Intelligent Connections. Recruiting Integrity.
Call Us: 415-510-2973

Archive for the News Category

FBI Warns of Cloud-Based BEC Attacks

FBI Warns of Cloud-Based BEC Attacks

The Federal Bureau of Investigation (FBI) has issued a warning over cloud-based business email compromise (BEC) scams that have cost US companies more than $2bn.

A BEC is a sophisticated scam targeting businesses that perform electronic payments, such as wire transfers or automated clearing house transfers. Typically, the scam involves a threat actor breaching a legitimate business email account through social engineering or computer intrusion techniques. 

After gaining access to a real email account, the threat actor can fraudulently acquire funds by emailing out phony invoices containing altered bank account details to a company's vendors and suppliers.

In a statement released on April 6, the FBI said: "Cyber criminals are targeting organizations that use popular cloud-based email services to conduct Business Email Compromise (BEC) scams. The scams are initiated through specifically developed phish kits designed to mimic the cloud-based email services in order to compromise business email accounts and request or misdirect transfers of funds."

The FBI revealed that between January 2014 and October 2019, the Internet Crime Complaint Center (IC3) received complaints totaling more than $2.1bn in actual losses from BEC scams using two popular cloud-based email services. 

BEC scams have been reported in all 50 states and in 177 countries. Losses from BEC scams overall have increased every year since IC3 began tracking this particular type of crime in 2013. 

The FBI said the way in which cloud-based email services are configured when they are acquired by users could be making life easier for cyber-criminals looking to compromise a company's email account.

"While most cloud-based email services have security features that can help prevent BEC, many of these features must be manually configured and enabled. Users can better protect themselves from BEC by taking advantage of the full spectrum of protections that are available," said the FBI.

The cost of building and maintaining robust cybersecurity means that small and medium-sized organizations, or those with limited IT resources, are most vulnerable to BEC scams. And one compromised business can have dire consequences for a whole industry.

The FBI said: "Cyber-criminals frequently access the address books of compromised accounts as a means to identify new targets to send phishing emails. As a result, a successful email account compromise at one business can pivot to multiple victims within an industry."

Source: Information Security Magazine

Fake 3D Printed Fingerprints Fool Biometric Scanners

Fake 3D Printed Fingerprints Fool Biometric Scanners

It wasn't quick or simple, but researchers at Cisco Talos have managed to break into devices secured with biometric authentication.

New research published today by Paul Rascagneres and Vitor Ventura revealed that manufactured fingerprints, created using 3D printing technology and textile glue, can defeat fingerprint authentication on a variety of phones, laptops, and padlocks. 

In a series of experiments, using different materials and restricted by differently sized budgets, researchers worked to trick capacitive, optical, and ultrasonic sensors. 

"Our tests showed that—on average—we achieved an ~80 percent success rate while using the fake fingerprints, where the sensors were bypassed at least once," wrote researchers. 

A 3D printer was used to create molds, then the fake fingerprints were cast onto materials that included silicon and fabric glue. 

“It was not so easy," Rascagneres told Infosecurity Magazine. "It took me months and a liter of resin."

To carry out their experiments, the inventive researchers used the publicly available fingerprints of nefarious gangster Al Capone.

Craig Williams, director of Talos Outreach, told Infosecurity Magazine: “It was a bit surreal to realize the use of a technology that was around during the ‘Al Capone’ era still provides effective security for most users. It will be interesting to see as technologies evolve how things change.” 

The fake fingerprints didn't work across all the devices tested. Researchers were unable to access the Samsung A70 phone, the Lexar Jumpdrive Fingerprint F35, or the Verbatim Fingerprint Secure USB-encrypted pen drive. 

Researchers were able to crack into an iPhone 8, Samsung S10, Huawei P30 Lite, MacBook Pro 2018, iPad 5th Gen, Samsung Note 9, Honor 7X, and an AICase Padlock. 

Given the expense, time, and effort it took to break into devices protected by fingerprint authentication, the researchers concluded that this security measure is adequate for the majority of the population. 

They wrote: "For a regular user of fingerprint authentication, the advantages are obvious, and it should be used. However, if the user is a more high-profile or their device contains sensitive information, we recommend relying more on strong passwords and token two-factor authentication."

Source: Information Security Magazine

Accenture Acquires Revolutionary Security

Accenture Acquires Revolutionary Security

Accenture has acquired a privately held Philadelphia company specializing in enterprise cybersecurity for information technology and operational technology environments.

Global professional services company Accenture announced its acquisition of Revolutionary Security on April 7. The financial terms of the deal were not disclosed.

Revolutionary Security was founded in 2016 and is headquartered in Whitpain Township, Pennsylvania. The company employs 90 cybersecurity professionals throughout the United States and serves a variety of clients in the energy, manufacturing, healthcare, financial services, and communications industries.

“The acquisition of Revolutionary Security is another demonstration of our continued commitment to invest in areas to keep our clients safe from cyber-threats,” said Kelly Bissell, who leads Accenture Security globally. 

“Revolutionary Security’s service offerings are a perfect complement to Accenture’s portfolio, and the acquisition furthers our mission of helping clients better protect and defend their organizations across their entire ecosystem.”

Jim Guinn II, who leads Accenture’s cybersecurity business for the energy, utilities, chemical, and mining industries, added that Revolutionary Security’s "extensive experience working with industrial companies and their specialized technical skill set will be incredibly valuable to our clients.”

Cybersecurity services offered by Revolutionary Security include assessment and testing, design and build of security programs and functions, and security operations across its clients’ IT and OT (operational technology) systems.  

LiveFire—Revolutionary Security's breach and attack simulation testing service—utilizes real-world cyber-threats to identify gaps in security processes and monitoring, as well as staff operations and technologies. 

President and CEO of Revolutionary Security Rich Mahler believes the acquisition will trigger growth. 

He said: “The opportunity to become part of Accenture Security will enable us to deliver more complete solutions to our clients and expand our services to even more clients globally. We’re excited to be joining a leading provider in cybersecurity services and look forward to working together to help clients solve their toughest challenges in IT and OT security.”

In March, Accenture agreed to acquire Context Information Security, which is the latest in a series of acquisitions—including those of Symantec’s Cyber Security Services, Deja vu Security, iDefense, Maglan, Redcore, Arismore, and FusionX—that the company says demonstrate Accenture Security’s "commitment to investing in and innovating advanced cybersecurity solutions."

Source: Information Security Magazine

Microsoft: Cyber-Criminals Are Targeting Businesses Through Vulnerable Employees

Microsoft: Cyber-Criminals Are Targeting Businesses Through Vulnerable Employees

Microsoft has warned that cyber-criminals are preying on people’s vulnerable psychological states during the COVID-19 pandemic to attack businesses. During a virtual press briefing, the multinational technology company provided data showing how home working and employee stress during this period has precipitated a huge amount of COVID-19-related attacks, particularly phishing scams.

Working from home at this time is very distracting for a lot of people, particularly if they are looking after children. Additionally, many individuals are in a stressful state with the extra pressures and worries as a result of COVID-19. This environment is providing new opportunities for cyber-criminals to operate.

“We’re seeing a significant increase in COVID-related phishing lures for our customers,” confirmed Ann Johnson, corporate vice-president, Microsoft. “We’re blocking roughly 24,000 bad emails a day with COVID-19 lures and we’ve also been able to see and block through our smart screen 18,000 malicious COVID-themed URLs and IP addresses on a single day, so the volume of attacks is quite high.”

Johnson therefore urged businesses to adapt and step up security practices in this environment. She noted that in the rush to get employees set up working from home productively, putting in place more stringent measures has been something of an afterthought for many businesses.

“It’s important to educate users and tell them to pause and think before they click on a link, and the second thing we’re telling organizations is that they need to enable multi-factor authentication for 100% of users, 100% of the time, because if their users are stressed, they are going to click on those links and potentially give away their credentials,” added Johnson.

In the briefing, Microsoft stated that the countries most targeted by COVID-19 attacks have been China, the US and Russia, followed by Japan and parts of Latin America. The global technology giant has also seen signs that the volume of attacks is beginning to normalize over the past few days.

Source: Information Security Magazine

Quarter of DevOps Suffer Open Source Component Breaches

Quarter of DevOps Suffer Open Source Component Breaches

A quarter of organizations have suffered a breach related to their application development process over the past year, with most of these coming via open source components, according to Sonatype.

The DevOps automation firm’s 2020 DevSecOps Community Survey is based on responses from 5045 software professionals around the world.

It revealed that 21% of the 24% of responding organizations that reported a breach over the past 12 months linked it to use of third-party components.

These are incredibly popular among DevOps practitioners as they help to speed the release of new products, although they can also contain vulnerabilities and sometimes malware.

Interestingly, the figure for reported open source component breaches rose to 28% for those organizations with mature DevOps practices that include keeping a Software Bill of Materials (SBOM) for all components.

This could be because of cultural differences associated with finding and reporting such issues, Sonatype claimed.

“DevOps practice and thought leaders continue to suggest that mature DevOps cultures supports scenarios where information is actively sought, new information is welcomed, and bridging functional groups is a rewarded behavior,” the report added.

“Failures are not silent in mature DevOps practices, but rewarded. For mature DevOps practices, awareness is one of the best agents for driving change.”

The report also suggested that happy developers are more likely to be good for overall cybersecurity: they are 3.6-times less likely to neglect security when it comes to code quality, 2.3-times more likely to have automated security tools in place and 1.3-times more likely to follow open source security policies.

Research from Sonatype last year revealed that there had been a 71% increase in open source-related breaches over the previous five years. UK firms on average downloaded 21,000 software components known to contain vulnerabilities.

Source: Information Security Magazine

Over 350,000 Exchange Servers Exposed to Serious RCE Bug

Over 350,000 Exchange Servers Exposed to Serious RCE Bug

Over 350,000 Exchange servers around the world are still exposed to a critical vulnerability patched by Microsoft in February and actively being exploited in the wild, according to Rapid7.

The security vendor deployed its Project Sonar scanning apparatus to find that over 82% of the 433,464 Exchange servers it detected were still vulnerable as of March 24.

Discovered by Trend Micro’s Zero Day Initiative, the vulnerability in question, CVE-2020-0688, allows for remote code execution on unpatched systems if the Exchange Control Panel (ECP) interface is accessible to the attacker and they have a working credential for it.

After Rapid7 itself released a Metasploit module related to the bug, security researchers at Volexity spotted “multiple APT actors” trying to exploit the vulnerability at the beginning of March.

“Many organizations employ two-factor authentication (2FA) to protect their VPN, e-mail, etc, limiting what an attacker can do with a compromised password,” the vendor explained.

“This vulnerability gives attackers the ability to gain access to a significant asset within an organization with a simple user credential or old service account. This issue further underscores why changing passwords periodically is a good best practice, regardless of security measures like 2FA.”

Rapid7 Labs manager Tom Sellers urged affected organizations to update Exchange immediately and check for compromise.

However, Project Sonar also revealed more widespread security deficiencies. It found over 31,000 Exchange 2010 servers around the world that have not been updated since 2012, while almost 800 Exchange 2010 servers have never been updated.

“In addition to the high numbers of servers that are missing multiple updates, there is a concerning number of Exchange 2007 and 2010 servers,” Sellers added.

“Exchange 2007 transitioned to End of Support (EoS) status nearly three years ago on April 11 2017. No security updates, bug fixes, timezone updates, etc., are provided after that date. Exchange 2007 does not have the vulnerability described by CVE-2020-0688 but if it did, it would not have been fixed.”

Source: Information Security Magazine

EU Privacy Tsar Calls for Europe-Wide #COVID19 Tracking App

EU Privacy Tsar Calls for Europe-Wide #COVID19 Tracking App

Europe’s data protection tsar has called for a pan-EU COVID-19 health tracking app to avoid fragmented member state approaches which may not follow privacy-by-design principles.

European data protection supervisor (EDPS), Wojciech Wiewiórowski, said his team is already cooperating with other EU institutions to create a joined-up approach in line with GDPR.

He argued that even the strict EU data protection regulation makes some allowances for use of personal data in exceptional circumstances like the current pandemic.

“GDPR states that the right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality,” explained Wiewiórowski.

“Legality of processing the personal data – even so called sensitive data like data about health – can be achieved when processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued.”

To that end, even if specific data processing during the crisis may interfere with privacy rights, it may be necessary. However, an EU-wide approach as advocated by the EDPS will ensure any measures are temporary, and limited in purpose and data access.

There must also be a clear “way back to normality” – i.e. organizations must know what they will do with any data collected after the crisis is over, said Wiewiórowski.

“The EDPS is aware that a number of EU member states have or are in the process of developing mobile applications that use different approaches to protect public health, involving the processing of personal data in different ways. The use of temporary broadcast identifiers and Bluetooth technology for contact tracing seems to be a useful path to achieve privacy and personal data protection effectively,” he added.

“Given these divergences, the EDPS calls for a pan-European model ‘COVID-19 mobile application,’ coordinated at EU level. Ideally, coordination with the World Health Organisation should also take place, to ensure data protection by design globally from the start.”

The statement should go some way to assuaging the fears of global rights groups, which signed an open letter last week warning that efforts to contain the virus mustn’t be used as cover to usher in a new era of online surveillance.

They claimed that telecoms-based tracking is already underway in 23 countries, while 14 have deployed tracking apps.

Tracking infection rates and movement across the populace is seen as an essential step to helping prevent the spread of the pandemic and a key pillar of any lockdown exit strategy.

Source: Information Security Magazine

Akamai CSO: Online and Remote Work is the Future of Business

Akamai CSO: Online and Remote Work is the Future of Business

The internet is proving to be the most valuable resource at the moment, and opportunities will await those who adapt and are more prepared.

Speaking as part of the Akamai Edge conference, delivered as a virtual summit, Andy Ellis, CSO and senior vice-president at Akamai, said that where once the internet was disruptive, it is now enabling us to teach our children and talk to family members during the COVID-19 crisis.

“Maybe we’re at conferences that are recorded in people’s basements, living rooms and potentially on their back porch, and we didn’t have to travel to them,” he said. “Maybe we’re having meetings with staff no longer focused on who is in the headquarters.”

Ellis called these “opportunities for us to seize” and we can wait and “return to the world we used to be in” when COVID-19 pandemic is over, but the digital landscape is now different now. “People have tasted the opportunity where we have meetings on video rather than in person,” and support staff who can work wherever they want to be, as long as they have an internet connection.

“The world we are going to come out of this in, will be one in which the internet becomes a more crucial component of everything we do,” he said. This could be exercise, banking, work or school; “the opportunities are bound for us and those who anticipate and seize them and are prepared to adapt will come out of this more prepared for the world we will be in,” he said.

“Those who merely sit on their hands and wait, and are not prepared for the changes of the digital landscape, will be the followers. Which do you choose to be? My preference is to seize the opportunity.”

Asked by Infosecurity if he felt that threats were consistent or if they are taking advantage of a more dispersed and remote workforce and potentially vulnerable staff, Ellis followed Tom Leighton’s earlier point that attackers may have more time on their hands, but what has really happened is the environment has changed. “Businesses that were ill-prepared for the moment that we’re in are probably finding it a little more challenging to operate as where they are today isn’t where they were, and isn’t what their security was set up for,” he explained.

He added that too many businesses worked in a siloed model, and now everyone is remote “and what worked when 5% of the workforce [worked remotely] doesn’t work when 100% of the workforce is distributed, especially when they are seizing new technologies to enable them with their work which will expose you to hazards.”

Source: Information Security Magazine

Scammers Target US Stimulus Checks

Scammers Target US Stimulus Checks

In the latest sorry COVID-19 scam, fraudsters are impersonating financial institutions to steal from Americans expecting stimulus checks from the US federal government. 

Following the outbreak of the novel coronavirus, many Americans have been furloughed, fired, or had their hours or workload reduced as businesses across the country closed and lockdown measures were implemented. 

To soften the economic blow dealt by the deadly virus, the US Senate approved a $2tn stimulus package on March 25. 

Knowing that people all across America are now waiting to receive a government check, threat actors have swooped in to exploit the situation.

Researchers at Abnormal Security have detected an attack in which scammers impersonating a major financial institution are asking victims to verify their financial details before their stimulus funds can be released.

"These attackers created a convincing email and landing page that appeared to come from a major financial institution," wrote researchers.

"The email sent by the attackers claims that this financial institution has placed the funds on hold until the user can sign in and 'verify account ownership' so they can be released."

The email contains a link to a fake website that appears to be from a legitimate financial institution. 

"The URL is masked with a link, and the real URL takes victims to a site hosted at 'https://theruncoach.icu/home.php,' which attackers likely control and will use to steal the login credentials for this financial institution from victims," wrote researchers. 

Should recipients of the email fall victim to this attack, the login information for their banking account will become compromised.

In a bid to appear authentic, the attackers also inserted other genuine links into the email, including one that took users to the impersonated financial institution's real privacy statement.  

"The landing page was similarly elaborate, appearing almost exactly like the true bank landing page," wrote researchers. 

"Recipients would be hard-pressed to understand that this was, in fact, a site designed specifically to steal their credentials."

Researchers would not name which financial institution the scammers they observed were pretending to be associated with. 

"Please keep in mind that, although these attackers were impersonating one specific financial institution for this attack, they have already launched attacks impersonating many other financial institutions," said the researchers.

Source: Information Security Magazine

Linux Servers Under Attack for a Decade

Linux Servers Under Attack for a Decade

New research has found that the Linux platform has been under attack from Chinese threat groups for a decade. 

The "Decade of the RATs Research Report," published today by BlackBerry, reveals how five Chinese APT groups targeted Linux servers, Windows systems, and mobile devices running Android in a prolonged cross-platform attack. 

Researchers said that they are confident that the APT groups "are likely comprised of civilian contractors working in the interest of the Chinese government who readily share tools, techniques, infrastructure, and targeting information with one another and their government counterparts." 

Currently, Linux runs on all of the world’s 500 fastest supercomputers, and 90% of all cloud infrastructure and 96.3% of the world's top 1 million servers run on Linux.

Historically, the Linux platform has been overlooked from a security perspective. 

"One of the main reasons there aren’t many security tools for Linux is because there are relatively few Linux machines in the world (roughly 2%), therefore it’s a tough way for companies to make money,” Eric Cornelius, chief product architect at BlackBerry, told Infosecurity Magazine.

"Security products and services are not as widely deployed for Linux platforms as they are for the more popular Windows and Mac platforms."

Cornelius added that a prevailing assumption that Linux is more secure because it is open source "is just not the case." 

Asked what currently overlooked platforms could become "the Linux of the future" from a cybersecurity perspective, Cornelius said: “The most obvious one is mobile. As the 'Mobile Malware' report that we released this past fall points out, security vendors have only recently started deploying products to address a problem that governments and government-backed groups have been getting away with for a decade or more, with relative impunity. 

“Attitudes about adware are the source of another area of concern, as more and more APT groups disguise their malware as adware, thinking that it can fly under the radar and receive low priority if caught. We’ve also seen an uptick in the abuse of legitimate cloud service providers whose infrastructure is being co-opted by attackers to carry out their operations.”

By exposing a threat that has emerged from the past, the new research is bad news for security professionals, already stretched by dealing with current and predicted threats. 

Asked how professionals should split their attention when it comes to countering attacks, Cornelius said: “It's a process, not an exact science. But too often, the security industry and network defenders fixate on the next and the newest and forget to look back to see how past threats have evolved. As the old adage goes, 'Those who cannot remember the past are condemned to repeat it.'”

Source: Information Security Magazine