Home Blog Page 235

60% of Security Pros Trust Cyberthreat Detections Verified by Humans over AI

Artificial Intelligence, AI, neural, machine learning

WhiteHat Security, an application security provider for enterprises’ businesses and an independent subsidiary of NTT Ltd., stated that over half of organizations globally use artificial intelligence (AI) or machine learning in their security operations, however, 60% of them are more confident in cyberthreat detections verified by humans over AI.

In its research, “AI and Human Element Security Sentiment Study”, WhiteHat Security highlighted the need for security organizations to incorporate both AI- and human-centric offerings, especially in the application security space.

According to research findings, based on the responses of 102 professionals in the cybersecurity industry, 45% of respondents opined that their companies lack a sufficiently staffed cybersecurity team. Over 70% of respondents agreed that AI-based tools made their security teams more efficient by eliminating over 55% of everyday security operations. Incorporating AI tools into security operations decreased employees’ stress levels, according to 40% of respondents. And, 65% claim that AI tools allow them to focus on cyberattack mitigation and preventive measures.

Despite the advantages AI-based technologies offer, the majority of respondents stressed that there are skills and benefits the human element provides cybersecurity teams that AI and machine learning cannot match.

WhiteHat provides services that are required for organizations to secure the entire software lifecycle (SLC) from the development through deployment and operation. Its Application Security Platform technology solutions include Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST). WhiteHat was acquired by end-to-end cybersecurity solutions provider NTT Security last year.

Commenting on the survey results, Anthony Bettini, CTO at WhiteHat Security, said, “With the growing cyberthreat landscape, it is imperative for security tools and organizations to have a combination of both AI and the human element so there can be continuous risk evaluation with verified results. For all its advantages, AI is still heavily reliant on humans to be successful. Human monitoring and continuous input are required if AI software is to successfully learn and adapt. This is why the human element will never be completely eradicated from the security process.”

Microsoft Along with Global Internet and Law Enforcement Agencies Come Together to Disrupt Necurs

Microsoft and its partners across several countries went all guns blazing against the nefarious botnets called Necurs. The infamous Necurs is touted to be the world’s most prolific botnet and has infected more than nine million computers, with victims in nearly every country in the world.

According to Microsoft, the disruption will ensure the criminals behind the Necurs botnet network would no longer be able to use key elements of its infrastructure to execute cyberattacks.

The disruption of Necurs was caused by coordinated legal and technical steps by Microsoft and its partners—a result of eight years of tracking and planning. The Digital Crimes Unit of Microsoft along with other firms in the security community first observed the Necurs botnet in 2012 and witnessed it distribute several forms of malware with the most infamous one being the GameOver Zeus banking trojan. The researches also observed that, during a 58-day period in investigation, Necurs-infected computer sent a total of 3.8 million spam emails to over 40.6 million potential victims.

Believed to be operated by Russia-based cybercriminals, Necurs has been used for an array of cybercrime including fake pharmaceutical spam email, online dating scams among several others. Apart from this, the botnet is also sold in the black market as part of a botnet-for-hire service.

The disruption took place after a U.S. District Court for the Eastern District of New York issued an order enabling Microsoft to take control of Necurs infrastructure. Following which, Microsoft analyzed a technique used by Necurs to systematically generate new domains through an algorithm.

“We were then able to accurately predict over six million unique domains that would be created in the next 25 months. Microsoft reported these domains to their respective registries in countries around the world so the websites could be blocked and thus prevented from becoming part of the Necurs infrastructure. By taking control of existing websites and inhibiting the ability to register new ones, we have significantly disrupted the botnet,” Tom Burt, CVP, Customer Security & Trust, Microsoft wrote in a blog post.

“For this disruption, we are working with ISPs, domain registries, government CERTs and law enforcement in Mexico, Colombia, Taiwan, India, Japan, France, Spain, Poland and Romania, among others. Each of us has a critical role to play in protecting customers and keeping the internet safe,” Tom added.

Countering Necurs in India

The breakdown by countries for the first seven days of March 2020 showed 13.59% of the distinct infected IP addresses coming only from India. India is also home to one of the largest number of super-nodes, also known as P2P (peer-to-peer) communication channels, which is created by cybercriminals in order to prevent botnet disruption by law enforcement, network operators and researchers.

In India, the Microsoft Digital Crimes Unit partnered with the Computer Emergency Response Team (CERT-IN) and National Internet Exchange of India (NIXI) to disrupt cyberattacks led by the botnet. This effort prevented the criminals behind Necurs from registering new domains to execute attacks in the future in India.

Avast Says 72% of Mobile Malware is Due to Adware

Malware and Vulnerability Trends Report, Mobile malware threats

Avast, a provider of digital security products, revealed that Adware (advertising-supported software) is responsible for 72% of all mobile malware and the remaining 28% related to banking trojans, fake apps, lockers, and downloaders. Adware is a kind of software that hijacks mobile devices to spam the victim with unwanted ads.

Threat intelligence team from Avast stated that Android adware is a rising issue with its number increased by 38% in the past year alone. According to Avast, Adware disguises itself in the form of gaming and entertainment apps to infect the devices when a user clicks on ads. These apps appear genuine while installing, but once opened, they start spamming the user with ads (mostly with malicious content). This happens when a user downloads apps that run stealthy activities without the user’s knowledge like downloading an encrypted .dex file in the background of a device.

Avast recommended few tips to help prevent mobile adware attacks, which include:

  • Only download apps from official app stores, like Google Play, as they have security measures in place to check apps before developers upload them, or from the app’s website directly for extra assurance
  • Check app ratings of other users in the store, as it’s still important to watch out for fakes. If an app has few stars and many negative comments, something might be amiss
  • Carefully review the permissions an app requests before downloading an app; if an app requests access to data that it doesn’t need in order to function, it might be fraudulent
  • Check your banking and credit card statements to identify any unauthorized payments. Cybercriminals will select low cost subscriptions so they’re hard to spot
  • Use an antivirus solution on your phone to identify and stop any attempted attacks

Commenting on the findings, Nikolaos Chrysaidos, Head of Mobile Threat Intelligence & Security at Avast, said, “No one likes getting served with incessant ads; they’re often unwanted and can ruin our enjoyment of an app. They could also pose a threat to users as cybercriminals can use them as a backdoor to a device – whether it’s to make money from advertisers or steal your personal information. We’ve been tracking this issue for a number of years and the increased use of mobile devices is likely fueling its growth.”

Johns Joins Parsons’ Cybersecurity Leadership

Cybersecurity technology provider Parsons Corporation named John Johns as vice president account executive of the company’s federal intelligence operating unit under the Parsons’ cyber and intelligence market.

Previously, John served as vice president and account executive in Culmen International and also held various leadership roles at KEYW, SIX3 SYSTEMS, and CACI. He holds more than 25 years of work experience in business development, pipeline development, strategic partnering, and campaign strategy development. In his new position, Johns will lead account management and customer engagement to grow Parsons’ long-standing support to the U.S. Intelligence Community.

Parsons provides next-gen technology to global defense, intelligence, and critical infrastructure markets, with capabilities across cybersecurity, missile defense, space, connected infrastructure, and smart cities.

Commenting on the new appointment, Robert Miller, senior vice president of Parsons’ cyber and intelligence market, said, “John is a proven business executive with total commitment to serving the sophisticated and dynamic technology needs of government agencies charged with national security missions. We will look to John to accelerate our support to the next level, advancing their missions with state-of-the-art technology solutions that deliver insights essential to ensuring strategic advantage.”

6.9 Million Dutch Donors Face Identity Theft Scare

identity theft

Earlier this week, BRIC, an implementing body of the ministry that manages the Dutch donor register, informed Hugo de Jonge, the Dutch Minister of Health, Welfare, and Sport, of the physical loss of two external backup hard drives (HDD). The Minister, in turn, wrote a letter to the Parliament informing them that these hard drives contained 6.9 million donor records registered from 1998 to 2010. The physical loss of these drives has sparked concerns of identity theft among registered Dutch donors.

BRIC began digitizing the donor records in 2011, wherein, the paperwork was replaced by a digital version. The backup of these records is maintained in external HDDs which are kept in a highly secured and guarded vault. BRIC recently started disposing of the paper archive of the Donor Register as part of their physical document clean-up process. The cleanup guidelines suggested to check for a corresponding digitized copy of the donor record and only then proceed with the physical destruction of the paper record.

While doing so, the agency discovered that two backup HDDs were missing from the vault. To make it worse, BRIC’s spokesperson confirmed that the drives were unencrypted. The donor details in these drives include donor details such as first and last name, gender, date of birth, the then-address, organ donation choices, identification numbers and a copy of the user’s signature.

However, BRIC has maintained that the data stored on the drives do not contain “special personal data” as mentioned under GDPR and thus the risk of identity theft is very low. The loss of drive and corresponding Dutch donor records has already been reported to the Dutch Data Protection Authority and, as of now, the investigation revealed no incidents of identity theft.

Researcher Found Malicious “Coronavirus Maps” that Infects and Steals Data

COVID-19 Cyberthreats Spike in India, Brazil, and the U.K.: Google

Cybercriminals never leave an opportunity to exploit any vulnerability or situation to prey on users online. Even, they are taking advantage of the fear and panic caused by the spread of the 2019 Novel Coronavirus (2019-nCoV).

Shai Alfasi, a security researcher at Reason Labs, discovered that threat actors are spreading malware disguised as “Coronavirus map” to steal personal information like usernames, passwords, credit card numbers, and other sensitive information that is stored in the users’ browser. Attackers use the stolen information for illegal activities like gaining access to bank accounts or selling it on the deep web.

Attacking via Malicious Coronavirus Map

Attackers designed multiple websites related to coronavirus information to prompt users to click/download an application to keep updated on the situation. The website displays a map (looks like a genuine one) representing COVID-19 spread. It generates a malicious binary file and installs it on victims’ devices.

AZORult Malware

According to Alfasi, the new malware triggers a malicious software tracked as “AZORult”, which is an information stealer first discovered in 2016. Attackers use AZORult to steal users’ browsing history, cookies, ID/passwords, cryptocurrency, and is also able to download additional malware onto infected devices. Describing AZORult, Alfasi said, “AZORult is commonly sold on Russian underground forums for the purpose of collecting sensitive data from an infected computer. There is also a variant of the AZORult that creates a new, hidden administrator account on the infected machine in order to allow Remote Desktop Protocol (RDP) connections.”

“As the coronavirus continues to spread and more apps and technologies are developed to monitor it, we will likely be seeing an increase in corona malware and corona malware variants well into the foreseeable future,” Alfasi added.

Coronavirus Propagates Emotet Malspam Campaign in Japan

An Emotet malware spam (malspam) campaign, disguised as official notifications related to coronavirus from disability welfare service providers and public health centers was observed targeting audiences in Japan including the prefectures of Osaka, Gifu, and Totori.

Analysts from IBM X-Force and Kaspersky along with infosec community experts found that Emotet operators used previously compromised account templates to target potential victims for the Emotet malspam campaign. According to IBM, the attackers seem to be geo-targeting the email content and language to inflict fear among audiences in these areas, thus, making them more likely to click on the malicious attachment.

EC-Council Hosts Certified Ethical Hacking Bootcamp To Provide State-of-the-Art Cyber Security Education for U.K. University

Certified Ethical Hacker

The two-day Certified Ethical Hacker course will teach attendees how to test for weaknesses in online security systems that could be exploited by malicious hackers. The aim is to ensure teachers at schools, colleges, and universities in the U.K. have the very latest cybersecurity skills and can pass these onto their students.

The course is being organized by EC-Council and the cybersecurity educators’ community organization CISSE UK, in partnership with Northumbria University. It will take place at Northumbria’s award-winning Computer and Information Sciences building this weekend. Northumbria has a strong reputation in the field of cybersecurity and is an academic partner of the EC-Council, as well as an accredited examination center for the Certified Ethical Hacker exam – an internationally recognized qualification. All final year students on Northumbria’s Computer Networks and Cyber Security B.Sc (Hons) degree are given the opportunity to undertake the Certified Ethical Hacker exam, receiving a separate qualification from the EC-Council alongside their degree if successful.

Dr Neil Eliot is a Senior Lecturer within Northumbria’s Department of Computer and Information Sciences and has coordinated the University’s partnership with CISSE and the EC-Council which led to this weekend’s boot camp event. A certified ethical hacker since 2014, Eliot believes giving teachers the latest cybersecurity skills is essential to ensuring students have the skills needed to stay safe in an increasingly digital world. He said, “So much of our lives are conducted online these days, and while this is often more convenient it also means our personal information is at risk from hackers.

“It is vital that we teach young people about the risks of sharing information online, how to spot a potential threat and what to do if they suspect they are being targeted. The best time to do this is while they are studying at school, college, or university, before they enter the world of employment, but this means ensuring their teachers are up to date with the latest cybersecurity developments,” Eliot further added.

Philip Blake, EC-Council Regional Director (Europe), said, “EC-Council’s Academia division strongly believes in supporting faculty, students, and Cybersecurity ecosystems across the world. Groups such as CISSE, in partnership with higher education, industry, and government have also been instrumental in influencing Cybersecurity program expansion and development. In addition to supporting CISSE (USA), EC-Council Academia is now pleased to support CISSE UK as they partner with Northumbria University to implement EC-Council’s tactical Cybersecurity program tracks.”

Dr Charles Clarke of CISSE UK said, “We are delighted to be collaborating with both Northumbria University and EC-Council, on what is a unique and valuable opportunity for academics. The cybersecurity sector evolves both rapidly and continuously, impacting the culture of how this subject is taught and experienced by students in universities. This CEH Weekend Boot Camp at Northumbria University is the first of an anticipated series of such events and is representative of a broader CISSE UK strategy to establish a culture of outstanding, innovative and state-of-the-art cybersecurity education, in the UK.”

Eliot has now applied for grant funding to carry out a survey of teachers at schools, colleges, and universities to find out the level of cybersecurity education currently being provided across the North of England. This will identify gaps in provision, raise awareness of the importance of teaching these skills, and shape the planning of future training events.

Eliot said, “The young people of today are the business owners of tomorrow and it is essential that they understand how to keep their own information, and that of their future customers and employees, safe from malicious hackers. “By understanding the current state of play when it comes to cybersecurity education in schools and colleges, we can suggest improvements and design training which will give teachers and academics the skills required.”

 

SentinelOne Partners with Lenovo for Enhanced ThinkShield Protection

NCSC and Microsoft Cyber Accelerator program

Endpoint protection firm SentinelOne announced a strategic partnership with Lenovo. The California-based company stated the new partnership integrates its autonomous endpoint protection platform with Lenovo’s ThinkShield security portfolio to deliver AI-powered cloud protection, real-time prevention, ActiveEDR, and IoT security.

Founded in 2013, SentinelOne provides autonomous endpoint protection services to organizations to help them prevent, detect, respond, and hunt attacks across all major vectors. The company claims that its security platform is designed to save customers time by applying AI to automatically eliminate threats in real-time for both on-premise and cloud environments.

The partnership enables SentinelOne to become a core component of Lenovo’s ThinkShield security offerings, empowering workstations, servers, cloud workloads, and IoT devices to autonomously defend themselves in real-time.

Speaking on the new partnership, Tomer Weingarten, CEO and Co-founder, SentinelOne, said, “With the leading PC market share, Lenovo is the global choice for enterprise computing and datacenter needs. They need the very best in protection and visibility as their devices are the front lines in the fight against cybercriminals. We are excited to equip Lenovo with technology to deliver a security advantage, hardening endpoints to autonomously prevent, detect, and respond to modern-day risks and threats without impacting device performance.”

“The endpoint has increasingly become the preferred vector of cyberattack; this is especially true as digital transformation continues to accelerate where and how work is done. Inherent to our strategy of ‘Smarter Technology for All’ is secure endpoint solutions. This strategic partnership between Lenovo and SentinelOne means that our enterprise customers can now take advantage of the combined power to deliver industry-leading endpoint protection that leverages true, contextual AI,” said Nima Baiati, global director and GM, Cybersecurity Solutions, Intelligent Devices Group, Lenovo.

Recently, SentinelOne raised US$200 million in Series E funding led by private equity firm Insight Partners along with participation from Tiger Global Management, Qualcomm Ventures LLC, Vista Public Strategies of Vista Equity Partners, and Third Point Ventures. The company stated the new investment will be used to accelerate the company’s next-gen endpoint, cloud, and IoT protection platforms through its autonomous AI mechanism.

Trend Micro Says It Blocked 12.7 Million Email Threats in 2019

Business Email Compromise Attacks

Trend Micro revealed that it thwarted 12.7 million potential email threats for customers leveraging cloud-based email services. In its report, “2019 Cloud App Security Roundup”, Trend Micro stated that more than 11 million of emails threats blocked last year were phishing related. The number of unknown phishing links in these kinds of attacks increased from 9% to 44% in 2019.

The report also highlighted that cybercriminals are getting better at using sophisticated methods to overcome the first layer of defense against Business Email Compromise (BEC) attacks. The number of BEC attacks caught by AI-powered authorship analysis increased from 7% in 2018 to 21% in 2019, according to the report. As of now, Trend Micro blocked around 400,000 attempted BEC attacks, which is 271% more than in 2018.

Trend Micro recommended enterprises to follow certain mitigation steps to defend against email threats, which include:

  • Move away from a single gateway to a multi-layered cloud app security solution
  • Consider sandbox malware analysis, document exploit detection, and file, email, and web reputation technologies to detect malware hidden in Office 365 and PDF documents
  • Enforce consistent data loss prevention (DLP) policies across cloud email and collaboration apps
  • Choose a security partner that can offer seamless integration into their cloud platforms, preserving user and admin functions
  • Develop comprehensive end user awareness and training programs

Wendy Moore, Vice President, product marketing at Trend Micro, said, “Organizations are leveraging the power of SaaS-based applications in greater numbers to drive productivity, cost savings and growth. However, in doing so they may be opening themselves up to risk if they only rely on built-in security. As our report shows, built-in security is not enough on its own to stop today’s cybercriminals. Businesses must take ownership of cloud protection and find a multi-layered third-party solution to enhance their platform’s native security functionality.”

Threat actors using stolen email credentials to breach cloud accounts

Earlier a survey revealed that threat actors used previously stolen login credentials to launch brute-force attacks on high-profile cloud-based business systems that use multi-factor authentication (MFA). According to the research by enterprise security firm Proofpoint, hackers used IMAP-based password spraying attacks to breach Microsoft Office 365 and G Suite accounts which are protected with multi-factor authentication. This technique allows malicious actors to perform credential stuffing attacks to compromise sensitive data.

Securing Email Data When the Office Computer Comes Home

e-mail

The office laptop is finding its way into living rooms and bedrooms, as more organizations allow their employees to work from home. Traveling staff work out of hotel rooms, lobbies, libraries and cafés. In light of the current Coronavirus epidemic, companies are advising their employees to work from home. The laptop is an endpoint to the corporate network. It also holds important data of the organization, and that data may be valued much more than the cost of the laptop. That presents a lot of risks, and the employee needs to be vigilant and take certain precautions. A stolen/misplaced laptop or a malware infection from an insecure home network or public Wi-Fi network can spell doom for the organization. That data could fall into the wrong hands or, if not backed up, could be lost forever.  And tech support may not be immediately available when malware infects or an application gives an error while loading.

By Victor Bobrov, Recovery Toolbox

Microsoft Outlook is one of the most used applications on the office laptop. It’s used for communicating with colleagues and clients. Files are exchanged (as attachments) and meetings are planned. Skype calls can be scheduled through Outlook.

Imagine a day when you are expecting an important email from a client. As usual, you load the Outlook application, and then you are confronted with the following message on the screen:

Outlook data file cannot be accessed.

Or

The operation failed. An object could not be found.

Recovery Toolbox for Outlook

If you go online and scan for this message in support newsgroups, you will see that this issue occurs due to any of the following reasons:

  • OST file corruption (Outlook profile)
  • Incorrect configuration
  • Faulty mail synchronization between the Outlook client (on the laptop) and the  Microsoft Exchange server
  • Slow internet connection
  • Malware attacks

But for now, there’s no tech support person around, and you need to fix this yourself, to check if that important mail has come in.

What does “Outlook data file cannot be accessed” mean? Just because everything looks bad and it is not clear, what should you do with it? As per the error text, it is clear that Outlook is unable to open your mailbox and download the messages to your laptop. The reason itself is not provided, of course. In my case, it is most likely the power outage, but there could be a variety of reasons, from hard drive issues to viruses. By the way, if you suspect a malware infection, it is essential to remove it first. Otherwise, everything could happen again, as soon as you repair Outlook!  Guess what is the best way to restore data? Correct if you said, time-honored backups.

The Solution

You can resolve this problem by using Recovery Toolbox for Outlook and fix the issue in 30 minutes.

The Inbox Repair Tool

In the case of Outlook issues, Microsoft suggests using a free recovery method named Inbox Repair Tool. By the way, there is no need to download it separately, it represents a part of the Microsoft Office package and is installed together with the Outlook email client. Try it, maybe happiness is right there, and it can help you. However, it did not help me. Therefore, I am not going to provide detailed instructions. There are more useful services for email repairing. Most of them have only one disadvantage: the cost. But it is crucial to sort out priorities and think, what is more critical: your mailbox or US$50? That is the cost of a license to use the Recovery Toolbox for Outlook – a third-party tool.

Recovery Toolbox for Outlook

Recovery Toolbox for Outlook

Note that there is no need to purchase the tool right now. Try the free version of Recovery Toolbox for Outlook to evaluate if the recovery is possible at all. When you install it, the application recreates the mailbox structure and allows previewing messages and other objects, without a possibility to save data. This option can save you money and time. For example, there is no need to restore the whole file. It is often enough to open it with Recovery Toolbox for Outlook and make screenshots or written notes of the most critical data: phone numbers, logins, and passwords to access bank accounts or something else of similar importance. You will be asked to pay for this tool if you opt to recreate your mailbox, and save it for a connection to Outlook.

You should perform the steps below:

  1. Download the latest version of Recovery Toolbox for Outlook from the developer website.
  2. Install the program by clicking on the downloaded file.
  3. Use the software shortcut, located on the desktop, to start working.
  4. Choose a mailbox in the Outlook format that shows the following error: “Outlook data file cannot be accessed”.
  5. Perform the restoration of the selected e-mail box and estimate results.
  6. If you have purchased the program, the results can be saved.

In general, Recovery Toolbox for Outlook supports any version of Microsoft Outlook, and it can be installed on any computer running Windows, even without the Internet connection. Moreover, in some cases, the network connection can harm: What else can you do to make sure the application does not send your personal data to somebody else? The best way is to switch OFF all possible connection channels. On the other hand, this option is mostly for paranoiacs because the absence of outgoing traffic from Recovery Toolbox for Outlook can be easily tracked using another method, the firewall, for example.

Recovery Toolbox for Outlook

Online service for recovering Outlook data files

If the license fee (US$50) is beyond your budget, then try the online data recovery service. For US$10 you can recover 1 GB of data. The online email repair service works from any device, not only a PC. You can also upload files from a tablet or a mobile phone. Just make sure the internet connection speed is good enough. The service works as follows:

  1. Open this link https://outlook.recoverytoolbox.com/online/
  2. Search your hard drive and find the required file of *.PST format to upload to the remote site.
  3. Provide an email address and CAPTCHA.
  4. Complete the payment process for using this service.
  5. Download the successfully repaired file.
  6. Connect the file of *.PST extension to Outlook.

Recovery Toolbox for Outlook

Despite all guarantees of privacy and safety offered by the developer, those worried about the confidentiality of their data would hesitate to upload it to an online data recovery service. If that’s the case then download the offline version instead, but you will need to pay the license fee to use it.

For other users, the service is simple and advantageous. Think about the business losses if you are unable to respond to an important email in time. Or you need to connect to a client, but his contacts are stored in the mailbox, and you do not remember them. Or maybe, you need to send some money, but the Internet bank account details are stored in that e-mail box that cannot be opened due to corruption of the OST file.

In such instances, a fee of US$10 or US$50 is negligible.

Some may want to look for another free solution, but that would take some time to discover.

Regardless of whether you opt for a free or paid solution, always make it a practice to backup your Outlook data file (OST).

For more information visit: https://outlook.recoverytoolbox.com/outlook-data-file-cannot-be-accessed.html

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

SPONSORED FEATURE

 

1...234235236...410Page 235 of 410