Home Blog Page 202

83% of Global Enterprises Do Not Have Basic Domain Security Measures

Domain Name Security

A latest research from domain security provider CSC revealed that security gaps in enterprise domain security procedures expose organizations’ networks to cyber risks and vulnerabilities such as domain name system (DNS) hijacking, data fraud, and phishing attacks.

According to the research “2020 Domain Security Report: Forbes Global 2000 Companies”, 83% of global 2000 organizations have not adopted basic domain security practices. It was found that IT, media, and entertainment sectors are implementing sophisticated security measures towards domain security, while industries like materials and real estate are most vulnerable to attacks.

Image Source: CSCDBS

Other notable findings from the research include: 

  • 4 in 5 global 2000 companies are severely at risk and exposed to domain name and DNS hijacking due to a lack of registry locks. Unlocked domains are vulnerable to social engineering tactics, which can lead to unauthorized DNS changes and domain name hijacking.
  • 53% of the Forbes Global 2000 use retail-grade domain registrars, putting them at greater risk for phishing, social engineering, and attacks while complicating compliance demands.
  • Only 20% of global 2000 companies use enterprise-grade DNS hosting. Lack of DNS hosting redundancy and using non-enterprise-level DNS providers poses potential security threats like resiliency to Distributed Denial of Service (DDoS) attacks, as well as downtime, and revenue loss.
  • 97% of the global enterprises do not use DNS security extensions (DNSSEC), which means a majority of companies are prone to cache poisoning attacks. Lack of deployment of DNSSEC leads to vulnerabilities in the DNS, which could include an attacker hijacking any step of the DNS lookup process.
  • Domain-based message authentication, reporting, and conformance (DMARC) use is only at 39% for the global 2000 companies. DMARC is an email validation system designed to protect a company’s email domain from being used for email spoofing, phishing scams, and other cybercrimes.
Image Source: CSCDBS

“These security shortfalls are the direct result of not executing proper domain security techniques. Domain security cannot be an afterthought, and there needs to be a conscious effort to make this an intentional and critical part of every company’s overall cybersecurity posture, especially as criminals evolve their attack methods. As companies move to more online business models, it’s essential to use defense-in-depth practices to proactively manage, secure, and defend the foundational internet-facing components of digital brand presence,” said Mark Calandra, Executive Vice President for CSC.

 

Acronis Appoints Steven McChesney as Chief Marketing Officer

Acronis

Swiss-Singaporean cybersecurity firm Acronis has announced the appointment of industry veteran Steven McChesney as Chief Marketing Officer. In his new role, McChesney will be instrumental in helping Acronis build awareness around the importance of cyber protection, while also spearheading overall marketing strategy for the firm.

McChesney is an industry veteran who has an experience in client-facing roles and served several leadership positions at F5 Networks, Druva, and Visio. He also held roles in Midisoft and Egghead Software.

“I look forward to working closely with the Acronis team on the expansion of a new industry category – cyber protection. It’s clear that traditional backup practices are no longer sufficient, making cyber protection necessary,” said McChesney.

“Steven McChesney will help to extend our global leadership in cyber protection and bring Acronis’ marketing to the next level,” said Acronis Founder and CEO Serguei “SB” Beloussov.

Acronis offers cyber protection, solving safety, accessibility, privacy, authenticity, and security (SAPAS) challenges with innovative backup, disaster recovery, and enterprise file sync and share solutions to enterprises in hybrid cloud environments and on-premises.

Last September, the company secured $147 million in an investment round led by Goldman Sachs reaching to the valuation of over one billion dollars. Serguei Beloussov stated the new proceeds will be used to expand the company’s engineering team, build additional data centers, grow its business reach in North America, and pursue acquisitions.

“In 2018, Acronis achieved 20% business growth, and in 2019 it is on track for over 30% growth with the Acronis Cyber Cloud business growing by over 100%. Recently we announced the Acronis Cyber Platform, enabling third-parties to customize, extend, and integrate our cyber protection solutions to the needs of their customers and partners. The investment round led by Goldman Sachs will help us to fast-track the product development through acquisitions of companies and additional resources, and accelerate the growth.” he said.

Half of Mobile Banking Apps are Vulnerable to Fraud Data Theft

Mobile Banking Apps

A recent study by Positive Technologies revealed that over 50% of mobile banking applications are vulnerable to fraud and data theft due to inadequate security layers. The analysis “Vulnerabilities and threats in Mobile Banking” found that banking apps have several security flaws which can be easily exploited to compromise the app and access sensitive data or commit banking fraud.

The Investigation

Security experts at Positive Technologies investigated 14 banking apps and discovered that 13 apps failed to prevent unauthorized access to user data. The researchers stated that all the 14 apps have coding errors and security flaws and 76% of vulnerabilities can be exploited without physical access to the device. The flaws can allow attackers to perform brute-force attacks, man-in-the-middle schemes, distribution of malware like banking Trojans, etc., according to the report.

Client/Server-Side Vulnerabilities

According to the study, 3% of apps running on Android devices are vulnerable to high client-side attack risks, 40% posed medium threats, and 57% have low risks. Apps running on iOS devices (37%) posed medium risks and 63% had a low risk of client-side attacks. It also found that the majority of flaws were generated from the app’s source code originated from deep linking technology.

“Deep linking is used differently on iOS and Android: Developers on Android have more freedom of implementation. This explains the larger number of vulnerabilities in Android applications compared to iOS,” the report said.

The study also pointed out that 50% of the apps contained high-risk, server-side vulnerabilities related to insufficient authentication errors.

“More than half of mobile banks contain high-risk server-side vulnerabilities – for example, insufficient authentication/authorization, password brute-force, business logic errors. Unauthorized access to applications usually results from authentication and authorization flaws,” the report added.

Fake Banking Apps and Trojans

Recently, the FBI issued a warning about threat actors targeting users with fake banking apps to compromise bank accounts, as more people are using online banking during the Coronavirus pandemic. In an official statement, the FBI stated that online and mobile banking apps witnessed a 50% surge in usage since the beginning of 2020. It is expected that cybercriminals would try to abuse new mobile banking customers through app-based banking trojans and fake banking apps. The FBI advised the public to be cautious while downloading banking apps, as hackers spread fake apps concealing malicious intent in them.

Middle East Cybersecurity Market Worth $29.9 Bn Post COVID-19

Cybersecurity Investment Estimated to Grow up to 6% in 2020

According to a new research, the Middle East cybersecurity pre-COVID-19 market size is estimated to grow from $16.1 billion in 2020 to $28.7 billion by 2025, at a Compound Annual Growth Rate (CAGR) of 12.2%, while the post-COVID-19 market size is projected to grow from $15.6 billion in 2020 to $29.9 billion by 2025, at a CAGR of 13.8%. The research report “Middle East Cybersecurity Market” also revealed that the demand for small and medium enterprises (SMEs) in different industry verticals and countries is expected to grow during the forecast period.

Network Security is the Primary Segment

According to the research, the network security sector is estimated to  have the largest market size post COVID-19. It is found that the evolving vulnerabilities in the networks of the energy and utilities, BFSI, IT and ITeS industry sectors triggered the growth of the Middle East cybersecurity market.

“With the growth of COVID-19-related adaption in remote working practices, the network of enterprises in the Middle East has been jeopardized. Organizations are adopting measures to combat the situation and are collaborating with security vendors to manage the situation effectively,” the report said.

Health Care to Grow at the Highest CAGR

The research also highlighted that the health care sector is expected to contribute to the largest market share and to grow at the highest CAGR from 2019 to 2025, due to the increased security incidents during the pandemic. It will be followed by the government and defense sector, with second-highest CAGR from 2019 to 2025.

“The demand for cybersecurity solutions is rising, as the adoption of these solutions provides advanced protection from cyber threats without affecting the operational efficiency,” the report added.

Cyberattacks on Enterprises in the Middle East

Recently, security researchers from Cisco Talos discovered a new version of Remote Access Trojan named “JhoneRAT”, which targeted a set of enterprises in several Middle East countries including UAE, Saudi Arabia, and Iraq. The Trojan was developed using Python and attacked the victim’s device via malicious Microsoft Office documents.  The researchers advised users to avoid clicking file extensions from unknown sources.

 

Security Never Impedes Innovation but Helps It Move Forward

CISO MAG hosted its latest webinar in the Fireside Chat series with Ajay Kumar, Director of Solutions Engineering at BeyondTrust. The topic for the webinar was “Cybersecurity in Times of Crisis”. Senior leaders and executives from countries like the U.S., the U.K., Canada, Singapore, Philippines, Cambodia, Qatar, Nepal, Saudi Arabia, Italy and even smaller nations like Trinidad and Tobago, Guatemala, and Cote d’Ivoire attended the webinar held on June 17, 2020.

The webinar elaborately discussed how the COVID-19 Pandemic altered the way business was done around the world. With remote workforces operating on unsecured home networks, corporate security teams such as the IT service desk have been struggling to gain control of enabling remote workforce and maintain business productivity.  Kumar highlighted how since the onset of COVID-19 the priorities for CISOs and CIOs have been to enable secure remote access for employees.

When asked has security been causing impediments to the workflow, he said, “Security never impedes innovation but helps it move forward. It is exactly the way brakes function in a car. Brakes in cars are not just to slow the car down or bring it to a halt, but also enable the car to go faster while ensuring safety. This is exactly what security brings to business—it drives the innovation ahead.”

While talking about privileged access, he also stressed about how passwords have been the legacy platform and it is not going away anytime soon.

The Fireside chat also offered strategic insights on how organizations today can empower the remote workforce through the right security tools to maintain business continuity while negating cyber threats.

Kumar said, “For situations like COVID-19, BeyondTrust have secure remote access solutions that can be hosted on cloud as well as on-premises.” He also highlighted how Privileged Remote Access Security from BeyondTrust was designed with security as the key priority while also keeping in mind several compliance norms.

During the webinar the audience also took part three polls following which Kumar later took questions from the audience: You can see the results of the snap polls here:

To his credit, Kumar has over 15 years of experience in cybersecurity, and seven specializing in privileged access and identity access management. Prior to becoming the Director of Solutions Engineering – APJ at BeyondTrust, he was the Regional Technical Sales Leader for over seven years at IBM. He is a trusted cybersecurity advisor to enterprise customers, his experience spans across several industries such as banking, insurance, energy and utilities, in addition to state and federal government.

At BeyondTrust, Kumar heads the regional security engineering department, helping enterprises and government agencies improve their security posture against internal and external threats.

Following the webinar, five lucky participants won the book titled “Identity Attack Vectors: Implementing an Effective Identity and Access Management Solution” written by Morey J. Haber, CTO & CISO of BeyondTrust.

Five lucky attendees who tweeted about the webinar also won a one-year subscription of CISO MAG.

You can watch a recording of the Fireside chat here.

The next in the line is CISO MAG Virtual Series-Virtual Roundtable with Ajay Kumar, Director, Solution Engineering BeyondTrust and Sean Gunasekera, ASEAN Cyber Security Lead, EY. The Virtual Roundtable scheduled for June 24, 2020 will be moderated by Brian Pereira, Principal Editor, CISO MAG. 

Register for the next webinar at https://register.gotowebinar.com/register/1063860370404613135

Through the Fireside Chat series, CISO MAG will be partnering with industry experts and solution providers from across the world to host similar webinars to discuss some of the pressing issues and trends in the cybersecurity. Stay tuned.

 

About BeyondTrust

BeyondTrust is the worldwide leader in Privileged Access Management (PAM), empowering organizations to secure and manage their entire universe of privileges. Our integrated products and platform offer the industry’s most advanced PAM solution, enabling organizations to quickly shrink their attack surface across traditional, cloud and hybrid environments.

The BeyondTrust Universal Privilege Management approach secures and protects privileges across passwords, endpoints, and access, giving organizations the visibility and control they need to reduce risk, achieve compliance, and boost operational performance. We are trusted by 20,000 customers, including 70 percent of the Fortune 500, and a global partner network. Learn more at www.beyondtrust.com.

 

About CISO MAG

CISO MAG is a publication from EC-Council, which provides unbiased and useful information to the professionals working to secure critical sectors. The information security magazine includes news, comprehensive analysis, cutting-edge features, and contributions from thought leaders, that are nothing like the ordinary. Within the first year of launch, the magazine reached a global readership of over 50,000 readers. The magazine also has an Editorial Advisory Board that comprises some of the foremost innovators and thought leaders in the cybersecurity space. Apart from this, CISO MAG also presents a platform that reach out to the cybersecurity professionals across the globe through its Summits and Awards and Power List surveys.

 

About EC-Council

EC-Council, officially incorporated as the International Council of E-Commerce Consultants was formed to create information security training and certification programs to help the very community our connected economy would rely on to save them from a devastating Cyberattack. EC-Council rapidly gained the support of top researchers and subject matter experts around the world and launched its first Information Security Program, the Certified Ethical Hacker. With this ever-growing team of subject matter experts and InfoSec researchers, EC-Council continued to build various standards, certifications and training programs in the electronic commerce and information security space, becoming the largest cybersecurity certification body in the world. Learn more at https://www.eccouncil.org.

Ripple20 Sends Ripples Across Industries with 19 Critical Vulnerabilities

Ripple20

An Israeli security company, JSOF, found 19 critical vulnerabilities in a widely used Transmission Control Protocol/Internet Protocol (TCP/IP) software library developed by an Ohio-based Treck Inc. and named them collectively as Ripple20. Treck is a software solutions provider for IoT devices used across industries and critical infrastructures like power grids, healthcare, automotive, etc. Thus, not fixing these vulnerabilities at the earliest would have been detrimental to the security of these critical infrastructures.

Know what are the Ripple20 Vulnerabilities

Out of the 19 vulnerabilities of Ripple20, four vulnerabilities are rated very critical, with CVSS scores over 9. These vulnerabilities found in the Treck TCP/IP software enable potential threat actors to carry out Remote Code Execution. One of the critical vulnerabilities, recorded under CVE-2020-11901, is in the DNS protocol. If exploited, it would potentially allow threat actors to gain control over devices from outside into the victim’s network perimeter, and even on devices that are not connected to the internet.

The other 15 vulnerabilities have a CVSS score ranging between 3.1 and 8.2, and potential effects ranging from Denial of Service to Remote Code Execution.

As per JSOF’s findings, four of these of Ripple20 vulnerabilities have been closed over the years as part of routine code changes. However, they also noted that it remained open in certain affected devices.

The researchers said, “Ripple20 vulnerabilities are unique both in their widespread effect and impact due to supply chain effect. These vulnerabilities allow attackers to bypass NAT and firewalls and take control of devices undetected, with no user interaction required. This is due to the vulnerabilities being in a low level TCP/IP stack, and the fact that for many of the vulnerabilities, the packets sent are very similar to valid packets, or, in some cases are completely valid packets. This enables the attack to pass as legitimate traffic.”

Here’s a detailed description of the Ripple20’s four most critical vulnerabilities:

CVE ID CVSSv3

Description

Potential Impact

Fixed on Version
CVE-2020-11896 10 This vulnerability can be triggered by sending multiple malformed IPv4 packets to a device supporting IPv4 tunneling. It affects any device running Treck with a specific configuration and allows a stable remote code execution. Remote Code Execution 6.0.1.66

(release 30/03/2020)
CVE-2020-11897 10 This vulnerability can be triggered by sending multiple malformed IPv6 packets to a device. It affects any device running an older version of Treck with IPv6 support, and was previously fixed as a routine code change. It can potentially allow a stable remote code execution. Out-of-Bounds Write 5.0.1.35

(release 04/06/2009)
CVE-2020-11901 9 This vulnerability can be triggered by answering a single DNS request made from the device. It affects any device running Treck with DNS support and can be used to perform Remote Code Execution. This is the most severe of the vulnerabilities despite having a CVSS score of 9.0, due to the fact that DNS requests may leave the network in which the device is located, and a sophisticated attacker may be able to use this vulnerability to take over a device from outside the network through DNS cache poisoning, or other methods. Remote Code Execution 6.0.1.66

(release 03/03/2020)

JSOF reported these issues to Treck who have in return replied positively and collaborated with JSOF researchers in getting the issues fixed. Treck’s affected clients like  Intel, HP, Schneider Electric, Caterpillar, B.Braun, Green Hills, Rockwell Automation, etc. and international bodies like  ICS CERT, CERTCC,  JPCERT/CC, CERT-IL have all acknowledged these critical vulnerabilities and issued respective advisories.

Cybersecurity Exposure Index 2020 Reveals Most Vulnerable Countries

Over 126 Mn People are Victims of Cybercrime Across U.S. and U.K.

A new survey by password security resource PasswordManagers.co revealed the countries that are most and least exposed to cyberattacks. The survey “Cybersecurity Exposure Index (CEI) 2020” analyzed and ranked 108 countries based on their exposure to Trojans, malware, and phishing attacks. It also revealed the level of cybersecurity commitment across Europe, America, Asia-Pacific, and Africa.

According to the report, Finland is the least exposed country to cybercrimes, followed by Denmark, Luxembourg, Australia, and Estonia. Afghanistan topped the list as the most exposed country to cyberattacks, followed by Myanmar, Ethiopia, Palestine, and Venezuela.

The survey measured the cybersecurity exposure score of each country from 0-1 (low-high exposure). It is found that Europe has the lowest exposure score (0.329), followed by North America (0.462). Nearly, 70.73% of European countries are classified in the low and very low exposure groups.

Imagesource: PasswordManagers.co

Africa has the highest exposure score (0.643), with 75% of African countries classified in the high and very high exposure groups. Asia-Pacific accounts for 60% of very high exposure countries globally. Around, 66.67% of North American countries are listed in the moderate, low, and very low exposure groups. 40% of South American countries are classified in the high and very high exposure groups, with the highest proportion of countries classified in the moderate exposure group (50%).

Imagesource: PasswordManagers.co

Commenting on the report, Josh Frisby, Founder of PasswordManagers.co said, “As each country begins to adapt to a new, unprecedented, post-COVID 19 world, cybersecurity becomes increasingly imperative to secure digital infrastructures. We’ve compiled data of five of the most significant types of end-point and cloud cyberattacks alongside the level of commitment to cybersecurity across 108 countries.”

“Cybersecurity is imperative to secure digital infrastructures, devices, and identities, and while some countries may be more exposed than others, the commitment to protect against cybercrime should dominate the priorities of every organization and individual. Depending on where you reside, you may be more or less exposed to cybercrime but, by taking the appropriate steps, such as using a password manager to securely store your credentials, browsing the web via a VPN when using unsecured public Wi-Fi, and employing security software, you substantially increase your protection against cyberattacks,” Frisby added.

 

86% of Security Pros Says Common Attacks Rose During COVID-19

remote working, cyberattacks on remote workforce

A new survey from Bitdefender revealed that 50% of infosec professionals did not have a contingency plan to face a situation like the COVID-19 pandemic. The survey “The Indelible Impact of COVID-19 on Cybersecurity” stated that lack of forward planning from organizations resulted in a surge of cyberthreats, with 86% of infosec professionals admitting that attacks in the most common attack vectors were on the rise during the pandemic.

“Cyberwarfare and IoT as an attack vector were reported to be up by 38%, and APTs and cyber espionage IP theft and social media threats/chatbots by 37% — all of which could be an indication of a bumper year for breaches,” the report said.

According to the report, 81% of security professionals believed that COVID-19 will change the regular business operations. The survey found that phishing attacks (26%), ransomware (22%), social media threats/chatbots (21%), cyberwarfare (20%), Trojans (20%), and supply chain attacks (19%), rose during the pandemic. 1 in 3 (34%) of respondents said that they fear that employees are feeling more relaxed about security issues because of their surroundings. Nearly, 33% of respondents reported that employees not sticking to protocol, especially in terms of identifying and flagging suspicious activities.

While 33% of respondents are concerned about their colleagues may fall prey to attacks, 31% cited that the heightened risk of a data breach was caused by unsuspecting employees. 25% of respondents were worried about bad actors targeting remote workforce with malware and ransomware attacks.

Industries Under Attacks

According to the report, the financial services (43%), health care (including tele medicine) 34%, and the public sector (29%) are the hardest hit industries during COVID-19 outbreak, followed by retail (22%), energy (20%), and education (18%). Around 77% of infosec professionals believed that health care was not effectively prepared due to budget constraints.

Liviu Arsene, Global Cybersecurity Researcher at Bitdefender, said, “At least half of organizations admitted they were not prepared for a scenario such as this, whereas the attackers are seizing the opportunity. But within the current situation there is a great opportunity for positive change in cybersecurity. In cybersecurity with high stakes around monetary and reputational loss the ability to change, and change rapidly, without increasing risk is critical. With COVID-19 changing the business landscape for the foreseeable future security strategy has to change. The good news is that the majority of infosec professionals have recognized this need for rapid change, although forced by current by circumstances, and have started taking action.”

 

Dropbox Drops a Box of Security Surprises for its Premium Customers

dropbox

With the lines between work and home blurring due to the ongoing forced remote work, Dropbox has now decided to introduce additional security measures and other features for its premium customers who are stuck at their home desks. The beta version of this update is already released; however, the final version will be rolled out soon in the coming weeks.

Dropbox is traditionally a data and file storage, sharing and collaboration platform which offers solutions for both home and work users. It follows a subscription-based model called the Dropbox Plus, which charges a mere premium of $9.99 per month for 2TB worth storage space.

Based on the type of user, Dropbox Plus has two product offerings – Home and Work – with different features and capabilities. Here are the new security features for the two modules:

For Home Users

  • Dropbox Passwords: We are quite familiar with the “Remember Password?” option that pops-up on the screen while logging into any website or web applications. If you click “Yes,” it simply remembers it and fills it in the next time you visit the same website. Dropbox Passwords does the same thing. It allows a seamless login process for websites and apps by storing their passwords and syncing them across the user’s various devices with zero-knowledge encryption (Single Sign-On).
  • Dropbox Vault: It allows the user to secure and organize documents and permits exclusive emergency access rights only to select friends or family members. Additionally, the Vault has a secure 6-digit PIN over and above the existing security features.
  • Backup: Now, Dropbox also automatically backs up users’ Mac or PC folders to Dropbox for enabling them secure access on-the-go. This feature is also helpful in data restoration in case of data loss due to hardware or OS failure.

For Office Users

  • HelloSign eSignature: Dropbox acquired HelloSign last year and this feature is proof of their collaborative work. This eSignature has been introduced as an embedded feature and has been set by default for Dropbox. It enables Dropbox users to securely send, sign, and store their confidential documents without leaving Dropbox. This functionality will be available to private beta users shortly and will become available to all users in the next month.
  • Dropbox App Center: For Dropbox users, connecting to Zoom, Slack, and Google is now just a few clicks away. The App Center is a centralized repository that is currently available to a subset of users in beta with 40+ integrated partners.

Foodora Data Breach Impacts 727,000 Customers Across 14 Countries

Foodora Data Breach

Food delivery firm Foodora is a victim of a data breach that exposed more than 727,000 customers’ details from 14 countries across Europe including France, Finland, Austria, Spain, and Italy. The exposed data included usernames, phone numbers, addresses, full names, locations, and hashed passwords of Foodora customers. However, payment information or credit card details are not breached in the incident, according to Databreachtoday report.

Delivery Hero, the parent company of Foodora, stated that unknown members posted the leaked customers’ data on various hacking forums. The data was dumped in a series of SQL files for each country, labelled as “CustomerAddress” and “Customers.” The affected customers are getting suspicious emails from unknown third parties, the company said.

Image Courtesy: Databreachtoday

“Unfortunately, we can confirm that a data breach has been identified concerning personal data dating back to 2016. The data originates from some countries across our current and previous markets. We started a thorough internal investigation and have informed all relevant authorities. We are working closely with our security and data protection teams, as well as local authorities, to identify what caused the breach and inform the affected parties,” Delivery Hero said in a statement.

In addition, Troy Hunt, data breach expert and the creator of Have I Been Pwned data breach notification service, tweeted, “Foodora had 583k unique customers exposed in 2016. Data included names, delivery addresses, phone numbers and passwords stored as either salted MD5 or bcrypt. 73% were already in @haveibeenpwned.”

Cyberattacks on Food Delivery Services

Multiple security incidents have been reported on food delivery service providers globally. In a recent incident, threat actors launched a distributed denial-of-service (DDoS) attack on Germany-based food delivery firm Takeaway.com (Liefrando.de). Attackers demanded two Bitcoins (around US$11,000) in ransom to stop the attack. Earlier, DoorDash, a San Francisco-based food-delivery service provider, faced a massive data breach that affected data of around 4.9 million people (its customers, delivery workers, and merchants), who were using its service platform. The company said that an unauthorized third-party accessed its user data on May 4, 2019. DoorDash clarified that users who joined its services platform on or before April 5, 2018, were affected in the incident.

 

1...201202203...410Page 202 of 410