Home Blog Page 188

Blur or Focus? Malicious Photo Editing Apps Target Android Devices

Mobile Apps Security, mobile apps

The threat intelligence and research team from cybersecurity firm White Ops found a new campaign of malicious photo editing apps on the Google Play Store targeting Android devices with random out-of-context ads. The researchers discovered 29 malicious Android apps in the Play Store with more than  3.5 million downloads.

ChartreuseBlur Analysis

The researchers named their investigation as “ChartreuseBlur,” since a majority of the apps used the word “blur” in their package name. The malicious apps have known to obfuscate the code and escape security detection by making its icon disappear from the device’s home screen shortly after download.

The apps have a three-stage payload evolution. In the first two stages, the app appears normal, but it reveals its malicious activities in the third phase. Once the app is downloaded, it begins attacking the device with unwanted ads.

The researchers stated that they conducted an analysis on one of the apps called Square Photo Blur and found that its features were like that of all apps. The team published a list of malicious applications and recommended users to remove them immediately, if anyone is using them.

How to Identify Malicious Apps

Researchers stated that users should reverse engineer every mobile app before installing it. Here are some questions a user can ask to help identify malicious apps:

  • Do the reviews talk about ads popping up all the time?
  • Do the reviews talk about the app disappearing or being unable to uninstall itself?
  • Do the reviews have a lot of complaints that the app does not work as advertised?
  • Are there a lot of 5-star reviews, but the recent reviews are mostly 1-star?
  • Does the app publisher have a lot of downloads in a very short amount of time?

If the answer is yes to any of the above, then it might be a bogus or malicious app.

Cyberthreats associated with Malicious Apps

Researchers from cybersecurity firm Trend Micro revealed that they have discovered three malicious apps on Google Play, which are designed to compromise victim’s devices and steal information. The three malicious apps, Camero, FileCryptManager, and CallCam, were masked as photography and file manager tools. It’s also observed that the Camero app exploits use-after-free vulnerability CVE-2019-2215 that exists in Binder, an inter-process communication system in Android. By exploiting the CVE-2019-2215 vulnerability, attackers can inject malicious codes and steal information without user knowledge.

 

CISA and NCSC Warn QNAP Users to Upgrade Firmware to Avoid QSnatch Malware Infection

WhisperGate malware campaign, Flagpro malware, MosaicLoader Malware, drinik

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.K.’s National Cyber Security Centre (NCSC) are investigating a data-stealing malware dubbed “QSnatch,” which is targeting Network Attached Storage (NAS) devices manufactured by QNAP (Quality Network Appliance Provider). In a joint security advisory, the agencies stated that the number of QNAP NAS devices infected with the QSnatch malware has reached 62,000 across the globe, of which 7,600 were in the U.S. and 3,900 in the U.K.

Once a device is infected with QSnatch malware, it enables hackers to prevent administrators from installing firmware updates by modifying the system’s host file, redirecting core domain names used by the NAS to local out-of-date versions. According to the advisory, all QNAP NAS devices are potentially vulnerable to QSnatch malware if not updated with the latest security updates. While it is unclear how the malware breaks into vulnerable devices, the agencies urged QNAP device users to upgrade to the latest firmware to prevent malware infection.

Locations of QNAP NAS devices infected by QSnatch are:

Image Source: CISA

“The infection vector has not been identified, but QSnatch appears to be injected into the device firmware during the infection stage, with the malicious code subsequently run within the device, compromising it. The attacker then uses a domain generation algorithm (DGA)—to establish a command and control (C2) channel that periodically generates multiple domain names for use in C2 communications,” the advisory said.

QSnatch Malware Properties

The agencies stated that QSnatch malware contains multiple properties like:

  • CGI password logger – This installs a fake version of the device admin login page, logging successful authentications and passing them to the legitimate login page
  • Credential scraper
  • SSH backdoor – This allows the attacker to execute arbitrary code on a device
  • Exfiltration
  • Webshell functionality for remote access

QSnatch Discovery

CISA and NCSC stated that they first spotted QSnatch malware in two campaigns — one in early 2014 which continued until mid-2017, and in late 2018 that was active till  late 2019. “The two campaigns are distinguished by the initial payload used as well as some differences in capabilities. This alert focuses on the second campaign as it is the most recent threat.  It is important to note that infrastructure used by the malicious cyber actors in both campaigns is not currently active, but the threat remains to unpatched devices,” the advisory added.

Malware Mitigation

CISA and NCSC recommended organizations to follow certain security measures to protect their devices against malware attacks. These include:

  • Organizations need to ensure their devices have not been previously compromised. Organizations that are still running a vulnerable version must run a full factory reset on the device prior to completing the firmware upgrade to ensure the device is not left vulnerable.
  • Verify that you purchased QNAP devices from reputable sources.
  • If sources are in question, run a full factory reset on the device prior to completing the firmware upgrade.
  • Block external connections when the device is intended to be used strictly for internal storage.

 

Good News for SecOps Teams! Mapping Cloud Threats to MITRE ATT&CK Gets Easier

cloud, cloud security

The sudden and accelerated implementation of cloud technology due to the COVID-19 pandemic can be termed as a high-risk proposition. The hurried shift towards new technologies often makes the businesses overlook the security implications and compliances associated with them. Poor configurations also create security gaps. However, cybercriminals are taking advantage of these loopholes and targeting cloud environments with customized malware, ransomware, and other types of cyberattacks.  According to  McAfee’s research, most enterprises face an average of 20 attack attempts per month on their cloud services.

Many SecOps teams leverage repeatable processes and frameworks such as ATT&CK to mitigate risk and respond to threats to their endpoints and networks, but so far cloud threats and vulnerabilities have presented an unfamiliar paradigm.

– Rajiv Gupta, Senior VP and GM, Cloud Security – McAfee

Thus, it is more essential than ever for businesses to arm their SecOps teams with a solution that enables them to manage the ‘n-number’ of security risks impacting their cloud environment. One such solution that helps the SecOps teams in mapping the cloud threats to MITRE ATT&CK, a curated knowledge base and model for noted cyber adversary behavior, is now being provided by McAfee’s MVISION Cloud.

Mapping Cloud Threats to MITRE ATT&CK

McAfee’s MVISION Cloud, a device-to-cloud cybersecurity provider has announced the integration of MITRE ATT&CK into the company’s flagship service. McAfee MVISION Cloud, also known as Cloud Access Security Broker (CASB), claims to deliver an accurate methodology to hunt, detect, and stop cyberattacks on cloud services. Being the first of its kind, this new offering from McAfee gives SecOps teams much-needed direct visibility of the source of cloud vulnerabilities and threats mapped to the tactics and techniques of ATT&CK.

Rajiv Gupta, Senior Vice President and General Manager of Cloud Security, McAfee, said, “Many SecOps teams leverage repeatable processes and frameworks such as ATT&CK to mitigate risk and respond to threats to their endpoints and networks, but so far cloud threats and vulnerabilities have presented an unfamiliar paradigm. By translating cloud threats and vulnerabilities into the common language of ATT&CK, MVISION Cloud allows security teams to extend their processes and run books to the cloud, understand and preemptively respond to cloud vulnerabilities, and improve enterprise security.”

How This Helps SecOps Teams

The ATT&CK integration with McAfee MVISION Cloud has rendered new capabilities to the SecOps teams for mitigating cloud attack risks and vulnerabilities, which include:

  • Moving from a Reactive to Proactive Approach: It allows SecOps teams to visualize not only executed threats in the ATT&CK framework, but also potential attacks that they can stop across multiple Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS) environments.
  • Break Silos: SecOps teams can now bring pre-filtered cloud security incidents into their Security Information Event Management/Security Orchestration, Automation, and Response platforms via API, mapped to the same ATT&CK framework they use for device and network threat investigation.
  • Take Direct Action: Helps in fortifying Cloud Security Posture Management (CSPM) by providing security managers with cloud service configuration recommendations for SaaS, PaaS, and IaaS environments, which address specific ATT&CK adversary techniques.

With the introduction of ATT&CK into McAfee MVISION Cloud, SecOps teams will no longer be required to manually sort and map incidents to a separate framework for cloud threats and vulnerabilities, which can be cumbersome and time-consuming. It provides the security teams with a meaningful tool that enables them to automatically map all their threat incidents to a single framework and maintain a log of the cloud attacks that have been fully executed, and also the ones that are in progress. It also has the ability to combine incidents, anomalies, threats, and vulnerabilities into one holistic, familiar view.

Phishing is the Top Digital Fraud Globally: Report

Phishing Campaign on FINRA

A new research from consumer credit reporting agency TransUnion revealed that phishing is the top digital fraud across the globe related to the COVID-19 pandemic. In its research report “Consumer Financial Hardship Studies” TransUnion stated that 27% of consumers reported that they were hit with COVID-19-themed phishing scams. Nearly, 32% of respondents said they had been targeted by digital fraud related to COVID-19.

“From the impacts of phishing and other well documented COVID-19 scams like unemployment fraud, it’s clear that fraudsters have the data and increasing opportunities to create synthetic identities and utilize stolen identities. Identity fraud is a primary way fraudsters leverage stolen consumer data from phishing and other social engineering schemes. It can have long-term impacts for consumers such as the compromise of multiple online accounts and bringing down credit scores, which we anticipate will increase during pandemic reconstruction,” said Shai Cohen, Senior Vice President of Global Fraud & Identity Solutions at TransUnion.

The Top Global Online COVID-19 Scams Targeting Consumers 

Rankings

Percentage Hit by Scheme
Phishing

27%
Third-party seller scams on legitimate online retail websites

21%
Charity and fundraising scam

19%
Unemployment scam

18%
Fraudulent COVID-19 vaccines, cures, tests, and PPE

15%
Fake insurance

15%
Shipping fraud

14%
Identity theft

14%
Stolen credit card or fraudulent charges

13%
Stimulus check scam

12%
Someone changing your personal or account information via a call center

12%
Account taken over

11%

 

Online COVID-19 Scams Targeting Consumers by Country 

Country Top Fraud Type Percent Targeted by All Digital COVID-19 Fraud

Canada

 Phishing

30%
Colombia

Third-party seller scams on legitimate online retail websites

25%

Hong Kong

 Phishing

37%

South Africa

 Unemployment scam

38%

The U.K.

 Phishing

30%

The U.S.

 Phishing

31%

 

The findings are based on the responses from 7,384 consumers surveyed in Canada, Colombia, Hong Kong, South Africa, the U.K., and the U.S. between June 30 and July 6, 2020.

Bala Kumar, vice president of product management, Global Fraud & Identity Solutions at TransUnion, said, “With successful phishing attacks that have increased during the pandemic, data breaches and social media sharing, consumers should assume their data is on the dark web. Despite these threats, consumers expect that organizations will protect their identities, and enable secure but still convenient digital experiences. TransUnion’s Document Verification solution provides comprehensive consumer-friendly identity verification by triangulating the validity of the document, danger of the device used to capture the document and risk associated with the identity on the document.”

 

Cybercrimes Continue to be a Growing Problem for Older Adults

Senior citizens data

Every year, cybercriminals steal approximately $40 billion from older adults (senior citizens aged 60 and over) in the U.S. Cybercrime can be defined as “any criminal activity in which a computer (or networked device) is targeted and/or used.” Cybercriminals with access to an older adult person’s information via a computer, smartphone, or other networked device, can easily exploit it for nefarious intent, defined as “an act of forcing, compelling, or exerting undue influence over a vulnerable adult causing the vulnerable adult to act in a way that is inconsistent with relevant past behavior or causing the vulnerable adult to perform services for the benefit of another.”

By Yotam Gutman, Director of Marketing, SentinelOne

The scope of bad actors targeting senior citizens can be explained by the lack of experience and skills in using computers/technology among the elderly, against the growing popularity of computer systems held by people of the same age, and the fact that most of them have credit cards.

In the past, people in their 70s and 80s hardly ever used computers. Nowadays, people of the same age have social media accounts, surf the Internet, and of course use smartphones.

Unlike their younger counterparts, seniors are less aware of cyberthreats and, in many cases, lack the tools and experience to identify attacks and fraudulent attempts. Even elderly people with no access to computers or smartphones can fall victim to cyber crimes such as in the case where their personal details have been leaked from a database and sold to criminals who can then exploit. Seniors also give bad actors the highest hit rates from phone phishing scams with frequent attempts being compromise of personal information and news of harm/captivity of the elderly’s children.

Most of the crimes against the adult population use a similar pattern as fraud against the elderly with no connection to computers (such as telemarketing of unnecessary services by highly aggressive sales reps).

The criminals will reach out to those people in a non-suspicious manner – sending a legitimate-looking email, offering to connect on Facebook or by using a legitimate website that offers them some vacation or other prize. The criminals will then try to obtain the details of those people. They will seek credit card and identification details that allow them to use these cards. Another tactic is impersonating a person in need and requesting a transfer of funds.

Recently, the FBI arrested a network of criminals impersonating other people (Captain Garcia of the U.S. military stationed in Syria, for example) who then persuaded their victims – many of whom were elderly – to transfer money to various causes, all of which were fictitious.

Another favorite method of criminals is impersonating “official” entities – government officials, municipalities and various authorities, while exploiting the trust (or innocence) of those veteran citizens and fraudulently obtaining their details.

In addition, this population is exposed to “normal” cybercrime – phishing, infection by malware and theft of personal information. The only difference is that the likelihood of this population recognizing such an attack is extremely slim, as the ability of people in this age group to understand that they have been compromised and to seek assistance is minimal. It should be noted that such attacks can also be carried out against people through their smartphones, which are very popular with this age group. These devices are usually not installed with protection software that could alert the user to malicious websites or warn them of attempts to exfiltrate personal details from the device.

What can be done?

It all starts and ends with education, but this time it is the younger generation which needs to educate their parents. We should remember the warnings they repeatedly told us when we were younger, and echo similar messages back to them, though in a slightly different way:

  • Know your friends and enemies: Research shows that the elderly are oblivious to cyber risks, so it’s worthwhile explaining to them some basic concepts and providing them with some examples of criminal or fraudulent online activities for them to learn from and avoid.
  • Do not open the door to strangers, and do not receive anything from strangers: Any communication from a party that they do not know personally should be treated with caution. It’s wise to assume all profiles on social networks are fake until proven otherwise.
  • Don’t tell anyone any personal information: Even if you are convinced that you are in contact with an official, or a real person – do not provide credit card details, residential address or social security number – certainly not by email or messenger.
  • If there is any suspicion, call “a responsible adult”: if requests are made to provide contact information, it is advisable to consult a person who is well-versed in security to see that the site is genuine. Yes, that person could be your 13-year-old grandson!
  • If something looks too good to be true, it’s probably not true: This old adage is just as true in the online world as it is in the physical world. Resist those tempting offers that pop up while browsing for weird apps that install themselves on the mobile device, and avoid those people who offer big, congested “if only” details or who to send you money.

Conclusion

Unfortunately, today’s elderly will continue to be the victims of cybercrime. This phenomenon will likely become worse before getting better as more elderly dable in technology their generation adopts digital means of payment and banking through smartphones. It will probably take years until the generation who “grew up using computers” come of age, and are immune to such scams with their decades of built-in experience and suspicion of every poor girl from Nigeria who needs a hundred dollars a month to buy dresses for school. Until then, watch out for your parents, and help guard them against those they cannot guard against themselves.

Aspen initiative for protecting older users online-
https://www.aspentechpolicyhub.org/project/protecting-older-users-online/

 

About the Author

Yotam_Gutman_Yotam Gutman is the Director of Marketing at SentinelOne. He has filled several operational, technical, and business positions at defense, HLS, Intelligence, and cybersecurity companies, and provided consulting services for numerous others. Gutman joined SentinelOne 6 months ago to oversee local marketing activities in Israel and contribute to the global content marketing team. He founded and managed the Cybersecurity Marketing Professionals Community, which includes over 300 marketing professionals from more than 170 cyber companies.

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

Patch Now! Hackers Exploiting Cisco’s ASA/FTD Software to Steal Data

Hackers Exploiting Cisco’s ASA/FTD Software to Steal Data

Networking and hardware company Cisco stated that it has become aware of the availability of public exploit code and active exploitation of a high-severity vulnerability in its web services interface,  Adaptive Security Appliance (ASA) and the Firepower Threat Defense (FTD) software. In a security advisory, Cisco stated that the security vulnerability dubbed as “CVE-2020-3452” could allow an unauthenticated, remote attacker to perform directory traversal attacks and steal sensitive data.

“An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device,” Cisco said.

It is found that the vulnerability affects Cisco products if they are running a vulnerable release of Cisco ASA Software or Cisco FTD Software with a vulnerable AnyConnect or WebVPN configuration. The company also confirmed that this vulnerability does not affect Cisco Firepower Management Center (FMC) Software and cannot be used to obtain access to ASA or FTD system files or underlying operating system files. The company has released software updates to fix the vulnerability.

“The attacker can view files within the web services file system only. The web services file system is enabled for the WebVPN and AnyConnect features outlined in the Vulnerable Products section of this advisory; therefore, this vulnerability does not apply to the ASA and FTD system files or underlying operating system (OS) files. The web services files that the attacker can view may have information such as WebVPN configuration, bookmarks, web cookies, partial web content, and HTTP URLs,” the advisory said.

Counterfeit Cisco Switches

Recently, an investigation report from F-Secure revealed a pair of counterfeit network switches  impersonating the  Cisco network switches.   The counterfeit devices, versions of the Cisco Catalyst 2960-X series switches, were designed to bypass authentication processes to system components. According to the investigation, the counterfeit devices did not have any backdoor functionalities, but had the ability to bypass security controls.  The counterfeits were physically and operationally similar to an authentic Cisco switch. Threat actors either invested heavily in imitating Cisco’s original design or had access to proprietary engineering documentation to create fake copy, the report said.

 

Dave’s User Database Available for Free Download on Hacking Forums

data breach

Dave, a digital banking and overdraft protection service provider, confirmed that a data breach incident compromised 7,516,625 of its user details. The leaked data includes personally identifiable information (PII) like names, email IDs, birth dates, physical addresses, and phone numbers. The investigation will be carried out in accordance with FBI’s directives.

Key Highlights of Dave Data Breach

  • The data breach took place through Waydev – a former third-party service provider for Dave.
  • 7,516,625 Dave users were affected due to the data breach.
  • The leaked information included user(s) names, email IDs, birth dates, physical addresses, and phone numbers, and passwords stored in hashed form using bcrypt.
  • No bank account or credit card numbers, records of financial transactions, or unencrypted Social Security numbers (SSN) of its users were compromised.
  • The leaked records were put on the underground forum by a threat actor popularly known as “ShinyHunters”.
  • Dave reported the incident to appropriate law enforcement authorities and is now working with the FBI for further investigations.
  • Dave also onboarded CrowdStrike, to assist in the further investigation as a cybersecurity consultant.
  • All its users will be asked to do a mandatory password reset for their accounts as a precautionary measure.

The First Traces

The leaked information first surfaced when a cybercriminal put a sale advert on an underground forum called RAID. The sale of the entire database was offered for $16,000 (i.e. approximately $470 per record). The ad was later removed, probably due to the successful sale of the leaked database. However, the same database later appeared on other forums but this time as a free download by a notorious threat actor named “ShinyHunters”. This is the same threat actor who is responsible for various other mega hacks and publishing of user records like Tokopedia, Unacademy, Wishbone, and many more.

In a blogpost, Dave informed that it had no evidence of any unauthorized actions taken with any of its user accounts or that any user had experienced any financial loss because of this incident. Dave’s security team quickly secured its systems and has been working around the clock to keep the user accounts safe.

However, this entire incident yet again highlights the limitations and dangers of not having a fully equipped third-party management system, since such data thefts can eventually lead to the downfall of any organization’s cybersecurity posture.

Check this story to know more about “The Role of Third-Party Management in Cybersecurity”

121.4 Million Ransomware Attacks Recorded in the First Half of 2020

Ransomware attacks, LockBit Ransomware

A  survey from cybersecurity firm SonicWall revealed that the opportunistic use of COVID-19 pandemic by cybercriminals has resulted in the rise of ransomware and IoT malware attacks globally. The survey “2020 SonicWall Cyber Threat Report” found that ransomware continues to be the most concerning threat to enterprises and the preferred attack method, with 121.4 million attacks (20% increase) reported globally in the first half of 2020. The threat researchers recorded 79.9 million ransomware attacks (109% increase) in the U.S. and 5.9 million ransomware attacks (6% decline) in the U.K.

Decline in Malware Attacks

The survey also sheds light on the global malware attacks, which saw a declining trend since last year. During the first half of 2020, global malware attacks fell from 4.8 billion to 3.2 billion (-24%) over 2019’s mid-year total. The U.S. (-24%), the U.K. (-27%), Germany (-60%), and India (-64%) encountered reduced malware attack volume. However, ransomware has seen a corresponding jump over the same time period.

Image Source: SonicWall

Changing Attack Landscape

Cybercriminals utilized the global pandemic to launch social-engineered attacks, phishing, and other Coronavirus-related scams. SonicWall researchers detected a surge in scams and exploits specifically based around COVID-19 and noted a 7% increase in COVID-related phishing attempts during the first two quarters.

“COVID-19 phishing began rising in March, and saw its most significant peaks on March 24, April 3 and June 19, 2020. This contrasts with phishing as a whole, which started strong in January and was down slightly globally (-15%) by the time the pandemic phishing attempts began to pick up steam,” the survey stated.

The survey also found a 176% increase in new malware attacks disguised as trusted Microsoft Office file types and 11% of PDF files made up 33% of all newly identified malware in 2020. “Cybercriminals are too sophisticated to use known malware variants, so they’re re-imagining and re-writing malware to defeat security controls like traditional sandboxing techniques — and it’s working,” the survey added.

 IoT Continues to Attract Threat Actors

The researchers found a 50% increase in IoT malware attacks, a number that represents the number of additional smart devices that are connected online as employees and enterprises functioning remotely.

The survey findings are based on the threat intelligence data gathered from 1.1 million sensors in over 215 countries and territories.

Bill Conner, SonicWall President and CEO, said, “Cybercriminals can be resourceful, often setting traps to take advantage of people’s kindness during a natural disaster, panic throughout a crisis and trust in systems used in everyday life. This latest cyber threat data shows that cybercriminals continue to morph their tactics to sway the odds in their favor during uncertain times. With everyone more remote and mobile than ever before, businesses are highly exposed, and the cybercriminal industry is very aware of that. It’s imperative that organizations move away from makeshift or traditional security strategies and realize this new business normal is no longer new.” 

 

India’s First Virtual Awards Show Honoring Excellence in Cybersecurity

2nd edition ciso mag awards

Mumbai, India – July 27, 2020 – Following the huge success of CISO MAG Awards India 2019, EC Council’s CISO MAG is all set to virtually host the 2nd Edition of the CISO MAG Awards and Summit India on  July 30, 2020 from 9:55 AM to 15:00 PM IST. #HyperCyberSec

CISO MAG Awards 2019 was received excellently in the market with support from eminent partners namely SonicWall (Presenting Partner), SearchInform (Gold Partner), Sequretek (Cocktail Partner) and Ola (Mobility Partner) among others. It was graced by illustrious members, associations, and business circles in India.

CISO MAG plans to recreate the same magic, this year, virtually around the central theme ‘Cybersecurity in a Hyper Connected Ecosystem,’ staying true to what the changing times demand.

The 2nd CISO MAG Summit & Awards 2020 – India has been specifically designed to create more awareness on the need for cybersecurity and its related implications across the nation with its major aim to:

  • Promote and highlight professionals and organizations who have demonstrated best practices in the information security arena.
  • Uphold the cybersecurity profession in India region by recognizing innovations and contributions by the professionals and organizations.
  • Ensure fair, transparent, and robust award selection and recognition.

The intent of this event is to help drive innovation, excellence, and a positive change in the Indian security industry by recognizing best-in-class products, companies, and individuals.

This is your annual opportunity to build cross-sector security partnerships, benchmark your company’s digital resilience, and participate in the discussions shaping India’s cybersecurity landscape in 2020 and beyond.

The winners will have exciting reasons to celebrate:

  • Global Exposure – Winners will be featured in CISO MAG magazine under the exclusive India Awards section.
  • Online Promotion – Winners will be promoted on event website and social media.
  • Event Trophy – Winners will receive the coveted CISO MAG trophy
  • Certificate of Acknowledgement
  • Visibility in 20+ Countries

Milind Mungale, Executive Vice President & CISO, NSDL e-Governance Infrastructure Limited; Bharat Anand, CIO & CTO, Ministry of Home Affairs, Government of India; and Durga Prasad Dube, Senior VP and CISO, Reliance Industries Ltd., together form the esteemed Jury overseeing the Awards.

Associate partners for this event include Computer Society of India and Electronic Security Association of India.

Arvind Gupta, Innovation Evangelist, Technology Entrepreneur and Policy Advisor, will open the event with his keynote address. He will share his insights on strategic approaches to accelerate transformation in Cybersecurity in times of COVID-19.

Dr. Pavan Duggal, Advocate, Supreme Court of India and Brijesh Singh, Inspector General, Maharashtra Police, will be addressing the gathering to help reimagine business and reshape the future of work as the world goes digital.

A Panel discussion involving Dr. Balsing Rajput, Superintendent of Police, Maharashtra Cyber Cell, will be hosted on ‘Leveraging analytics to derive a proactive security framework and incident response mechanism to safeguard business continuity.’ 

The event will conclude with a discussion on ‘Fortifying the cybersecurity strategy through comprehensive risk assessments, information sharing and access management protocols.’

Mansi Thapar, Head Information Security, Jaquar Group; Jacxine Fernandez, Vice President & Group Chief Information Security Officer, Adani Group; and Mohd. Shadab Siddiqui, Head of Information Security, Privacy, Trust and Compliance, Hotstar will be a part of this engaging interaction.

You can now register for the event in one step.

Additional details on the CISO MAG Summit and Awards 2020 – India are available at https://events.cisomag.com/E-Events/CISO-MAG-Summit-Awards-2020.html

About CISO MAG

CISO MAG, an EC-Council initiative, is a cybersecurity magazine delivering cutting-edge updates about the latest happenings in the cybersecurity world. It is the handbook for CISOs, CXOs, and every responsible stakeholder of a secure Internet space. More information can be found at https://cisomag.com/

For more information, press only:

Name: Deepali Mistry

Email: [email protected]

Phone: +91-9833151933

 

Update Now! Researchers Find Multiple Bugs in ASUS Routers

MikroTik Devices, ASUS Routers

Security researchers from Trustwave revealed that certain models of ASUS routers are vulnerable to malicious attacks. The bugs in the routers are related to its firmware update process. In a security advisory, the researchers stated that they found security vulnerabilities in the ASUS RT-AC1900P router model of version 3.0.0.4.385_10000-gd8ccd3c. The two vulnerabilities, dubbed CVE-2020-15498 and CVE-2020-15499, in the routers’ firmware could have allowed attackers to perform malicious attacks.

Trustwave researchers said the vulnerability CVE-2020-15498 allows the router to accept forged server certificates for the firmware update. This enables  cybercriminals to launch a man-in-the-middle attack (MITM) using no-check-certificate option passed to the wget tool and later download firmware update files on the router by connecting the device to a malicious network. The vulnerability CVE-2020-15499 shows the firmware release notes dialog in the router management web interface, which is susceptible to cross-site scripting.

“Given that the device accepts forged certificates, an attacker can trick the router to display a message that a new firmware is available when the admin user opens the firmware upgrade page. Furthermore, an attacker can then craft a malicious file containing release notes for the new firmware that will contain arbitrary javascript. Due to cross-site scripting the malicious javascript will be executed when an unsuspecting admin user clicks the release notes link on the firmware upgrade page,” the researchers explained.

Trustwave recommended users to immediately upgrade the router’s firmware to version 3.0.0.4.385_20253 or the latest stable release to avoid any malicious intrusions.

Target on Home Routers

Recently, cybersecurity solutions provider Trend Micro warned users about a new wave of attacks targeting home routers. In its research report “Worm War: The Botnet Battle for IoT Territory,” Trend Micro revealed that cybercriminals are using home routers to build botnets. The research found a surge in cyberattacks by exploiting routers, particularly in Q4 2019. Attackers made brute force log-in attempts against routers by using automated software to try common password combinations. The number of attacks increased from around 23 million in September to nearly 249 million attacks in December 2019. In March 2020, around 194 million brute force login attacks were reported.

 

1...187188189...410Page 188 of 410