Home Blog Page 278

Proofpoint Acquires Threat Intelligence Firm ObserveIT for US$ 225 million

96% of Cybersecurity Professionals are Happy With Their Roles

Enterprise cybersecurity and compliance company, Proofpoint, recently announced that it has entered into a definitive agreement to acquire ObserveIT in an all-cash deal for US$ 225 million. The California-based company stated that the new acquisition helps the company to bolster its enterprise cybersecurity portfolio and improve its data loss prevention (DLP) capabilities by using ObserveIT’s technology.

Founded by Gabriel Friedlander and Avi Amos in 2007, ObserveIT designs a cyber defense system to prevent insider breaches within an organization. The company moved its control center to Boston after it was acquired by Bain Capital in 2013.

With an integrated suite of cloud-based solutions, Proofpoint helps global companies to prevent targeted threats, safeguard their data, and make their users more resilient against cyberattacks. The acquisition deal integrates Proofpoint’s information classification and intelligence offerings with ObserveIT’s endpoint and data risk analytics solutions. Proofpoint also intends to invest in ObserveIT’s insider threat management solution.

Speaking on the new acquisition, Gary Steele, Chairman, and CEO of Proofpoint said, “Today’s ObserveIT acquisition underscores Proofpoint’s commitment to providing organizations with people-centric cybersecurity and compliance solutions that protect what matters: their people and the data they have access to, in a post-perimeter, cloud-first world.”

“Proofpoint’s leadership in people-centric cybersecurity, broader intelligence, and R&D resources are significant market differentiators and directly complement our ability to quickly detect insider threats and prevent critical information loss,” said Mike McKee, ObserveIT CEO. “We are very excited to join the Proofpoint team and provide customers with even more powerful solutions to mitigate insider threats, decrease incident investigation time, and make sure users don’t intentionally or accidentally send valuable, confidential information externally.”

Recently, Proofpoint acquired Meta Networks, a technology expert in zero-trust network access (ZTNA), in a cash deal of around US$ 111 million and US$ 9 million in common stocks and options. The acquisition helps Proofpoint strengthen its cloud-based architecture and people-centric security platform.

Aimed to integrate Meta Networks’ ZTNA technology with Proofpoint’s cloud access security broker (CASB), the acquisition will offer comprehensive cloud access and advance security platform to customers. The acquisition of Meta Networks will also help Proofpoint in expanding its presence in the Israel region.

Russia Launches “Disconnect from the Internet” Law

France Fines Facebook and Google,Russia fines Google, Meta heavily New York City Law Department Hit by a Cyberattack

It seems that Russia wants to build its own Internet Firewall platform to monitor internet traffic in the country through government servers. The Russian government recently launched its controversial “Disconnect from the Internet” Law.

According to the reports, the new law allows the government the ability to disconnect the country from the global internet.

The law, which was officially approved by President Putin in May this year, requires all local Internet Service Providers (ISPs) to route internet traffic through the servers managed by the country’s telecommunications watchdog Roskomnadzo. The servers act as kill-switches and disconnect Russia from external connections and re-routes internet traffic inside Russia’s own internet space, which the government is referring to as a country-wide intranet named RuNet.

It’s said that the government wanted to disconnect the country’s cyberspace from the rest of the world in the event of a national emergency or foreign cyber threats. The government reportedly expended about 30 billion rubles (US$ 460,000,000) for its execution.

Experts from both political and security sectors opined that Russia’s new law is an attempt to increase censorship and take greater control over information online.

In related news, Facebook stated that it is tightening its security for the 2020 U.S. elections after fresh signs of Russia meddling. The social media giant stated that it’s taking down accounts involved in illicit activities and stepping up searching state-controlled media trying to manipulate American voters.

Facebook pledged to use a variety of security measures, including artificial intelligence, to counter Russian attackers or other online intruders who use misleading strategies and false information to meddle in the 2020 U.S. elections.

The new steps announced by Facebook include Fighting Foreign Interference, preventing inauthentic behavior, increasing transparency, labeling state-controlled media on their Page and in the Ad Library, preventing the spread of misinformation, and monitoring candidates’ accounts, elected officials through Facebook Protect.

Researchers Discover the First “BlueKeep” Mass Hacking Campaign

Bluekeep Vulnerability

BlueKeep, a critical remote code execution flaw, has been spotted by security researchers for the first time in the wild to launch a mass hacking operation.

The BlueKeep flaw exploitation was predicted by security researcher Kevin Beaumont recently when his multiple EternalPot RDP honeypot systems, a decoy computer system for detecting BlueKeep attacks, got crashed.

In May this year, Microsoft discovered the Bluekeep vulnerability in older versions of Microsoft’s Remote Desktop Protocol (RDP). If exploited, the flaw allows unauthorized access to computers running Windows XP, Windows Vista, Windows 7, Windows Server 2003, and Windows Server 2008.

According to Microsoft, BlueKeep (tracked as CVE-2019-0708) is a wormable vulnerability which is self-spreading and can be weaponized by potential malware to spread from one vulnerable computer to another automatically. It said that in order to exploit the vulnerability, an attacker would need to send a specially crafted request to the target systems Remote Desktop Service via RDP.

“A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction. An attacker who successfully exploited this vulnerability could execute arbitrary code on the target system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights,” Microsoft said in a statement.

The BlueKeep flaw has been considered as a serious threat since its discovery. Microsoft, and even government agencies like the National Security Agency (NSA), urged Windows users to apply security patches. It’s said that nearly 1 million systems were found vulnerable even a month after patches were released.

“Although Microsoft has issued a patch, potentially millions of machines are still vulnerable. This is the type of vulnerability that malicious cyber actors frequently exploit using software code that specifically targets the vulnerability. For example, the vulnerability could be exploited to conduct denial of service attacks. It is likely only a matter of time before remote exploitation tools are widely available for this vulnerability. NSA is concerned that malicious cyber actors will use the vulnerability in ransomware and exploit kits containing other known exploits, increasing capabilities against other unpatched systems,” NSA said in a statement.

Phishing is No Longer an Email-Based Threat: Research

xss vulnerability in UPS, Phishing Attack, spear phishing, phishing mails

Security experts said cybercriminals are customizing their hacking methods to trick consumers. According to the cloud security firm Akamai Technologies, attackers are using enterprise-based development and deployment strategies like Phishing as a Service (PaaS) to target global tech companies.

In its report, 2019 State of the Internet / Security Phishing: Baiting the Hook, Akamai revealed that around 42.63 percent of attacks were targeted on large brands like Microsoft, PayPal, DHL, and Dropbox. Akamai opined that hackers expanded phishing attacks to social media and mobile devices, making it no longer an email-based threat.

The report stated that cybercriminals are targeting global companies and their users with sophisticated phishing kit operations.

“This evolving method continues to morph into different techniques, one of which being business email compromise (BEC) attacks,” Akamai said.

According to the report findings, the IT industry is the primary target for attackers with 6,035 domains and 120 kit variations. The second most-targeted industry is the financial services with 3,658 domains and 83 kit variants. Following that, E-Commerce (with 1,979 domains, 19 kit variants) and Media industry (with 650 domains, 19 kit variants). It’s said that Phishing defenses of the companies forcing hackers to change their attack operations.

“Phishing is a long-term problem that we expect will have adversaries continuously going after consumers and businesses alike until personalized awareness training programs and layered defense techniques are put in place,” said Martin McKeay, Editorial Director of the report.

“As the phishing landscape continues to evolve, more techniques such as BEC attacks will develop, threatening a variety of industries across the globe. The style of phishing attacks is not one size fits all; therefore, companies will need to do due diligence to stay ahead of business-minded criminals looking to abuse their trust,” McKeay concluded.

A similar research from email and data security company Mimecast revealed that there is a significant increase in Business Email Compromise (BEC) attacks. In its report, Email Security Risk Assessment (ESRA), Mimecast stated that emails containing viruses and malware attachments are being delivered to users’ inboxes from incumbent email security systems.

The ESRA highlighted that BEC attacks have increased to 269 percent when compared to the same findings in the last quarter’s report. Mimecast stated that they’ve found 28,783,892 spam emails, 28,808 malware attachments, and 28,726 dangerous file types that are delivered to users’ inboxes.

WhatsApp rolls out Biometric Security Lock for Android Devices

WhatsApp Biometric Security

WhatsApp recently announced the launch of biometric authentication through fingerprint sensors on the Android platform, as an additional privacy measure. The Facebook-owned messaging app stated that devices running on Google’s Android operating system will soon be able to secure their WhatsApp accounts through the biometric authentication method.

However, WhatsApp stated that the Android devices should be of a new model, with a fingerprint reader to use the new authentication platform.

Earlier this year, WhatsApp introduced biometric mechanisms for Apple’s Touch ID and Face ID. The security feature works in all iOS 9 and above iPhone devices. “iPhone users can prompt Touch ID or Face ID when you open WhatsApp on your phone. When this is enabled, you’ll have to use Touch ID or Face ID to unlock the app,” WhatsApp said.

“Today we’re introducing similar authentication, allowing you to unlock the app with your fingerprint, on supported Android phones. To enable it, tap Settings > Account > Privacy > Fingerprint lock. Turn on Unlock with fingerprint and confirm your fingerprint,” WhatsApp stated in its announcement.

In related news this week, WhatsApp has sued the Israel-based cyber intelligence company NSO Group for violating the Computer Fraud and Abuse Act. According to the lawsuit filed in the federal court, the NSO Group deployed its custom malware on around 1,400 WhatsApp installed mobile devices in April and May 2019.

NSO Group is a developer of spyware for mobile devices. The firm is known for the development of Pegasus software that targets mobile phones to gather information and provides authorized governments with technology that helps them combat terror and crime.

In May, WhatsApp revealed that it discovered a vulnerability in its network system that allowed hackers to install spyware via an infected WhatsApp voice call. It stated that the spyware can exploit the mobile device, its calls, and texts; it activates the phone’s camera, microphone, and it is able to perform other malicious activities. The malicious spyware was developed by the NSO Group, according to Facebook.

Facebook to Pay £500,000 Penalty for Cambridge Analytica Scandal

Facebook Cambridge Analytica Scandal, Facebook data breach

It seems the clash between Facebook and the U.K.’s Information Commissioner’s Office (ICO) over the infamous Cambridge Analytica scandal has come to an end.

Facebook has agreed to pay the £500,000 (around US$ 645,000) penalty imposed by ICO, the UK’s data protection watchdog, for failing to safeguard the users’ data gathered by political data firm Cambridge Analytica.

According to the settlement deal, Facebook has agreed to drop its legal appeal against the penalty. The ICO stated that Facebook can retain some documents that ICO disclosed during the appeal process to use for its own investigation into issues around Cambridge Analytica.

Commenting on the agreement, Harry Kinmonth, Director and Associate General Counsel at Facebook, said, “We are pleased to have reached a settlement with the ICO. As we have said before, we wish we had done more to investigate claims about Cambridge Analytica in 2015. We made major changes to our platform back then, significantly restricting the information which app developers could access. Protecting people’s information and privacy is a top priority for Facebook, and we are continuing to build new controls to help people protect and manage their information.”

“The ICO has stated that it has not discovered evidence that the data of Facebook users in the EU was transferred to Cambridge Analytica by Dr. Kogan. However, we look forward to continuing to cooperate with the ICO’s wider and ongoing investigation into the use of data analytics for political purposes,” Kinmonth added.

Recently, Facebook announced that it is tightening its security for the 2020 U.S. elections after fresh signs of Russia meddling. The social media giant stated that it’s taking down accounts involved in illicit activities and stepping up searching state-controlled media trying to manipulate American voters.

Facebook pledged to use a variety of security measures, including artificial intelligence, to counter Russian attackers or other online intruders who use misleading strategies and false information to meddle in the 2020 U.S. elections. The new steps announced by Facebook include, Fighting Foreign Interference, preventing inauthentic behavior, Increasing transparency, labeling state-controlled media on their Page and in the Ad Library, preventing the spread of misinformation, and monitoring candidates accounts, elected officials through Facebook Protect.

“Smart technology for automated coding is the answer to securing mobile apps”

Tom Tovar is CEO and co-creator of Appdome, the mobile industry’s first no-code mobile solutions platform. Prior to Appdome, Tom served as executive chairman of Badgeville, an enterprise engagement platform acquired by CallidusCloud; He was also the CEO of Nominum, a DNS security and services provider that was acquired by Akamai; and chief compliance officer and VP of corporate development and legal affairs at Netscreen Technologies. He began his career as a corporate and securities attorney with Cooley Godward LLP. Tovar also holds a JD from Stanford Law School and a BBA in finance and accounting from the University of Houston.

 In an exclusive interaction with Augustin Kurian of CISO MAG, Tom talks about the trends in cybersecurity startups, the no-code model adopted by the company and several initiatives and partnerships of Appdome.

 You began your career as a corporate and securities attorney with Cooley Godward LLP. You then moved to Netscreen Technologies before starting a few of your own ventures. Tell us a bit about your journey in the information security domain.

That’s right. As a lawyer in Silicon Valley, it doesn’t take long to zero in on risks and strategies needed to preserve intellectual property, and the value of data and user privacy. To get these parts right, you have to understand the systems that protect all the elements of the value chain. NetScreen’s market-defining firewall-protected the enterprise perimeter, as well as the data and users behind it. Today, Appdome focuses on securing mobile apps inside the enterprise and in the public consumer markets. As consumers and digital workers, we all use mobile apps to conduct our work, enjoy mobile commerce, as well as share and learn from one another. Our data flows into the mobile apps we use at work and at play. Breaches, compromised processes, loss of data, identity theft, or hacked code; APIs and SDKs threaten how we use our apps. Appdome created a one-of-a-kind solution that secures the mobile data, code, connection and user in seconds, adding the highest levels of security without work, source code, IP or privacy risks.

You have closely seen the startup culture in the information security industry. You helmed major startups which were later acquired by other major infosec tycoons. Can you elaborate on the current startup scene in the cybersecurity industry?

The security market has grown into one of the most dynamic and exciting spaces ever. And when you think about it, it has to be. Threats to digital and mobile economies evolve at lightning speeds. Entrepreneurs and start-ups have to step in to close the gaps. I like companies that leverage A.I., data, and crowdsourcing to deliver solutions that customers need. Customers will continue to reward innovation, for fast outcomes and systems that work. The highest growth potential rests with those start-ups that can combine all three into a single offering. That’s what excites me about Appdome.

What are your tips for budding cybersecurity professionals who want to jump on the entrepreneurial bandwagon?

First of all, do it. Innovation comes from people and the market needs more people stepping forward to start companies. To be successful, look at the market. The companies that are winning are solving something worth solving. They’ve zeroed in on a problem that’s real, pervasive and persistent. They’ve also delivered something that is unique to them. Customers teach each company where to go and what to do next, but the entrepreneur has to take the first step.

One of the biggest concerns at endpoints is securing the mobile app’s APIs. Tell us about how Appdome is securing the mobile app’s APIs with AI and no-codes.

Inside each mobile application rests a treasure trove of business, backend, and user data. Mobile APIs are a big part of that story as developers rightly use APIs to enrich mobile applications for all of us. For example, at this year’s Money 2020 trade show, I saw so many awesome API-based services for everything from biometric authentication, to customer engagement and more. Appdome’s SecureAPI™ secures APIs in mobile apps in minutes, protecting the API itself, as well as the credentials used, and the payloads delivered by the API into mobile apps. Appdome’s SecureAPI™ does not rely on a gateway or highly specialized security development expertise. Users simply click a button to encrypt and shield all the API fundamentals (API URLs, Keys, Secrets, etc.), as well as protect API payloads in motion.

The U.S. Navy’s MyNavy Portal Mobile App using Appdome was one of the news that made headlines early this year. How does Appdome fare against state-sponsored actors considering the U.S. Navy would always be targeted by other nations?

Appdome is honored to provide the U.S. Navy military-grade security for the My Navy Portal mobile apps. We helped them deliver the project faster, with better security than originally scoped. Our technology ensures the Navy, and all of our other customers have the highest levels of security to protect them from all bad actors.

Tell us a bit about the anti-bot services of Appdome and even that doesn’t require coding?

Appdome has a phenomenal partnership with F5 Networks to defend mobile businesses against bots. F5 Anti-Bot SDK does the heavy lifting to protect the mobile backend from bots, while Appdome does the heavy lifting to secure the mobile client from tampering, reversing and debugging. It’s a fast, easy-to-use, end-to-end solution that helps F5 customers defend their mobile businesses without doing any manual coding. Like all of our solutions, Appdome for F5 Anti-Bot is compatible with all native, non-native, and hybrid Android and iOS apps.

This brings us to the last question. A lot of services from Appdome are no-code. Why is that? Do you think no-code formats must be an industry standard?  

The best technologies help us do more in our work and daily lives. That’s why all features, SDKs, APIs and mobile standards available on Appdome are 100 percent no code out-of-the-box. Manually building or coding security into apps takes a lot of time and expertise. Security researchers and engineers are highly specialized professionals. So, it’s easy for the rest of us to fall behind, make mistakes, and more. Appdome believes that using smart technology to perform automated coding is the answer to securing the world’s mobile apps. Build by build, app makers can use Appdome to build standard, self-adjusting, templates of mobile security features into mobile apps with the click of a button. Appdome ensures that mobile security objectives will be achieved no matter how the app, OS, SDK or API changes.

Augustin Kurian is part of the editorial team at CISO MAG and writes interviews and features.

Domain Registrar Web.com Hacked!

Popular domain registrar Web.com and its subsidiaries Network Solutions and Register.com are the latest victims of a hacker attack that resulted in the theft of customers’ sensitive information.

According to the official report, unknown intruders accessed the company’s computer systems that gave them access to the account information of current and ex-customers. The intrusion occurred in late August 2019, but the companies said they became aware of the breach on October 16, 2019.

After its investigation, Web.com stated that attackers accessed nearly 22 million records of current and former users of Network Solutions, Register.com, and Web.com accounts. The exposed information included name, address, phone number, email address, and other details of customer accounts. However, Web.com clarified that no financial information was exposed in the incident.

“We store credit card numbers in a PCI (Payment Card Industry) compliant encryption standard and do not believe your credit card information is vulnerable as a specific result of this incident. That said, it is good practice to monitor your credit card account and we encourage you to notify your credit card provider if you see any suspicious charges,” the statement added.

“We encrypt account passwords and do not believe this information is vulnerable as a specific result of this incident. As an added precautionary measure, customers will be required to reset passwords the next time they log in to their accounts. As with any online service or platform, it is also a good security practice to change passwords often and use a unique password for each service,” a spokesperson of Web.com said.

The companies, Network Solutions, Web.com, and Register.com, stated they’re notifying the affected users via email and their websites, and have also reported the incident to federal authorities for further investigation.

Office 365 Voicemail Phishing Alert!

Hackers Target Office 365 Users with SurveyMonkey Phishing Campaign

Office 365 provides users the ability to use all traditional Office Suite applications such as Word, PowerPoint, Excel, Access, Outlook, etc. on the go. This widespread usage acts as a prime reason for its popularity among varied businesses and working professionals. But this popularity has attracted a lot of attention from hackers and the dark web world.

According to a blog published by McAfee Labs Senior Security Researcher, Oliver Devane, Voicemail Phishing attacks using different phishing kits have been on a steady incline in recent weeks. While voicemail phishing technique is not alien to anyone but using multiple phishing kits to enable a voicemail phishing attack is a first of its kind.

Oliver further explains the chronology of events in this phishing attack:

  • The attack is initiated by sending a fake voicemail attachment to the user through an email. This email informs the user about a missed phone call, along with a request to login to their account to access their voicemail.

The following filenames used for attachments of phishing emails act as its indicators:

  • 10-August-2019.wav.html [Format: DD-Month-YYYY.wav.html]
  • 14-August-2019.html [Format: DD-Month-YYYY.html]
  • Voice-17-July2019wav.htm [Format: Voice- DD-MonthYYYYwav.htm]
  • Audio_Telephone_Message15-August-2019.wav.html [Format: Audio_Telephone_MessageDD-Month-YYYY.wav.html]

On accessing the attached HTML file the user is redirected to a fake phishing webpage. While redirecting an audio recording is played making the user believe the authenticity of the received voicemail message. On inspecting the source code of this audio file the following HTML code was discovered:

<audio autoplay hidden>

<source src=”http://soundbible.com/mp3/Hello-Soundbible.com-218208532.mp3” type=”audio/mp3”>

</audio>

Once the fake phishing webpage is loaded the user can see a Microsoft logo and respective email address prepopulated on the landing page replicating Microsoft’s login landing page. This screen prompts a user to enter the password stating, “Enter Password. Because you’re accessing sensitive info, you need to verify your password”.

When the password is entered, a success message is displayed on the screen and the user is further redirected to the office.com login page.

As mentioned earlier, voicemail phishing is not new to the world of cybersecurity. But this time around attackers have used not one or two, but three different phishing kits. McAfee’s report makes a mention of these three kits, namely, Voicemail Scmpage 2019, Office 365 Information Hollar, and the third one is unnamed yet, has a close resemblance to an old phishing kit used to target users in 2017. These kits are phishing users’ credentials such as email, password, IP Address, and Location.

McAfee also stated that its customers using VSE, ENS, Livesafe, WebAdvisor, and MGW are protected against these phishing campaigns as it has already taken preventive measures. McAfee has advised its users to be extra vigilant about emails and corresponding attachments received from unknown senders and requested them to use Two-Factor Authentication (2FA) instead of Single-Factor Authentication (SFA).

Hackers Plead Guilty in Uber’s 2016 Data Breach

Uber Data Breach

Two hackers, Glover and Mereacre, have pleaded guilty for their extortion scheme to steal sensitive information of 57 million Uber’s passengers and drivers.

According to the statement from the Federal Court, California, the hackers admitted stealing personal information from the ride-hailing service provider that was stored on Amazon Web Services from October 2016 to January 2017 and then demanding a ransom.

After hiding the incident for more than a year, Uber admitted, in November 2017, that two hackers gained unauthorized access to information on Github and stole Uber’s credentials for a separate cloud-services provider, where they were able to download driver and rider data.

The incident was first reported by Bloomberg on November 21, 2017. The company reportedly fired its chief security officer, Joe Sullivan, and a deputy, Craig Clark, soon after for concealing the hacking incident.

It was reported that Uber paid hackers US$ 100,000 in ransom to destroy the stolen data to hide the breach that allegedly compromised the personal information of about 57 million passengers around the world in October 2016.

A week after Uber acknowledged a massive data breach, the Washington state Attorney General Bob Ferguson sued the taxi-aggregator for failing to report the incident. On November 28, 2017, Ferguson filed a multimillion-dollar lawsuit against Uber King County Superior Court, alleging that the ride-sharing company violated the state’s revised data breach notification norm.

Ferguson charged civil penalties of up to US$ 2,000 per violation, which could result in millions of dollars if Uber loses. While asking Uber to cover the costs and fees associated with the lawsuit, Ferguson alleged that names and driver’s license numbers of at least 10,888 Uber drivers in Washington state were stolen without their being notified as state law requires.

Uber also faced a fine of £385,000 (US$ 491,284) from the United Kingdom’s Information Commissioner’s Office (ICO) for failing to protect customers’ data and not reporting the breach in a timely manner. The taxi-aggregator was also slammed by the Dutch Data Protection Authority with a fine of €600,000 (US$ 679,257) for the same reason.

The ICO stated the breach allowed hackers to illegally access personal data, including names, email addresses, and phone numbers of 2.7 million Uber customers in the U.K. and 174,000 in the Netherlands.

1...277278279...410Page 278 of 410