Home Blog Page 205

Ransomware Threats Surge by 25% in Q1 2020: Report

Ransomware attacks, LockBit Ransomware

A new report from specialist insurance firm Beazley reported a 25% increase in ransomware attacks in the Q1 of 2020, compared to Q4 of 2019. The “Beazley Breach Insight Report” stated that nearly all businesses reported security incidents during Q1 of 2020. The manufacturing sector reported the highest number of incidents, with a 156% increase in incidents quarter-on-quarter.  Apart from the manufacturing sector,  the most affected sectors continue to be financial services and healthcare, which together accounted to almost 50% of all ransomware attacks reported in Q1 of 2020.

Image Courtesy: www.beazley.com

According to the report, ransomware attacks against vendors and managed service providers (MSPs) continued to be a major security concern in Q1 2020. The attacks against MSPs also affected banks, credit unions, and health care providers.

The COVID-19 Impact

While threat actors focused on COVID-19 related ransomware attacks, business email compromise (BEC)  eased in Q1 2020.

Image Courtesy: www.beazley.com

“While the financial services, health care and retail sectors reported fewer BEC incidents than in Q4, this may prove to be a temporary reprieve tied to behavioral changes amid the response to COVID-19. Employees first adjusting to working from home may have been less responsive to emails generally, and organizations may have been more focused on quickly ramping up remote working capacity than on identifying and reporting BEC incidents,” the report said.

Katherine Keefe, Head of BBR Services, said: “Cybercriminals are preying on people’s heightened anxiety during this pandemic, tricking them into clicking and sharing links that steal information. Also, those working from home may have weaker IT security than corporate networks typically provide. Organizations must ensure their security systems and protocols are up to date and ensure that colleagues working from home are extra vigilant.”

The research findings are based on the number of security incidents reported to Beazley’s in-house breach response team Beazley Breach Response (BBR) Services.

 

Advancing Your Cybersecurity Program Past the Crisis

Harness Your System, Free Decryptor, federal government, cybersecurity

COVID-19 forced enterprises to transition to a distributed, remote workforce almost overnight. As employees brought their offices home, cybersecurity teams had to suddenly adjust their practices and priorities. The security architecture you may have scrambled to build within an unreasonable timeline includes desirable properties you likely were planning to implement anyway. Once you have a chance to strategize, you will be able to use them to advance your cybersecurity program for the long term.

By Lenny Zeltser, CISO at Axonius

The shift from security paradigm grounded in a traditional network perimeter began years ago, driven in part by the popularity of SaaS products, which were easier to deploy and use than the applications that enterprises needed to manage themselves. Cloud computing made it possible to run code away from the local environment and enabled businesses to spend less and move more swiftly. Also, organizations started warming up to the idea of at least some employees working remotely.

So, even before the pandemic, cybersecurity teams needed to start accommodating:

  • Sensitive connections traversing untrusted networks
  • Transactions originating from potentially unmanaged computers
  • Business logic running on infrastructure managed by others
  • Web-based applications provided as a service by third parties

The ruthless fervor of the COVID-19 pandemic did not impose many new cybersecurity requirements. Instead, the sudden dispersal of the employees dramatically accelerated pre-existing trends. That is why many of the security measures you may have rushed to implement will serve you well in the long term.

The challenge is that when rushing to support a suddenly distributed workforce, you may have had to make in-the-moment decisions related to a variety of risks that usually would take months if not years to address:

  • When you cannot trust the network, how can you protect the data from being intercepted or modified?
  • When there is no network perimeter, how can you defend and safely manage your endpoints?
  • When you rely on someone else’s apps and infrastructure, how can you live up to SLAs and track security metrics?
  • When you lack centralized visibility into major aspects of your IT operations, how can you oversee their security and respond to incidents?

Fortunately, there is a security model that offers guidance for addressing such risks. It is called Zero Trust. John Kindervag, who coined this term back in 2010, explains that this paradigm “examines information about the device, its current state, and who is using it” when making security decisions. As described in the recent Zero Trust Architecture document by NIST, the idea is to narrow the sphere of trust from large networks protected by a perimeter to components, such as endpoints and users.

Zero Trust, as NIST puts it, “is a response to enterprise trends that include remote users and cloud-based assets.” This is the very configuration you are supporting due to the pandemic, so even if you weren’t sure how to begin your journey toward Zero Trust, COVID-19 forced you to advance down this path even.

When you get a chance to shift focus from tactical to the strategic planning of your security program, look at Zero Trust guidelines from the sources and people you trust. You will discover that your Zero Trust journey will likely include:

  • Centralizing identity management using a provider that can integrate cloud, SaaS, and on-premise applications.
  • Minimizing reliance on VPNs, so having access to a particular (once-trusted) network doesn’t give the user special privileges.
  • Strengthening your endpoints’ security posture with the help of modern systems management, Mobile Device Management (MDM), and anti-malware tools.
  • Implementing Single Sign-On (SSO) in a way that allows you to make access decisions based on multiple factors, such as the state of the user’s device.
  • Automating user provisioning and de-provisioning based on people’s business needs in a way that incorporates the principle of least privilege.
  • Gathering IT asset data from all components of your heterogeneous environment to maintain asset inventory and identify security gaps.

The business requirements of your organization today–remote workforce, distributed endpoints, heavy reliance on SaaS and cloud services–likely represent the ongoing needs of the enterprise. Take a look at the current state of your crisis-induced cybersecurity program. Decide which aspects of it you want to keep and which you will need to change once you are no longer in crisis mode. Consider using Zero Trust principles as guidelines. You might find that the work you have already done has advanced your program farther than you were expecting.

About the Author

Lenny ZeltserLenny Zeltser is the Chief Information Security Officer at Axonius, a cybersecurity asset management company, tackling foundational IT asset management challenges to dramatically improve organizations’ cybersecurity posture. Previously serving as VP of Product, Zeltser now focuses on protecting the company’s information assets, expanding its security architecture, and advocating a strong security culture to help enable the business. He previously led security product management at Minerva Labs and NCR.

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

60% of Organizations Believe to Likely Suffer Email Borne Attacks

BEC Scammers Exploit Email Auto-Forwarding Rules, FBI warns

A survey from email and data security firm Mimecast revealed that nearly 60% of organizations believe that they will likely suffer from an email-borne attack in the coming year. And 77% of respondents stated that they are introducing a cyber resilience strategy, with 31% of respondents citing data loss; 31% of them stated a decrease in employee productivity, and 29% reported business downtime due to lack of cyber resilience preparedness.

According to the report, “State of Email Security 2020 Report,” domain-spoofing and email-spoofing have become mainstream attack vectors, and 49% reported that they are expecting an increase in web or email spoofing and brand exploitation in the next 12 months. While 84% of respondents feel concerned about an email domain, web domain, brand exploitation, or site spoofing attack.

Old Threats Continue to be a Major Concern

The study also stated that impersonation attacks, phishing attempts, and ransomware continue to be major security concerns, and 72% of respondents reported phishing attacks remained flat or increased in the last 12 months; 74% reported the same about impersonation attacks. “Ransomware also continues to wreak havoc, as just over half of respondents (51%) said ransomware attacks impacted their organization, citing data loss, downtime, financial loss and loss of reputation or trust among customers,” the report said.

Need for Strong Security Awareness

The report highlighted that there is a strong need for a more cyber aware workforce, with 97% of organizations stating that they offer security awareness training to their employees. However, 60% of them reported they have been hit by malicious activity spread from employee to employee.

Joshua Douglas, Vice President of threat intelligence at Mimecast, said, “We are seeing the same threats that organizations have faced for years playing out with tactics matched to world events to evade detection. The increases in remote working due to the global pandemic have only amplified the risks businesses face from these threats, making the need for effective cyber resilience essential. It is likely that cyber resilience strategies are lacking key elements, or do not have any at all, depending on the organization’s maturity in cybersecurity.

“Security leaders need to invest in a strategy that builds resilience moving at the same pace as digital transformation. This means organizations must apply a layered approach to email security, one that consists of attack prevention, security awareness training, roaming web security tied to email efficacy, brand exploitation protection, threat remediation and business continuity,” Douglas added.

The survey report is based on the views of 1,025 global IT decision makers on the present state of cybersecurity.

Dark Basin Hack-For-Hire Group Exposed for Targeting Organizations Globally

Compromised Email Accounts

A hack-for-hire campaign has targeted thousands of users and hundreds of organizations across six continents over the past several years, according to a report from Citizen Lab, a laboratory-based at the Munk School of Global Affairs and Public Policy of the University of Toronto.

Dubbed as “Dark Basin,” Citizen Lab linked the hacker group to an Indian technology firm BellTroX InfoTech Services and related entities. It is found that the group spied on American nonprofits, senior politicians, government prosecutors, CEOs, journalists, and human rights defenders.

Based on its investigation that started in 2017, Citizen Lab discovered around 28,000 shortened URLs containing e-mail addresses of targets.  Dark Basin was Initially suspected as a state-sponsored campaign but was later identified as a hack-for-hire operation. The group is likely behind the commercial espionage on high-profile public events, criminal cases, financial transactions, news stories, advocacy groups,  hedge funds, and multiple industries.

“Over the course of our multi-year investigation, we found that Dark Basin likely conducted commercial espionage on behalf of their clients against opponents involved in high profile public events, criminal cases, financial transactions, news stories, and advocacy,” Citizen Lab said.

Links to Indian Firm

Citizen Lab stressed this cyber-espionage is the work of BellTroX InfoTech Services. Surprisingly, the BellTrox’s director, Sumit Gupta (also known as Sumit Vishnoi), was indicted in 2015 by the U.S. authorities for participating in a similar hack-for-hire scheme, including crimes related to a conspiracy to access the e-mail accounts, Skype accounts, and computers of clients.

“To our knowledge, Gupta was never arrested in relation to the indictment. An aggregator of Indian corporate registration data lists Sumit Gupta as the director of BellTroX, and online postings by a ‘Sumit Vishnoi’ contain references to BellTroX,” Citizen Lab said.

Citizen Lab attributed Dark Basin operations to India as hundreds of phishing emails related to them show timestamps consistent with working hours in India’s time zone (UTC+5:30), and the same timestamps were observed in phishing kit source code that was left open online by the group. Several URL shortening services had names associated with Indian words like Holi, Rongali, and Pochanchi.

Image Courtesy: Citizen Lab

Targeting American Organizations

Dark Basin hacking group targeted American advocacy organizations working on domestic and global issues, including the climate advocacy organizations and net neutrality campaigners. “Dark Basin has a remarkable portfolio of targets, from senior government officials and candidates in multiple countries, to financial services firms such as hedge funds and banks, to pharmaceutical companies,”  Citizen Lab added.

Security pros at CitizenLab discovered a cluster of targeted individuals and organizations that were engaged in environmental issues in the U.S. In 2017, Citizen Lab contacted these organizations, which are linked to the #ExxonKnew campaign, to determine the nature and scope of the attacks.

In 2016, the campaigners of #ExxonKnew were invited to a private meeting via a secret email, which was later leaked to two newspapers. According to Citizen Lab, two recipients of the leaked email were identified as the targets of Dark Basin group. The targeting spiked in February and March 2016, and then in June and July 2017.

Image Courtesy: Citizen Lab

Some other targeted organizations include Rockefeller Family Fund, Climate Investigations Center, Greenpeace, Center for International Environmental Law, Oil Change International, Public Citizen, Conservation Law Foundation, and Union of Concerned Scientists.

“We were able to identify several BellTroX employees whose activities overlapped with Dark Basin because they used personal documents, including a CV, as bait content when testing their URL shorteners. They also made social media posts describing and taking credit for attack techniques containing screenshots of links to Dark Basin infrastructure. BellTroX and its employees appear to use euphemisms for promoting their services online, including ethical hacking and certified ethical hacker,” Citizen Lab said.

Citizen Lab notified hundreds of targeted individuals and organizations and provided with assistance in tracking and identifying the hacking campaign. It also shared its investigation findings with the U.S. Department of Justice (DOJ).

 

Double the Trouble: Nintendo Revises Data Breach Numbers to 300,000

Nintendo data breach, data breach

Japanese consumer electronics and video game giant, Nintendo, had earlier admitted that over 160,000 of its gamers’ accounts had been hacked by cybercriminals. However, further internal investigations have now confirmed that another 140,000 user accounts were compromised, taking the tally to 300,000 affected accounts.

The Nintendo Data Breach

Nintendo has a unique NNID (Nintendo Network ID) for all its users. NNID acts like a user ID, which can be linked to the Nintendo account and used optionally for login purposes. However, the cybercriminals exploited this NNID login system, and illicitly gained access into the Nintendo accounts linked to it. The cybercriminals further had access to users’ nicknames, dates of birth, countries, email addresses, and other information linked to the NNIDs which posed a severe identity theft threat. The worst nightmare, however, came true when some users started reporting suspicious activities on their accounts. One of the users reported, “Someone hacked my PayPal and spent $200 on Nintendo games.”

Even after revising the numbers, Nintendo confirmed that less than 1% of all NNIDs around the world may have been illegally logged in been fraudulently traded.

Nintendo informed its users in an official release that due to the amount of damage caused and as a foot forward in a secure direction it is “now abolishing the function to log in to a Nintendo account via NNID.” As part of additional security measures, Nintendo informed its users of a sequential password reset for all affected NNIDs and Nintendo accounts. It has also urged its users to integrate a two-step verification process and usage of different passwords for all their NNIDs and Nintendo accounts to prevent such mishaps in the future.

It is essential to find and report new threats as users can take further measures to avoid identity theft and subsequent monetary losses.

Facebook Sues Indian Firm for Registering Impostor Domains

facebook - sue/lawsuit

Facebook filed a lawsuit in Virginia against 12 hoax domain names registered by Indian-based proxy service provider Compsys Domain Solutions Private Ltd. The malicious domains spoofed Facebook and its product names to carry out unethical activities.

The social networking giant claimed that imposter domains like facebook-verify-inc.com, instagramhjack.com, and videocall-whatsapp.com were designed to mislead people. Facebook also stressed that registrars and proxy service providers have a responsibility to take down fraudulent and malicious websites.

Christen Dubois, Facebook’s Director and Associate General Counsel of IP Litigation, said, “We regularly scan the internet for domain names and apps that infringe on our trademarks and today’s lawsuit is part of this ongoing effort to protect people from phishing, credential theft and other methods of online fraud. We filed suit after we reached out to Compsys about these domain names and did not receive any response.”

Lawsuits Filed Earlier

This is not the first time Facebook took legal action against imposter domains. Recently, it filed a similar lawsuit against Namecheap,  Arizona-based provider of domain name registrars online, for refusing to cooperate in an investigation to find malicious domains that have been registered through its services. Facebook said that Namecheap impersonated its brand name and refused to share details about the owners of the suspicious domains. Security experts at Facebook tracked down 45 suspicious Facebook lookalike domains that are registered via Namecheap.

Earlier, the Israel-based cyber intelligence firm NSO Group was sued by Facebook for violating the Computer Fraud and Abuse Act. According to the lawsuit filed in the federal court, the NSO Group deployed its custom malware on around 1,400 WhatsApp installed mobile devices in April and May 2019. WhatsApp revealed that it discovered a vulnerability in its network system that allowed hackers to install spyware via an infected WhatsApp voice call. It stated that the spyware can exploit the mobile device, its calls, and texts; it activates the phone’s camera, microphone, and also performs other malicious activities.

 

Unisys Supports Cyber4Healthcare Program to Make Cyberspace More Secure

healthcare cybersecurity, Nucleus:13

Information technology company Unisys Corp. will be supporting CyberPeace Institute’s Cyber4Healthcare initiative to ensure hospitals and health care organizations are protected against the increasing cyberattacks amid the Coronavirus outbreak. The Cyber4Healthcare program is designed to offer free cybersecurity services to health care front-line workers fighting the pandemic.

By Pooja Tikekar, Feature Writer at CISO MAG

The program also calls for a stop to cyberattacks on hospitals, health care and medical research facilities and holds attackers accountable with international law wherever possible.

Unisys will also offer pro bono online consultations to help health care organizations address grave areas of cyber defense such as:

  • How to minimize the effect of ransomware within an organization by leveraging proven strategies like Zero Trust and network architectures like micro-segmentation
  • How to safely extend cyber perimeters to include work-from-home (WFH) with better identity and encryption practices
  • A “spot check” of current cyber risk based on an individual organization’s operational goals

Tom Patterson, Chief Trust Officer, Unisys, said, “We know that adversaries can attack our most critical infrastructures through the click of a single WFH employee. That’s why Unisys will stand with government, industry and academic leaders around the world to safeguard patient data, testing information and intellectual property so that our medical workers on the frontline can focus on delivering care to patients in their hour of need.”

Ransomware Attacks Against Hospitals

INTERPOL issued a warning to hospitals and other organizations on the COVID-19 front line about the surge in ransomware attacks. INTERPOL’s Cybercrime Threat Response team detected that hackers are holding medical institutions hostage and demanding ransom in exchange for access to vital digital files.

WHO Urges Cyber Vigilance

The World Health Organization (WHO) reported a fivefold increase in cyberthreats directed at its staff and the public through email scams. In April, around 450 active WHO email addresses and passwords were leaked online, however, the leaked credentials did not impact the organization as the data was not recent. It stated that cybercriminals are formulating phishing emails in the name of WHO and other regulatory bodies, in an attempt to lure potential victims to give sensitive information, download a malicious attachment, or open a malicious link.

About the Author

Pooja Tikekar is a Feature Writer, and part of the editorial team at CISO MAG. She writes news and feature stories on cybersecurity trends.

More from the author.

 

 

Safeguarding Your Networks and Applications from the Risks of Remote Work with VPNs and RDP

remote desktop protocol (rdp)

With so many employees sheltering in place due to Coronavirus, enterprises with Windows are depending on VPNs and Microsoft’s Remote Desktop Protocol (RDP). However, while this allows employees to access company apps and files, using VPN and RDP surfaces creates other, longer-lasting problems.

By Gil Azrielant, CTO and Co-founder, Axis Security

VPNs are notoriously problematic to begin with, especially when paired with RDP’s security flaws. RDP has numerous known vulnerabilities (CVEs) registered against it. And even with patches, new vulnerabilities continue to emerge.

For an organization to thrive in this environment, they will need to adopt security measures when deploying Microsoft RDP-enabled access widely — ideally without having to constantly upgrade their servers. This is difficult when they have to provide remote access quickly, without the privilege of upgrading software.

How vulnerable is your RDP environment?

For remote workers to do their jobs, they often need to connect to remote workstations, servers or applications within the company. That’s why so many organizations with Windows computers rely on both VPNs to get on the network and Microsoft’s Remote Desktop Protocol (RDP) via the Remote Desktop Connection application to get to a particular machine.

VPN enablement can be painful for both IT and end users. In fact, VPNs can aggravate RDP’s security flaws. While many have patches available, some may not be able to receive upgrades, resulting in untold numbers of vulnerable legacy servers, which may or may not be able to receive upgrades. And even with those patches, RDP vulnerabilities continue to emerge.

Common vulnerabilities and exposures (CVEs) of RDP include BlueKeep, which allows cybercriminals to remotely take over a connected PC. We have listed relevant CVEs at the end of this post. Further, hackers continually use brute force attacks to try to obtain user credentials that have remote desktop access.

We recommend that, when using Microsoft’s RDP, organizations adopt additional security measures. Some are simply procedural. But whatever form they take, they are necessary to keep enterprise data safe.

How to alleviate RDP’s vulnerabilities?

Providing large scale urgent access while keeping users safe is not easy. But new access and security technologies make it possible without fiddling with VPNs or directly upgrading servers. A modern solution that is equipped to handle RDP’s vulnerabilities will provide a layer of security over all managed RDP servers. These solutions will analyze all user requests before they are securely forwarded to the RDP server. This protects the RDP host and its data by acting something like an RDP request broker.

This process of preventing the remote users from touching the applications effectively mitigates all those RDP-related CVE’s below, reducing the application attack surface and minimizing risk.

The most important thing to remember regarding RDP is to never put your RDP servers on the public Internet. Within minutes of public-facing RDP servers going out, they will be scanned, and then every hour numerous connection requests and exploitation attempts will take place. It is impractical that such legacy protocols can be secure on the Internet.

Other important steps that can be taken to protect against RDP vulnerabilities include:

  • Enable network level authentication (NLA)
  • Eliminate network access to the machine
  • Enforce MFA for every login
  • Focus on system patching, with virtual patching being the ideal technique for this
  • Choose and enforce a strict policy

No VPN required, Giving your access and security a boost

The risks of enabling remote access are legitimate concerns for any enterprise. Traditional mitigation techniques, such as upgrading the server operating system, can take time and have cascading consequences. But new technologies are stepping up to improve access security and minimize complexity when it comes to VPNs and server software upgrades.

Here’s a partial list of CVEs related to RDP, which can be mitigated with the right steps taken and the support of the right technologies:

CVE-2019-0708 (BlueKeep) – The exploitation requires the client to bind to a specific channel. Axis security has a whitelist of allowed channels, and the MS_T120 channel is blacklisted.

CVE-2020-0660 – Is caused by insufficient validation of requests, that allow a crafted-malformed request to be sent and crash the system. Malformed packets will never be sent from the Application Access Cloud to your servers, as it validates and disarms every request and response before sending it over.

RDP as implemented in versions of Windows, including Server 2008/12 R2, 7, 8.1, 10, are known vulnerable to exploits described:

CVE-2020-0609 – This vulnerability lies in Windows RD Gateway. We isolate your RD gateway from the internet, so no one can send malicious requests to it. Malformed packets will never be sent from the Application Access Cloud to your servers, as it validates and disarms every request and response before sending it over.

CVE-2020-0610 – This is very similar to the last one. This vulnerability lies in Windows RD Gateway. We isolate your RD gateway from the internet, so no one can send malicious requests to it. Malformed packets will never be sent from the Application Access Cloud to your servers, as it validates and disarms every request and response before sending it over.

CVE-2019-1181 – This vulnerability affects unpatched versions of Windows Server 2008-2019, and Windows 7-10. Our RDP service is not vulnerable to this vulnerability.

CVE-2019-1182 – This vulnerability affects unpatched versions of Windows Server 2008-2019, and Windows 7-10. Our RDP service is not vulnerable to this vulnerability.

CVE-2019-1222 – This vulnerability affects unpatched versions of Windows Server 2016-2019, and Windows 10. Our RDP service is not vulnerable to this vulnerability.

CVE-2019-1226 – This vulnerability affects unpatched versions of Windows Server 2016-2019, and Windows 10. Our RDP service is not vulnerable to this vulnerability.

About the Author

Gil AzrielantGil Azrielant is the Co-founder and CTO of Axis Security. He is responsible for technology strategy and the development of the company’s cloud-based zero-trust application access platform. Gil’s cybersecurity career began in the elite Unit 8200 of the Israeli Army Intelligence Corps, where he worked on advanced cybersecurity and code decryption. He served five years inside this elite unit, working as a researcher and team leader.

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

Open Source Software Flaws Rise by 130% in 2019: RiskSense

microsoft, flaws in SonicWall SRA SMA

A recent study by vulnerability management firm RiskSense revealed that the number of open source software (OSS) vulnerabilities increased in 2019 compared to 2018.

The study titled “The Dark Reality of Open Source” also stated that the total common vulnerabilities and exposures vulnerabilities (CVEs) reached 968 in 2019, up from 421 in 2018, a rise of 130%. It also found that it takes an average of 54 days for OSS vulnerabilities to be added to the National Vulnerability Database (NVD) after public disclosure, thereby leaving organizations exposed to critical application security risks for a long time.

Vulnerabilities in Open Source Projects

According to the study, the OSS projects that had the most number of CVEs were the Jenkins automation server (646) and MySQL (624), each of which had 15 weaponized vulnerabilities. While HashiCorp’s Vagrant only had nine CVEs. Other OSS projects that had vulnerabilities that were trending or popular in real-world attacks included Apache Tomcat, Magento, Kubernetes, Elasticsearch, and JBoss.

RiskSense also stated that cross-site scripting weaknesses are the second most common form of vulnerabilities and the most weaponized ones. In addition, the study revealed that some weaknesses like deserialization issues (28) and code injections (16) were far less common but remained popular in active attack campaigns.

Srinivas Mukkamala, CEO of RiskSense, said, “While open source code is often considered more secure than commercial software since it undergoes crowdsourced reviews to find problems, this study illustrates that OSS vulnerabilities are on the rise and may be a blindspot for many organizations. Since open source is used and reused everywhere today, when vulnerabilities are found, they can have incredibly far-reaching consequences.”

70% Of Mobile and Desktop Apps Contain Open Source Security Flaws

According to Veracode’s annual report, 70% of mobile and desktop applications that are being used today have at least one security flaw which stems from the use of open-source library. The report, “State of Software Security,” revealed that lack of awareness about where and how open-source libraries are being used are major factors in contributing toward security issues. Open-source library is free to use centralized code repositories that provide ready-made applications for developers. These libraries are not only ubiquitous but also risky, the research stressed. The research examined 351,000 external libraries in 85,000 applications and found that these libraries have several security bugs. Even a single bug can affect hundreds of applications.

 

Is There a “SNAKE” Under Honda’s Hood?

Honda, Honda Snake Ransomware attack

Although metamorphically, however, many cybersecurity experts believe that “there is a Snake under Honda’s hood”. Yes, you read it right! Operations of the Japanese automobile giant, Honda, were reportedly disrupted in parts across Europe, Japan, and the U.S. due to Snake ransomware (also known as EKANS).

A report from NBC News stated that the ransomware attack was first discovered in the late hours of Sunday night. Owing to the security crisis, the operations on certain production units of Honda in Europe was put on hold.

Honda Confirms Disruption

Honda’s spokesperson confirmed the security incident but did not exactly mention the type and motive behind the cyberattack. He said, “On Sunday, June 7, Honda experienced a disruption in its computer network that has caused a loss of connectivity. We have canceled some production today (Monday, June 8) and are currently assessing the situation. At this point, there is no effect on either Japanese production or dealer activities, and no customer impact. In Europe, we are investigating to understand the nature of any impact. We can confirm some impact in Europe and are currently investigating the exact nature.”

However, the cybersecurity company Virus Total claimed that it had certain evidence which clearly points out that Honda’s internal server has been encrypted with Snake ransomware and the cybercriminals have demanded a ransom in exchange of the encryption key. At this point, it is unclear as to how many systems were exactly being affected, but Snake ransomware operators are notoriously known to copy critical data before encrypting it for leveraging negotiations with the victim.

Earlier this year, a threat intelligence report from security firm Dragos had uncovered the Snake ransomware targeting industrial control systems (ICS). Researchers said Snake was the first of its kind file-encrypting malware customized to infect the network systems that control operations in manufacturing environments.

While investigating, researchers found a list of command processes linked to ICS operations. This disrupted the ICS processes on victims’ devices and allowed cybercriminals to deploy the ransomware and compromise the targeted devices asking them for a ransom.

1...204205206...410Page 205 of 410