Home Blog Page 183

Cutting the Vulnerability Noise with Context

cybersecurity

Chasing Patches

Why does 20% of hacking activity focus on vulnerabilities? Here’s why and it’s no surprise. The cycle of scanning and patching continues as it ever does. The discussion of which patches get deployed in what order ranges from friendly conversation to heated argument. There are never enough cycles to patch them all. And some systems cannot be patched because of deprecated code or critical functionality.

By Brandon Hoffman, CISO at Netenrich

Certainly, we could shift the heavy lifting of ordering and priority left, and have machines do the work. The idea of having the machines learn and crunch enough data to make decisions for us is appealing. Many smart people and vendors have worked hard on this problem for decades, yet the need for a human analyst remains too deeply embedded.

So, an organization builds a risk model and aligns it to their business. The machines are spinning away on the risk model and the data input. Yet somehow it feels that something is missing because while we all accept that there is no 100%, the damage is still not being controlled. Setting aside the technology difficulty and dependence on future improvements, there remains an opportunity to dissect the inputs to the risk model and make course corrections.

Risk Model Elements

Every organization has, or should have, a risk model that is aligned with the specifics of an organization’s business and exposure areas. Some elements of this risk model are generic or more widely applicable. These elements are commonly adopted by technology providers and include all the usual suspects such as CVSS scoring, patch availability, and assessments related to the function of the system impacted.

Furthermore is a core component of risk valuation – contextualization. Context is fundamental for any intelligence driven model, and that’s what we are really chasing……context. Some variables of context are more easily identified and remain relatively constant. Examples that are present in the vulnerability risk model include the operational area of the system, uptime requirements of the system, and the user(s) of the system.

More difficult components that require constant re-assessment include the downstream impact and accessibility of the system in question. How exposed is this system to somebody targeting it and if exploited, where can you pivot from that system? Technology providers have done a reasonably good job of creating systems that can generate this type of analysis. Technology that assesses risk exposure from the outside in and systems that calculate network paths and potential access through the network.

The final piece needed for context comes down to adversary capability, intent, and opportunity. These contextualized data points are critical inputs to any risk model, especially when considering risk to business systems and data. To evaluate capability, intent, and opportunity, you need to assess the “who”, and this analysis is what bolsters the model to create further efficiency and gains in risk reduction.

Bolstering the Model by Adding Context

The majority of attacks on business systems are driven by cybercriminals. Their motivation is the potential financial gain from selling access, data, or tools that empower other criminals. From the adversary’s perspective, they carefully consider which tools to equip themselves with for targeting specific high-value victims, but also look at it from the other angle at tools and exploits being developed against vulnerable systems that can be attacked opportunistically.

They too are considering risk against a similar model – Is there a patch, how many of these systems exist (availability and exposure of targets), what data may be present on these systems, and where are these systems generally positioned in the organization. Depending on the capability of the adversary, they may also consider if there is available exploit code, is it weaponized, and is it easy to use or re-purpose. The starting point for this perspective is from outside-in. The initial attack vector will most likely be an externally facing company asset, which provides a unique challenge and opportunity at the same time.

Analysis of the adversary perspective can be a daunting and complex task. Understanding of the attack surface available to the adversary is just the beginning. It is compounded by the difficulty to obtain the prerequisite information for interpretation of motive and intent. Creating a statistical analysis of how frequently a specific exploit is mentioned or discussed doesn’t really provide enough contextual data to satisfy this component of the risk model. The observables necessary to analyze this would cover credibility of an adversary over time (have they been successful at this), where an adversary is sharing information about an exploit (is it with the world or exclusively with other credible criminals), and most importantly the technical status/maturity of the exploit being discussed and shared. These contextual data points are the critical inputs to the risk model that can have a significant and effective impact on scoring and prioritization.

Consider a situation where there is a vulnerability on a system of low value, rated as low criticality. Understanding where that system exists and downstream access from that system is important, yes. However, if there is no observed targeting or meaningful discussion of that vulnerability by the community of adversaries who normally have the capability, intent, and opportunity to attack the system, or possibly there is only rudimentary code available to leverage that vulnerability, the criticality would remain low.

Conversely, if the people who typically perpetrate these attacks on a regular basis are having meaningful conversations and executing technology advancements to make leveraging this vulnerability more accessible, that low priority vulnerability becomes critical.

Context remains the key input to risk modeling and that context comes from a reasonably challenging combination of closed-source access, data collection and triage, and human-driven intelligence analysis.

About the Author

Brandon Hoffman is the Chief Information Security Officer (CISO) at Netenrich. He is a veteran CTO and security executive well-known for driving sales growth and IT transformation. Hoffman is responsible for Netenrich’s technical sales and security strategy for both the company and its customers. Most recently, he oversaw Intel 471’s dark web threat intelligence business. As former CTO at Lumeta Corporation and RedSeal Networks, Hoffman led technical and field development in network security, vulnerability, and risk management. He’s also held key practitioner roles in security architecture, penetration testing, networking, and data center operations. Hoffman holds a MS Degree from Northwestern University and a BS Degree from University of Illinois at Chicago.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

India Ranks Second in Drive-by Download Attacks and Cryptomining Encounter: Microsoft

Vulnerabilities in Zimbra

The drive-by download attack volume has been witnessing a steep surge since 2018, with India being the second highest in terms of volume of attacks in the Asia Pacific region. The number is nearly three times higher than the regional and global average. In fact, India, together with Hong Kong and Singapore, continued to face high drive-by download attack volume, according to findings from the latest edition of Microsoft’s “Security Endpoint Threat Report 2019.” The country moved from 11th to second highest attack volume YoY across the region. The report also asserted that cybercriminals remain focused on stealing financial information or intellectual property.

India also recorded the second highest in cryptocurrency mining encounter rate in the Asia Pacific. Even though there has been a considerable decline in the cryptocurrency mining encounter rate compared to 2018, India was still 4.6 times higher than the regional and global average. During these attacks, victims’ computers were infected with cryptocurrency mining malware, allowing criminals to leverage the computing power of their computers without their knowledge.

 Ransomware Hogs the Limelight 

With respect to ransomware attacks, the report also highlighted that the Asia Pacific continued to experience a higher-than-average encounter rate for malware and ransomware attacks – 1.6 and 1.7 times higher than the rest of the world with India continuing to rank the third-highest for ransomware attacks. This was despite a 35% and 29% decrease in malware and ransomware encounters respectively over the past year.

Drive-by download

Talking to CISO MAG about this alarming trend around ransomware, Keshav Dhakad, Group Head & Assistant General Counsel – Corporate, External & Legal Affairs, Microsoft India, said, “With the modes of attacks, cybercriminals are shifting their efforts to customized campaigns targeting specific to geographical areas, industries, and businesses.”

Drive-by-download

Countries with lowest encounter rate were Japan, New Zealand, and Australia.

In an ensuing statement, he added, “While overall cyber hygiene in India has improved, we believe there is more to be done. Typically, high malware encounters are a result of excessive usage of unlicensed and/or pirated software, and the proliferation of sites that illegitimately offer free software or content, such as video streaming. Consumer education is important – users should regularly patch and update programs and devices and be able to identify unsafe websites and illegitimate software.”

 Cybersecurity in Times of Pandemic 

COVID-19 has changed the cybersecurity landscape and remains the top-of-mind concern for individuals, organizations, and governments around the world. Ever since the onset of the pandemic, every country in the world has seen at least one COVID-19-themed attack with a continuous increase in the volume of successful attacks.

Among phishing messages seen globally each day, over 60,000 include COVID-19-related malicious attachments or malicious URLs with attackers impersonating establishments like the World Health Organization (WHO), Centers for Disease Control and Prevention (CDC), and the Department of Health.

Dhakad further explained, “Attacks have affected aid organizations, medical billing companies, manufacturing transport, government institutions, and educational software providers.”

He stated, “According to our data, we found that COVID-19 themed threats are mostly retreads of existing attacks that have been slightly altered to tie to the pandemic. This means that attackers have been pivoting their existing infrastructure, like ransomware, phishing, and other malware delivery tools, to include COVID-19 keywords, to capitalize on people’s fear. Once users click on these malicious links, attackers can infiltrate networks, steal information, and monetize their attacks.”

When asked, with COVID-19 seeing mass layoffs in several companies across the world and many of these may have been employees with privileged access. Doesn’t it pose a bigger insider threat challenge?  Dhakad responded to this question: “Zero trust has been principal for organizations. It is important that all the accesses are verified. Fortunately, technology is well advanced to easily spot the anomalies. To stress again, zero trust policy must be mandatory for every organization during these times.”

Microsoft has also issued guidance for businesses and individuals:

 Guidance for Businesses 

  • Safeguard employees with strong tools and infrastructure.
  • Turn on two-factor authentication (2FA) or multi-factor authentication (MFA) as employees work from home.
  • Include end-to-end encryption on trusted applications for audio/video calling and filesharing.
  • Guide employees on how to identify phishing attempts and distinguish between official communications and suspicious messages.

 Guidance for Individuals 

  • Update all devices with the latest security updates and ensure that an antivirus service is included.
  • Watch out for malicious or compromised websites and avoid pirated content.
  • Recognize and report suspected attack attempts.
  • Verify all links and attachments before opening them.

“You can’t quantify business risk with RAG color coded scores”

quantify business risk, Adam Palmer, Chief Cybersecurity Strategist, Tenable

A recent study by Forrester Research shows that 97% of Indian organizations experienced at least one business-impacting cyberattack in the past 12 months. Yet, only four in 10 security leaders in India have a clear picture of how much at risk, or how secure their organizations are. In a chat with CISO MAG, Adam Palmer, Chief Cybersecurity Strategist at Tenable, tells us how security leaders should quantify business risk and assess the attack surface, using accurate and more insightful metrics like the cyber exposure score.

Palmer has over 20 years of cybersecurity experience.  That includes executive positions at large cybersecurity vendors, leading the U.N. Global Program against cybercrime.  Before joining Tenable, Palmer held the position of Global Director, cybersecurity Risk & Controls for Banco Santander – the largest bank in the EU and Latin America.

Palmer began his career as a U.S. military officer focused on cybercrime cases.  After the military, he worked in a senior operational role by creating the [.]ORG top-level Internet domain cybersecurity program.

Edited excerpts of the interview:

By Brian Pereira, Principal Editor, CISO MAG

Your research shows that only 4 in 10 security leaders know how secure or at risk they are. How does an organization quantify business risk due to these business-impacting cyber attacks? Are there any frameworks or tools to do this?

I worked on this idea for two years and my prior job at the bank (Banco Santander) was trying to quantify risk — moving from qualitative to quantifiable analysis. Many security leaders use the heat matrices, the red, amber, green (RAG) scores to try to describe risk to the business leaders. This is really IT talk. Every organization I worked at did this. It doesn’t say anything to really quantify the risk or help people understand the reduction in risk. How can a business leader make a decision based on a color in RAG scores? There is a gap in communication between how IT people speak (technical or ambiguous), and the expectations of business leaders — quantitative understanding of risk.

A cyber exposure score, which is what Tenable creates, is a powerful tool because it gives you a quantifiable number.

Why haven’t security leaders been able to do accurate risk assessments for business-impacting cyberattacks?

The heart of it is really the lack of partnership between the security and the business leaders. There’s not enough alignment of metrics and objectives with business strategic priorities. I see that organizations report risk in a very qualitative language. This is not the language of business leaders. They have to consider industry benchmarking frameworks and accurately report it to the business, especially in times like today.

Organizations with security and business leaders who are aligned in measuring and managing cybersecurity as a strategic business risk deliver demonstrable results. What would be your recommendations to security leaders to do this security-business alignment? How do they weave cybersecurity into the fabric of business discussions?

The keys are a few things: linking the security program to business performance.  Making sure you have visibility across the entire attack surface. The attack surface has expanded with cloud and even operational technology. You can’t protect what you can’t see. And you have to apply a business context to your tactical decisions and express that in a quantifiable matrix that business leaders understand.

Looking at the global threat landscape, which countries are being targeted the most? And what could be the reasons?

We saw that all the markets had a high percentage of business-impacting events over the last 12 months. 97% of businesses in India reported a cyberattack within the last 12 months. And 74% expect an increase in cyberattacks. Today, we are in a very dynamic business environment, with business and technology closely woven together. The effective business-aligned CISO just can’t focus on technical issues or one part of that threat landscape. They really have to be aligned with the business and elevate themselves as a business-aligned security expert — and be aware of the entire expanded threat landscape.

Specific to India, what does your research show, with respect to the types of businesses being increasingly targeted?

We saw medium and large businesses being attacked. We know that these businesses make India a dynamic and exciting economy, with Digital India, and all the technology being used throughout India – in business and in government. Cybercriminals know where the money is, and they target technology and intellectual property. Given the monetary value and the damage that can be caused by a successful attack, across industries, telecom, health care, finance, all these industries are major targets. And what we found in this study is that all of these are equal opportunity targets for cybercriminals to attack a business.

Your research shows that 67% of security leaders in India say these attacks also involved an operational technology (OT) system. What kind of industries are being targeted within India? Does this also include critical infrastructures like nuclear plants and electricity grids?

This is really an issue of convergence. Automation is now common in the industrial environment. And that environment is converging with the IT environment. It is in critical infrastructure and manufacturing. But it can be in lots of different types of businesses. Think about automated access controls, with all kinds of smart connected devices, HVAC — some of these use smart connected industrial controllers. And we are finding that cybercriminals are attacking these devices and often, security teams aren’t monitoring these satisfactorily. They are using legacy approaches for vulnerability risk management, and they are not detecting these devices. And the criminals are attacking them.

A heavy manufacturing plant that uses OT devices, was targeted last year in Europe. And it cost Euro 40 million in the first week.  It disabled their operations. So it is critical that the security teams secure these critical operations and make sure they are using the same amount of analysis and care that they apply to other amounts of threats and that they are applying that as well to this new threat vector, which is OT.

I want to talk about the COVID-19 response strategies, and you have another data point in your report about this: 75% of the respondents say their COVID-19 strategies are somewhat aligned to the business. What is the reason for the surge in COVID-19 related phishing attacks on businesses?

Cybersecurity threats really thrive amidst a climate of uncertainty. We’ve seen attacks increase with attackers taking advantage of the current pandemic environment. This highlights the fact that cybersecurity should be a board-level concern. In times of crisis, it’s more important that you have clarity and alignment with the business. Cybersecurity teams need to evolve to align themselves to a business strategy that understands this, connects with this, and manage cyber risk, in relation to the world around them, which is now an unusual world due to COVID-19.

Cybersecurity Strain: 161% Increase in Visits to High-Risk Apps

Mobile Apps Security, mobile apps

Research experts from Netskope Cloud warned security teams about the surge in the use of risky apps and websites by the remote workforce, globally. In its report “Cloud and Threat Report – August 2020” Netskope Cloud stated that the number of remote employees has more than doubled and changes in user behavior has been dramatic in the Q1 of 2020, with 161% increase in visits to high-risk apps and sites by a 64% remote workforce.

Research Highlights

  • 80% increase in the use of collaboration apps as remote workers sought to remain connected with their colleagues, and a 2% increase in the total number of cloud apps being used in the average enterprise.
  • 600% increase in visits to adult content.
  • 97% increase for personal use of managed devices.
  • Cloud-based malware delivery (vs web) increased to 63%.
  • Personal use of devices increased by 97% and use of risky apps and websites increased by 161%.
  • 7% of all users uploaded regulated data, source code, company confidential data, and other sensitive data to personal instances, exposing the data to potential misuse and theft.
    Image Source: Netskope Cloud

The research also revealed that Cloud Storage, Webmail, and Social apps were among the most popular apps used for phishing, with 63% of malware delivered over cloud applications like Microsoft Office 365 OneDrive for Business, SharePoint, Google Drive, and Amazon S3. While, Microsoft Office 365 OneDrive for Business, Microsoft Live Outlook, Blogger, AOL Mail, and Facebook are the most popular apps used for phishing attacks.

“The percentage of phishing attempts being delivered through cloud applications held steady at 15% with a variety of apps being used to deliver the bait, including cloud storage, webmail, web hosting, and social media apps. This statistic, combined with those reported by the Anti-Phishing Working Group, indicates that phishers are both using the cloud to phish and phishing for cloud credentials,” the report said.

“Device sharing at home is validated by the traffic to websites and apps categorized as Education and Kids, where managed devices are used for remote education efforts within families. Even with an increase in personal use of managed devices and high-risk websites, the most popular apps remain the leading delivery method of cloud-enabled threats and malware. And finally, as expected, the use of collaboration apps increased greatly as remote teams aim to stay connected,” the report added.

Protective Measures

Netskope Cloud also recommended certain security measures to protect sensitive data from adversaries. These include:

  • Use strong authentication and access controls like 2FA, MFA, etc.
  • Adaptive access controls based on the user, app, device, location, data, and destination to selectively grant access to specific activities.
  • Zero-trust network access to private apps in data centers and public cloud services to reduce exposure of apps and limit network lateral movement.
  • Continuous security assessment of public cloud services to detect misconfigurations and publicly exposed data.
  • Cloud inline analysis of managed and unmanaged cloud apps for data context to enable data and threat protection defenses.
  • Selective and safe enablement of cloud applications based on a third-party risk assessment of applications with the ability to recommend safer alternatives.
  • Granular policy controls for data movement to and from apps, instances, users, websites,devices, and locations.
  • Cloud data protection (DLP) for sensitive data from internal and external threats
  • Behavior analysis for anomalies, plus confidence index scores for users with event correlation timelines to visualize changes in behavior.
  • Real-time coaching to users on activity and data movement with justification collection, proceed/cancel, or warning alerts to change user behavior.

 

CYFIRMA’s DeCYFIR Platform Can Predict Hacker Motives Before an Attack!

Cyfirma's DeCyfir, Cyfirma launches DeCyfir

Have you seen the Tom Cruise flick Minority Report? One of its themes is precrime or the ability to predict a crime before it happens. Well, CYFIRMA, a Singapore-based threat discovery and cyber-intelligence analytics company, seems to have come up with something similar for cybercrimes. It has introduced a cloud-based, AI-powered cybersecurity platform – DeCYFIR. The platform is designed to empower businesses with an ability to discover threats from the trenches of cyberspace and decode them into useful insights. DeCYFIR segregates important threat signals from all the noisy data out there. This enables businesses to not only take remedial actions against cybercriminals, but also helps in detecting their motives much before an actual attack occurs.

DeCYFIR Brings the Power of 3

The DeCYFIR platform has three tenets: Predictive, Contextual, and Comprehensive.

Predictive: The DeCYFIR platform, identifies potential threats at an early planning stage of a cyberattack. It picks up threat indicators from the deep/dark web, hackers’ forums, and other closed communities including its own repository of indicators of compromise (IoCs) and predicts upcoming attacks based on a set of probability mathematical models and analytical engines.

Contextual: DeCYFIR provides a quality intelligence solution to businesses by giving them industry, geography, and technology-specific threat information. The platform has a unique capability to join the dots between hackers, exploit campaigns, motivations, methods, and attack readiness. Thus, it offers businesses a combined and complete contextual visibility of their threat landscape.

Comprehensive: DeCYFIR redefines quality cyberthreat intelligence by providing all three layers of insights (strategic, management and tactical). These insights enable business leaders to take informed and accurate decisions for mitigating risks according to threat severity.

With DECYFIR, cyberthreats and signals are automatically discovered and decoded. These insights are provided in real-time so that security teams are always kept a step head of their cyber adversaries.

Click here to know more about CYFIRMA and its efforts to bring Cyberthreat Intelligence to the fore

Key Features of DeCYFIR

DeCYFIR consists of several modules, each designed to help businesses strengthen their cybersecurity postures and be better equipped to handle the risks of digitalization. However, the three features that stand-out are:

  • Threat Visibility and Intelligence (TVI) – Answers the WHO, WHY, WHAT, WHEN and HOW of the looming cyberthreats, and provides recommendations for remedial actions.
  • Cyber Situational Awareness (CSA) – Provides real-time cyberthreat insights, trends, news related to technology, regulatory & law, policy changes, emerging cyberattacks, vulnerabilities, exploits and much more.
  • Cyber Incident Analytics (CIA) – Enables businesses to comprehensively respond to security incidents with not only tactical information but also strategic-level insights by mapping associated campaign, hacker’s affiliation, motive, and mechanism.

Additionally, the latest version of DeCYFIR includes the following key features:

  • Risk Dossier – A threat playbook that provides complete contextual and correlated details of threats discovered by DeCYFIR.
  • Threat Search Engine – A dedicated search engine that enables businesses to search the dark, deep and surface web, P2P channels, bin sites and other data sources to retrieve information related to specific cyber events, attacks, incidents, malware, vulnerabilities, campaign, and threat actors.
  • Complete Threat Landscape View – A single pane view that offers business leaders and security teams a unified vision into their businesses’ external threat landscape and overall cyber posture.
  • Risk and Hackability Score – Risk and Hackability Score are calculated using proprietary algorithms and mathematical models. With Risk Score, businesses gain a vantage view of their external threat landscape and their preparedness as compared to their industry peers. Hackability Score however serves as an indicator of how hackable businesses are, and their level of attractiveness as a potential target.

DeCYFIR-ing the Threats in a COVID-19 World

The COVID-19 pandemic has increased the world’s digital dependency, and correspondingly increased businesses’ vulnerability to cyberattacks. According to the Global Risks Report 2019 published by the World Economic Forum, massive data fraud, theft, and cyberattacks have been ranked amongst the top five risks globally for the next 10 years in terms of likelihood. In such uncertain times, which includes a global pandemic, trade wars, and geopolitical tensions, cyberthreats and cybersecurity have become an inevitable aspect of businesses across various verticals.

Kumar Ritesh, Founder and CEO of CYFIRMA, said, “Accelerated digitalization has brought about a rise in intensity and sophistication of cyberthreats. Adding to that, remote working has introduced new attack vectors. Integration of business applications with third-party systems can create new vulnerabilities, and employees unaccustomed and untrained in cybersecurity practices can heighten the digital risk. Our enhanced threat discovery and cyber-intelligence platform, DeCYFIR, will help businesses across all verticals as we know cyber-intelligence is the new currency that will power growth and allow businesses to thrive in the post-pandemic digital economy.”

As the digital landscape expands and cybercriminals and state-sponsored groups extend their cyber warfare into businesses and homes, reining in cyberthreats and risks require a mindset shift towards an intelligence-based predictive approach. The DeCYFIR platform could just be the solution that businesses require to decode threats and uncover hidden signals in this hyper-connected world.

And it’s not even 2054, the year in which the film Minority Report is set!

Cyber Warfare, Cyber Warfare WhitepaperAlso, download this whitepaper now and read about “Cyber Warfare” and CYFIRMA’s pledge towards protecting your businesses, enterprises, and governments from such attacks.

 

 

Qualcomm’s Flaws Led to “Achilles’ Heel” in 40% of Android Phones

vulnerabilities in DSP Chip, vulnerabilities in Qualcomm MSM Chip

Check Point, in its research dubbed “Achilles,” discovered multiple vulnerabilities in Qualcomm’s Snapdragon Digital Signal Processor (DSP) chips, exposing over 40% of all smartphones globally to cyberattacks. If exploited successfully, the vulnerabilities allow threat actors to take control of mobile devices without the user’s knowledge.

What’s a DSP Chip?

A Digital Signal Processor is like a computer on a chip that has both hardware and software designed to optimize and enable each area of use on the device itself, including charging abilities, multimedia experiences, and advanced AR abilities. Most modern smartphones, including high-end smartphones from Google, Samsung, LG, Xiaomi, OnePlus and others, have at least one of these chips.

Flaws in DSP Chip

Check Point researchers stated that the vulnerabilities in the DSP chip allows an attacker to turn the devices into spying tools without the user’s knowledge, render the mobile phone constantly unresponsive, and inject un-removable malware with evading detection capabilities. By using a fuzzing technique against smartphones with the vulnerable DSP chip, the researchers were able to identify 400 discrete attacks.

After Check Point disclosed its findings, Qualcomm acknowledged the vulnerabilities and assigned six of the flaws with CVE listings: CVE-2020-11201, CVE-2020-11202, CVE-2020-11206, CVE-2020-11207, CVE-2020-11208, and CVE-2020-11209. Even though Qualcomm fixed the six flaws affecting its Snapdragon DSP chip, the smartphone makers still has to deliver fixes to their users’ devices, which means that many smartphones are still vulnerable to potential threats.

Check Point recommended organizations to use proper mobile security solutions to protect their corporate data on mobile devices.

“While DSP chips provide a relatively economical solution that allows mobile phones to provide end users with more functionality and enable innovative features– they do come with a cost. These chips introduce a new attack surface and weak points to these mobile devices. DSP chips are much more vulnerable to risks as they are being managed as ‘Black Boxes’ since it can be very complex for anyone other than their manufacturer to review their design, functionality, or code,” Check Point said.

“Due to the ‘Black Box’ nature of the DSP chips it is very challenging for the mobile vendors to fix these issues, as they need to be first addressed by the chip manufacturer. Using our research methodologies and state-of-the-art fuzz testing technologies, we were able to overcome these issues – gaining us with a rare insight into the internals of the tested DSP chip. This allowed us to effectively review the chip’s security controls and identify its weak points,” Check Point added.

 

Tanium and Google Cloud Partnership Marks the Beginning of a New “Chronicle”

Cloud Security

Tanium, a unified endpoint security provider, has partnered with Google Cloud to collectively fight against advanced persistent threats (APTs) to the distributed business operations keeping in mind the ongoing and post COVID-19 era. This handshake brings together Tanium’s Threat Response platform and Google Cloud’s security analytics platform, Chronicle, whose acquisition was completed by Google Cloud in October 2019.

With Tanium and Google Cloud, customers don’t have to make difficult tradeoffs between the quality, breadth, timeliness or storage cost of their security telemetry.

What the Tanium and Google Cloud Partnership Means

Customers of both the platforms are excited about this partnership as it will help enterprises detect, investigate, and scope advanced, long-lived attacks (APTs) in a more diligent manner. It will additionally give them the following enhanced capabilities:

  • Proactive Threat Hunting: SecOps teams can now swiftly hunt threats both live and by comparing logs compiled over a year of endpoint activity. The high-fidelity and real-time security telemetry comes from Tanium, which then combines with the analytics and cloud-scale data capacity of Chronicle delivering high-speed search and cyber forensics capability to its customers.
  • Accelerated Incident Response: Both platforms together are now highly capable of providing historical data required to investigate, scope, and further remediate advanced persistent threats. With Chronicle, customers can correlate up to one year of data gathered from the Tanium platform’s sophisticated endpoint telemetry and network activity. This enables incident response teams to take comprehensive remediation actions against long-prevailing APTs.
  • Reduces Overhead Costs: This coalition also increases the efficiency of security analyst(s) and reduces costs associated with storage and point tool sprawl. Tanium reduces or nearly eliminates the need for a separate endpoint security and management solution. With a single agent architecture that provides detailed telemetry across endpoints, coupled with Chronicle’s cost-effective storage for that endpoint telemetry with zero data volume charges and a simpler user interface, this is soon going to be a hot favorite among security analysts.

Sunil Potti, General Manager and Vice President of Cloud Security at Google Cloud, said, “With Tanium and Google Cloud, customers don’t have to make difficult tradeoffs between the quality, breadth, timeliness or storage cost of their security telemetry. APTs require a sophisticated approach to detection and response. This starts at the endpoint, where most compromise activities begin. With telemetry sourced from Tanium’s comprehensive endpoint security approach, customers have the data they need to detect and investigate post-compromise activity to accelerate remediation and prevent future intrusion.”

The Other Collaboration

Tanium and Google Cloud are also extending their zero trust initiatives with another partnership between Tanium and Google’s BeyondCorp. Through this integration, Tanium will support the ability to use endpoint identity, state, and compliance data for BeyondCorp Remote Access.

Later this year, the two companies also plan to collaborate on improving the methodologies of managing and securing client endpoints like thin-client devices, cloud endpoints, and mobile operating systems.

Researchers Discover 30 Vulnerabilities in 20 CMS Products, including Microsoft SharePoint

CISA vulnerabilities, Microsoft Vulnerabilities, HP Device Manager Susceptible to Dictionary Attacks

Security researchers Alvaro Munoz of GitHub and Oleksandr Mirosh of Micro Focus Fortify discovered over 30 security vulnerabilities in 20 content management systems (CMS), including Microsoft SharePoint, Alfresco, and Atlassian Confluence. Munoz and Mirosh presented their findings at the Black Hat cybersecurity conference and demonstrated how a threat actor can escape template sandboxes and get access to the Remote Code Execution (RCE).  They also analyzed security controls executed by several CMS frameworks and techniques to bypass them.

A CMS is a software application used to manage the creation and modification of online content,  mostly used for enterprise content management (ECM) and web content management (WCM). According to the researchers, content in the CMS platform is stored in a database and displayed to users based on a set of templates.  These templates support a subset of programming language capabilities and are sandboxed to prevent users from any intrusions.

Using a Microsoft SharePoint server as a main CMS attack surface, the researchers found six unique RCE vulnerabilities by combining flaws in its implementation and design.  They also reviewed certain popular Java Template engines like Apache Velocity, Apache FreeMarker, Pebble, and JinJava and discovered multiple ways to escape template sandboxes and achieve RCE in many products including, Atlassian Confluence, dotCMS, Alfresco, Liferay, Crafter CMS, XWiki, and Apache OfBiz.

“In the most simple attack scenario, the attacker has access to the target CMS applications such as regular Sharepoint users being able to create their own sites and therefore being able to provide their own templates. In some cases, we were able to get trial accounts on cloud-based CMS platforms and perform the attacks from our own trial admin account. These were the most interesting cases since we were able to compromise the underlying infrastructure which could have allowed us to initiate attacks against other tenants. No matter what the vector used, though, the impact is always critical since once the mitigations are bypassed, template engines can be used to evaluate arbitrary code leading to Remote Code Execution (RCE),” the researchers said.

 

Middle East Employee Security Training is Essential Amid Remote Working

Infosec-Middle-East

Across the Middle East, the COVID-19 pandemic is causing Middle East organizations to rapidly enable remote working for their knowledge workers. As these trends toward remote work or mixed environments become the “New Normal,” there are major cybersecurity implications. Employees are often the weakest link in cybersecurity. What happens now that they are working at home?

By Dr. Moataz Bin Ali, Vice President, Trend Micro Middle East & North Africa

While many Middle East employees have become more aware about the importance of cybersecurity, they are often lacking on the practical deployment – and CISOs need to develop personalized strategies.

Head in the Clouds – How big of a cloud security nightmare are you?

As part of Trend Micro’s Head in the Clouds survey, we interviewed 13,200 remote workers across 27 countries, including 502 remote working knowledge workers in the United Arab Emirates (UAE) and 501 in Saudi Arabia about their attitudes towards corporate cybersecurity and IT policies.

First, the good news: Among two of the largest markets in the Middle East, more than four fifths of remote workers in Saudi Arabia (86%) and the UAE (82%) say they are more conscious of their organisation’s cybersecurity policies since lockdown began in March. Among respondents, 88% in both the UAE and Saudi Arabia say that they take the instructions from their IT teams seriously.

However, many remote workers in the Middle East are continuing to break their organizations’ cybersecurity policies due to limited understanding or resource constraints.

One of the biggest but also most frequent mistakes that employees are making is accessing non-work applications on a corporate device – whether personal email, social media, or entertainment streaming.

The majority of employees admit to using non-work apps on a corporate device – including 58% in the UAE and 59% in Saudi Arabia. Respondents gave numerous reasons – including giving a work-related reason, trying out the latest apps, and thinking that it’s acceptable because the IT team hasn’t yelled at them yet.

Nearly half of respondents – including 42% in the UAE and 42% in Saudi Arabia – have said they uploaded corporate data to non-work apps. While some of these uploads may seem fairly routine, such as transferring files through a third-party service or using a third party chat platform, the security risks can be immense.

Just as much of a concern are the employees who are using their work laptops for personal browsing (40% in the UAE, 37% in Saudi Arabia). While the top results – search engines, personal email, and news – may seem fairly harmless, employees may not fully understand the risks that they are posing to corporate data,

Furthermore, about one-third of employees in the region also say that they access corporate data from a personal device (36% in the UAE, 34% in Saudi Arabia). In our always-on work culture, employees may face burdens to reply quickly from whichever device that they are using. But these devices may not be fully secure in terms of separate passwords, virtual private networks (VPNs), or two-factor authentication.

COVID-19 Threats Present New Challenges

As the COVID-19 coronavirus continues to spread, the topic is being used in many malicious campaigns — including email spam, business email compromise (BEC), malware, ransomware, and malicious domains. Fraud activity is still on the rise as communities remain in and are starting to emerge from quarantine.

In the countries that comprise the Gulf Cooperation Council (GCC), during H1 2020, Trend Micro recorded 163,774 COVID-related threats: 36,312 email spam attacks; 127,415 URL attacks, and 47 malware threats detected. The UAE led the GCC with 138,584 COVID-19 attacks, including 13,229 email spam attacks, 125,330 URL attacks, and 7 malware threats detected. Similarly, Saudi Arabia was not far behind with 8,509 attacks in H1 2020– including 7,970 email spam attacks, 514 URL attacks, and 25 malware threats detected.

As employees across the GCC and the Middle East continue to adapt to new methods of working, they should also be wary of cybercriminals using popular online tools, sharing software, and file attachments in their scams. Unverified mobile apps tracking COVID-19 can also present major risks.

Tailoring Cybersecurity Programs to Meet the Middle East’s Needs

When it comes to cybersecurity, not everyone has the same habits and attitudes towards risk. As a result, we’ve worked with leading cyber-psychologists to identify four typical key character types. Rather than take a one-size-fits-all approach, Middle East organizations should tailor their cybersecurity training and risk management to these character types.

  • Fearful – Anxious about doing something wrong or exposing themselves or their organization to risk, highly accountable for their own behaviour, not always aware of what cyber risks are out there or how to manage them, may deploy risk avoidance strategies at the cost of productivity.
  • Conscientious – Well-versed in understanding cybersecurity risks, always takes proactive steps to avoid or manage risk, highly accountable for their own behaviour, and mindful of their role in protecting the organization.
  • Ignorant – Distinct lack of cybersecurity awareness, absence of accountability for their own behaviour, careless and regularly takes risks, and does not understand the significance of their actions as they relate to cybersecurity.
  • Daredevil – Careless and lacks any sort of diligence around cybersecurity, has no regard or accountability for their own behaviour, reckless and has a perceived superiority that the rules do not apply to them, and believes that infosecurity responsibility lies elsewhere within their organization.

What are the practical steps that Middle East organizations can take in their cybersecurity readiness?

In addition to delivering a more personalized approach to cybersecurity training sessions, we are also recommending that organizations take a multilayered protection approach to protect all fronts. Middle East organizations need to prevent users from accessing malicious domains that could deliver malware.

For example, Trend Micro’s connected threat defense enables organizations to deploy security solutions at all touchpoints in an IT system – endpoints, hybrid cloud and networks. Trend Micro solutions can detect and block malware, malicious domains, and spear phishing emails; find unknown malware using machine learning; thwart spam and email attacks; and use AI to identify email attacks.

Ultimately, remote working only works if there is a high degree of trust between managers and their teams.

As lockdown measures continue to loosen across the Middle East, organizations and their employees will have to re-earn trust if they are to continue benefiting from the work from home environment.

About the Author

Dr. Moataz BinaliAs Vice President for Trend Micro Middle East and North Africa (MENA), Dr. Moataz Binali is responsible for spearheading the company’s strategy across the region, and advancing its position as a leader in cybersecurity that is passionate to make the world safe for exchanging digital information. A significant part of Dr. Binali’s role is to oversee Trend Micro’s efforts in enhancing the cybersecurity posture amongst governments and enterprises, contributing to the digital economy of MENA. Prior to joining Trend Micro, he held pivotal roles on regional level in global technology organizations such as SAP, IBM, and Microsoft.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Threat Alert! Attackers Use Malicious Email Accounts to Launch BEC Attacks

Threat Alert! Attackers Use Malicious Email Accounts to Launch BEC Attacks

Researchers at Barracuda, a provider of cloud-enabled security solutions, has warned users about threat actors who create accounts with legitimate email services and use them to launch business email compromise (BEC) attacks. The researchers identified 6,170 malicious accounts that use Gmail, AOL, and other email service providers and were responsible for more than 100,000 BEC attacks on nearly 6,600 organizations since the beginning of 2020.

Image Source: Barracuda

The number of organizations attacked by a malicious email account ranged from one to a single mass scale attack that impacted 256 organizations and the number of email attacks sent by a malicious account ranged from one to over 600 emails, with the average being only 19.

Malicious Email Accounts

According to the researchers, malicious email accounts were responsible for 45% of all BEC attacks detected since April 1, 2020. Cybercriminals targeted several enterprises with multiple attacks from the same email accounts with specially crafted messages and URLs. Usually, attackers do not use their malicious accounts for a long period of time. Nearly 29% of malicious accounts were used for only a 24-hour period.

Cybercriminals design BEC attacks to bypass email gateways which is the reason why they only use each malicious account in a small number of attacks to avoid detection.

“While most malicious accounts are used by attackers for a short period of time, some cybercriminals used these accounts to launch attacks for over year. It is not unusual for cybercriminals to return and re-use an email address in attacks after a long break,” researchers said.

 

Image Source: Barracuda

Attackers Prefer Gmail

Hackers prefer Gmail for their malicious accounts as it is easily-accessible, free, easy to register, and is able to pass through email security filters. Gmail accounted for 59% of all email domains used by cybercriminals. Yahoo! was the second most popular one, with 6% of all observed malicious account attacks.

Image Source: Barracuda

“By nature, business email compromise is a highly targeted attack. After an initial research period, cybercriminals will impersonate an employee or trusted partner in an email attack. Usually, email is used first to establish contact and trust. Attackers will expect replies to their BEC attacks. Therefore, these attacks are usually very low volume and highly personalized to ensure a higher chance of reply,” researchers added.

How to Protect against Malicious Accounts

  • Barracuda researchers concluded that identifying accounts used by attackers is not always easy. Threat actors use the technique of spoofing, wherein they pretend to be someone else in an attempt to gain illegitimate advantage. However, organizations can implement the following measures to avoid BEC attacks:Leveraging artificial intelligence to identify unusual senders, requests, and other communications will help detect BEC attacks and other fraud.
  • Working with a vendor that can share this type of threat intelligence between different organizations in real time will allow for a greater level of protection.
  • Train your users to recognize targeted phishing attacks. User training should always be part in your security posture. Make sure your employees know how to recognize messages that come from outside of your organization and are aware of the latest tactics used by cybercriminals.

 

1...182183184...410Page 183 of 410