source of truth. This not only accelerates response to critical vulnerabilities and attacks but also foster greater collaboration between IT and security teams.

VMware will introduce expanded offerings for Carbon Black Cloud Workload later this year including a new module for hardening and better securing Kubernetes workloads. The new capabilities will give security teams governance capabilities and control of Kubernetes environments.

 Security for the Distributed Workforce 

The distributed workforce introduces multiple challenges ranging from employee on-boarding, visibility and compliance, security, employee safety, and more. To address these challenges and successfully embrace the future of work, organizations need to re-think how they approach security, experience, and operational complexity associated with the IT environment. Security must not only be intrinsic; it needs to be thought of in the context of employee experience to maximize productivity and engagement. To enable that differentiated approach, VMware also introduced expanded capabilities for the VMware SASE Platform, Workspace Security VDI, and Workspace Security Remote.

These new solutions will deliver end-to-end zero trust security controls and simplified management – where VMware’s Secure Access Service Edge, Digital Workspace, and Endpoint Security technologies work harmoniously across applications on any cloud to any device.

Paying Ransom is Now Illegal! U.S. Dept of Treasury Warns

Ransomware Attacks, Graff ransomware attack

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced that paying ransom to cybercriminals is now illegal. In an official advisory, the agency stated that organizations that facilitate ransomware payments to hackers on behalf of ransomware victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, are violating OFAC regulations.

“Ransomware payments made to sanctioned persons or to comprehensively sanctioned jurisdictions could be used to fund activities adverse to the national security and foreign policy objectives of the United States. Ransomware payments may also embolden cyber actors to engage in future attacks,” OFAC said.

“OFAC may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if it did not know or have reason to know it was engaging in a transaction with a person that is prohibited under sanctions laws and regulations administered by OFAC,” OFAC added.

The agency also highlighted that ransomware attacks have become more sophisticated and costly, with a 37% annual increase in reported ransomware cases and a 147% annual increase in associated losses from 2018 to 2019. Not only popular/large organizations, cybercriminals targeted numerous small- and medium-sized corporations.

Ransom Demand Increase by 100%

A report published by Coalition, a provider of cyber insurance services in North America, revealed that ransomware incidents accounted to 41% of cyber insurance claims filed in the first six months of 2020. The report “H1 2020 Cyber Insurance Claims Report” highlighted that the average ransomware demand increased by 100% from 2019 through 2020. Several organizations stated that ransomware attacks are the most prevalent and destructive cyberthreats. The severity of ransomware attacks increased by 47%, with a 100% spike from 2019 to Q1 2020. New and malicious strains of ransomware variants such as Maze and DoppelPaymer are leveraged to demand heavy ransom and expose organizational data. An average Maze demand is six times larger than the overall average ransom demand, the report stated.

CYBER WARFARE: The Fight Beyond Enemy Lines [INFOGRAPHIC]

cyber warfare

Digitization has helped businesses immensely, especially, in the ongoing pandemic. It has allowed robustness through business continuity, remote working capability, and online supply chain management.  However, this has given birth to a new threat landscape that stretches from our critical assets to as close as our homes, which we once thought as the most secure place to be in. With a number of international peacekeeping sanctions and treaties in place, it has been difficult for prominent nations to begin a full-blown war upfront. Thus, these nations have now resorted to exploiting the newly found threat landscape for targeted surgical destruction.

Moreover, risking a soldier’s life on the battleground is no longer necessary as enemy assets deep beyond borders can now be penetrated easily with a new form of warfare – the Cyber Warfare.

Let’s have a look at the what, which, when, where, and how of cyber warfare through this insightful infographic that has been developed by the editors at CISO MAG in collaboration with researchers at CYFIRMA, a cyber threat intelligence (CTI) platform and cybersecurity solutions provider.

Related Post

Cyber Warfare: The Battle Tact of the Digital Age

Cyber Warfare, Cyber Warfare WhitepaperDownload this whitepaper now and read about “Cyber Warfare” and CYFIRMA’s pledge towards protecting your businesses, enterprises, and governments from such attacks.

 

 

Top Cyberthreats to Financial Service Providers

FBI Warns About Fake Mobile Banking Apps, Trojans

With so much banking being done online, financial service providers are no stranger to cyberthreats. However, the recent COVID-19 pandemic is being blamed for a 238% increase in cyberattacks against banks and other financial institutions, according to the latest cybersecurity statistics. These entities must be prepared for these attacks and know how to quickly respond to minimize harm to their institution and customers’ private data.

By Ben Hartwig, Web Operations Director at InfoTracer

According to one survey of IT executives, approximately two-thirds of financial organizations experienced at least one cyberattack in 2016. Here are some of the biggest cybersecurity threats financial service providers are facing today.

1. State-Sponsored Attacks

While many people think of a cybercriminal as a one-man operation or a group of criminals in for financial gain, some cyberattacks are actually encouraged and launched by foreign governments. The increasing frequency of such attacks led to NATO officially defining cyberspace as the fifth domain of warfare, in which it recognized the critical role that a country’s infrastructure plays in its stability. Foreign factions may try to attack banks, stock exchanges, and other financial institutions to destabilize a country and make citizens concerned about their economy.

In some instances, governments may hire their own hackers to attack the financial industry in other countries. In others, they may spread fake news about the market to influence trade volume. Researchers from the MIT Sloan School of Management and the Yale School of Management found that the past impact of article writers had a large impact on abnormal trading behavior and that a fake article was more likely to cause greater market disruption than a real article.

2. Regulatory Inaction 

While many banks may feel overregulated, others believe there are not enough regulations or consumer protection laws in an age of rapidly-evolving technology. Regulatory action is often short-sighted and reactionary, so banks must consider more effective and timely methods to protect their institutions and customers.

3. Credential Theft and Identity Theft

A particularly dangerous type of cybersecurity threat to customers is account takeover, in which a criminal gains access to a customer’s account and then changes information on it so that the real owner does not have access to it nor receives updates about the account. This attack is often a result of credential stuffing, in which hackers use computers to keep inserting various credentials until they break into an account. Some criminals go a step further by using that login information to access other accounts owned by the customer since many people use the same username and password combinations across multiple platforms. They may also use the gathered information to commit identity theft.

Account takeover statistics show that rates of account takeover have steadily increased over the last few years. Losses rose 122% from 2016 to 2017, and then another 164% in 2018. The number of these attacks nearly doubled from 2017 to 2018.

4. Employee Errors

While banks are very careful about hiring employees, who will not steal from them, a major cybersecurity risk occurs from employee errors, not due to intentional wrongdoing. For example, employees may open a phishing email that installs viruses on the bank’s network. This was the most common type of cyberattack in 2016. Given the COVID-19 pandemic and that many banking employees are working from home, simple employee errors and technological vulnerabilities may subject financial institutions to additional cybersecurity threats.

5. Data Theft and Manipulation

In some types of cyberattacks, criminals make slight changes to data, which may not be immediately detectable. Because nothing is stolen at the time, employees may not recognize the attack. However, once the criminals gain access to this data, they can manipulate algorithms in the system for their own financial gain.

6. Phishing Attacks

The last four Verizon Data Breach Investigations Reports have identified the use of stolen credentials as the number one method hackers use to gain unauthorized access to accounts. Many of these cyberattacks occur when bank customers or employees click on an email or link or download an attachment in an email. The email may state that their account has been compromised and they need to log in with new information, which is then used by the criminal to access the account. Alternatively, this strategy may be used to install malware on the computer system.

7. Ransomware

Ransomware is a particularly dangerous type of malware that takes over a victim’s computer system by encrypting data and making it impossible for the owner to access it unless they pay a large fee. Many of these attacks target banks because the criminals are after large payouts.

8. Cloud Providers

Many banks store information on the cloud to avoid expenses related to data storage. However, if these servers are not secure, the banks can still lose important data if destructive malware is installed and erases information. Unsecured cloud providers may also be the cause of a massive data breach that exposes customers to identity theft and other privacy concerns.

9. Third-Party Vendors

Even if banks have secure systems, if they use third-party vendors to deliver certain services, they may have a greater risk of being breached. With more system entry points, there are more ways hackers can enter your system.

10. Complex Technologies

As technology continues to evolve, criminals find new security vulnerabilities and methods to exploit financial institutions, such as using AI and IoT to increase cyberattacks. A recent report by VMware Carbon Black said that 82% of surveyed CIOs said that cyberattack methods are becoming more sophisticated. Social engineering was one example the report pointed to, regarding the exploitation of human weakness.

Ways Banks Can Protect Themselves from These Cyberthreats

Banks can harness the same technology that is used against them to protect themselves, including:

  • Adopting AI that can more quickly identify threats
  • Encrypting data so that it is not compromised even if a breach occurs
  • Monitoring cloud security
  • Limiting access to cloud security
  • Making frequent updates
  • Devising a recovery plan if an attack occurs
  • Instructing employees and customers to only access bank data in a secure location
  • Updating security frequently
  • Increasing budgets for IT resources
  • Updating security systems and protocol
  • Using multi-factor authentication
  • Training employees on cybersecurity risks

Conclusion

Implementing the strategies above and being conscious of the potential threats to your financial institution can help you prevent an attack.

About the Author

Ben HartwigBen Hartwig is a Web Operations Director at InfoTracer. He guides on marketing and entire cybersecurity posture and enjoys sharing best practices. You can contact him via LinkedIn.

 

 

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

 

Turbo-charge Your SaaS Evaluation Capability, Now!

SaaS

The year 2020 saw over 27 billion records exposed in the first half and 2019 saw about 14 billion records exposed. The driving force behind these incidents has been exposed databases and cloud service misconfiguration. Now, while enterprises may be deliberate and be cautious about adopting cloud, the ones that leverage SaaS solutions in ever-increasing numbers, have been pioneers at adopting public cloud services. This necessitates a solid SaaS evaluation capability. Taking the industry-standard checklists approach can help with basic hygiene. However, this approach has proven to be hardly adequate to build a comprehensive risk profile and help deter breaches, especially for mission-critical journeys. Here are four steps that can turbo-charge your organization’s SaaS evaluation capability:

By Ravi Ivaturi, Sr. Vice President – Digital Security Architecture at Citi

1. Understand the Product Architecture

Let loose your security architects on the SaaS product. A clear and comprehensive understanding of the product’s intended use and its implementation architecture is critical. Several facets of the architecture – logical, data flow, control flows, deployment architecture, and existing controls architecture need to be explored and understood. Any shortcomings in building this degree of detail will potentially lead to inadequately protected attack surfaces. Any assessment or checklist evaluation will be incomplete and even inaccurate without a deep understanding of the product’s architecture. Essentially, you need to get not just under the hood, but deep into the engine block.

2. Benchmark Against Known-good

Once the product architecture is well understood, the next step is to determine what is acceptable and what is not. A time-tested and proven approach is to benchmark against good design patterns. Let me elaborate with an example: public cloud platforms provide multiple ways to encrypt data stored on a file repository (e.g. AWS S3). Have a clear standard and design pattern on what option is acceptable, and for which scenarios it must be established internally. Any SaaS product leveraging S3 for storage can be evaluated against these patterns to determine risks owing to deviation. Now, obviously, this approach will require a good-sized library of design patterns with relevant controls. The good news is that a small set of services are used extensively. This makes it feasible to build an effective pattern-library in a short duration of time. A threat-based approach could also be adopted – given most data exposures happen due to misconfigured datastores; start with developing acceptable patterns for datastores. This will equip your SaaS security evaluation program to protect against threats that resulted in half of the data-exposures in the past two years!

3. The Misconfiguration Problem

Most SaaS vendors choose from one of the top three public cloud platforms. The single biggest security challenge faced by cloud deployments is a misconfiguration. We all are aware that Gartner predicts that, “Through 2025, 99% of cloud security failure will be due to a customer’s fault.” Sounds incredulous? Well, consider the Twilio S3 security incident from July 2020: Twilio distributes a JavaScript SDK that allows its clients to easily interact with its product. This SDK is hosted on an AWS S3 bucket for clients to download. Attackers were able to modify Twilio’s SDK and inject it with malicious code. The root cause is S3 bucket misconfiguration that allowed anyone on the Internet to write to the S3 bucket. While little has been disclosed on how the company was alerted to the breach, the bucket had been misconfigured since 2015. A security solution that actively looks for misconfiguration would have detected this issue within minutes.  Twilio is not alone – you’ll be surprised to know how few vendors have implemented this control and in an effective way. So, absolutely insist that the SaaS provider implements a solution for actively detecting and alerting against misconfiguration.

4. Risk Visibility

As cloud adoption continues to explode, more and more organizations will end up with their data islands on public cloud platforms. Despite all the best efforts, there is going to be a varying degree of control implementation and operational effectiveness. The risks are only further augmented by lift-and-shift strategies that don’t account for the inherently different architectures of public cloud platforms. It is therefore imperative to ensure that the senior leadership has a clear line-of-sight into the SaaS product adoption, control state, and inherent risks. Any SaaS evaluation program will fall short despite its best efforts with the leadership being provided clear and explicit visibility into this aspect.

It would be remiss to not touch upon the people aspect. For implementing the above four steps effectively, teams with appropriate skills and specialization are a must. Unless an enterprise already has a proven team of security architects, operationalizing these four steps will require the infusion of external resources and upskilling the existing teams.

Conclusion

With the ever-growing data breaches, driven by misconfigured cloud services, it is imperative that enterprises enhance their SaaS evaluation capabilities. This can be achieved by ensuring that the evaluation process includes steps to gain a deep understanding of the SaaS product architecture, benchmark against known good patterns, and providing a direct line of sight to leadership teams.

References

https://www.securitymagazine.com/articles/93093-data-breach-reports-down-52-in-the-first-half-of-2020-number-of-records-exposed-increase-to-27-billion#:~:text=The%20two%20largest%20breaches%20ever,2020%20surpassed%2090%20million%20records

https://www.gartner.com/smarterwithgartner/is-the-cloud-secure/

About the Author

Ravi IvaturiRavi is a cybersecurity leader with deep expertise in building cybersecurity programs for emerging technologies. He enjoys authoring technology articles, engaging with cybersecurity startups, and above all, solving problems. In his current role, Ravi heads the Cloud Security Architecture function for Citi’s Consumer division, providing security leadership for financial products used by millions of individuals across 19 countries. He also serves on Citi’s apex Security Architecture Council, providing oversight to enterprise-wide security architecture. With over 15 years of cybersecurity experience in the Financial sector, Ravi brings together a well-rounded experience and thought leadership in emerging-technology risks, security assessments, compliance, and technology risk management. Ravi holds a master’s degree from New York University in Computer Science.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

 

Anthem to Pay $39.5 to Settle Data Breach Lawsuit

Surveillance Legislation (Identify and Disrupt) Amendment Bill

Health insurer Anthem agreed to pay $39.5 million to settle another class action suit related to a cyberattack in 2015 that exposed the personal data of nearly 79 million people. The settlement is related to an investigation brought by the U.S. states’ attorneys general, including New York, Indiana, Connecticut, Illinois, Kentucky, Massachusetts, and Missouri. The cyberattack, which, in its time, was considered one of the biggest cybersecurity attacks the nation had ever witnessed, had compromised users’ names, addresses, social security numbers, and medical identification numbers.

In a recent statement, Anthem stated that it is also committed to enhance its ongoing data protection measures. “The company is pleased to have resolved this matter, which is the last open investigation related to the 2015 cyberattack. Anthem does not believe it violated the law in connection with its data security and is not admitting to any such violations in this settlement with the State Attorneys General,” Anthem said.

“Anthem’s first priority was to ensure that its systems were secure and immediately engaged the FBI and a world-class security organization. The company took immediate action to investigate and assist consumers and customers and to meet and exceed its legal obligations to provide notice and cooperate with law enforcement. Following the investigations, no evidence has been found that information obtained through the 2015 cyberattack targeting Anthem has resulted in fraud,” Anthem added.

Not the First Settlement

The recent settlement is separate from a class action suit over the breach that Anthem settled in 2018. In July 2017, Anthem reported a massive data breach that resulted in an identity theft of 18,000 Anthem Medicare members. In April 2017, the company discovered that an employee who worked for one of the Anthem’s health care consulting firms was stealing and misusing the information of Medicaid members since July 2016.

As part of the settlement, Anthem agreed to pay a total of $115 million to resolve the litigation. The final resolution also pays for credit monitoring and identity protection services to all the victims for two years, including the costs of sending notices to class members, administering claims, and the attorneys’ fees. Anthem also clarified that there is no evidence of any fraud or misuse of the compromised data.

New InterPlanetary Storm Malware Variant Targets IoT Devices in Asia

WhisperGate malware campaign, Flagpro malware, MosaicLoader Malware, drinik

Deemed as an “unusual” security threat upon its discovery last year, the InterPlanetary Storm malware has resurfaced into the wild with a few add-on capabilities. It is now targeting Mac and Android-based IoT devices in addition to the Windows and Linux-based machines, with its primary targets set in Asia.

 Key Highlights 

  • The InterPlanetary Storm malware has resurfaced and now targeting Mac and Android-based IoT devices along with its primary targets, the Windows, and Linux-based machines.
  • Researchers have found nearly 13,500 devices being affected by this variant.
  • Majority (62%) of the machines infected by the malware are in Asia.

New Kid on the Block

The researchers at Barracuda have been studying the activity of the operators behind this malware for long and recently found that the malware itself is building a botnet. They fear that this botnet has already infected roughly 13,500 machines across 84 different countries around the globe, with a majority (62%) of them based in Asia.

The percentage-wise break-up of the locations of all infected machines is as follows:

  • 59% of infected machines are in Hong Kong, South Korea, and Taiwan
  • 8% are in Russia and Ukraine
  • 6% are in Brazil
  • 5% are in the United States and Canada
  • 3% are in Sweden
  • 3% are in China
  • All other countries are 1% or less

The InterPlanetary Storm malware, which was discovered in May 2019, uses the InterPlanetary File System (IPFS) p2p network and its underlying libp2p implementation. It first targeted Windows machines; however, the new variant, discovered in June 2020, is capable of attacking Linux and Android-based machines.  It is also targeting IoT devices, such as TVs that run on Android operating systems, and Linux-based machines, such as routers with ill-configured SSH service.

InterPlanetary Storm Malware Infection Routine

The new variant gains access to machines by running a dictionary attack against SSH servers. It can also gain entry by accessing open ADB (Android Debug Bridge) servers. The malware detects the CPU architecture and the OS on its victim’s machine, and then run through the ARM-based machines, which is a CPU based on reduced instruction set computer architecture (RISC), commonly used in routers and other IoT devices.

James Forbes-May, Vice President of APAC for Barracuda, said, “While the botnet that this malware is building does not have clear functionality yet, it gives the campaign operators a backdoor into the infected devices so they can later be used for cryptomining, DDoS, or other large-scale attacks.”

Other Features

Barracuda researchers found several unique features designed to help the malware protect itself once it has infected a machine. These include automatically updating itself to the latest available version; installing a service using a Go daemon package and killing other processes on the machine that pose a threat to the malware, such as debuggers and competing malware.

Forbes-May added, “In order to protect against such attacks, it’s incredibly important to properly configure SSH access on all devices. This means using keys instead of passwords, which will make access more secure. When password login is enabled and the service itself is accessible, the malware can exploit the ill-configured attack surface. This is an issue common with routers and IoT devices, so they make easy targets for this malware.

Using a cloud security posture management tool to monitor SSH access control to eliminate any configuration mistakes, which can be catastrophic, is crucial while deploying an MFA-enabled VPN connection and segmenting your networks, rather than granting access to broad IP networks, can provide an additional layer of security against this kind of attack.

HP Device Manager Susceptible to Dictionary Attacks

CISA vulnerabilities, Microsoft Vulnerabilities, HP Device Manager Susceptible to Dictionary Attacks

Security experts from IT giant HP announced that it has discovered multiple security vulnerabilities in certain versions of its HP Device Manager, a software that allows system administrators to manage their HP Thin Client devices. In a security advisory, HP stated the vulnerabilities could allow malicious actors to remotely gain unauthorized access to resources and also SYSTEM privileges. The flaws could also expose the Device Manager to dictionary attacks due to weak cipher implementation. In dictionary attacks, hackers try to obtain illicit access to a system by using a large set of words to generate potential passwords.

The issue came to light after security researcher Nick Bloor reported about the vulnerabilities. Bloor stated that an HP developer put a backdoor database user account in HP Device Manager, which leads to unauthenticated remote command execution as SYSTEM.

“Do you or your clients use HP thin clients and manage them with HP Device Manager? I strongly advise you, firstly, to log on to all servers running HP Device Manager and set a strong password for the ‘dm_postgres’ user of the ‘hpdmdb’ Postgres database on TCP port 40006,” Bloor added.

The vulnerabilities and affected versions include:

However, HP clarified that the CVE-2020-6925 vulnerability does not impact the users who are using Active Directory authenticated accounts. It also added that the CVE-2020-6927 flaw does not impact customers who are using an external database and have not installed the integrated Postgres service.

HP is stated that it will release security patches for all the vulnerabilities. Meanwhile, the company recommended certain security steps to partially mitigate the issues by:

  • Limiting incoming access to Device Manager ports 1099 and 40002 to trusted IPs or localhost only.
  • Removing the dm_postgres account from the Postgres database.
  • Updating the dm_postgres account password within HP Device Manager Configuration Manager.
  • Creating an inbound rule within Windows Firewall configuration to configure the PostgreSQL listening port (40006) for localhost access only.

“HP is broadly distributing this security bulletin to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action,” HP added.

1...161162163...410Page 162 of 410