Home Blog Page 174

Another Web Skimming Attack! Hackers Use Telegram to Pilfer Card Data

Skimming-Attack

Cybercriminals constantly adopt new attack techniques to implement their malicious activities. Recently, Magecart attackers implemented a new web skimming technique by leveraging the popular messaging app Telegram to pilfer card data.

Telegram-Based Skimming Attack

According to Malwarebytes, hackers exploited the Telegram app to send stolen payment details from compromised websites. They used the messaging platform to exfiltrate sensitive data by deploying skimmer codes and traditional Trojans.

“The fraudulent data exchange is conducted via Telegram’s API, which posts payment details into a chat channel. That data was previously encrypted to make identification more difficult. For threat actors, this data exfiltration mechanism is efficient and does not require them to keep up infrastructure that could be taken down or blocked by defenders. They can even receive a notification in real time for each new victim, helping them quickly monetize the stolen cards in underground markets,” Malwarebytes said.

Image Source: Malwarebytes

According to the security researcher AffableKraut — who is the first to disclose the incident in a Twitter thread — the skimmer code checks for web debuggers to evade security detection and looks for sensitive data fields like billing, payment details, credit card number, expiration, and CVV.

Injecting e-skimmers or malicious JavaScript on e-commerce sites to pilfer payment card details is a common technique used by Magecart operators. But this time, they used a new method to exfiltrate data through a message sent to a Telegram channel using an encoded bot ID in the skimmer code.

“Defending against this variant of a skimming attack is a little more tricky since it relies on a legitimate communication service. One could obviously block all connections to Telegram at the network level, but attackers could easily switch to another provider or platform (as they have done before) and still get away with it,” Malwarebytes added.

Facebook’s VDP: A Step Towards Improved Vulnerability Tracking

Facebook Takes Down Hundreds of Fake Accounts Under Coordinated Inauthentic Behavior

Facebook has often been criticized for its non-disclosures across various verticals and policies. However, now it seems that Facebook is finally correcting itself by means of adopting its first Vulnerability Disclosure Policy (VDP). This VDP has been specifically designed for vulnerability reporting of third-party code and systems. Unpatched third-party vulnerabilities often directly or indirectly impact Facebook’s overall performance and security. Thus, it is one of Facebook’s top priorities to get this fixed and the VDP takes care of this.

Facebook’s Vulnerability Disclosure Policy in a Nutshell

The idea behind this policy comes from Facebook’s ideology that “not all bugs are equally sensitive” and “fixing an issue requires close collaboration between researchers at Facebook reporting the issue and the third-party (engineers) responsible for fixing it”.

Facebook said that it will contact the concerned third-party with any security issue that their researchers have found, to which the third-party is obligated to respond within the next 21 days. The response must include the mitigation steps being taken to fix the issue and the security of the impacted people. If the third-party fails to respond within 21 days, the social media giant would reserve the right to disclose the said vulnerability on a public forum so that affected people can take necessary actions.

Similarly, even after the receipt of response, if the third-party fails to fix the vulnerability within the next 90 days, Facebook would again reserve the right to go public about the vulnerability. Facebook, however, also takes into consideration that certain vulnerabilities can take a longer period to be sorted and hence, there could be “some deviations from the actual timeline,” but this change is solely at their disposal.

Facebook’s Other Baby

Facebook’s other company, WhatsApp, also got itself a new channel to publish its security updates. WhatsApp Security Advisories is a directory designed to increase transparency by providing information on all the vulnerabilities addressed in the messaging service provider’s mobile and web applications. This page displays a comprehensive list of WhatsApp security updates and associated Common Vulnerabilities and Exposures (CVEs).

CISA’s VDP

Coincidentally, just a couple of days ago CISA issued directives to government agencies for implementing VDP at the earliest. It has acknowledged that this form of security is for the “public good” and thus stands strongest when the “good faith” security researchers and various governmental organizations collaborate in fortifying the defenses. However, the basis of this can only be laid on the strong foundation of a formal policy that helps finding and reporting of vulnerabilities in a legally authorized manner. Thus, to ease this process for the researchers, CISA recommends VDP to be defined across governmental agencies.

Massive Data Breach! View Media’s Unsecured Database Exposes 38 Mn User Records

106 million Thailand visitors

Online marketing company View Media’s unsecured database, which held 38 million U.S. users’ data, was recently exposed online. According to researchers from CyberNews, the database was hosted on a misconfigured Amazon Web Services (AWS) server, allowing anyone to access users’ personal data like full names, email addresses, residence details, phone numbers, and ZIP codes.

Data Breach Threat

The leaky server contained 5,302 files, including 700 statement of work documents stored in PDF files and 59 CSV and XLS files that contained 38,765,297 records of the U.S. citizens. In addition, the bucket contained tens of thousands of various marketing files like banner advertisements, newsletters, and promotional flyers.

Though the leaky database is now secured, it is unclear whether any threat actors have accessed the data before.

The Aftereffects

Even though the data in the unsecured server did not contain sensitive or financial information like social security numbers (SSNs) or credit card details, hackers can still make use of the available personal details for various malicious activities.

“Scammers can use the names, email addresses, and phone numbers of the exposed people for a wide variety of fraudulent schemes. Simple contact details can be enough for spammers and phishers to launch targeted attacks against 38+ million exposed Americans from multiple angles, such as robocalls, text messages, emails, and social engineering campaigns. Determined cybercriminals can combine the data found in this bucket with other data breaches to build profiles of potential targets for identity theft,” the researchers said.

Increasing Misconfigurations

A cloud security survey by cybersecurity firm Sophos revealed that 70% of organizations suffered at least one public cloud security breach in 2019, with misconfigurations exploited in 66% of reported attacks. The survey report titled “The State of Cloud Security 2020” stated that 50% of organizations that use multi-cloud environments are more likely to suffer a cloud security incident than those using a single cloud. Besides, 33% of organizations reported that attackers gained access through stolen cloud provider account credentials.  A quarter of organizations stated that managing access to cloud accounts is a primary concern to them. Nearly 96% of respondents admitted that they face issues with their current level of cloud security, while 44% of respondents reported data breaches are the top security concern. Only 1 in 4 respondents stated lack of staff expertise as a top concern.

Australia Introduces “Code of Practice” for All IoT Devices

IoT attacks

The number of IoT devices like smart TVs and home assistants getting connected over the internet is scaling by the day, and so are the potential threats and malicious cyber activity associated with them. Thus, to address these concerns, Australia has introduced the “Code of Practice,” which is a basic cybersecurity standard for all IoT devices in the country.

The Need for “Code of Practice” Cybersecurity Standard

In 2019, the number of active IoT devices connected to the internet globally was merely 7.6 billion. However, a research from Transforma Insights suggests that this number will stand tall at nearly 24.1 billion by 2030, thereby generating a revenue of more than $1.5 trillion, at 11% CAGR.

Australia has been counted as a digitally advanced country and its digital security standards have been regarded as few of the best. A testimony to this is the fact that a study on global comparison of cybersecurity defenses ranked Australia as the world’s 15th most secure country. It jumped 12 spots in this ranking from the previous year, which shows their continuous commitment towards raising the bar for cybersecurity standards.

However, until now there were no guidelines or security standards defined for the IoT devices in the country. Many of these devices are developed with functionality as a priority, and not security. Cybersecurity of these devices is often absent or an afterthought. Thus, to change this purview and improve the cybersecurity quotient of the IoT devices in Australia, the Department of Home Affairs, in partnership with the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), has developed and introduced the “Code of Practice.”

The 13 Principles of the “Code of Practice”

The ACSC has defined 13 cybersecurity principles for consumer IoT devices, as per the global industry standards, needs of Australian people, and other applicable compliances. They are:

  1. No duplicated default or weak passwords.
  2. Implement a vulnerability disclosure policy.
  3. Keep software securely updated.
  4. Securely store credentials.
  5. Ensure that personal data is protected.
  6. Minimize exposed attack surfaces.
  7. Ensure communication security.
  8. Ensure software integrity.
  9. Make systems resilient to outages.
  10. Monitor system telemetry data.
  11. Make it easy for consumers to delete personal data.
  12. Make installation and maintenance of devices easy.
  13. Validate input data.

In addition to this, the ACSC has also released tips for consumers to secure their personal IoT devices.

Europe was the First in Line

This is not the first time that a country has implemented cybersecurity standards for IoT devices. Earlier, in June 2020, the European Telecommunications Standards Institute (ETSI) launched a new cybersecurity standard – ETSI EN 303 645 – to establish a cybersecurity baseline for all consumer IoT devices. Apart from the 13 cybersecurity measures provided in this standard and already defined GDPR compliance policies for data protection, the ETSI EN 303 645 standard also provides five specific data protection provisions for consumer IoT devices.

Proofpoint And CyberArk Extend Partnership to Mitigate Cyberattacks

Abnormal Security Partners with Microsoft to Boost Cybersecurity

Enterprise cybersecurity and compliance company Proofpoint announced that it is extending its partnership with CyberArk, a company offering privileged account security. The alliance integrates Proofpoint’s targeted attack protection platform with CyberArk’s privileged access security solutions to help organizations identify their Very Attacked People (VAP) and deploy additional security policies to remediate attacks against privileged users and high-risk assets.

With the new partnership, global organizations can now use a combination of Proofpoint’s Targeted Attack Protection (TAP) and CyberArk’s Privileged Access Security to identify and manage privileged access and revoke privileged access for potentially compromised users.

CyberArk provides privileged access management services globally. It offers enterprises a critical layer of IT security to protect their critical data, infrastructure, and digital assets on-premises, in the cloud, and throughout the DevOps pipeline. With an integrated suite of cloud-based solutions, Proofpoint helps global companies to prevent targeted threats, safeguard their data, and make their users more resilient against cyberattacks.

Bhagwat Swaroop, Executive Vice President of Industry Solutions and Business Development for Proofpoint, said, “Threat actors are exceptionally adept at targeting individuals with privileged access to extremely sensitive data — and organizations need the ability to seamlessly protect those users, across their ecosystem of security solutions.”

Adam Bosnian, Executive Vice President of Global Business Development at CyberArk, said, “Privileged users are just as vulnerable to email-based cyberattacks as anyone in an organization, however the systems and environments they manage are so critical to the business that a breach can be devastating. With Proofpoint Targeted Attack Prevention feeding information to CyberArk about ‘very attacked’ privileged users in an organization, we can immediately — and automatically — apply remediation measures to help stop targeted threats before they can reach their intended destination.”

Ad Scams Deliver a Bitter Pill to TikTok

TikTok Security Vulnerabilities Could Expose User Data, tiktok, tiktok child data mishandling

The problems for the popular short-video app TikTok don’t seem to subside. After facing a complete ban in India and an impending ban in countries like the U.S. and New Zealand, TikTok is in the soup again over concerns surrounding scammers purchasing ads to promote fake mobile apps, diet pills, and other bogus products and services. According to a recent research by Tenable, TikTok’s popular ‘#ForYou’ page has become a habitat for ad scams.

Satnam Narang, Staff Research Engineer at Tenable, listed four ways scammers are exploiting the TikTok ad network. These include:

  • Easy money offers claims to help users earn money by downloading applications that are either deceitful or questionable in nature. These advertisements promote fake apps, lure users into potential pyramid schemes, request personally identifiable information and, in some cases, encourage users to install mobile device management tools that make it easy to take over users’ devices.
iMoney: The hidden interface behind several apps, including Super Expense. Photo Courtesy: Tenable
  • “Free” offers that come with a price, such as free diet pills ads use fake celebrity endorsements and news articles to dupe users into providing credit card details in exchange for “free” goods, subjecting unsuspecting users to recurring subscription fees.
Fake articles promoting diet pills using the CNN News logo and false claims from notable figures. Photo Courtesy: Tenable
  • Dropshipping schemes promote questionable or extremely overpriced goods offered by dropshipping. While dropshipping itself isn’t necessarily a scam, these offers are problematic when they involve price gouging, counterfeit or questionable goods, or duping buyers into paying for goods they never receive.
Examples of TikTok advertisements promoting dropshipped goods. Photo Courtesy: Tenable
  • Dodgy credit and tuition assistance offers prey on those in dire financial straits by promising to repair credit card history or promoting online classes as a way to access financial aid. In many cases, these ads are merely a ruse to entice users to pay for bogus services or share their personally identifiable information.
TikTok advertisements promoting credit repair using videos of notable celebrities and figures who have no part in the business whatsoever. Photo Courtesy: Tenable

According to Narang, a surge in popularity brings with it challenges toward content moderation and combating abuse, and TikTok is also facing a similar predicament, “which is why it is important for ByteDance — and any new U.S. owner — to prioritize up leveling the app’s content moderation and abuse team in order to curtail these types of questionable ad practices,” he noted, while adding that there is ample room for improvement.

“For users of TikTok, it’s important to recognize that scammers are opportunistic individuals. Scammers see users as a means to an end – the goal is to prey on consumer insecurities and desires to earn fast money, get a good deal on a hot product, lose weight without working out or relieve credit card debt. While we all wish it weren’t so, the reality is there’s no easy way to accomplish these things. TikTok users would do well to be skeptical of many of the advertisements on the platform, because at the end of the day, they’re not always what they appear to be,” Narang concluded.

Tenable also shared its elaborate findings with Amazon, Apple, Facebook, and TikTok. Following which Apple removed iMoney from its App Store. While TikTok has stated that it will “direct this to the right person on our team to review.”

With a major chunk of its user-base under the age 14, the ad scam fiasco for TikTok would be another bitter pill to swallow. Earlier this year, South Korean telecommunication watchdog, Korea Communications Commission (KCC), found TikTok guilty of mishandling child data in the country and thus imposed a 186 million won (i.e. approximately US$155,000) fine.  In February 2020, the company settled with the FTC by agreeing to pay a $5.7 million fine for failing to adhere to the Children’s Online Privacy Protection Act (COPPA). Back then, this was the largest civil penalty ever obtained by FTC in a children’s privacy case.

4 in 10 Companies Expose Unsafe Network Services Online

4 in 10 Companies Expose Unsafe Network Services Online, network and security

A joint research by cyber risk management firm RiskRecon and the cybersecurity research firm Cyentia Institute revealed that a large number of organizations leave their unsecure network services open online, exposing their critical data to risks. According to the research, “Third-Party Security Signals: Exposing the reality of unsafe network services,” nearly 33% of enterprises in the digital supply chain expose unsafe network services like data storage, remote access, and network administration to the internet.

 Key Findings 

  • Within the top three unsafe network services, data stores, such as S3 buckets and MySQL databases are the most exposed.
  • Remote access is the second most exposed service; admins should consider restricting the accessibility of these services only to authorized and internal users.
  • Universities are woefully exposed. With a culture that boasts open access to information and collaboration, the education sector has the greatest tendency to expose unsafe network services on non-student systems, with 51.9% of universities running unsafe services.
  • Global regions lack proper security posture. Countries such as the Ukraine, Indonesia, Bulgaria, Mexico and Poland confirm the highest rate of domestically hosted systems running unsafe services.
  • Beware of ElasticSearch and MongoDB. Firms that expose these services to the internet have a 4x to 5x higher rate of severe security findings than those who do not run on internet-facing hosts.
  • Unsafe services uncover other security issues. Failing to patch software and implement web encryption are two of the most prevalent security findings associated with unsafe services.

The findings are based on the evaluation of millions of internet-facing systems across 40,000 commercial and public institutions. Cyentia and RiskRecon analyzed the data in two strategic ways: the direct proportion of internet-facing hosts running unsafe services and the number of organizations exposing unsafe services somewhere across their infrastructure.

Kelly White, CEO and co-founder at RiskRecon said, “Blocking internet access to unsafe network services is one of the most basic security hygiene practices. The fact that one-third of companies in the digital supply chain are failing at one of the most basic cybersecurity practices should serve as a wakeup call to executives and third-party risk management teams. We have a long way to go in hardening the infrastructure that we all depend on to safely operate our businesses and protect consumer data. Risk managers will be well served to leverage objective data to better understand and act on their third-party risk.”

Jay Jacobs, partner and Co-founder, Cyentia Institute, said, “Similar to how medical doctors diagnose illnesses through various outward signs exhibited by their patients, third-party risk programs can perform quick, reliable diagnostics to identify underlying cybersecurity ailments. Not only is the presence of unsafe network services a problem, but the data we examine in this report also shows that they are a symptom of broader problems. Easy, reliable risk like this offers a rare quick win for risk assessments.”

CISA Trusts “Good Faith” Security Researchers; Issues VDP Directive

Russian hackers, Senate Homeland Security Report, Electronic Warfare Associates

Cybersecurity has been a growing concern in the U.S. since the time tensions between the former and China have escalated. In such a scenario, CISA has acknowledged that this form of virtual security is for the “public good” and thus stands strongest when the “good faith” security researchers and various governmental organizations collaborate in this fight. However, the basis of this can only be laid on the strong foundation of a formal policy that helps finding and reporting of vulnerabilities in a legally authorized manner. Thus, to ease this process for the researchers, CISA recommends vulnerability disclosure policies (VDP) to be defined across governmental agencies.

What is Vulnerability Disclosure Policy?

Currently, most governmental agencies lack a formal mechanism to receive information from security researchers or white-hat hackers about potential security vulnerabilities on their systems. In the draft directive issued by CISA, it clearly states, “Only a few agencies have clearly stated that those who disclose vulnerabilities in good faith are authorized.” The vulnerability disclosure policy changes this. It makes agencies publish policies with detailed descriptions of which systems are in scope, the types of testing that are allowed, and how security researchers can submit vulnerability reports. These policies also cover all internet-accessible systems or services in government agencies – including systems that were not intentionally made internet-accessible.

The VDP also forces all agencies to maintain a tracking mechanism for all vulnerability lifecycles. There would be complete transparency of which phase the vulnerability is in and what measures are being taken to plug it.

The Bug Bounty Consideration

As per the memo sent from the White House, a coordinated vulnerability disclosure (CVD) consists of two components, first VDP and second bug bounty. However, the Office of Management and Budget (OMB) defines the latter as an optional resource. It says, “Federal agencies can leverage a bug bounty as an incentive focused tool to identify vulnerabilities. This type of program, although not required, should be considered in the greater context of an agency’s enterprise risk management program. Federal agencies are encouraged to consider the use of bug bounty programs.”

The recommendations in the directives issued are clear, but it will be interesting to see the timeline for its complete implementation as this is a coordinated framework and involves all federal and governmental agencies.

NCSC Releases Cybersecurity Guidelines with International Allies

Avaddon ransomware, Microsoft and Fortinet flaws, apt

The U.K.’s National Cyber Security Centre (NCSC) joined hands with international cybersecurity agencies from five countries to issue security guidelines that intend to help organizations globally in disclosing data breaches and handling threat actors. The joint security advisory “Technical Approaches to Uncovering and Remediating Malicious Activity” is released in cooperation with the U.S.’s Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre, the New Zealand National Cyber Security Centre and CERT NZ, and the Canadian Communications Security Establishment.

“The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation,” the advisory said.

The advisory revealed the technical approaches for organizations when addressing potential security incidents and includes certain mitigation steps.

Common missteps to avoid when responding to a security incident:

  • Mitigating the affected systems before responders can protect and recover data.
  • Touching adversary infrastructure (Pinging, NSlookup, Browsing, etc.).
  • Preemptively blocking adversary infrastructure.
  • Preemptive credential resets.
  • Failure to preserve or collect log data that could be critical to identifying access to the compromised systems.
  • Communicating over the same network as the incident response is being conducted (ensure all communications are held out-of-band).
  • Only fixing the symptoms, not the root cause.

Mitigations

The advisory also recommended certain practices for organizations to mitigate potential threats to their network. These include:

  • The FTP and Telnet protocols transmit credentials in cleartext, which are susceptible to being intercepted. To mitigate this risk, discontinue FTP and Telnet services by moving to more secure file storage/file transfer and remote access services.
  • Restrict or Discontinue Use of Non-approved VPN Services.
  • Shut down or Decommission Unused Services and Systems.
  • Quarantine and Reimage Compromised Hosts.
  • Disable Unnecessary Ports, Protocols, and Services.
  • Restrict or Disable Interactive Login for Service Accounts.
  • Disable Unnecessary Remote Network Administration Tools.
  • Manage Unsecure Remote Desktop Services.
  • Credential Reset and Access Policy Review.

NCSC Director of Operations Paul Chichester said, “Cybersecurity is a global issue that requires a collaborative international effort to protect our most critical assets. This advisory will help organizations understand how to investigate cyber incidents and protect themselves online, and we would urge them to follow the guidance carefully. Working closely with our allies, and with the help of organizations and the wider public, we will continue to strengthen our defenses to make us the hardest possible target for our adversaries.”

CISA Director Chris Krebs said, “With our allied cybersecurity government partners, we work together every day to help improve and strengthen the cybersecurity of organizations and sectors of our economy that are increasingly targeted by criminals and nation states alike. Fortunately, there’s strength in numbers and this unified approach to combining our experiences with a range of malicious actors means that we’re able to extend our defensive umbrella on a global scale.”

75% of CEOs Will be Personally Liable for Cyberattacks by 2024: Gartner

active directory
active directory

Research and advisory firm Gartner estimated that nearly 75% of CEOs will be personally liable for the financial impact due to the growing Cyber-Physical System (CPS) attacks by 2024. In its report, Gartner stated that CPS security incidents can lead to physical damage to people and destruction of assets in a rapid space, and environmental disasters. It also predicted that CPS incidents will increase in the coming years due to lack of focus and investment in cybersecurity.

What is Cyber-Physical System?

A cyber-physical system is a computer system in which a mechanism is controlled by a computer-based algorithm. CPSs are engineered to orchestrate sensing, computation, control, networking, and analytics to communicate with the physical world.

“Cyber-physical systems underpin all connected IT, operational technology (OT) and Internet of Things (IoT) efforts where security considerations span both the cyber and physical worlds, such as asset-intensive, critical infrastructure and clinical health care environments,” Gartner said.

According to Gartner, the financial loss due to CPS attacks will reach over $50 billion by 2023. In addition, the costs to organizations in terms of compensation, litigation, insurance, and regulatory fines will be higher.

Katell Thielemann, Research Vice President at Gartner said, “Regulators and governments will react promptly to an increase in serious incidents resulting from failure to secure CPSs, drastically increasing rules and regulations governing them. In the U.S., the FBI, NSA and Cybersecurity and Infrastructure Security Agency (CISA) have already increased the frequency and details provided around threats to critical infrastructure-related systems, most of which are owned by private industry.”

Thielemann added, “Technology leaders need to help CEOs understand the risks that CPSs represent and the need to dedicate focus and budget to securing them. The more connected CPSs are, the higher the likelihood of an incident occurring. A focus on ORM – or operational resilience management, beyond information-centric cybersecurity is sorely needed.”

It is essential to note that damages in the digital world have an adverse impact in the physical world, since vulnerabilities and risk vectors exist in a cyber-physical spectrum.

1...173174175...410Page 174 of 410