Home Blog Page 277

App Defense Alliance – Google’s Fab Four for Mobile App Security

Google Play

Google in its latest, and probably the most important announcement for Google Play Store security, has informed about the creation of the App Defense Alliance. This Alliance brings the industry’s leading mobile security providers onboard with Google Play Protect. The App Defense Alliance is a collaboration between Google, ESET, Lookout, and Zimperium. The App Defense Alliance was created to ensure the safety of the Google Play Store. Google and its partners aim to quickly find Potentially Harmful Applications (PHAs)
and take the appropriate action to protect users.

Google Play Store which was first introduced as Android Market, is designed on the lines of Apple’s App Store. The Play Store has a wide range of offerings – games, apps, books, music, TV shows, movies and much more at your fingertips. But this is only the icing on the cake; Google Play Protect is the cherry on top.

Google Play Protect is Google’s built-in malware protection which scans and verifies billions of downloaded apps every day. It helps keep your Android device(s) secure by running safety checks on Google Play Store apps before you download them, and raises an alert if any PHA is found. This ensures that PHAs are stopped even before they make it to the Google Play Store.

This alliance is going to be a give and take relationship. The App Defense Alliance partners can send a request to the Google Play Protect scanner service for analyzing it. The scanner service then sends back the scan results directly to the partner. But as we mentioned it’s two-way traffic. Google Play Protect scanners can also send requests to partner’s scanner services and receive results from their scan engines. This helps in creating an advanced app security and risk mitigation. Based on the combined scan results it can further be decided whether a certain app can be published on Google Play Store or not.

In Google’s Security Blog, Dave Kleidermacher, VP, Android Security & Privacy said, “Our number one goal as partners is to ensure the safety of the Google Play Store, quickly finding potentially harmful applications and stopping them from being published.

As part of this Alliance, we are integrating our Google Play Protect detection systems with each partner’s scanning engines. This will generate new app risk intelligence as apps are being queued to publish. Partners will analyze that dataset and act as another, vital set of eyes prior to an app going live on the Play Store.”

Speaking about the partners involved in the App Defense Alliance, he further adds, “All of our partners work in the world of endpoint protection and offer specific products to protect mobile devices and the mobile ecosystem. Like Google Play Protect, our partners’ technologies use a combination of machine learning and static/dynamic analysis to detect abusive behavior. Multiple heuristic engines working in concert will increase our efficiency in identifying potentially harmful apps.

We hand-picked these partners based on their successes in finding potential threats and their dedication to improving the ecosystem. These partners are regularly recognized in analyst reports for their work.

Knowledge sharing and industry collaboration are important aspects in securing the world from attacks. We believe working together is the ultimate way we will get ahead of bad actors. We’re excited to work with these partners to arm the Google Play Store against bad apps.”

Data Breach at California DMV Affects 3,200 Drivers’ Information

California DMV data breach

Information of thousands of drivers has been exposed in a data breach at the California Department of Motor Vehicles (DMV) that went unnoticed for four years.

According to the DMV, Social Security information of 3,200 driver’s license holders was improperly accessed by federal agencies, including the Department of Homeland Security, Internal Revenue Service, Small Business Administration, and district attorneys in San Diego and Santa Clara counties, the Los Angeles Times reported.

DMV restricted access to the data after discovering the breach on August 2, 2019. However, Anita Gore, DMV’s spokesperson, clarified that no information was accessed or shared with private individuals during the breach.

As per the official statement, a total of seven agencies have accessed the data, including district attorneys in San Diego and Santa Clara counties, the Small Business Administration, and the Internal Revenue Service. It also stated that data was accessed as part of investigations into criminal activity or compliance with tax laws.

“Protection of personal information is important to DMV, and we have taken additional steps to correct this error, protect this information and reaffirm our serious commitment to protecting the privacy rights of all license holders,” Anita Gore said. “That’s why DMV immediately began correcting the access error following a legal compliance review, ensured that no additional confidential information was disclosed to these entities, and has implemented several additional layers of review.”

The affected people were informed of the breach via letters. In which, the Chief Privacy Officer at the DMV, Albert C. Hwang said, “We sent this letter and the attached notice to you based on having, in the past, shared your Social Security information in error.”

In February 2019, the officials of California’s government had announced that they were going to support cybersecurity education and committed to providing programs and events that help train the next generation of cybersecurity professionals.

The officials stated that they’ve initiated a program, the California Mayors Cyber Cup (CMCC), that utilizes cyber competitions to spread awareness about cybersecurity and the many career opportunities that exist within that field. CMCC brings students, parents, teachers, government officials, business leaders, and other stakeholders together to create awareness of cybersecurity issues and reinforce the connection between the community and the educational institutions to highlight the many career and business support resources available in each community.

Researchers Found New Laser-Based “Light Commands” Attack

Light Commands Attacks

Security researchers from the University of Electro-Communications & Michigan discovered a new kind of injection attack that allows an attacker to infuse arbitrary audio signals into voice assistants using light.

The new attack dubbed “Light Commands” is a vulnerability that exists in MEMS (micro-electro-mechanical systems) microphones, allowing attackers to inject inaudible and invisible commands into voice assistants via Photoacoustic effect.

“We propose a new class of signal injection attacks on microphones based on the photoacoustic effect: converting light to sound using a microphone,” researchers stated.

To launch the Light Commands attack, an attacker needs to transmit a light modulated audio signal that converts into the original audio signal within a microphone. Researchers revealed that hackers can remotely send invisible and inaudible signals to smart home devices like Alexa, Portal, Google Assistant, and Siri. It’s said that the Voice Controller systems in MEMS microphones lack authentication mechanisms.

Once the attackers hijack the device, they can control smart home switches, operate smart doors, make online purchases, and unlock smart locks by stealthily brute-forcing the user’s PIN.

Researchers stated that attackers require no physical access or user interaction to exploit the vulnerability; all they need is sight access to the target device and its microphone ports. It’s confirmed that Light Commands attack works within a distance of  110 meters.

With technology advancing day-by-day, cyber-attackers are finding innovative ways to get into our devices.  Recently, academic researchers from England and Sweden have discovered that hackers can use the microphone on the smartphone to steal the phone password and gain access to the device’s data.

Researchers found malware that can exploit the smartphone’s microphone to steal the device’s passwords and codes. In their report, s, the researchers claimed that they’ve found the first Acoustic side-channel attack that presents what users type on their touch-screen devices.

Recently, a cybersecurity researcher, Matt Wixey, revealed that attackers can hack modern audio gadgets to make deafening sounds. He discovered that attackers can build a custom-made malware to induce it on connected speakers to produce deafening sounds at high intensity, turning them into offensive cyber-weapons.

These developments are reminiscent of the early days of phone hacking in the 1980s when phone hackers (or “phreaks”) hacked into telecommunication systems. They used devices (or used their own whistling) that made sounds to emulate phone signals going across to switchboards and modems. The concept was called “phreaking”. It was done just to make free phone calls and have some innocent fun.

Don’t Reboot Your Systems after Ransomware Attack: Experts

Ransomware attacks, ransomware, Sinclair Broadcast group

Security pros stated rebooting a computer after a ransomware attack could lead to restarting a crashed file-encryption process and cause potential loss of encryption keys stored in memory. Instead, the victims should hibernate the computer or disconnect it from the network, experts recommended.

According to a research report, powering down the computer is also a good idea, but hibernating is better as it saves a copy of the memory of ransomware strains. The report revealed that in 1,180 U.S. users, who fell victim to ransomware, almost 30 percent of them chose to reboot their computers to deal with the attack.

The report stated that there are two stages of a ransomware recovery process. The first is finding the ransomware’s items like processes and boot persistence mechanisms and removing them from the infected host. And, the second is restoring the data if a backup mechanism is available.

“The classical paradigm to defend against malware attacks has traditionally been victim-agnostic and reactive, with defenses focusing on identifying the attacks like phishing emails, malicious websites, and files,” the report stated.

Ransomware has received considerable news coverage in recent years, in part due to several attacks against high-profile corporate targets. Multiple governments have fallen victim to ransomware attacks in recent times. In July this year, Louisiana declared a state of emergency after a wave of ransomware attacks hit school districts. The incident affected school systems in Sabine, Morehouse, and Ouachita parishes in North Louisiana. The attack infected the school’s computer and network systems with ransomware. The Emergency Declaration allows Louisiana’s cybersecurity experts to assist local governments in securing their network systems.

Recently, the Texas Department of Information Resources (DIR) revealed that around 23 Local Government Organizations in Texas have been hit with a ransomware attack. “On the morning of August 16, 2019, more than 20 entities in Texas reported a ransomware attack.  The majority of these entities were smaller local governments,” the DIR said in a statement. “The State of Texas systems and networks have not been impacted. It appears all entities that were actually or potentially impacted have been identified and notified.”

Libarchive Vulnerability Allows Code Execution on Linux and BSD Distros

Linux

Libarchive is a default compression library that is optimized for reading and writing compressed archive files in a single go. It means that Libarchive can process large archive files that cannot be stored on a disk and instead process them on-the-go as they read from or write to a network or a tape drive.

Google recently disclosed a Libarchive vulnerability which was discovered by its security researchers (having identifier CVE-2019-18408) using ClusterFuzz and OSSFuzz automated testing tools. It allowed hackers to execute arbitrary code if it received a specially crafted archive file. This library is included by default in Debian, Ubuntu, Gentoo, Arch Linux, FreeBSD (Berkeley Software Distribution), and NetBSD distros. The announcement of this vulnerability was made public as several Linux and FreeBSD distros released updated patches to fix the Libarchive vulnerability.

Debian Security Advisory authored by Moritz Muehlenhoff said, “A use-after-free was found in libarchive, a multi-format archive and compression library, which could result in denial of service (DDOS attack) and potentially, the execution of arbitrary code if a malformed archive is processed.” IBM in its security bulletin also mentioned that multiple Libarchive vulnerabilities have affected its Watson Explorer, a cognitive and content analysis platform.

Libarchive is also included as a default library in Microsoft Windows 10 (insider build 17063) since 2017.  Similarly, MacOS has integrated the usage of Libarchives since 2009, with bsdtar and bsdcpio being the default system tar and cpio command-line utilities. The bsdtar and bsdcpio command-line utilities are feature and performance enhanced as compared to other tar and cpio implementations and hence very popular across various operating environments. Its features include:

  • Reads a variety of formats, including tar, pax, cpio, zip, xar, lha, ar, cab, mtree, rar, and ISO images.
  • Writes tar, pax, cpio, zip, xar, ar, ISO, mtree, and shar archives.
  • Automatically handles archives compressed with gzip, bzip2, lzip, xz, lzma, or compress.
  • Unique format conversion feature.

Although this could have affected a wider audience, the Libarchive vulnerability being ineffective on Apple and Microsoft operating systems helped in its timely containment and rapid fix.

Australia Spends AU$ 8.5m to Build National Freight Data Hub

Remote Access Scams

The Australian government recently announced that it’s going to spend AU$8.5 million to create a national freight data hub. The government stated the new data hub helps businesses and governments make better operational decisions.

“A well-designed hub will improve access to and sharing of valuable freight location and performance data,” said Michael McCormack, the Deputy Prime Minister of Australia.

The funding will be divided into two parts, in which AU$5.2 million will be allocated for designing the national freight data hub, including arrangements for data protection, data collection, confidentiality, dissemination, and hosting. And the remaining AU$3.3 million will be used to establish a freight data exchange pilot.

The government also released a discussion paper to seek views on the design of the hub, including what datasets should be collected and how the data should be shared. Cybersecurity and the protection of commercial in confidence material are considered as high priorities to the government.

“The protection and confidentiality of data is a key concern of stakeholders that could inhibit participation in the Hub, therefore lessening the potential network-wide benefits. Sharing of freight data is also hampered by inconsistent and disparate approaches, such as data that cannot be compared across supply chains or states,” the announcement stated.

Earlier, the government of Australia launched several Joint Cyber Security Centers (JCSC) to promote cybersecurity across the government, business, and academia. The facilities are a part of the government’s $47 million JCSC program that bridges the security gap between several public and private companies in sectors such as defense, finance, transport, energy, health, mining, and education.

In July this year, Australia established a new cybersecurity node in a bid to drive innovation and harness cybersecurity talent in the region. The New South Wales government and AustCyber have jointly launched the NSW Cyber Security Innovation Node at the harbor city’s Joint Cyber Security Centre. Announced in 2018, the new information security hub will form a part of a series of nodes backed across Victoria, the ACT, Western Australia, South Australia and Tasmania, and will be coordinated by the NSW Cyber Security Network, which is backed by the NSW Government and universities, and aligned with AustCyber’s national agenda of sector growth.

Canadian Territory Nunavut Suffers Ransomware Attack

Ransomware attack on Nunavut, Emotet Cobalt Strike

The Government of Nunavut is the latest victim of a sophisticated ransomware attack. In an official statement, the Premier of Nunavut, Joe Savikataaq, stated he noticed a new and advanced type of ransomware that affected their network systems across the territory on November 2, 2019.

The attack encrypted individual files on various servers and workstations impacting all government online services. “All government services requiring access to electronic information stored on the Government of Nunavut (GN) network are impacted, except Qulliq Energy Corporation,” said Savikataaq.

“I want to assure Nunavummiut (citizens of Nunavut) that we are working non-stop to resolve this issue. Essential services will not be impacted and the GN will continue to operate while we work through this issue. There will likely be some delays as we get back online, and I thank everyone for their patience and understanding,” Savikataaq added.

The officials from the government stated that there is no information as of now about the loss of personal information or data breach. The state departments are implementing emergency plans to restore electronic data services related to health, family services, education, justice, and finance.

Multiple governments have fallen victim to ransomware attacks in recent times. In July this year, Louisiana declared a state of emergency after a wave of ransomware attacks hit school districts. The incident affected school systems in Sabine, Morehouse, and Ouachita parishes in North Louisiana. The attack infected the school’s computer and network systems with ransomware. The Emergency Declaration allows Louisiana’s cybersecurity experts to assist local governments in securing their network systems.

Recently, the Texas Department of Information Resources (DIR) revealed that around 23 Local Government Organizations in Texas have been hit with a ransomware attack. “On the morning of August 16, 2019, more than 20 entities in Texas reported a ransomware attack.  The majority of these entities were smaller local governments,” the DIR said in a statement. “The State of Texas systems and networks have not been impacted. It appears all entities that were actually or potentially impacted have been identified and notified.”

Data Breach Reports Increase in Canada after Privacy Law

Canada Revenue Agency Shut Down Services after Cyberattacks

The number of reported data breaches in Canada increased by six times after the country implemented a new breach-reporting regulation.

The new regulation, the Personal Information Protection and Electronic Documents Act (PIPEDA), went into effect on November 01, 2018. As per the regulation, Canadian companies are required to report all the details of data breaches that occurred within the organization. They also need to notify affected individuals and keep records of all data breaches.

According to the Office of the Privacy Commissioner of Canada’s report, around 680 security breach reports, which is six times the volume received during the same period one year earlier, were received since November 01, 2018. It’s said that the number of Canadians affected by a data breach is more than 28 million, in which 58 percent of reported breaches involved unauthorized access.

“Since reporting became mandatory, we’ve seen the number of data breach reports skyrocket. Some of those reports have involved well-known corporate names, but we have also seen significant volumes coming from small- and medium-sized businesses,” the report stated. “We have seen a significant rise in reports of breaches affecting a small number of individuals – often just one and sometimes through a targeted, personalized attack.  This is the correct approach to reporting: there can be a risk of significant harm even when only one person is affected by an incident.”

Cybersecurity experts have opined the Canadian government isn’t doing enough to protect businesses and consumers from data breaches.

A recent survey from Keyfactor, a provider of secure digital identity management solutions, revealed that 87 percent of surveyed cybersecurity pros think that more privacy and security legislation is required to better protect Canada’s businesses and consumers.

According to the survey, 58 percent of respondents think regulators and the Canadian officials are not trying to regulate the security guidance on measures like data encryption. The survey also highlighted that 50 percent of respondents stated that manual and complex processes as their greatest challenge in managing Public Key Infrastructure (PKI) while 43 percent of respondents were concerned about their ability to securely adopt DevOps, cloud, and IoT.

5 Cybersecurity Solutions to Steamroll Hackers and Scammers in 2020

anti-hacking

By Joshua Blackborne

Cyberattacks have become a part of the reality of doing business in today’s digital landscape. Almost every company relies on computers, digital tools, and the internet these days, and this leaves us all exposed to cyberthreats.

Hackers and scammers today have easier access to increasingly sophisticated methods that allow them to exploit vulnerable devices and users. Companies whose digital infrastructures fall victim to these attempts are exposed to a variety of attacks such as data breaches, ransomware, and fraud. According to its latest threat report, McAfee Labs saw an average of 504 new threats per minute in Q1 of 2019 alone.

Experts expect attacks to persist and even grow in the coming years. As such, security needs to be part of every company’s business strategy. Fortunately, the cybersecurity community has been putting up a good fight against attacks, developing tools that help mitigate the risks posed by hackers and scammers.

Here are five security solutions that you can use to protect your company from vulnerabilities, attacks, and scams as we all get set for 2020.

Secure Your IoT With FirstPoint’s Virtual Mobile Networks

Companies are now aggressively adopting mobile and Internet-of-Things (IoT) devices. Many of these devices, however, rely on cellular connectivity.

The problem is that cellular networks can be exploited. Hackers can now use fake cell towers, location tracking, SMS phishing, and SSL loopholes to intercept data or even gain access to devices that rely on cellular connectivity. Once they take control of these connections, the hackers can readily eavesdrop on all the data being transmitted over the network and even install malware into connected devices, often without anyone even knowing.

FirstPoint’s Virtual Mobile Networks

Employed by telecoms who are looking to cater to key clients who require a high-fidelity security solution, FirstPoint has created a solution designed to specifically secure cellular connections at the network level. Once integrated, FirstPoint essentially routes all information between a user and the cellular network through a secure virtual network. Using advanced algorithms, all traffic that passes through this secure network is scanned for threats.

Should any malicious traffic or processes be detected, FirstPoint can effectively screen and prevent these from executing.

Get All Hands on Deck With Cymulate’s Attack Drills

Another major challenge for businesses is knowing whether their chosen cybersecurity tools actually work. Typically, testing defenses involves performing penetration tests that probe networks for vulnerabilities. IT teams can also form “read teams” that take on the role of hackers and employ similar attack methods to test their security.

Unfortunately, both approaches require high levels of technical skills to pull off. Contracting third parties to perform these can also be expensive.

Cymulate’s Attack Drills

As an alternative, organizations can use Cymulate’s breach and attack simulation (BAS) platform to test their defenses. Cymulate simulates various attacks across vectors. It can test the effectiveness of endpoint security solutions such as anti-viruses and anti-malware by deploying payloads on target machines. It can also test the security of email, web applications, and servers to ensure that all components comprising a company’s infrastructure are protected.

After testing, the platform generates a comprehensive report and a score to help security teams identify weak and vulnerable areas so that they can commit to corrective actions. Since solutions and threats evolve, Cymulate can automatically test periodically to ensure that everything works as it should.

Reward Social Reengineering with Hoxhunt’s Phishing Drills

The human element continues to be the weak link in cybersecurity defense. An Egress study showed that human error was the main cause of 60 percent of personal data breaches reported between January 1 and June 20 of 2019.

Human fallibility is why hackers continue to perform social engineering attacks as a means to gain access to enterprise systems. Phishing, or the use of fraudulent messages to trick users into giving up information or installing malware into their devices, remains a popular attack method among hackers.

Hoxhunt’s Phishing Drills

Hoxhunt allows enterprises to enhance security by focusing on improving the human element. It provides automated phishing training for all members of the organization in a sustained manner, and while in a real working environment.

Hoxhunt generates ML-powered personalized simulated phishing emails directed to specific users and provides feedback on how well users react to these simulated attacks. Through proper ongoing, in-context training and a gamified experience, teams can distinguish these fraudulent messages and report the emails. That’s why Hoxhunt says its customers quickly find failure rates diving to under 2 percent.

Seamlessly Prevent Payment Fraud with Signifyd’s Authentication Tool

Businesses operating in the e-commerce space are always exposed to the threat of online fraud. Stolen credit card information can be purchased on the cheap from the dark web. Scammers and fraudsters often take advantage of this by using these stolen accounts to purchase goods online.

Unfortunately for e-commerce merchants, card companies generally rule in favor of customers when these fraudulent charges are contested. When disputes and chargebacks happen, businesses have no choice but to refund the transaction and bear the brunt of expenses such as the cost of goods and shipping.

Signifyd’s Authentication Tool

As such, it’s important for businesses to have fraud prevention and protection. Signifyd offers a comprehensive service that combines big data, machine learning, and manual reviews to check the authenticity of transactions.

Integrating with popular shopping carts like Shopify, BigCommerce, and Magento, this platform also improves customer retention by minimizing instances of falsely declined payment attempts. Online shoppers readily abandon merchants that erroneously deny their legitimate transactions, so advanced fraud prevention allows companies to minimize revenue leakage from both losses and churn.

Reveal and Manage SaaS Access Permissions with Torii

The problem of shadow IT, or the use of unauthorized devices and applications, has been a constant concern of IT teams over the years. The phenomenon has become even more alarming thanks to the rise of cloud-based services and software-as-a-service (SaaS) as a distribution method for applications since it allows just about anyone to subscribe to apps and services on a DIY basis.

Shadow IT can create some major problems for organizations. Companies may be spending unnecessarily on redundant apps. But if people use insufficiently secure apps, or if they grant SaaS tools permission to access network resources like contact databases or email messages, new vulnerabilities are released into the infrastructure, without IT even knowing it. As a result, data may get lost, destroyed or intercepted, and data privacy regulations can be unwittingly violated.

Reveal and Manage SaaS Access Permissions with Torii

A leading SaaS management platform, Torii helps minimize the dangers of shadow IT by enhancing visibility and reducing latency. It can automatically identify and track all instances of SaaS use within the network. What’s more, Torii’s database displays the risk levels and access permissions that each SaaS product generally demands. This allows administrators to create an accurate, real-time inventory of all SaaS accounts and terminate subscriptions to insecure and non-compliant apps.

Torii also supports automated alerts, as well as custom onboarding and offboarding features that allow IT teams to manage and delegate access to all SaaS accounts via automated workflows.

Strategy is the Key to the Stack

Hackers and scammers are only bound to increase their malicious ways, especially now that they can so easily monetize the data that they steal from companies. Surely, you wouldn’t want your company to be part of the growing number of organizations that fall victim to cyberattacks. As such, it is crucial for you to have a comprehensive cybersecurity strategy that fits your specific context. Knowing where your company is vulnerable and investing the proper tools to strengthen your defenses will be crucial in preventing attacks.

CISO MAG did not evaluate the advertised/mentioned product, service, or company, nor does it endorse any of the claims made by the advertisement/writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

51 Percent Organizations Not Ready to Handle a Cyber-Attack: FireEye

Whistle-Blower Reports to ICO Increase by 34% in the Last Year

Cybersecurity research firm FireEye revealed that nearly 51 percent of organizations don’t believe that they’re capable of handling threats like cyberattacks or data breaches.

In its latest report, FireEye Cyber Trendscape Report 2020, FireEye stated that it surveyed over 800 CISOs and senior-level executives across North America, Europe, and Asia to help organizations scale their cybersecurity standards. The report discloses the present scenario of how CISOs across the world are thinking about the current cybersecurity landscape.

According to the report, only 49 percent of CISOs are confident that their organization could deal with security incidents or data breaches. Also, nearly 29 percent of organizations with cyber-attack response plans stated that they’ve not tested them for a year. However, 76 percent of firms stated that they’re in a plan to increase their cybersecurity budget in 2020.

“The greatest number of U.S. participants (39 percent) indicated budgetary increase plans of 10 percent or more, followed by the UK (30 percent) and Korea (22 percent),” the report stated.

FireEye is a cybersecurity company that protects enterprises from the impact and consequences of cyber-attacks. In its latest security incident findings, the company discovered an undetected hacker group from Iran, that managed to steal travel and mobile data of individuals in the Middle East region.

According to FireEye, the Iranian group dubbed APT39, targeted several people in the Middle East, especially in the Gulf region. It’s believed that the espionage group is allegedly providing information to the Iranian government. The researchers at FireEye stated that they had been tracking APT39 activities since 2014 to protect organizations from cyber incidents.

The researchers said the group uses phishing emails that target specific people and include malicious attachments or links resulting in a POWBAT infection. FireEye also observed that the group uses Persian language words in encrypting data. APT39’s activities are reportedly focused on the telecommunications sector, the travel, and the IT industry, and allegedly represent Iran’s potential global operational reach and how it collects key data.

1...276277278...410Page 277 of 410