Home Blog Page 279

Mysterious Malware Infects over 45,000 Android Phones

GO SMS Pro Android App Still Vulnerable to Data Exposure

Thousands of Android users have been complaining online about a malicious app that hides itself, downloads other threats, and displays ads on the infected devices, and reinstalls itself even after users delete it from their devices.

According to a report published by Symantec, the malicious app packed with the malware, named Xhelper, has infected more than 45,000 Android devices in the last six months and is continuing to infect 2,400 devices on an average each month. Symantec stated the malicious app mainly targeting mobile users in India, U.S., and Russia.

Though Symantec didn’t find the exact source of the malicious app, it did suspect that the malicious app was pre-installed on Android devices from certain brands.

Once launched, the malware connects to its remote command-and-control server over an encrypted channel and downloads additional payloads like clickers, droppers, and rootkits on the infected Android devices.

“None of the samples we analyzed were available on the Google Play Store, and while it is possible that the Xhelper malware is downloaded by users from unknown sources, we believe that may not be the only channel of distribution,” Symantec said in its report. “From our telemetry, we have seen these apps installed more frequently on certain phone brands, which leads us to believe that the attackers may be focusing on specific brands.”

“However, we believe it to be unlikely that Xhelper comes preinstalled on devices given that these apps don’t have any indication of being system apps,” the report added.

Symantec urged Android users to take simple precautions like, keeping devices and apps up-to-date, avoiding app downloads from unfamiliar sources, paying attention to the permissions requested by apps, frequently back up data and installing a good antivirus app that protects against malware and similar threats.

A similar research from Kaspersky revealed an ongoing Android malware campaign dubbed ViceLeaker that has been active since 2016. According to Kaspersky, a hacker group has been found targeting Israel citizens and other Middle East countries with surveillance malware named Triout. The malware is designed to steal sensitive information, including call recordings, text messages, photos, videos, and location data without users’ knowledge.

Apart from spying features, the malware also has backdoor capabilities, including upload, download, delete files, record surrounding audio, takeover camera, and make calls or send messages to specific numbers, according to the researchers.

Facebook sues NSO Group for violating Computer Fraud and Abuse Act

WhatsApp and Indian governmentWhatsapp Hack

Facebook has sued the Israel-based cyber intelligence company NSO Group for violating the Computer Fraud and Abuse Act. According to the lawsuit filed in the federal court, the NSO Group deployed its custom malware on around 1,400 WhatsApp installed mobile devices in April and May 2019.

NSO Group is a developer of spyware for mobile devices. The firm is known for the development of Pegasus software that targets mobile phones to gather information and provides authorized governments with technology that helps them combat terror and crime.

In May WhatsApp, a Facebook-owned instant messaging app, revealed that it discovered a vulnerability in its network system that allowed hackers to install spyware via an infected WhatsApp voice call. It stated that the spyware can exploit the mobile device, its calls, and texts; it activates the phone’s camera, microphone, and it is able to perform other malicious activities. The malicious spyware was developed by the NSO Group, according to Facebook.

Now, after its investigation, Facebook revealed that the attack was linked to the NSO Group. It stated the attackers used servers and Internet-hosting services that related to NSO. According to WhatsApp’s findings, nearly a hundred human rights advocates, journalists, and members of civil society across the world were targeted in the attack.

“Between and around April 2019 and May 2019, Defendants used WhatsApp servers, located in the United States and elsewhere, to send malware to approximately 1,400 mobile phones and devices. Defendants’ malware was designed to infect the Target Devices for the purpose of conducting surveillance of specific WhatsApp users. Unable to break WhatsApp’s end-to-end encryption, Defendants developed their malware in order to access messages and other communications after they were decrypted on Target Devices. Defendants’ actions were not authorized by the Plaintiffs and were in violation of WhatsApp’s Terms of Service. In May 2019, the Plaintiffs detected and stopped Defendants’ unauthorized access and abuse of the WhatsApp Service and computers,” a statement from the lawsuit read.

China Passes New Cryptography Law

Chinese actors target telecom

In an attempt to ensure the security of cyberspace and information, the Chinese government recently passed a new law on cryptography. This paves the way for the country to release its own digital currency, which is aimed at cutting costs of circulating  paper money and to help policymakers control the money supply

The new cryptography law, which comes to effect on January 1, 2020, is designed to assist the development of the cryptography business and enhancing the security of cryptocurrency.

In 2014, China’s Central Bank set up a research team to work on its digital currency to cut the costs of traditional paper money and to control the money supply. The new digital currency can be used across major payment platforms like WeChat and Alipay, according to the Central Bank.

Previously, a wide range of uncoordinated laws and regulations governed the Internet in China. The Chinese government implemented a contentious new law in 2017, which allegedly imposes strict requirements on data storage and scrutiny. The proposed law, which was approved in November 2016 by China’s National People’s Congress, prohibits service providers from recording and selling the personal information of Internet users. In the case of these prohibitions being violated, it also gives users greater information security rights, including requirements that their data be wiped clean.

International trade organizations opposed the new Chinese regulations, at a minimum pushing for a delay in implementation, arguing that the new rules would hamper business activities on the Internet in China.

In an attempt to prevent any damage to global trade services, the U.S. asked China not to implement its stringent cybersecurity law. In a two-page document submitted for debate at the World Trade Organisation (WTO) Services Council, the U.S. claimed that China’s new cybersecurity norms can have a huge impact on cross border services supplied through a commercial presence abroad.

Strontium Hacker Group Targets 2020 Tokyo Olympics

Tokyo Olympics 2020

Microsoft recently warned about a new wave of targeted cyberattacks by a group of state-sponsored Russian hackers.  According to Microsoft’s Threat Intelligence Center report,  attackers targeted nearly sixteen International Sporting and Anti-Doping organizations ahead of the 2020 Summer Olympics in Tokyo.

Microsoft stated the attacks are linked to a Russian hacking group “Strontium,” also known as Fancy Bear or APT28, which is believed to be linked to Russian military intelligence agency GRU and has been active since 2007.

The tech giant revealed that the methods used in recent attacks are similar to those previously used by Strontium to target government organizations, think tanks, militaries, law firms, human rights organizations, and financial firms across the world. It’s said that the Strontium group launched a variety of attacks, including spear-phishing, exploiting internet-connected devices, and password spraying.

According to Microsoft, the attacks have occurred in September 2019, after the World Anti-Doping Agency (WADA) announced a ban of all Russian athletes from all upcoming world championships and Olympics sporting events.

“At least 16 national and international sporting and anti-doping organizations across three continents were targeted in these attacks which began September 16th, just before news reports about new potential action being taken by the World Anti-Doping Agency. Some of these attacks were successful, but the majority were not. Microsoft has notified all customers targeted in these attacks and has worked with those who have sought our help to secure compromised accounts or systems,” Microsoft said in a statement.

In order to avoid any kind of cyber threats during the 2020 Olympic and Paralympic Games, the Japanese government introduced a new cybersecurity strategy in 2018. As a part of the strategy, the government plans to create a new body to ensure effective coordination among government agencies, the Olympic organizing committee, municipalities, and business operators to respond to cyber threats.

The government also decided to introduce a five-level scale to classify the severity of cyber-attacks. The severity index categorizes the cyber-attacks into five levels: the lowest level 0 indicates “No Impact” while the highest level 4 indicates “Extremely Grave Impact.” The index would be helpful for people, government, and business entities in understanding the magnitude of threats and taking necessary actions.

Insider Threats: A Problem That is Preventable

Insider Threats

By Tony Pepper, CEO & co-founder, Egress

Earlier this summer, I read a fascinating story about McAfee launching a lawsuit against three former employees. The lawsuit alleged that these employees conspired to steal trade secrets on behalf of their new employer, accusing them of moving to a competitor and exfiltrating business-sensitive documents to their personal email accounts.

The scenario in the McAfee suite is a classic case of insider risk in action: privileged users accessing sensitive internal data and intentionally leaking it to personal email addresses or file-sharing sites. These edge cases are quite difficult for traditional data loss prevention (DLP) controls to mitigate, as they operate based on pre-defined static rules. One major issue is that traditional DLP doesn’t take a proactive stance with the user because its simplistic alerts and reminders tend to be written off as “nagging.” This is why new proactive and intelligent machine learning-based approaches provoke a strong reaction from leading firms as they modernize their email security strategies. By detecting gray areas of human risk, engaging users, and providing corrective guidance, insider problems can be significantly mitigated.

The McAfee incident underscores a widespread issue continuing to face businesses in all industries. Insider threats are a major concern for IT leaders, so why hasn’t the problem been dealt with? Why do scenarios like McAfee’s remain all too common? Unfortunately, the reason the issue has been unaddressed for so long is that most solutions are not effective at analyzing email and file content, validating recipient identity, or, at a more fundamental level, understanding the difference between good behavior and bad.

Each and every leakage vector outlined in the McAfee case is detectable and preventable by systems that can learn what the normal pattern of behavior is and contrast it to potentially risky or even malicious behavior. When intelligent, pattern-based approaches are used in conjunction with powerful, user-facing DLP, it’s a potent combination. The result is a new preventative and active approach to real-time insider detection and mitigation.

And while the McAfee case is a great example of what can happen when insiders decide to intentionally leak information for personal gain, the reality is that the most insider threats are not malicious at all, but accidental. Earlier this year, Verizon’s annual Data Breach Investigations Report revealed that more than 50 percent of data breaches are caused by phishing attacks or the use of stolen credentials. While privilege abuse and data mishandling of the type that affected McAfee remain prominent within the ‘misuse’ category of attacks, accidental breaches caused by employees failing to identify and avoid phishing scams and other, similar social engineering attacks are much more common. It’s worth remembering that the person responsible for a breach isn’t always an obvious, mustache-twirling villain. Sometimes it’s just a well-meaning employee unsure which warning signs to look out for.

Fortunately, the same pattern-based approaches that have proven effective at identifying malicious behavior are also highly capable of detecting careless behavior. In this way, the system doesn’t even need to determine “good” behavior from “bad” behavior: it only needs to identify behavior outside the norm. Look at it this way: how many times have you accidentally sent an email to the wrong person? Now extrapolate that number out to an entire organization. Misdirected emails happen, but the trick is to identify those emails—especially those containing sensitive information—before they can be sent.

When this strategy is taken to the next level and feedback is provided directly to end-users as well as InfoSec ops, it’s a powerful educational, awareness, and risk prevention approach. An employee who is about to do something risky can be warned automatically, avoiding the embarrassment and cost of an investigation—not to mention the fact that the business itself will avoid a costly breach.

Traditional DLP methods have focused on post-incident monitoring and remediation; however, legal recourse (as in the McAfee case) is a substantially costlier approach to insider breaches. It can also be unpleasant for businesses to deal with post-breach fallout, fines, and negative media coverage. Adopting a prevention-focused approach to insider threats can help not only stop many breaches from occurring in the first place, but bring a greater understanding of the dangers of both malicious and accidental threats to the workforce.

Co-founder of Egress, Tony currently serves as CEO, overseeing all aspects of business growth and innovation. Prior to Egress, Tony held executive management positions at Reflex Magnetics, Pointsec Mobile Technologies, and Check Point Software Technologies.

A frequent technology and industry speaker, Tony holds a Bachelor of Politics degree, a Software Engineering Master’s and is a certified BCS Fellow. Tony sits on industry committees including Intellect’s Government Management and Defence & Security Groups.

CISO MAG did not evaluate the advertised/mentioned product, service, or company, nor does it endorse any of the claims made by the advertisement/writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Adobe’s 7.5 million Creative Cloud Accounts Exposed

Adobe Creative Cloud

Adobe, a known name in creative cloud services, has mistakenly exposed around 7.5 million user account details. This vulnerability was brought to light by Security Researcher and Consultant Bob Diachenko and reported in the press by Paul Bischoff Tech Journalist, Privacy Advocate And VPN Expert from Comparitech.

As per Adobe’s whitepaper, most components of Creative Cloud are hosted on Amazon Web Services (AWS) which include Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Simple Storage Service (Amazon S3). The Elasticsearch database is used to store, search, and analyze large volumes of data in near real-time. Diachenko’s analysis spotted that this Elasticsearch database was left exposed as there was no password protection provided for it. The result – if people knew how to find this vulnerability, they could easily access the database through their browser and find details of 7.5 million Creative Cloud accounts at their fingertips. It was also found that this flaw was live and unnoticed for close to a week, but whether anyone else had unauthorized access to it is not known.

Diachenko reported this security flaw to Adobe on October 19 to which it responded immediately and also gave a formal update to its users through the Adobe Blog. It stated: “At Adobe, we believe transparency with our customers is important. As such, we wanted to share a security update.

Late last week, Adobe became aware of a vulnerability related to work on one of our prototype environments. We promptly shut down the misconfigured environment, addressing the vulnerability.

The environment contained Creative Cloud customer information, including e-mail addresses, but did not include any passwords or financial information. This issue was not connected to, nor did it affect, the operation of any Adobe core products or services.

We are reviewing our development processes to help prevent a similar issue occurring in the future.”

The good news is that the user data which was exposed did not contain payment information or passwords, but it did include info such as:

  • Email address
  • Account creation date
  • Adobe products subscribed
  • Subscription status
  • Member IDs
  • Country
  • Time since last login
  • Payment status

The only concern that Adobe now has is that if someone did lay hands on this piece of information then its users are at risk of a Phishing attack.

Aviatrix Raises US$ 40 Million to Accelerate Growth

Aviatrix Funding

Aviatrix, a provider of advanced networking and security services, recently secured US$ 40 million in a Series C funding round led by existing investor CRV along with the participation from Formation 8, Ignition Partners, and Liberty Global Ventures.

The startup stated the new investment will be used to expand its sales channel, customer support, marketing, and product development operations and help enterprises by protecting their critical applications from on-premises to the public cloud.

Founded in 2014, Aviatrix develops software products that enable enterprises to build hybrid clouds. The company is focussed on Hybrid Cloud Networking, VPC Peering, Cloud networking, AWS Direct Connect, Azure ExpressRoute, AWS Marketplace, Global Transit Network, Egress Security, and Cloudsquad. Aviatrix also allows networking for CloudOps for enterprise SaaS vendors.

Speaking on the new investment, Steve Mullaney, the CEO at Aviatrix, said, “Business and application owners demand networking and security teams provide the same level of resiliency, performance, functionality, and security in the cloud as they get on-premises. The basic constructs of AWS and the other public clouds do not give enterprises the toolset required to accomplish this, and it is causing a great deal of pain for IT moving to the cloud.”

“Aviatrix gives enterprise IT an architecture to provide a common set of networking, security, and operational services across one or more public clouds. We’re seeing unprecedented demand from some of the largest organizations, and this latest funding will enable us to extend our demonstrable market leadership even more quickly,” Mullaney added.

Fortinet Acquires enSilo to Boost Endpoint Security

FireEye Acquires Respond Software

Network and software security firm Fortinet recently acquired endpoint detection and response firm enSilo to accelerate its security solutions to the edge of corporate IT environments. The acquisition further enhances the Fortinet Security Fabric.

enSilo provides a robust set of endpoint security tools. The company develops pre-infection, threat hunting, and incident response capabilities for a comprehensive endpoint solution.

Fortinet intends to offer customers additional security effectiveness through the integration of enSilo’s endpoint detection and response (EDR) technology with Fortinet’s FortiSIEM solution. FortiInsight UEBA (user entity behavior analytics) features, and FortiNAC solution.

Enterprises will gain better endpoint visibility and tightly coordinated, dynamic control of the network, user, and host activity within their environment. Likewise, MSSPs will be able to extract the full value of this combination and deliver a comprehensive and efficient managed detection and response (MDR) service. Furthermore, enSilo, a Fortinet Security Fabric-ready partner prior to the acquisition, already complements FortiGate Next-generation Firewalls, FortiSandbox, FortiSIEM, and the FortiClient Fabric Agent, providing an additional detection and enforcement layer that helps organizations further reduce the time to detect, investigate, and remediate malicious attacks.

Founded in 2000, Fortinet helps service providers, public and private enterprises globally with its intelligent, seamless protection across the expanding attack surface. The company stated the new association enhances Fortinet’s Security Fabric by providing enterprises with a full suite of endpoint detection and response (EDR) capabilities designed to automate the protection against advanced threats, pre- and post-execution, with real-time orchestrated incident response functionality.

The latest acquisition deal also allows Fortinet to offer agent-based software and services aimed at automating real-time threat detection, speeding response, and secure Internet of Things (IoT) devices.

“Together, enSilo and Fortinet share the commitment to solve our customers’ most difficult challenges and to protect the endpoints and their corresponding operations and data. Now, enSilo brings its patented approach for advanced endpoint protection and response to Fortinet and its broad security portfolio,” said Roy Katmor, Chief Executive Officer and Founder, enSilo.

Commenting on the latest acquisition deal, Ken Xie, CEO, and Founder of Fortinet said, “As businesses become more networked and operations extend from the cloud to the edge and Internet-of-Things, the digital attack surface has expanded exponentially and has become more complex to secure. Manual threat hunting or point security solutions are ineffective when managing or securing these new environments. Instead, security and the network need to be integrated and orchestrated to enable advanced threat containment at network speeds. In acquiring enSilo, we add automated, real-time detection, protection, and response enhancements to our Fortinet Security Fabric to further protect endpoints and corresponding edge data.”

In 2018, Fortinet made an expansive partnership agreement with cybersecurity company Symantec to provide customers security solutions. As per the partnership deal, Fortinet’s Next-Generation Firewall (NGFW) capabilities are planned to be integrated into Symantec’s cloud-delivered Web Security Service (WSS). Additionally, Symantec’s endpoint protection solutions are also planned to be integrated into the Fortinet Security Fabric platform. The technology partnership provides essential security controls across endpoint, network, and cloud environments that are critical to enforcing the Zero Trust security framework.

Jackson Health’s HIPAA Violation Costs US$ 2.15 million fine

Healthcare Data Breaches, Premier Diagnostics data exposed

In what seems to be one of the biggest HIPAA fines imposed by OCR for the current year – Jackson Health Systems, Florida was charged a US$ 2.15 million fine on account of three separate HIPAA violation instances.

First Instance

Earlier, Jackson Health Systems based on the guidelines set by HIPAA Breach Notification Rule notified the Department of Health and Human Service’s (HHS) Office of Civil Rights (OCR) that Protected Health Information (PHI) paper records of 256 patients stored in 3 boxes were lost in 2012. But this number was corrected in 2016 and it went up to 1,436 PHI patient records. The HIPAA Breach Notification Rule specifically requires the concerned entities to notify the patients and the Department of Health and Human Services of any physical or electronic breach. It also states that if more than 500 PHI records were compromised then a notification about the same is to be given to the press.

Second Instance

During the investigation in July 2015, OCR came across a shared photograph of a Jackson Health Systems operating room screen. This image showed the patients’ medical information and was circulated on social media without acquiring required patient consent. This violated the HIPAA Privacy Rule –  which requires an entity to protect individuals’ medical records and other personal health information across all mediums. Patient’s PHI records at no point can be shared or displayed without their authorization or consent.

Third Instance

The third story is a recurring instance where an employee of Jackson Health Systems knowingly with an intent of identity theft leaked and sold around 2,000 PHI patient records. Reportedly, this employee had access to PHI records of around 24,000 patients and the authorities were in the dark about it from 2011 to 2016.

OCR also reported a few security concerns which if taken care of could have minimized the damages caused:

  • The breach was not reported by Jackson Health System when it was first noticed. An accurate breach report during the first breach instance itself would have helped JHS define effective and more stringent security measures avoiding further penetration attempts.
  • It did not take enough measures to identify risks and regularly carry-out IT audits. IT audits help in identifying threat elements and defining a secure architecture for any organization.
  • Although a third-party risk assessment firm recommended a few measures in 2014,  findings suggest they were not effectively implemented.

They are now said to have upgraded and implemented their software and other procedures along with HIPAA related training process to its entire workforce in phases. The Jackson spokesperson said, “(We) recognized and reported (the privacy breaches) because strong organizations like ours admit their errors clearly, learn from them thoughtfully, and take decisive action to prevent them in the future.”

1...278279280...410Page 279 of 410