Home Blog Page 256

CRITICALSTART Partners with SentinelOne for Endpoint Protection

Collaboration, partnership, alliance, KnowBe4 and Agari Partner to Prevent Identity-Based Email Attacks

CRITICALSTART, a provider of managed detection and response (MDR) services, recently partnered with endpoint protection firm SentinelOne to jointly develop next-generation endpoint, cloud, and IoT protection security solutions.

Founded in 2013, SentinelOne provides autonomous endpoint protection services to organizations to help them prevent, detect, respond, and hunt attacks across all major vectors. The company claims that its security platform is designed to save customers time by applying AI to automatically eliminate threats in real-time for both on-premise and cloud environments.

CRITICALSTART helps enterprises protect their data systems while reducing their security risks. The company offers a set of security solutions from the delivery of managed security services to security-readiness assessments like the defendable network, professional services, and product fulfillment.

Commenting on the new partnership deal, Randy Watkins, CTO of CRITICALSTART, said,  “We selected SentinelOne due to its efficacy, ease of management, and breadth of EDR capabilities. Additionally, our partnership helps address the growing headcount shortage by giving organizations the resources they need to secure their operations.”

Phishing Scam Affects Texas-Based School District

phishing campaign, Smishing attacks

The Manor Independent School District (MISD) in Texas is facing a loss of US$2.3 million after falling victim to a phishing attack. The phishing scam came to light after a school district employee discovered the issue in December 2019 and reported it to the police.

MISD’s notice didn’t reveal any information about the incident. However, in a notice published on Twitter, the MISD stated that the Manor Police Department and FBI are investigating the incident.  Anne Lopez, a detective with the Manor Police Department, disclosed a few details about the phishing attack to news outlet KVUE.

Lopez said, “It was three separate transactions. Unfortunately, they didn’t recognize the fact that the bank account information had been changed and they sent three separate transactions over the course of a month before it was recognized that it was a fraudulent bank account. So I think it’s important that any email you get, any phone call you get, that you question everything and make sure you know who you’re talking to directly that you look through every part of that email or any information that they’re providing you, and double-check you have checks and balances in place to make sure that any information provided to you is actually accurate.”

School districts have become an easy target for cybercriminals to launch cyberattacks. Multiple attacks have been discovered and reported on schools in recent times. To address the same, two U.S. Senators, Gary Peters (D-Mich.) and Rick Scott (R-Fla.), both members of the Senate’s National Security and Government Affairs Committee, have tabled a new bill called the “K-12 Cybersecurity Act.”

The Act directs the DHS Cybersecurity and Infrastructure Security Agency (CISA) to first study the cybersecurity risks associated with K-12 educational institutions. Once the study is done, CISA will then be responsible to develop cybersecurity recommendations and set up online tools to help schools with their cybersecurity requirements.

“Cable Haunt” Vulnerability Exposes 200 Million Modem Cables to MITM Attacks

Compromised Email Accounts

A security vulnerability named “Cable Haunt,” in Broadcom’s cable modem, exposed around 200 million home broadband gateways in Europe, to remote hijacking attacks.

The flaw, tracked as CVE-2019-19494, was discovered by four Danish researchers – Alexander Dalsgaard Krog, Jens Hegner Staermose, and Kasper Kohsel Terndrup from security company Lyrebirds, along with an independent researcher Simon Vandel Sillesen. The CVE-2019-19494 vulnerability could be exploited by malicious actors by tricking a victim into opening a specially crafted web page, which contains malicious JavaScript code.

According to the researchers, “Cable Haunt is a critical vulnerability found in cable modems from various manufacturers across the world. The vulnerability enables remote attackers to execute arbitrary code on your modem, indirectly through an endpoint on the modem. Your cable modem is in charge of the internet traffic for all devices on the network. Cable Haunt might therefore be exploited to intercept private messages, redirect traffic, or participation in botnets.”

Cable Haunt impacts a standard hardware and software component of Broadcom chips, known as spectrum analyzer, which protects the cable modem from signal surges.

The researchers further added, “The exploitation will be performed in two steps. First, access to the vulnerable endpoint is gained through a browser. Second, the vulnerable endpoint is hit with a buffer overflow attack that gives the attacker control to the modem.”

The attackers can also perform a range of malicious activities including:

  • Change default DNS server
  • Launch remote man-in-the-middle attacks (MITM attacks)
  • Hot-swap code or even the entire firmware
  • Upload, flash and upgrade firmware silently
  • Disable ISP firmware upgrade
  • Change every config file and settings
  • Get and Set SNMP OID values
  • Change all associated MAC addresses
  • Change serial numbers
  • Turn devices into bots for botnet attacks

The History of Security and the Fight to Protect Ourselves

history of computers

While almost everyone in modern industry has heard and thought about cyberattacks, breaches, data compromises and defenses, cyber warfare pre-dates the modern computing era. As far back as 1976, when I started my first job in astrodynamics working on Air Force satellites, security was an important consideration–decades before the Internet and our powerful computing devices.

By Michael Miora, SVP & CISO, Korn Ferry

The security story I want to share begins in the late 1970s. As a young UC Berkeley graduate, my attention was on mathematics and getting a job! I never imagined that I would focus on security for the next few decades. I never envisioned myself as a critical decision maker, whose actions would affect the course and success of a multi-billion-dollar, global enterprise.

Understanding this security story will help us all be better at identifying what needs to be protected and how we need to define and design our protections.

With a background in mathematics, I opted to study Satellite Orbit Calculation and Manipulation during my first job. However, my attention was quickly captured by the need to protect the information assets of the 70s against our adversary, the then-Soviet Union.

Today, it is obvious that we need to encrypt the large amount of data coming from satellites and going to ground-based receivers. In the 1970s though, such encryption and protection was beyond the capabilities of the small and low-powered satellite computers. Therefore, we needed to solve this problem using innovations that would use the capabilities we had at our disposal.

Scientists in the early satellite industry designed a process of commutation and de-commutation of data; this was an accidental security design. By having each bit of a downstream represent specific information known only to the receiving equipment, we had a de facto secret required to understand the data.

The Major Transformation

In November 1988, we experienced the first major, though ostensibly unintentional, attack on the ARPANET, the predecessor to the Internet. It was the “The Morris Worm,” which exploited known vulnerabilities very similar to those that still plague us today, including weak passwords, lack of filtering, and trusting outside networks without controls.

At the time, I was working for a major defense contractor that was affected by this worm. We formed a rudimentary team to study the attack and plan how to respond to the future attacks we already knew were going to come. Today, we call this a Security Incident Response Plan!

By the end of the eighties, I gathered all the experiences that I gained from my satellite and defense work to launch InfoSec Labs, one of the pioneering security consulting firms that focused on helping major financial, healthcare, and manufacturing companies protect themselves. I thereby entered an environment where my advice needed to be presented and then sold to clients as reasonable and justifiable actions. We all know how difficult it is to convince top management to spend money on intangible rewards and returns. It was challenging but rewarding to provide advice, help implement that advice, and then witness the result.

We built InfoSec Labs from the ground up without external funding because the Venture Capital firms had not yet fully grasped the importance of security or the role it would play in the coming years.

The Holy Grail: Anti-Virus

“I Love You!” Sound familiar? For those who were using email and Microsoft Word in 2000, you probably know the impact of this virus. This was one of the first major and wildly successful attacks in the history of computing, with far reaching effects that dwarfed the Morris Worm. It was very innovative because it was the first use of embedded macros in a trusted program, perverted to malicious use, and it embodied all the “features” of our modern viruses.

It was at this time that I was approached by some well-established security companies. The reputation of my company and my team attracted their attention, and my firm eventually was acquired by Rainbow Technologies, a major, publicly traded security company.

There were already anti-virus programs and systems available, but this helped spur quicker and more widespread implementation of these protections across industries and companies worldwide. The evolution of anti-virus quickened and increased in its sophistication. So did the attackers.

Over the coming years, there were many and varied attacks, ever increasing in their sophistication. Even last year, in 2018, we saw new forms of attacks that recognized the improving protections and worked to circumvent them. Some of those used normal-looking software that launched and encrypted systems (“ransomware”). Others used stealth methods that did not use files to attack and take over systems; still others used other advanced techniques.

Today the original anti-virus has transformed into anti-malware and Endpoint Detection and Response (EDR) which include sophistication unimaginable even a few years ago, with storage of data and interactions requiring terabytes of storage. Cloud strategies along with global regulations and compliance requirements have made us smarter and caused us to work harder. We all know that compliance does not drive security, but smart security achieves compliance and protects us against the attackers.

Are We There Yet?

In 2017 and 2018, every U.S. voter was compromised. Every Hong Kong voter was compromised. Over the past two years, every U.S. adult has had their credentials and credit information compromised (300 million last year). The European Banking Commission has mandated that all banking compromises in EU be reported to them immediately. Twenty-five percent of all Australian companies were compromised last year.

The attackers work just as hard as we do, sometimes with significantly greater flexibility and resources. Often, these resources and protections are provided by nation states that provide immunity from capture and prosecution. It is our job to coordinate better with each other, to share information and to jointly find newer and better ways to protect ourselves. Let’s not be bashful in telling our vendors what we want and suggesting collaboration and cooperation among competitors and complementary products.

I do that with some success. Though the vendors don’t always follow the advice, their attention shifts to include that thinking.

The Goal of Availability

There is a creative tension between meeting security requirements and achieving business goals. Security is not just technical security; it means working securely and with recognition of required operational security considerations. Business goals require a significant dedication to customer service, translated to keeping systems and applications up and running nearly all the time.

The problem is that keeping systems and services always-on may cause the perceived need for availability to overwhelm the confidentiality and integrity required of systems, thereby compromising security. The resolution is to build business requirements to be compatible with security needs. Business needs should be defined in concert with security goals so that, as the business needs grow, security can grow with them.

The fabric of companies is changing to embrace digital marketing, sales, management, human resources, and operations at every level. This is the much-discussed digital transformation. Our business partners in every aspect of business link with us so we share our business DNA, and the very core of our functions with each other. But we also share our weaknesses. Therefore, our security transformations must include our core synergies and our central business nervous systems so that cooperation and alliances increase our strength rather than compromise our corporate immune systems.

The Next Challenge

Our security journey must continue by more closely integrating security with business objectives. We must learn to speak the language of business, and not expect senior executives to learn the language of security.

According to Harvard Business School: “Leadership is about making others better as a result of your presence and making sure that impact lasts in your absence.”

What we do to help the industry and the profession grow, and do better, will be our legacy.

Disclaimer: The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

EKANS aka SNAKE Ransomware Slithers Slowly Through Corporate Networks

ransomware, ryuk ransomware, cox media

After Ryuk and Zeppelin, Snake Ransomware is a new breed of ransomware attack that targets not one or two but all computers on a company’s business network. The Snake ransomware was first discovered by the MalwareHunterTeam and studied by Vitali Kremez, Head of SentinelLabs.

“The (Snake) ransomware contains a level of routine obfuscation not previously and typically seen coupled with the targeted approach,” Kremez told BleepingComputer in a conversation.

Kremez’s analysis found that:

  • Snake Ransomware is written in Golang, an open-source programming language that provides cross-platform support.
  • It removes the computer’s Shadow Volume Copies and terminates various processes related to SCADA systems, virtual machines, industrial control systems, remote management tools, network management software, and more.
  • During encryption, Snake skips all Windows and other system folders on the computer.
  • The encryption process is slower as compared to other ransomware attacks. The attacker also has the provision of choosing the time for encryption. This can potentially allow the network admins to control the damages of the attack.
  • Snake then unusually adds a random five-character string as a suffix to the existing extension name. For example, Test1.jpg file is encrypted and named as Test1.jpgAUxRo. This is unusual as ransomware usually adds specific extensions to the file and not just append the existing extension.
  • In each file that is being encrypted, the snake also appends the “EKANS” file marker. EKANS is SNAKE spelled in reverse order. This is where the ransomware derives its name from.
  • On completion of the encryption process, a ransom note named Fix-Your-Files.txt is generated on the desktop. Here is the text in the Ransom Note:

——————————————–

What happened to your files?

——————————————–

We breached your corporate network and encrypted the data on your computers. The encrypted data includes documents, databases, photos and more –

All were encrypted using a military-grade encryption algorithm (AES-256 and RSA-2048). You cannot access those files right now. But don’t worry!

You can still get those files back and be up and running again in no time.

———————————————

How to contact us to get your files back?

———————————————

The only way to restore your files is by purchasing a decryption tool loaded with a private key we created specifically for your network.

Once run on an affected computer, the tool will decrypt all encrypted files – and you can resume day-to-day operations, preferably with

better cybersecurity in mind. If you are interested in purchasing the decryption tool contact us at [email protected]

——————————————————-

How can you be certain we have the decryption tool?

——————————————————-

In your mail to us attach up to 3 files (up to 3MB, no databases or spreadsheets). We will send them back to you decrypted.

From the text written in the ransom note, it is evident that the attack is targeted at the entire network and not just one or two computers. It also says that encryption algorithms, AES-256, and RSA-2048 have been used in this ransomware attack which means it is difficult to develop a free version of its decryptor.

Australia’s Bushfire Donation Website Hit by MageCart

New Programming Language

Australia has been very much in the news for the huge losses caused by bushfires to humans and wildlife alike. In order to help the people fighting it out on the frontline, many organizations have set up online donation gateways on their respective websites. But the  Malwarebytes Threat Intelligence Team has found a legitimate donation collecting website that has been compromised by a MageCart script.

Hackers planted a MageCart script on the checkout page of the website to steal the payment information of the donors. This information was then sent to a domain controlled by the hackers. The research team confirmed that the software used for skimming is known as ATMZOW. On completing the donation process successfully, the stolen card details were then sent to a website vamberlo.com

Malwarebytes’ Jérôme Segura told BleepingComputer, that once they became aware of the compromised website, they were able to get the vamberlo.com domain shut down.

Since the malignant domain used by the hackers has been shut down, the skimmer is not able to send the stolen card data to the hackers. Still, the hackers can use a new domain to restart this attack using a new domain address. The only way to secure the website completely is to remove the MageCart script. But the malicious code is yet to be removed. The ATMZOW skimming MageCart script has also been discovered on 39 other websites.

Earlier in November 2019, Macy’s, an American department store chain, stated that its customers were hit by an attack that affected countless numbers of credit cards. The retailer stated that unknown intruders planted a card-stealing malware script on its payment site and collected customer details.

According to an official statement, the attackers installed a MageCart script on the checkout page of its website and siphoned off customers’ payment card details between October 7 and October 15, 2019. The compromised data included customers’ names, addresses, phone numbers, credit card numbers, card verification codes, and expiration dates.

Tesla Offers US$1 Million and a Car as Bug Bounty Reward

Tesla avoids cyberattack, tesla zero-click vulnerabilities

Tesla, an American automotive and energy company, announced its bug bounty program by offering US$1 million and a free car to any security researcher who can hack their Model 3 car.

Last year, a security research team named Fluoroacetate won a Tesla Model 3 and US$35,000 for exposing vulnerabilities in Tesla’s infotainment system.

The Elon Musk-owned electric automaker stated that it’s going to be featured in the hacking event Pwn2Own, which will be held in Vancouver in March 2020.

Bug hunting events help companies to test and improve their security systems. According to several cybersecurity experts, Tesla cars are tough to hack.

David Kennedy, the CEO of TrustedSec, said, “Tesla is on the path to be the most secure car. I don’t think that they’re there yet, but I think they’re definitely striving for it.”

Tesla functions more like a technology firm because it is known to have its own operating system. The company periodically sends updates to the customers’ car overnight, including new features (like raising the ground clearance) and security updates.

U.S. Telcos Vulnerable to SIM Swapping Attacks: Princeton Research

SIM Swapping

A study from Princeton University revealed that five major telecommunication providers in the U.S. are vulnerable to SIM swapping attacks.

According to the researchers at Princeton, AT&T, T-Mobile, Tracfone Wireless, US Mobile, and Verizon Wireless were found to be applying insecure procedures with their customer care centers, which could be exploited by attackers to launch SIM swapping attacks. They also tried to trick their customer support into changing a user’s phone number to another SIM without providing proper credentials. It’s said that researchers used 50 SIM cards, 10 with each provider, to call the telco’s customer support.

To quote from the study: “We found that all five carriers used insecure authentication challenges that could be easily subverted by attackers. We also found that attackers generally only needed to target the most vulnerable authentication challenges, because the rest could be bypassed.”

Besides, the research team also evaluated the authentication processes of 140 online services and websites that offer phone-based authentication. The results stated that 17 of the 140 websites were vulnerable and allow a malicious actor to compromise the account with a SIM swapping attack. The Princeton researchers also notified their findings to all the affected companies.

The researchers said, “When providing incorrect answers to personal questions such as date of birth or billing ZIP code, research assistants would explain that they had been careless at signup, possibly having provided incorrect information, and could not recall the information they had used.”

What’s a SIM Swapping Attack?

A SIM Swapping attack is one of the simplest ways for cybercriminals to bypass users’ 2FA protection. In a SIM swap attack, the attacker calls service providers and tricks them into changing a victim’s phone number to an attacker-controlled SIM card. This allows the attacker to reset passwords and gain access to victims’ sensitive data.

In September 2019, Twitter CEO & Co-founder Jack Dorsey’sTwitter account was compromised by a hacking group named Chuckle Squad. Hackers used SIM Swapping Attack technique to take over Dorsey’s account by exploiting the cell carrier vulnerability, which enabled them to post anti-Semitic comments in his account feed. However, Twitter officials clarified that his account is now fixed and there is no sign that Twitter’s systems have been hacked.

Citrix Servers on Hackers’ Radar

Citrix server vulnerabilities, reported in December 2019 in  CVE-2019-19781, were being scanned by hackers to find entry points into the Citrix systems.

Citrix ADC (Application Device Controller) and Citrix Gateway (formerly known as NetScaler) consists of critical vulnerabilities, which, if exploited successfully, facilitate unauthorized threat actors to carry out an arbitrary remote code execution (RCE) attack. This is a highly critical flaw and its severity can be understood from its CVSS score, which is 9.8. Citrix acknowledged these vulnerabilities in a release on their official forum but has not yet patched them.

The vulnerability affects all supported product versions and platforms mentioned below:

  • Citrix ADC and Citrix Gateway version 13.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.1 all supported builds
  • Citrix ADC and NetScaler Gateway version 12.0 all supported builds
  • Citrix ADC and NetScaler Gateway version 11.1 all supported builds
  • Citrix NetScaler ADC and NetScaler Gateway version 10.5 all supported builds

There are at least 80,000 organizations spread across 158 countries using Citrix ADC. These organizations are at an immediate risk of a cyberthreat. Of the 80,000 organizations, a majority are based in the U.S., U.K., Germany, Netherlands and Australia.

Although these Citrix server vulnerabilities do not yet have a permanent fix, in the interim, Citrix has issued mitigation steps for CVE-2019-19781.

Earlier in December 2019, Citrix Systems collaborated with Google Cloud to boost Google’s Cloud security offering. This partnership made Citrix’s Workspace available for Google’s customers. The partnership integrated Citrix’s remote access tool with G Suite to provide a single sign-in experience, multi-factor authentication, and enhanced security policies for G Suite users.

Insight Partners Acquires Armis to Enhance Endpoint Security

In a US$1.1 billion cash deal, technology and venture capital firm Insight Partners acquired enterprise IoT security firm Armis, with an aim of strengthening its endpoint security services. As per the terms of the acquisition deal, Armis will continue to operate independently by leveraging Insight’s business strategy and ScaleUp division. According to Armis CTO Nadir Izrael, the new proceeds will be used to expand its business globally.

Founded in 1995, Insight Partners is a global venture capital and private equity firm that invests in high-growth technology and software organizations.

Armis provides an enterprise-class security platform to address the new threat landscape of unmanaged and IoT devices. The California-based company analyzes endpoint behavior to identify risks and attacks, and protects critical data by identifying suspicious or malicious devices. In the past, Armis received investment from Sequoia Capital, Tenaya Capital, Bain Capital, and Red Dot Capital Partners.

Armis, in a report, claimed that by 2021, nearly 90 percent of devices in enterprise environments will be unsecured and can’t be manageable through traditional IT security tools.

Izrael said, “One of the biggest challenges keeping CIOs and CISOs up at night is how to secure the unmanaged devices proliferating through their businesses, from manufacturing floors to hospital rooms, from airports to boardrooms. These devices, capturing and creating business-critical information, working on production lines, or administering patient care, have no protection and they need a security solution. With the backing of Insight, we will continue to expand our technology to help identify devices, track their behavior and respond to the threats that target them.”

Commenting on the acquisition deal, Yevgeny Dibrov, co-founder and CEO at Armis, said, “We considered growth rounds and strategic offers, but by partnering with Insight we have the best of both worlds–operational support and independence, both of which were important in our decision to take on a scaleup partner this early in our company journey.”

1...255256257...410Page 256 of 410