Home Blog Page 187

90% Organizations Experienced Spike in Cyberattacks Due to the Pandemic

Australian Securities and Investment Commission Hit by a Cyberattack

A survey from endpoint management services provider Tanium revealed that 90% of security leaders experienced an increase in cyberattacks due to the pandemic and 93% admitted that they were forced to delay key security projects due to sudden remote work conditions. The research report “What Happened When the World Stayed Home?”  focuses on the ongoing effects of COVID-19 on private and government organizations. Nearly all the executives surveyed said they had to delay or cancel planned security projects.

Identity and asset management (39%) and security strategy (39%) were the top areas interrupted due to the pandemic. Patching was one of the major concerns for organizations, with 88% of respondents who have struggled in this area and 43% experienced difficulties in patching remote workers’ personal devices.

COVID-19 Exposed Security Gaps

The research report also discussed  the preparedness of security leaders when it came to remote work culture. Nearly, 85% said that they felt ready to shift to a fully remote workforce and 98% said they experienced security challenges within the first two months. The top three challenges were: identifying new personal computing devices (27%), overwhelmed IT capacity due to VPN requirements (22%), and increased security risk from video conferencing (20%). The most common of these were attacks involving data exposure (38%), business email or transaction fraud (37%) and phishing (35%).

Impact of Pandemic Lasts Long

Around 85% of respondents believe that the negative impact of the global pandemic will last for several months to come. Most security leaders are concerned that home IT would be difficult to implement long-term for multiple reasons, including compliance regulations (26%), managing cybersecurity risks (25%), and balancing cyber risk with employee privacy (19%). The respondents identified cybersecurity as a top priority, with 70% of respondents stating that they will make cybersecurity the  primary priority for remote work going forward. Nearly 48% of respondents plan to invest in endpoint management tools to improve visibility of IT assets, and 47% plan to make improvements to patch management processes.

Chris Hodson, Chief Information Security Officer at Tanium, said, “The almost overnight transition to remote work forced changes for which many organizations were unprepared. It may have started with saturated VPN links and a struggle to remotely patch thousands of endpoints, but the rise in cyberattacks and critical vulnerabilities has made it apparent that we’re still far from an effective strategy for the new IT reality. Whether companies choose to permanently move their operations remote, return employees to the office, or some combination of both, one thing is clear: the edge is now distributed. IT leaders need to incorporate resilience into their distributed workforce infrastructure. A key part of this is making sure organizations have visibility of computing devices in their IT environment.”

 

i3forum Brings Telecom Giants Together in the Fight Against A2P Messaging Fraud

Smishing attacks

i3forum, a non-profit body, has launched a “Messaging Fraud Work Group” that will help fight Application-to-Person (A2P) messaging frauds taking place across the telecom ecosystem. This group’s key roles include providing advanced insights, knowledge, and collaboration among industry leaders.

What is A2P Messaging?

Short message service (SMS) was first used nearly 25 years ago and has ever since been an integral part of private and business communications. This application of SMS has further made it evolve into two different categories – Person-to-Person (P2P) and Application-to-Person messaging.

P2P messaging is described as the exchange of text messages between two or more end users i.e. a medium of two-way peer communication. However, A2P messaging is an SMS message sent from an application, like a web or mobile app to a subscriber. These messages could be in the form of customer alerts, verification codes and/or marketing messages. Mostly, it is observed that A2P messaging provides one-way SMS to recipients and are not expected to reply.

Increase in A2P Messaging Fraud

According to a joint study of Mobilesquared and Tata Telecommunications, the A2P messaging industry was worth $11.86 billion in 2017 and is now on course to deliver $26.61 billion in revenue by 2022. However, the same report also highlighted the growing concern among mobile network operators (MNOs) amidst rise in malpractices associated with A2P. The MNOs regarded SIM farms, grey routes, and spam (smishing) as the top three threats related to A2P monetization. They believed that A2P messaging frauds were stealing nearly 9.4% of the total A2P revenue which accounted for almost $1.5 billion.

Fraudsters have begun abusing A2P text messaging with a combination of social engineering attacks and technical workarounds like, Spam, Smishing, access hacking, grey routes, SIM farms, SIM swaps and many more. Thus, it has now become more necessary to stop these malpractices before they cause more severe monetary and reputational damages.

Formulation of the “Messaging Fraud Work Group”

Considering these concerning numbers and varied observations, i3forum decided to bring together the telecom giants of the world on the same platform – called the Message Fraud Work Group – in the fight against A2P Messaging Fraud. The work group members include AT&T, BICS, Deutsche Telekom ICSS, Lanck Telecom, Orange, OTE Globe, PCCW Global, Sparkle and Tata Communications.

Its initial objectives are to promote information sharing and mutual education about combating messaging fraud amongst carriers, while identifying best practices across different regulatory environments. The work group will collaborate to fight messaging fraud across the industry and solve crucial market challenges with new insights and solutions.

Anurag Aggarwal, Chair of the Messaging Fraud Work Group said, “Messaging fraud impacts the entire telecoms ecosystem and can result in loss of revenue, reputation and trust. i3forum’s new initiative brings the international carrier community together to tackle this challenge and enables us to deliver a consistent and coordinated effort to combat messaging fraud. We are aiming to enhance fraud prevention measures and their adoption to protect all kinds of industry players, from carriers to aggregators, MNOs, enterprises and end users.”

The work group aims to promote a Code of Conduct and a Classification Document to define the various types of fraud schemes, the types of disputes and recommendations on how to address those issues for carriers. It will collaborate its findings and observations to mitigate all kinds of messaging fraud in the industry, including identity theft, data theft, network manipulation and commercial exploitation.

Collaboration with MEF

Additionally, the work group is going beyond the i3forum and collaborating with the Mobile Ecosystem Forum (MEF), a global trade body that acts as an impartial authority addressing issues affecting the worldwide mobile ecosystem. MEF has already been combating messaging fraud and for quite some time and its A2P SMS Code of Conduct has immensely helped in tackling major fraud types that have been identified, defined and mapped in the MEF’s Enterprise Messaging Fraud Framework. Thus, one of the i3forum’s work group’s first deliverables can be defined as its contribution to the MEF’s Code of Conduct.

Cybercriminals are “Jackpotting” ATMs in Europe to Steal Cash

Cybercriminals are “Jackpotting” ATMs in Europe to Steal Cash

ATM manufacturer Diebold Nixdorf warned that unknown threat actors have used its proprietary software in a series of attacks against Diebold’s ProCash 2050xe USB cash terminals to illegally dispense cash across Europe. In a security alert, the company stated that attackers are using an external device known as “black box” and a software stack of the compromised ATM to launch a “Jackpotting Attack”.

How Jackpotting Works

  • Attackers launch a jackpotting attack to withdraw cash from an ATM illegitimately.
  • To jackpot the ATM, hackers connect their personal device (black box) to the ATM’s communication system to obtain physical access to the ATM machine.
  • Then the attacker unplugs the communication cable between the CMD-V4 dispenser and the ATM PC, and connects it to the black box to send illegitimate dispense commands to the ATM.

Countermeasures

Diebold recommendeds certain security measures to defend against ATM threats:

  • Implement hard disk encryption mechanisms to protect the ATM from software modifications and access to secrets (offline attacks)
  • Introduce intrusion prevention mechanisms to identify deviating system behavior and protect the ATM during operation (online attacks)
  • Follow network security best practices including segmented and secured LAN/VLAN with intrusion, detection, and prevention
  • Implement a secure connection with the host via TLS and Message Authentication Code (MAC)
  • Ensure real-time monitoring of security relevant hardware and software events including unexpected opening of the top hat compartment of the ATM
  • Investigate suspicious activities such as deviating or non-consistent transaction or event patterns, which are caused by an interrupted connection to the dispenser
  • Keep your operating system, software stack and configuration up to date. This is of importance for the core security HW components like EPP, card reader and cash devices as well as all banking related software components
  • Implement secure software update processes and follow security best practices on password management of remote access tools

“Diebold Nixdorf is continuing to analyze these new attacks. During this process, the company would like to point to the recommendations for countermeasures against the known logical attack vectors and the importance of their implementation. Diebold Nixdorf also recommends customers verify whether these recommended countermeasures have been put into operation to better protect your ATM fleet. Where applicable, this should also include checking irregular event alerts generated by the monitoring system to interrupt such attacks,” the advisory added.

 

9 in 10 Security Pros Lack Proper Tools to Detect Cyberthreats

Top Cybersecurity Jobs in 2021

A research from cybersecurity services provider LogRhythm revealed that 93% of security professionals lack the necessary tools to detect cyberthreats and 92% stated that they are still looking for suitable preventative solutions to mitigate the security gaps. The research report “The State Of The Security Team Are Executives the Problem?” highlights that 75% of security teams  now experience more work stress compared to two years ago.

Lack of Executive Support

The research also stated that the stress of security teams increases when there is no executive leadership to guide, with 57% of respondents admitting that their security program lacks proper executive support to provide strategic vision, buy-in, and budget. 42% of security pros cited inadequate executive accountability for strategic security decisions as the top reason they want to leave their job.

Redundant Security Tools

According to the research, 68% of respondents admitted their organization has deployed redundant security tools and 56% confessed that this overlap is accidental. Despite duplicative tools, 58% of respondents said they still need increased funding for tools as an additional support for their security programs.

“Security professionals rate the value of solution consolidation highly, citing top benefits as less maintenance (63%), faster issue detection (54%), identification (53%), and resolution (49%), as well as lower costs (46%) and improved security posture (45%). Yet only one in three companies (32%) have a real-time security dashboard which provides a clear, consolidated view of all their security solutions,” the report stated.

How to Reduce Stress

LogRhythm asked respondents about ways that would help reduce their stress, the responses include:

  • Increased security budget (44%)
  • Experienced security team members (42%)
  • Better cooperation from other IT teams (42%)
  • Supportive executive team (41%)
  • Fully staffed security team (39%)

All employees, from the CEO to the frontline IT worker, need to feel that they play a significant role in maintaining the security of the company for which they work. Now, more than ever, security teams are being expected to do more with less leading to increasing stress levels. With more organizations operating under remote work conditions, the attack surface has broadened, making security at scale a critical concern. This is a call to action for executives to prioritize alleviating the stress and better support their teams with proper tools, processes, and strategic guidance.

 

– James Carder, CSO and VP LogRhythm Labs

The findings are based on the responses from 308 security professionals and executives from organizations located in North America, South America, Europe, Africa, Asia, and Australia.

 

How IIFL Finance Ensures Cybersecurity for Remote Workers Servicing 2,377 branches

Cybersecurity for remote workers

IIFL Finance is one of the leading players in the Indian financial services industry. The IIFL Group covers multiple markets, including wealth management, home loans, microfinance, and retail banking, and has 2,377 branches in more than 500 cities across India. The business is digital and dynamic. Rather than through acquisition, IIFL aims to grow by identifying opportunities in the market, customizing solutions, and moving quickly. The IIFL Group grew 37% in 2019 compared to 2018. With the onset of the pandemic, IIFL wanted their teams to be able to work from anywhere, at any time securely. It believes all endpoints on the network need to be secure, including the infrastructure of its employees working from home. The Group has a wealth of sensitive personal and financial data. To protect its corporate reputation in the eyes of regulators and customers, IIFL Finance must effectively manage security threats posed to its remote workforce and secure its financial data.

The Group wanted to strengthen cybersecurity for both, on-premises and cloud-based activity, and establish clear visibility of the threat landscape. IIFL Finance knows that the Cloud can help scale up its business quickly and aims to reach its customers through digital channels. But that presents both opportunities and challenges. And it believes that it can counter the challenges by effectively managing the security threats.

To address this requirement, IIFL Finance deployed security solutions from Palo Alto Networks. These solutions have helped IIFL in:

  • Establishing end-to-end threat visibility, from the cloud to on-premises to devices
  • Providing complete protection of applications and workloads in physical data centers, across LAN perimeters, and in multiple public clouds
  • Increasing cloud-native application visibility and control
  • Ensuring scale to accommodate business growth

According to an IIFL spokesperson who led the project, in 2018, the Group started its “security transformation.” The aim was to establish a coherent, long-term strategy that would support business growth and protect against threats. It would need to reflect the themes of cloud and mobility. IIFL conducted proofs of concept (PoCs) against agreed-upon criteria with several vendors. In addition to a PoC, Palo Alto Networks undertook a Security Lifecycle Review (SLR), a unique assessment offering that highlights vulnerabilities within an organization’s existing setup. The SLR identified high-risk applications, susceptibilities, and how the network might cope if traffic were to increase sharply.

“The PoC showed Palo Alto Networks to be way ahead of the others. Its features and functionality suited our growth strategy,” said the IIFL spokesperson. “It was clear Palo Alto Networks would give us scale and visibility.”

The Solution

Palo Alto Networks’ approach, based on the Strata network security suite, includes Next-Generation Firewalls; Panorama network security management for all firewalls — at the perimeter, in the data center, or in the cloud; and the WildFire malware prevention service.

The implementation across the perimeter, data center, and cloud was completed in February 2020, just weeks before the COVID-19 pandemic locked down the Indian economy.

Around half of IIFL employees were already enabled with remote working at that time, and the lockdown required the remainder to be equipped.

Anil Bhasin, Regional Vice President, India & SAARC at Palo Alto Networks, said, “The cybersecurity challenges – handling multiple clients and managing thousands of employees working remotely – that a large financial services company like IIFL face on a daily basis are immense. This has become even more critical in the wake of the current COVID-19 pandemic. We are confident that the dynamic nature of our platform will provide a secure environment for IIFL to safely access remote work capabilities now and in the future.”

IIFL now has clear visibility into its security posture. It is stronger today and more assured of its future. According to an IIFL spokesperson who led the project, the implementation ran smoothly, and Strata has proven no bottleneck to performance.

“Even as more transactions go digital and volumes increase, we’ve seen no downgrade in the experience for those working from home,” the spokesperson added.

Security Transformation at IIFL is not yet completed. However, the pandemic is likely to accelerate and advance IIFL’s roadmap. The spokesperson said IIFL is exploring the Cortex security operations suite by Palo Alto Networks with a view toward faster investigations, fewer alerts, and greater automation.

Cybersecurity for Rmote Workers

In an article written exclusively for CISO MAG, Diego Souza, Global Deputy CISO, Cummins Inc. said, “COVID-19 has not only created a new way to work but it has brought new challenges to the organizations to provide an adequate level of support to its employees aligned with security concerns in how to protect their data and system in this new extended work environment.”

In this article, Souza offers recommendations to security leaders to cope with the new security challenges posed to remote workers.

“Security leaders had to scratch their heads to provide quick security controls to support the business and enable the work from home opportunity,” writes Souza.

Read the complete article here.

Organizations Suffer $3.86 Mn Cost Per Data Breach on Average: Report

BlackMatter Group, Volvo Cars ransomware attack

A global survey on the financial impact of data breaches on organizations by IBM Security revealed that security incidents cost $3.86 million per breach on average for companies. The survey “Cost of a Data Breach Report 2020” stated that around 80% of security incidents resulted in the exposure of customers’ personally identifiable information (PII), which in turn led to huge losses for businesses. It is found that organizations in the U.S. continue to suffer the highest data breach costs in the world, at $8.64 million on average. This is followed by health care providers with the average breach cost at $7.13 million.

Cost of Data Leaks and Misconfigured Clouds

The survey highlights the financial losses that organizations suffer when employees’ sensitive data is compromised.  The stolen or compromised employees’ credentials and cloud misconfigurations were the most common causes of a malicious breach, with nearly 40% of malicious incidents reported in 2019.  Over 8.5 billion records were exposed in 2019, and threat actors used previously exposed emails and passwords in one out of five data breaches.

Attackers used cloud misconfigurations to breach networks nearly 20% of the time, increasing breach costs by more than half a million dollars to $4.41 million on average – making it the third most expensive initial infection vector.

AI and Automation Reduce Costs

The survey revealed a cost-saving difference of $3.58 million for studied companies with fully deployed security automation versus those that have yet to deploy advanced technology, with a cost gap of $2 million, up from $1.55 million in 2018. It is found that artificial intelligence (AI), machine learning, analytics, and other forms of security automation enabled companies to respond to breaches over 27% faster on average, than companies that have yet to deploy security automation. On average companies with no automation takes 74 additional days to identify and contain a breach.

Other Key Findings include:

  • 70% of companies that adopted telework amid the pandemic expect it will exacerbate data breach costs
  • 46% of respondents said the CISO/CSO is ultimately held responsible for the breach, despite only 27% stating the CISO/CSO is the security policy and technology decision-maker. The report found that appointing a CISO was associated with $145,000 cost savings versus the average cost of a breach
  • Organizations with cyber insurance cost on average nearly $200,000 less than the global average of $3.86 million. In fact, of these organizations that used their cyber insurance, 51% applied it to cover third-party consulting fees and legal services, while 36% of organizations used it for victim restitution costs. Only 10% used claims to cover the cost of ransomware or extortion
  • In incidents where attackers accessed corporate networks using stolen or compromised credentials, studied businesses saw nearly $1 million higher data breach costs compared to the global average – reaching $4.77 million per data breach. Exploiting third-party vulnerabilities was the second costliest root cause of malicious breaches ($4.5 million) for this group

Wendi Whitmore, Vice President, IBM X-Force Threat Intelligence, said,  “When it comes to businesses’ ability to mitigate the impact of a data breach, we are beginning to see a clear advantage held by companies that have invested in automated technologies. At a time when businesses are expanding their digital footprint at an accelerated pace and the security industry’s talent shortage persists, teams can be overwhelmed securing more devices, systems, and data. Security automation can help resolve this burden, not only supporting a faster breach response but a more cost-efficient one as well.”

 

Update Now! Dell EMC Releases Patch for iDRAC Path Traversal Vulnerability

Zyxel Devices Vulnerable to Secret Backdoor

Technology giant Dell EMC issued a security patch for a path traversal vulnerability found in the Integrated Dell Remote Access Controller (iDRAC) that could allow threat actors to get full control of server operations. The company urged users to update their devices with the latest firmware to avoid further risks. The vulnerability “CVE-2020-5366,” with a high CVSS rating of 7.1, was discovered by security researchers Georgy Kiguradze and Mark Ermolov from Positive Technologies.

iDRAC is designed for secure local and remote server management and allows IT administrators to deploy, update and monitor Dell EMC PowerEdge servers remotely. The researchers stated that an attacker can exploit this vulnerability to obtain full control of server operation by turning it on or off, as well as changing settings for cooling and power. The path traversal vulnerability is one of the three most common vulnerabilities that enables attackers to view the content of server folders that should not be accessible even to a logged-in ordinary site user.

A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files.

– Dell said in a security advisory.

The vulnerability affects Dell EMC iDRAC9 controllers with firmware versions prior to 4.20.20.20.  To fix the vulnerability, users must install Dell EMC iDRAC9 firmware version 4.20.20.20, close the standard public and private SNMP communities, and use SNMPv3 in accordance with all security guidelines.

Dell EMC also recommended certain security practices for iDRAC use; these include:

  • Place iDRAC on a separate administration network. Do not connect it directly to the internet
  • It is recommended to use a dedicated Gigabit Ethernet port on servers for connecting iDRAC to a separate administration network
  • Along with placing iDRAC on a separate network, companies should isolate the administration network or VLAN (such as with a firewall) and restrict access to the subnet or VLAN to authorized server administrators only
  • Use 256-bit encryption and TLS 1.2 or later
  • It is recommended to use configuration options like IP address range filtering and system lockdown mode
  • Dell EMC recommends additional authentication such as Microsoft Active Directory or LDAP and strongly suggests updating iDRAC firmware

Kiguradze said, “The vulnerability makes it possible to read any file in the controller’s operating system, and in some cases, to interfere with operation of the controller (for instance during reading symbolic Linux devices like /dev/urandom). If attackers obtain the backup of a privileged user, they can block or disrupt the server’s operation. This attack can be performed externally — if an attacker has credentials, perhaps by brute-forcing, although this is unlikely given the product’s anti-brute-forcing protections — or internally, such as with the account of a junior admin with limited access to the server.”

 

Promo.com Data Breach Exposes Gaps in Third-Party Risk Management, Yet Again!

data breach

Promo.com, which is popularly known for its social media ads creation platform, went on record to disclose a data breach incident that compromised nearly 22 million of its user records. As per the initial internal investigation, the source of the data breach is linked to an existing vulnerability in Promo’s unnamed third-party service provider.

Your attack surface is a lot bigger than you think. The Promo breach serves as a reminder of the importance of vetting your third-party partners.

– Justin Heard, Director of Security Intelligence at Nuspire

Things We Know So Far… 

  • Promo.com team became aware of the data breach on July 21, 2020
  • The data breach affected 22.1 million users of both Promo and Slidely
  • A data security vulnerability in a third-party service provider caused the data breach
  • No reports of financial data loss, including credit cards and billing information, were observed as Promo does not store any of this information on its servers
  • The leaked data includes first and last name, email address, IP address, approximate user location based on the IP address, gender, as well as encrypted, hashed, and salted user passwords of Promo and/or Slidely accounts. Promo also informed that some hashed passwords may have been decoded into plain text
  • User login via social media account was not affected
  • Promo has now terminated and removed the third-party service under question
  • They hired an external cybersecurity firm to further reinforce and upgrade their security measures
  • As a precautionary measure, Promo requested all its users to change their passwords at the earliest

Experts Speak 

Although Promo.com, in its FAQ related to the data breach, has stated that it is safe to use the platform post a password reset,  this incident has yet again highlighted the gap and need of paying utmost attention towards third-party risk management.

Talking about the side angle of this attack with Justin Heard, Director of the Security Intelligence and Analytics Team at Nuspire, he pointed out that we often overlook the vulnerabilities in the expanded threat surface, i.e. the third-party services.

Heard said, “Your attack surface is a lot bigger than you think. The Promo breach serves as a reminder of the importance of vetting your third-party partners. If your third-party partners do not have equal or greater security standards, they are a security risk. As your organization grows and scales, so does your list of third-party vendors, and thus, it is in every organization’s best interest to always vet the security of their vendors.”

I recommend employing a layered approach to security. This requires advanced antivirus detection over legacy tools and educating your most important stakeholder in such a business environment – your staff.

– Justin Heard, Director of Security Intelligence at Nuspire

The added, “The overarching issue with third-party security is accountability. If your organization collects customer data or has privileged access, it is your responsibility to keep that data protected and fines should be issued if an organization fails to do so. I recommend employing a layered approach to security. This requires advanced antivirus detection over legacy tools and educating your most important stakeholder in such a business environment – your staff. Train them on what they can do to prevent such security incidents.”

54% of Universities in the U.K. Suffered a Data Breach Last Year

54% of Universities in the U.K. Suffered a Data Breach Last Year, Herff Jones payments card breach

A survey on the state of cybersecurity in the higher education sector, conducted by managed threat detection provider Redscan, revealed that nearly 54% of universities in the U.K. reported a data breach to the Information Commissioner’s Office (ICO) last year.

The survey report titled “The State of Cybersecurity across U.K. Universities”  stated that around 46% of all university staff received no security training and 24% did not commission a penetration test from a third-party. Security training is key to building a safe cyber space however, there is a lack of staff and student awareness about the current threats, such as COVID-19 scams.

Endless Phishing Attacks

Defending against the constant stream of phishing scams remains a challenge for all universities. Several universities receive millions of spam and phishing emails each year, with one institution reporting a high of 130 million. Phishing scams are becoming endless and the volume of attempts has increased by 50% since 2019.

Image Source: Redscan

Other Key Findings include:

  • Universities spend an average of £7,529 (US$ 9,729) per year on security training, with expenditure ranging from £0 to £49,000 (US$ 63,319)
  • Universities employ, on average, three qualified cybersecurity professionals
  • 51% of universities are proactive in providing security training and information to students
  • 12% of universities do not offer any kind of security guidance, support, or training at all to students
  • 66 out of 134 universities have Cyber Essentials or Cyber Essential Plus certification
  • 65% of students say that they would be less likely to apply to a university with a reputation for poor cybersecurity

“Universities are targeted by criminals seeking financial gain, as well as by nation state attackers looking to steal intellectual property. The Redscan report raises concerns that many may not be doing enough to defend against the latest threats, particularly at a time when institutions are embracing remote teaching en masse and conducting world-changing research in relation to COVID-19. The impact of failing to address key security vulnerabilities could be disastrous. State-sponsored espionage has the potential to inflict long-term damage on U.K. universities by deterring funding for research and damaging public perception,” the U.K.’s National Cyber Security Centre (NCSC) said in a statement.

Redscan CTO, Mark Nicholls, said, “The fact that such a large number of universities don’t deliver cybersecurity training to staff and students, nor commission independent penetration testing, is concerning. These are foundational elements of every security program and key to helping prevent data breaches. Even at this time of intense budgetary pressure, institutions need to ensure that their cybersecurity teams receive the support they need to defend against sophisticated adversaries. Breaches have the potential to seriously impact organizations’ reputation and funding. The threat posed to universities by nation state attackers makes the need for improvements even more critical. The cost of failing to protect scientific research is immeasurable.”

 

How Threat Actors Exploited Google Cloud to Launch Phishing Attacks

google cloud

The world today is increasingly digital. And with rapid digital transformation and technology adoption, hackers are misusing the situation with more targeted attacks. A report from cyberthreat intelligence provider Check Point Research stated that threat actors exploited Google Cloud to host malicious payloads and launch phishing attacks.

By Pooja Tikekar, Feature Writer at CISO MAG

The Google Cloud Phishing Journey

  • A PDF was uploaded to Google Drive.
  • The PDF was disguised to resemble a Microsoft SharePoint notice, which contained a link to an MS Access Document.
  • Once clicked, it redirected the user to a phishing page, which was hosted on googleapis.com/asharepoint-unwearied-439052791/index.html.
  • The user was then prompted with a popup to login with their Microsoft Office 365 credentials or organizational e-mail ID and password.
  • Once the login credentials were entered, the user was led to a real PDF report published by renowned global consulting firm. The final PDF left little or no suspicion in the mind of the user because he was tricked into viewing useful information.

Security professionals find it difficult to identify or detect such phishing campaigns as they are hosted on public cloud services.

During all these stages, the user never gets suspicious since the phishing page is hosted on Google Cloud Storage. However, viewing the phishing page’s source code has revealed that most of the resources are loaded from a website that belongs to the attackers, prvtsmtp[.]com:, the report stated.

Image source: Check Point

Investigating prvtsmtp[.]com showed that it resolved to a Ukrainian IP address (31.28.168[.]4). Many other domains related to this phishing attack resolved to the same IP address, or to different ones on the same netblock, the report added.

Google has a zero-day tolerance policy; hence it suspended the phishing URL and all the URLs associated with it. In the past, the hackers used Dropbox and Microsoft Azure to host phishing pages.

Precautionary Measures

To stay protected against phishing attacks, Check Point suggested the following practical precautions:

  • Beware of lookalike domains and double-check spelling errors in emails and websites.
  • Be cautious with files received via email from unknown senders, especially if they prompt for a certain action you would not usually do.
  • Do not click on promotional links or emails. Order goods from authentic sources.
  • Beware of “special” offers. “An exclusive cure for coronavirus for $150” is usually not a reliable or trustworthy purchase opportunity.
  • Do not reuse passwords between different applications and accounts.

About the Author

Pooja Tikekar is a Feature Writer, and part of the editorial team at CISO MAG. She writes news and feature stories on cybersecurity trends.

More from the author.

 

1...186187188...410Page 187 of 410