Home Blog Page 248

Philippines Beefs Up Security Protocols to Protect its Energy Sector

The Philippine Government stepped up its efforts to strengthen its cybersecurity landscape, in order to protect its energy sector from foreign intruders. The decision comes in the wake of concerns raised by the country’s lawmakers about the unauthorized access to the country’s power grid by foreign attackers, according to Hermogenes Esperon, the National Security Adviser of Philippines.

Esperon did not specify any foreign entity name, but it’s suspected that the threats to the country’s power grid are likely by state-sponsored attackers from China. It’s also said that a cybersecurity audit team from the National Security Council and the Philippines armed forces are investigating various websites in the country to ensure security against cyberthreats.

Esperon also highlighted, “Allegations that the National Grid can easily be controlled by foreign entities are being taken seriously by the government. The administration is taking steps and precautionary measures to guarantee that the National Grid Corporation of the Philippines, its facilities and infrastructure are protected with the highest security procedures.”

Philippines’ Vulnerability to Cyberattacks

Recently, a research from cybersecurity firm Kaspersky revealed that Philippines registered a total of 3,906,410 cyberthreats in computers of Kaspersky users during Q4 of 2019, which is equivalent to 31.6 percent of the overall. Philippines closely follows Nepal (37.7 percent), Algeria (37.4 percent), Albania (37.3 percent), Belarus (35 percent), Moldova (33.4 percent), and Tunisia (33.4 percent). The data that was collected over a time frame of November 2018 to October 2019, included 203 countries from across the geography.

Philippines also ranked third in the list of most Android mobile malware attacked countries in the South East Asia (SEA) region during the first three quarters of 2019. A total of 134,556 Android malware attacks were recorded, which accounted for 12 percent of total attacks in SEA. Kaspersky data indicated that Android Filipino mobile users are being targeted with the Hiddapp mobile malware, which secretly downloads ads on an infected device and displays them in the maximum number possible to the device user.

Coronavirus Propagates Emotet Malspam Campaign in Japan

malspam campaign

The World Health Organization (WHO.) has declared the outbreak of 2019 Novel Coronavirus (2019-nCoV) a public health emergency of international concern (PHEIC). However, hackers and threat actors are taking huge advantage of the fear and panic the virus has caused. An Emotet malware spam (malspam) campaign, disguised as official notifications related to coronavirus from disability welfare service providers and public health centers, has been observed targeting audiences in Japan including the prefectures of Osaka, Gifu and Totori.

Experts on Emotet Malspam

Analysts from IBM X-Force and Kaspersky along with infosec community experts found that Emotet operators used previously compromised account templates to target potential victims for the Emotet malspam campaign.

According to IBM, the attackers seem to be geo-targeting the email content and language to inflict fear among audiences in these areas, thus, making them more likely to click on the malicious attachment. One of the malspam emails said that the coronavirus had been detected in the Gifu region of Japan, while another mentions Osaka. A few of these emails also have a footer that mentions a legit address, as well as phone and fax numbers of disability welfare service providers and public health centers in the surrounding areas.

How the Japanese Emotet Malspam Works

Each of these malspam emails contains a warning note and call to action for downloading a malicious Word doc attachment (with Emotet malspam), which is said to contain precautionary health measures and latest updates related to coronavirus. On opening the attachment and enabling macros in Office 365, an obfuscated VBA macro script begins running in the background, which further installs a Powershell script and downloads the Emotet malware. The Emotet script also  downloads a few other malicious payloads to extract additional data from the targeted system.

Emotet Malspam Campaign History

Earlier, researchers spotted an Emotet malspam campaign leveraging environmental activist Greta Thunberg’s popularity to infect computers in Europe and Asia. Using Thunberg’s admiration among students, the trojan campaign used the  climate activist’s name to target domains with .com and .edu extensions. Attackers also geotargeted Europe and Asian countries, followed by Australia and the U.S.

According to researchers at Proofpoint and ExecuteMalware, these emails looked just like another invite from Thunberg for a climate change summit or demonstration with email subjects carrying enticing text like “Demonstration 2019” or “I invite you”. The emails also encouraged readers to forward and spread the message to their family and friends.

Why the OSI Model Isn’t Enough for Application Security

Application Security

For modern business, application security is an essential concern. Every company uses a variety of web, software, and mobile applications in order to serve customers and execute internal functions. Unfortunately, far too many of these applications are subject to critical vulnerabilities as a result of insecure coding practices, flaws in third-party libraries, and changes in the cybersecurity threat landscape.

Contributed by John Adams, Chief Executive Officer of Waratek

The effects of web application vulnerabilities have been tumultuous and widespread. We’ve seen huge global corporations fall victim to a single vulnerability with disastrous results. Equifax remains the poster child for application security awareness. The original September 2017 breach occurred when a vulnerability in the Apache Struts tool (used by numerous corporations and government organizations) was compromised by hackers. By the time the breach was discovered, the personal data of 143 million Equifax customers was accessed. A settlement with state and federal investigations could ultimately cost the company as much as US$700 million dollars. Meanwhile, more than 200,000 people have already signed a petition against the deal demanding Equifax face stronger accountability.

Equifax is not the only company to fall victim to a web application vulnerability. The list of victims crosses a wide array of industries including tech, financial and education, among others, with names like Facebook, Capital One and Georgia Tech making headlines for large-scale breaches.

If incidents like this can happen at this level, all businesses should be aware that they too could become victims of an application breach. The warning signs are all there. Research shows that 71 percent of applications in product contains at least one high-severity application flaw, with the average number of high-severity flaws in production applications being five. With numerous glaring vulnerabilities, it’s no wonder that web applications remain the primary target for attackers.

So what can be done to protect businesses from falling victim to web application breaches? Perhaps a new path forward is needed. Current solutions for keeping applications secure have been developed by the network engineering community, not the application engineering community itself. In fact, far too many companies have little or no application security at all—opting instead to deploy network security controls around the application – essentially perimeter protection.

This may be due, in part, because many vendors and companies design their security posture around the Open Standard Interconnection model (OSI) model. Popularized in the mid-’80s by the International Standards Organization (ISO), OSI is a conceptual model to promote interoperability between computing systems. This model sets out a construct of standard network protocols divided into seven layers that still govern how all internal and external networks communicate and function, including how they are secured.

The OSI Networking Model

The OSI networking model describes how applications exchange information over a network by separating these communications into seven different “layers.” While each layer is independently developed, the OSI model anticipates that each layer only communicates with the layer above and below it as information passes through the layers.

According to the OSI model, the seven layers of networking are:

  1. Physical layer: This layer deals with the transmission of electrical signals across different physical devices.
  2. Datalink layer: This layer handles the encoding, decoding, and logical organization of bits into data packets.
  3. Network layer: This layer moves data throughout the network by selecting the appropriate route and forwarding the data.
  4. Transport layer: This layer defines the protocols and port numbers that hosts on the network use to communicate.
  5. Session layer: This layer manages the connection between different systems (known as a session).
  6. Presentation layer: This layer translates data between the application and the network, performing functions such as encryption, compression, and string conversion.
  7. Application layer: This layer specifies how users interact with the data on the network through the form of interfaces and protocols. 

Under the OSI model, Layer Seven puts security closest to the end-user as a transaction begins and ends its journey. While the theory makes sense, the reality is this approach increasingly does not work. When the network packet leaves Layer 7 and enters the application, the source code of the application takes over and this source code is rife with vulnerabilities.

Various network security professionals have suggested adding a Layer 8, 9, or even 10 on top of the existing OSI model. These terms are often used to emphasize the importance of a strong “security culture” at the level of the individual or the organization, as well as the need for compliance with all applicable laws and regulations.

Today’s threat landscape is one of the sophisticated attacks as well as hyperconnected infrastructure and applications, this means that the attack surface has been expanded well beyond the network.

Since the OSI model only allows for network-based security controls, application code like open source libraries, APIs, and business logic are treated as security afterthoughts rather than the root cause of security problems. If organizations use only the OSI model for their security program, they risk building a wall around their proverbial fortress but leaving the front door unlocked.

Layer 8 – Oh, the humanity!

While not official, Layer 8 (and sometimes 9 and 10) is often referred to as the Human Layer. This is the layer where people become part of the communication structure. This layer has been used to reference points of failure that result from people, such as organizational compliance weaknesses or user negligence. While not intentional, layer 8 could also include developers when they mistakenly introduce application vulnerabilities during the development lifecycle.

Without official standards to govern the human element of information security, once data leaves the network, it enters the wild west of application code and business logic. Many companies have traditionally relied on network-based solutions, like web application firewalls (WAFs), to provide protection beyond the network. But in order to protect vulnerable application code, security ultimately needs to be inside the application code itself.

This is where runtime security solutions can automate the safeguarding of applications without the need for human interaction. The purpose of runtime application self-protection (RASP) is to run alongside or better yet, inside the execution of application code.

By offering this ‘in-app’ protection, RASP is capable of defending against threats to the entire application stack: business logic, open-source libraries, third-party frameworks, and even the runtime platform itself. In addition to the added layer of defense for production applications, the close proximately of RASP solutions can also allow users to deploy virtual patches and remediate vulnerabilities that may have been inadvertently introduced during development.

Traditional application security, like the web application firewall, detects attacks by detecting exploits, but accurately blocking them is where it gets tricky since network firewalls can only operate upon network packets with signature-analysis and pattern matching for known payloads.  This leaves application code – the root cause of where the vulnerabilities live – untouched and unaddressed.  When only operating at the network layer, IT teams have to deal with the trade-off between the risk of blocking legitimate traffic or having to manage a flood of erroneous alerts, without actually solving the root cause of their security concerns.

While there may not be a Level 8 in the OSI model yet, security engineers can and should move proactively to protect their enterprise applications by moving protection inside the application code — after all, application code is the last and ultimate line of defense between a cybersecurity thread and a successful exploit.  Fix the code and you fix the vulnerability!

John Adams is the chief executive officer of Waratek. As CEO, John has complete responsibility for developing markets and operating all aspects of the organization’s global business. John has a rich history in security and medical technology with his experience spanning more than two decades. Prior to Waratek, John served as President & COO of SecurAmerica and Chairman & CEO of American Security Programs, leading the company’s expansion into nearly three-dozen new geographic markets and growing the company from 5 employees to over 5,000. In his career, John has also served as SVP N. America for London-based G4S (formerly Securicor) and held senior executive positions at US Surgical Corporation and Medline Industries. John holds an MBA in Healthcare Administration from Webster University and a BS in Business Administration/Accounting from Florida Southern College. 

The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

New York City Partners with Israel-based Firm to Boost Cybersecurity

With an aim to boost cybersecurity for companies and individuals in the region, the New York City recently forged a partnership with Israel-based venture capital firm Jerusalem Venture Partners (JVP) under the Cyber NYC initiative. The US$100 million worth partnership will focus on companies and professionals working in the cybersecurity industry. At present, JVP has raised US$220 million from various investors to invest in cybersecurity firms based in New York City, as per a source.

According to Cyber NYC, the cybersecurity industry will witness around US$1.70 billion investments by the end of 2020, globally. The industry also opens to over 3.5 million security jobs by 2021, with approximately 10,000 security job openings in New York City alone.

Wilson Lin, the head of Cyber NYC, said, “Cybersecurity is continually growing more and more complex, and it is more and more urgent not only for large corporations like banks and large companies, but also for your own personal lives. There are new stories every day, every week about some large credit agency or large hotel chain being hacked. People are continually realizing that we are vulnerable, and a lot of our personal data is at risk.”

Recently, Two senators of New York, Republican NY Senator Phil Boyle and Democrat NY Senator David Carlucci, proposed two bills to ban government agencies and local municipalities from using public money for paying ransomware to cybercriminals.

Apart from ransomware payments, the proposed bills also recommended the creation of a state fund to aid government entities improve their cybersecurity capabilities. Several industry experts opined that this is the first time the state authorities have proposed a law that bans paying the ransom.

“The cybersecurity enhancement fund will make available grants and financial assistance to villages, towns, and cities with a population of one million or less for the purpose of upgrading the cybersecurity of their local government,” the bill stated.

Trello App Exposes Personally Identifiable Information of its Users

Data breach

Craig Jones, global cybersecurity operations director at Sophos, has discovered that Trello, an app used for organizing personalized to-do lists and coordinating team tasks, exposed the personally identifiable information (PII) data of its users who made their Trello boards  “public”.

When the news about office space company Regus exposing employee performance ratings through a public Trello board broke, Jones was quick to analyze the root cause of this expose, being a regular user of the app himself. He found that the default configuration of Trello boards is set to “private”, but many users change this setting to “public”. Once set to the public, all the information available on a user’s Trello board can be viewed by anyone. Search engines such as Google also indexed public Trello boards as these are HTML pages, making it simple for anyone to uncover the boards’ contents using a specialized search called a ‘dork’.

Jones discovered a host of PII data mentioned on the Trello boards including names, emails, dates of birth, ID numbers, bank account information. A company’s HR board contained details such as a job offer to a potential employee, including their salary, bonus and contractual obligations. While researching, Jones also came across an Australian Pub’s Trello board that exposed details of customer fraud, customer Gmail addresses and social media passwords, and API keys.

Knowing the criticality of the vulnerability and acting responsibly, Jones reported his findings to respective companies as well as Trello to reset their App board settings to “private”. He also recommends contacting Google to take down already indexed pages as content remains cached on search engines for a certain time period.

Lack of Security Protection

Earlier, an unprotected AWS S3 database containing personal and private information of British citizens was discovered by security researchers Noam Rotem and Ran Locar of the security firm vpnMentor.

Researchers found no security protection on this AWS database, also known as bucket, and thus were able to see all the files stored in it. The files contained a wide range of PII, including names, addresses, phone numbers, dates of birth, gender, national insurance number–everything that a threat actor requires to complete identity theft, fraud, or any cyberattack targeted towards the user or against him. “It’s everything you need to steal someone’s identity, to open a bank account in their name, or a lot of other malicious things,” the researchers said.

NanoLock Security and KPN Demonstrate Flash-to-Cloud Security for IoT Devices

IoT Connections to Reach 83 Billion by 2024: Report, CISA alerts critical infrastructure, CISA – FBI holiday season alert

Netherlands-based security firm KPN Security and flash-to-cloud protection services provider NanoLock Security jointly demonstrated NanoLock’s security solutions at NLSecur[ID] event. The event witnessed KPN and NanoLock Security’s presentation on how attackers tamper customer electricity usage by breaking into smart meters and how NanoLock’s protection can block and report such attacks.

NanoLock claimed that by using its cyber protection and management, KPN can expand its cybersecurity services to IoT device-level protection, advanced monitoring for products like smart meters, cameras, and other IoT devices. It’s said that NanoLock’s device-level solution protects IoT devices against cyberattacks, extending a powerful flash-to-cloud defense.

Based in the Netherlands, KPN is a telecom and security firm that provides mobile, internet, and television for consumers and enterprises. Sjoerd Hulzinga, IoT Security Product Manager, KPN, said, “IoT connectivity is among the fastest-growing demands from businesses and other customers alike. With NanoLock’s protection, management and monitoring of IoT devices integrated into KPN’s SOC, we will be able to offer our customers a robust cybersecurity solution. This will ensure that as our product and customer ecosystem continue to take hold in the IoT space, we are able to keep them protected from growing cyber threats and vulnerabilities.”

Yoni Kahana, VP Business Development, NanoLock Security, said, “As IoT continues to gain momentum in the telecom and utility industries, we believe that more companies will require new techniques to keep these critical devices and networks safe. By leveraging NanoLock’s solution, KPN customers will be protected from potential cyberattacks and vulnerabilities, and KPN will receive important monitoring analytics and forensic data that can be leveraged to understand trends and prevent the next attack.”

In related news, the U.K. government recently introduced a new legislation to improve security standards of the consumer IoT devices. The law, launched by the Department for Digital, Culture, Media, and Sport (DCMS), will mandate that IoT devices sold in the country must adhere to advanced security standards. The new regulations, jointly developed by DCMS and the National Cyber Security Centre, are intended for companies that manufacture and sell consumer IoT devices.

Infoblox to Host Cybersecurity Roadshow 2020 Across Middle East and Africa

Infoblox, a provider of cloud-managed network services, recently announced that it is hosting a cybersecurity roadshow in five cities across the Middle East and Africa (MEA). The roadshow, which goes by the theme “Take Network Security to the Next Level”, will commence on February 24, 2020, in Amman, Jordan, Johannesburg, and finally conclude on March 11, 2020, in Kuwait. Infoblox provides cloud-based network services to enterprises to manage their evolving network security issues. The company will help regional organizations understand how to improve incident response capabilities at the upcoming roadshow.

Ashraf Sheet, Regional Director MEA at Infoblox said, “Today’s enterprise is truly borderless. The network perimeter is dissolving with digital transformations like SD-WAN, IoT, and hybrid cloud, complicating traditional security approaches. Remote branches are directly connecting to the internet, losing the protection of the full security stack deployed in the data center.”

Sheet also highlighted, “Securing these evolving IT architectures adds to the burden on short-staffed security teams who are already dealing with an overwhelming number of alerts and rigid siloed security tools. What’s needed is a foundational approach that is simple yet pervasive, cost-effective yet powerful and boosts the efficiency of security operations through automation.”

The Middle East cybersecurity market is expected to grow at a compound annual growth rate (CAGR) of 22.5 percent between 2018 and 2024. It’s believed that public and private enterprises in this region are the most targeted verticals by cyberattackers. Hence, it’s important for enterprises in the Middle East to be able to identify security gaps in their systems.

Recently, security researchers from Cisco Talos discovered a new version of Remote Access Trojan named “JhoneRAT” targeted a set of enterprises in the Middle East countries. According to researchers, the Trojan was developed using Python and attacked the victim’s device via malicious Microsoft Office documents. It’s said that JhoneRAT targeted organizations that are based in countries including UAE, Saudi Arabia, Iraq, Libya, Algeria, Egypt, Morocco, Tunisia, Oman, Yemen, Syria, Kuwait, Bahrain, and Lebanon.

AustCyber’s Tasmanian Node Puts Australia on Global Cybersecurity Map

Cryptocurrency scams in Australia

Tasmania’s Cybersecurity Innovation Node, launched in Launceston on January 30, 2020, is the latest addition to AustCyber’s (Australian Cyber Security Growth Network) National Network of Cyber Security Innovation Nodes, which is designed to strengthen and accelerate Australia’s cyber capabilities and technical innovation.

AustCyber is a non-profit organization established by the Australian Government, under its roadmap for growing a cybersecurity sector for Australia at par with its international counterparts. The Tasmanian node now joins five other state and territory nodes in the country. These nodes are bound by bilateral partnerships between AustCyber and Australia’s State and Territory governments. Each node commits to the national priorities, as defined by the AustCyber’s business strategy and Cybersecurity Sector Competitiveness Plan, and is co-funded with AustCyber in its state and territory and primarily focuses on local cybersecurity workforce and business development and challenges, as long as they are not in conflict with national needs.

The guiding principles of AustCyber nodes are:

  • Have a clear and strategic intent
  • Maintain consistency and implement standard operating procedures (SOPs)
  • Make the country’s cybersecurity stance better, faster, and more competitive
  • Help the Australian cybersecurity ecosystem however possible and be open and integrate help from others
  • Encourage diverse thinking and background

Michelle Price, CEO of AustCyber, said, “As a local presence for AustCyber, the Node will ensure Tasmania benefits from the activities outlined in Australia’s Cyber Security Sector Competitiveness Plan, supporting sustained industry growth around servicing domestic cybersecurity needs while exporting capabilities to the world. The Tasmania Node will particularly focus on driving national strategy in the smart cities, Internet of Things (IoT) and marine technology sectors. Growth in the sector locally will attract business investment, create employment opportunities and support Australia’s national security through the development of advanced cybersecurity capability.”

Tasmanian Minister for Science and Technology, Michael Ferguson, was present during the launch event and said that the node would be essential in protecting Tasmania from future cybersecurity threats. “Linking in with national cybersecurity efforts will assist Tasmania to respond more rapidly to the future state, national and international threats, which are expected to become more pervasive in the future,” Ferguson said.

Ransomware Strikes News Monitoring Service Platform TVEyes

ransomware, ryuk ransomware, cox media

TVEyes, a platform for monitoring TV and radio news broadcasts, has taken down its operations due to a ransomware hit. In a tweet, TVEyes confirmed that its core server and engineering workstations in the U.S. were affected by ransomware, causing an outage to operations.

“We are rebuilding the system and expect to have TVEyes back online soon, but do not have an exact ETA. We appreciate your patience and will provide updates as they are available,” the company said in a tweet.

According to TVEyes’ CEO David Ives, the company restored its servers using backup files. Ives also clarified that there is no sign of any data breach. The attack on TVEyes raises severe concerns across the political and industrial sector as most of the high-profile campaigns for presidential elections are using TVEyes services. Apart from political campaigns, TVEyes services are also used by companies like Airbnb, Grubhub, JPMorgan Chase, Make-a-Wish Foundation, and the United Nations.

Multiple security incidents were reported on targeting the U.S. Presidential Elections. Earlier, Microsoft stated that it detected more than 740 intrusion attempts by state-sponsored attackers targeted on the U.S.-based political parties, campaigns, and other democracy-focused organizations, who were subscribed to Microsoft’s AccountGuard service.

The Microsoft AccountGuard provides free cyber threat detection services to election-related candidates, campaigns, and other groups. According to Microsoft, most of the attackers originated from Iran, North Korea, and Russia. The tech giant identified multiple hacker groups named Holmium and Mercury operating from Iran; Thallium operating from North Korea, and Yttrium and Strontium operating from Russia.

“Since the launch of Microsoft AccountGuard, we have uncovered attacks specifically targeting organizations that are fundamental to democracy. We have steadily expanded AccountGuard, our threat notification service for political campaigns, parties, and democracy-focused non-governmental organizations, to include 26 countries across four continents,” Microsoft said.

Over 10 Million Malicious Emails Blocked by British Council in 2019

British Council, the U.K.’s global organization specializing in international cultural and educational opportunities, was hit by over 10 million malicious email attacks in 2019. According to Nimbus Hosting, a web hosting firm based in England, the British Council blocked over 190,155 emails due to suspected malware, which also included Trojan horses and ransomware. It’s said that Nimbus Hosting obtained the information under the Freedom of Information (FOI) Act.

In addition, the British Council also thwarted 14,317 potential phishing campaigns, which are intended to trick users into handing over confidential information. And 10,132,159 emails were diverted as spam emails, which could contain viruses.

Tim Dunton, MD, Nimbus Hosting, urged organizations to follow strong security measures like the British Council did to prevent cyberattacks. Dunton highlighted that “These figures are another reminder that cyber-criminals will continually bombard organizations with scam emails, hoping to trick employees into handing over private data, to breach the organization’s security systems or steal personal information. All it takes is for one hoax email to fall through an email systems’ imperfect filtration system before an organization must face the consequences of a severe breach of customer information.”

Email Attacks on U.K. Firms

Earlier, a survey from the Audit and Consulting firm RSM International in the U.K. revealed that phishing and ransomware attacks were the most reported types of cyberattacks on financial services firms. It’s said that around 819 cyber incidents were reported by financial services firms to the Financial Conduct Authority (FCA) in 2019.  RSM said that Retail Banks were the most frequently affected by cyberattacks (486 security incidents), followed by wholesale financial markets (115 attacks), and retail investment firms (53 incidents). In 2019, financial firms reported around 93 cyberattacks, in which half of these (48 attacks) were phishing attacks while 20 percent (19 attacks) were ransomware attacks.

1...247248249...409Page 248 of 409