Cyber crime is a serious threat to safety in the skies, aviation industry heavyweights said Wednesday, vowing to fight the growing scourge before it causes a catastrophic incident.

Hackers, cyber criminals and other “terrorists” are stealing information but in a worst-case scenario could endanger lives by tampering with airline systems.

Among the five organizations getting together to take action against hacking are the International Air Transport Association (IATA) and other bodies that signed a new cyber security agreement late last week, formalizing their front against cyber crime.

“Our common goal in developing this agreement is to work more effectively together to establish and promote a robust cyber security culture and strategy for the benefit of all actors in our industry,” said Raymond Benjamin, secretary general of the International Civil Aviation Organization (ICAO).

He added: “As technologies rapidly evolve and become more readily accessible to all, cyber threats cannot be ignored.”

“This is an important new area of aviation security concern and our global community will ensure that it is met with a strong level of commitment and response.”

Tags:

• NEWS & INDUSTRY
• Vulnerabilities
• Cybercrime

Researchers have uncovered a total of 20 security holes in Zenoss Core, the free, open-source version of the application, server, and network management platform Zenoss.

According to an advisory published on Friday by the CERT Coordination Center at Carnegie Mellon University (CERT/CC), the vulnerabilities were identified and reported by Ryan Koppenhaver and Andy Schmitz of Matasano Security.

One of the most serious flaws is CVE-2014-6261, which can be exploited by a remote attacker to execute arbitrary code.

“An attacker who is able to get a victim to visit an attacker-controlled website while logged in to the Zenoss interface can execute arbitrary code on the Zenoss installation. Additionally, an attacker who is able to perform a man-in-the-middle attack between the Zenoss installation and Zenoss’ corporate ‘callhome’ server – or control the ‘callhome’ server – can execute arbitrary code on the Zenoss installation,” reads Zenoss’ description of the vulnerability.

Another serious vulnerability (CVE-2014-9246) is caused by the fact that sessions don’t expire. In order to exploit the bug, an attacker needs to obtain a targeted user’s session ID and copy it to his own computer. When the victim logs in, the attacker will be logged in as that user.

Researchers have also identified cross-site request forgery (CSRF), persistent cross-site scripting (XSS), information disclosure, open redirect, authorization bypass, and denial-of-service (DoS) vulnerabilities. In addition, the experts discovered multiple issues related to passwords, including the lack of password complexity requirements, a weak hashing algorithm, and the storing of passwords in plaintext in the session database.

These vulnerabilities have been assigned the following CVE identifiers: CVE-2014-6253, CVE-2014-6254, CVE-2014-9245, CVE-2014-6255, CVE-2014-6256, CVE-2014-9247, CVE-2014-9248, CVE-2014-6257, CVE-2014-9249, CVE-2014-6258, CVE-2014-6260, CVE-2014-9251, CVE-2014-6259, CVE-2014-6262 and CVE-2014-9252.

The vulnerabilities affect Zenoss Core 4.2.4. Two of the flaws, the session expiration bug and an open redirect in the login form (CVE-2014-6255 and CVE-2014-9246), have been addressed by Zenoss with the release of the latest Zenoss Core 4.2.5 service pack, CERT/CC said. The company is internally tracking the other bugs and plans of fixing them in a future maintenance release of Zenoss Core 5, which is currently in beta.

Zenoss does not plan on addressing CVE-2014-9250, which can be exploited by an attacker to obtain a user’s username and password by retrieving the authentication cookie. The company advises customers who want to use cookie-based authentication to ensure their installations operate over SSL/HTTPS.

Tags:

• NEWS & INDUSTRY
• Application Security
• Vulnerabilities

The systems of entertainment giant Sony have been hacked once again, and although the full extent of the breach is not yet known, the incident will likely be added to the list of most damaging cyberattacks.

A group of hackers called GOP (Guardians of Peace) has taken credit for the attack and they claim to have stolen terabytes of files. Sony admitted that a large amount of information has been stolen, including business and personnel files, and even unreleased movies.

On Friday, security firm Identity Finder revealed that the attackers leaked what appears to be sensitive personal data on roughly 47,000 individuals, including celebrities.

North Korea is considered a suspect, but the country’s officials have denied any involvement, and Sony representatives have not confirmed that the attack was traced back to the DPRK.

Researchers from various security firms have analyzed a piece of malware that appears to have been used in the Sony hack. The threat is designed to wipe data from infected systems.

The FBI launched an investigation and sent out a memo to a limited number of organizations, warning them about a destructive piece of malware that appears to be the same as the one used in the attack against Sony.

Some experts believe the FBI sent out the alert only to a few organizations that were likely to be affected. Others have pointed out that the FBI doesn’t appear to have a good incident response plan in place.

And the Feedback Begins…

Cody Pierce, Director of Vulnerability Research at Endgame:

“The latest FBI ‘flash’ report warning U.S. businesses about potentially destructive attacks references malware that is not highly advanced. Initial reports associate the alert with malware that overwrites user data and critical boot information on the hard drive, rendering the computer effectively useless. Based on analysis of the assumed malware sample, no technology exists within the sample that would warrant a larger alert to corporations. Additional information, either present in the malware–like IP address or host information–or during the investigation, also likely made it clear who required advance notification. Because of the malware’s low level of sophistication as well as the reportedly targeted nature of the attacks, it is entirely reasonable that the FBI would only inform a small number of companies.

The goal of these coordinated alerts is to raise awareness to the most likely targets so that they can ensure their security readiness, without unnecessary burden to those unlikely to be affected. In this case, because the malware is targeted and not sufficiently advanced, the FBI’s approach is justified. Conversely, in the event that more sophisticated malware or a new attack vector had been discovered, greater communication would have been necessary. Based on the information available, the FBI made the right decision in issuing this particular alert.” 

Mark Parker, Senior Product Manager, iSheriff:

 “For many organizations in the midst of breach investigation, decisions are often made very quickly. Without the luxury of planning meetings and impact analysis, some of the things are done in a ‘from the cuff’ manner based upon the evidence in hand, which may in fact be incomplete. In the case of the FBI memo that was sent out, it was done in a manner that was clearly done hastily. The threat posed by the malware was significant and a quick decision was made to send out an alert.

 

While I wasn’t in the room, I am fairly certain from having been in similar rooms, and in similar situations, that a list of who should receive the alert was not a very long conversation, and the point was to get the information out as soon as possible. What this demonstrates is that both Sony and the FBI do not have a good incident response plan in place for this type of incident. All organizations should have an incident response plan in place that lays out this sort of information in advance so that time is not spent on such issues. A clear process for key decisions is a very important part of any incident response plan, as is a list of who should be contacted in different situations.”

Steve Lowing, Director of Product Management, Promisec:

“Given that Sony Pictures is releasing a movie next month that satirizes assassinating North Korea’s supreme leader Kim Jong-Un, and after learning about this release last June declared war on the company, it’s widely held that the North Korean government is behind the attack. It’s likely that this is true at least at a sponsorship level given the number of attacks on South Korean banks and various businesses over the course of the last year, with the likely attackers being the country’s cyber warfare army known as unit 121.

Unit 121 is believed to be operating out of a Shenyang China luxury hotel giving them easy access to the world with being an arm’s reach from North Korea. The main reason for this is China’s close proximity to North Korea, North Korea’s almost non-existent internet access and China’s far superior network and cyber hacking resources. This is yet another example of State sponsored hacktivism targeting companies directly.”

Jonathan Carter, Technical Director, Arxan Technologies:

“So far, the evidence seems to suggest that the Sony hack was accomplished via execution of malicious malware. Hackers typically conduct these attacks by somehow tricking the user into executing something that is malicious in nature from within a system that is sensitive in nature. The recent iOS Masque and WireLurker vulnerabilities clearly illustrate that the delivery and execution of malicious code can take some very clever approaches. In light of these recent revelations, it is reasonable to expect to see a rise in distribution of malware (disguised as legitimate B2E apps that have been modified) via mobile devices owned by employees that have access to sensitive backend systems.”

Vijay Basani, CEO of EiQ Networks:

“It is possible that the hackers accessed not only unreleased movies, but also gained access to user accounts, celebrity passport details, sensitive trade secrets and know how. This demonstrates that in spite significant investments in traditional and next-gen security technologies, any network can be compromised. What is truly required is a total commitment from the senior management to building a comprehensive security program that delivers pro-active and reactive security and continuous security posture.”

Craig Williams, Senior Technical Leader and Security Outreach Manager for Cisco’s Talos team: 

“The recent FBI ‘flash alert’ was published covering the dangers of a new wiper Trojan that has received quite a bit of media attention. There are a few key facts that seem to be overlooked by many of the early news accounts of this threat:

Cisco’s Talos team has historic examples of this type of malware going back to 1998.  Data *is* the new target, this should not surprise anyone – yet it is also not the end of the world.  Recent examples of malware effectively “destroying” data – putting it out of victims’ reach – also include Cryptowall, and Cryptolocker, common ransomware variants delivered by exploit kits and other means.

Wiping systems is also an effective way to cover up malicious activity and make incident response more difficult, such as in the case of the DarkSeoul malware in 2013.

Any company that introduced proper back-up plans in response to recent ransomware like Cryptolocker or Cryptowall should already be protected to a degree against these threats detailed by the FBI.  Defense-in-depth can also detect and defeat this type of threat.”

Carl Wright, general manager at TrapX Security:

“The FBI and other national government organizations have an alerting process that we are sure they followed to the letter. It is important for them to provide an early warning system for these types of attacks, especially in the case of the Sony breach, because of the severe damage that could ultimately be used against our nation’s critical infrastructure.

Timely information sharing must be completely reciprocal in nature, meaning, corporations also have to be willing to share their cyber intelligence with the government.

 

When we look at the significant incidents of 2014 and in particular Sony, we see that most enterprises are focusing efforts and investments on breach prevention. 2014 has clearly highlighted the need for corporations and government to include additional technological capabilities that better detect and interdict breaches before they can spread within an organization.”

Ian Amit, Vice President, ZeroFOX:

“The Sony breach is a tricky situation. How it occurred is still up for debate – possibly nation state? Possibly an insider? Possibly a disgruntled employee? Regardless, it’s clear the breach goes very deep. It has gotten to the point that Sony is outright shutting down its network. This means even the backups are either nonexistent or compromised, and the hackers likely got just about everything, making this one of the worst breaches ever at an organization of this size. The attack touches anyone involved with Sony – auditors, consultants, screenwriters, contractors, actors and producers. The malware might be contained on Sony’s servers, but the data loss is much further reaching. Make no mistake, this breach is a big one.

I am skeptical this attack is nation state-level attack. The idea that North Korea is retaliating against Sony for an upcoming film is a wildly sensationalist explanation. Hackers regularly cover their trails by leaving red herrings for the cleanup crew – indications that the Russians, Chinese, Israelis, North Koreans and your grandmother were all involved. A small script of Korean language is hardly damning evidence. Code can be pulled from a variety of sources and there is no smoking gun (yet) in the case of the Sony breach.”

Oliver Tavakoli, CTO, Vectra Networks:

“Any malware that destroys its host will have limited impact unless it is part of a larger coordinated attack. One or two laptops being wiped at Sony would be a nuisance, but large numbers of devices being wiped all at once is devastating. The latter style of attack requires an attacker to achieve a persistent network-level compromise of the organization before the wiper malware even becomes relevant.

The information released as part of the FBI alert bears this out. The malware sample detailed in the alert was compiled only days before it was used. This is a strong sign that Sony was compromised well before the time the malware was built, and the wiper malware was the coup de grâce at the end of the breach.

This is particularly significant when evaluating the FBI alert. Sharing indicators of compromise (IoC) is a good thing, and the industry needs more of this sharing. But we need to keep in mind that these particular indicators represent the absolute tail end of a much longer and widespread attack. In fact, some of the IoCs detailed in the alert are only observable once the wiper malware has begun destroying data. Obviously, this sort of indicator is much too late in the game, but too often is the only indicator that is available. What the industry needs badly are indicators of attack that reveal the compromise of the organization’s network at a point when security teams can still prevent damage.”

Kenneth Bechtel, Tenable Network Security’s Malware Research Analyst:

 “This type attack is not new, it’s been around for a long time, with multiple examples. The most recent similarity is the ransomware that’s been attacking systems. These attacks are often difficult to detect prior to the execution of the payload. The best thing is a good backup scheme as part of your response. Many times the answer to modern malware infections is to reimage the system. In case this occurs on your system, a reimage is often the best response. The only thing that reimaging would not solve is having most current data like documents and spreadsheet. It’s this combination of reimaging and restoring backups that is the most efficient response to the attack. While this ‘fixes’ the host, network forensics should be done to identify the attack and create defenses against the attack in the future.”

Jon Oberheide, CTO, Duo Security:

“I don’t believe that the limited distribution of the FBI warning was improper. But, I think the scope and focus on data-destroying malware was a bit misguided.

 

Certainly data loss can have a big impact on the operations of a business. We saw that big time back in 2012 with the Saudi Aramco attack by data-wiping malware. But, regardless of whether the data loss is intentional or inadvertent, it’s vital to have proper disaster recovery and business continuity processes in place to be able to recover and continue operation. However, when considering a sophisticated cyber-attack, disaster recovery processes must assume that an attacker has more capabilities and reach than standard inadvertent data loss events. For example, an attacker may have access to your data backup infrastructure and be able to destroy backups as well. So, modern organizations may have to revisit their DR/BC models and take into account these new threat models.

The real impact of the Sony breach is not the destruction of data, but the longer term effects of confidentiality and integrity of their data and infrastructure. Rebuilding all their infrastructure post-breach in a trusted environment is an incredibly challenging and arduous task. The disclosure of credentials, infrastructure, critical assets, employee PII, and even things like RSA SecurID token seeds will have a much longer-term, but more under-the-radar, impact on Sony’s business.

Most importantly, in the modern day, breaches don’t only impact the directly-affected organization, but they tend to sprawl out and negatively impact the security of all organizations and the Internet ecosystem as a whole. A breach doesn’t happen in a vacuum: stolen credentials are re-used to gain footholds in other organizations, stolen source code is used to find vulnerabilities to assist future attacks, and information and experience is gleaned by attackers to hone their tactics, techniques, and procedures.”

Idan Tendler, CEO of Fortscale:

“The traditional concept for security was to keep the most important resources, i.e. the vaults with the cash (or in Sony’s case, films) safe. What we’re seeing with breaches of this magnitude is that the harm now goes far beyond any immediate and limited capital damage. Leaked sensitive information regarding employee salary and healthcare has the potential to cause enormous reputational harm and internal turmoil within a workforce. Revealing that kind of data can lead to jealousy, resentment and distrust among workers and create a very toxic work environment.

With news of passwords to sensitive documents also being leaked, Sony will need to be more vigilant in securing user access to resources by constantly monitoring and analyzing user activity for possible credential abuse.”

Clinton Karr, Senior security specialist at Bromium:

“These attacks are troublesome, but not surprising. Earlier this year we witnessed Code Spaces shutdown after a successful attack destroyed its cloud back-ups. Likewise, the evolution of crypto-ransomware suggests attackers are targeting the enterprise with destructive attacks. These attacks are unlike the “cat burglary” of Trojan attacks, but much more brute force like a smash-and-grab or straight vandalism.”

Ariel Dan, Co-Founder and Executive VP, Porticor:

“Reporting the technical details of a specific attack is a sensitive topic. Attack details can and will be used by new hackers against new targets. On the other hand, companies can’t do much to defend against a type of attack they know very little about. One relevant example of such a potential attack was around a severe security bug in the Xen virtualization system that exposed cloud users of Amazon Web Services, Rackspace and other cloud providers. The cloud vendors had stealthily patched affected systems, issued a vague notification to their users of an immediate restart action, and only after it was all done was the attack realized and publicized. Reporting the bug prior to fixing the problem would have a devastating effect on cloud users.

 

Back to the Sony attack: I personally believe that reporting the entire details of a security breach can do more harm than good, but there should be a way to communicate enough meaningful information without empowering the bad guys. Blogs like KrebsonSecurity provided additional details, including a snort signature to detect this specific attack. Such data is meaningful for the defender and does not help an attacker. From this information we learned that organizations should embrace an “encrypt everything” approach as we step into 2015. We should be able to guarantee that data is not exposed even if an organization has been infiltrated.”

Tim Keanini, CTO at Lancope:

“I think the question being asked here is a great opportunity to describe the threats of yesterday versus the threats we face today.  In the past, broad advisories on technical flaws were effective mainly because the problem was universal.  Attackers would automate tools to go after technical flaws and there was no distinction between exploitation of a large corporation or your grandmother. If the vulnerability existed, the exploitation was successful.  In the case of Sony, we are talking about a specific adversary (Guardians of Peace) targeting Sony Pictures and with specific extortion criteria.  With this type of advanced threat, warnings sent out by the FBI on the investigation itself will be less prescriptive and more general making its timeliness less of a priority. 

From everything we have seen disclosed so far, it is difficult to assess and advise on the information security practice when some of the flaws exploited seem to suggest very little security was in place.  The analogy would be: it would be hard to assess how the locks where compromised when the doors to host the locks were not even present.   For example, some of the disclosure on reddit earlier in the week suggests that some files named ‘passwords’ were simply in the clear and stored unencrypted in txt and xls files.  The investigation will determine the true nature of all of this speculation but I use this as an example because the FBI could issue a warning every day of the week that said “Don’t do stupid things” and be just as effective.

The lesson learned here is that if you are connected to the Internet in any shape or form, this type of security breach happening to you and your company is a very real risk.  Step up your game before you become the subject of another story just like this.  It would be weird but Sony Pictures should write a movie on how a cybercrime group completely comprised and held an entertainment company for cyber extortion – categorized under non-fiction horror.”

Kevin Bocek, Vice President of Security Strategy & Threat Intelligence at Venafi:

“As the FBI, DHS and others investigating the Sony hack work furiously to uncover the details and the threat actors behind this breach, it’s important that we recognize the attack patterns that are right in front of our face: cybercriminals are and will continue to use the same attack blueprint over and over again. Why? Because they use what works.

In April 2011, Sony’s PlayStation Network was breached where asymmetric keys were stolen, compromising the security of 77 million users’ accounts. Now, nearly four years later, Sony is still facing the same threat — only this time it’s directed on Sony Pictures Entertainment. In this latest breach, cybercriminals successfully gained access to dozens of SSH private keys – the same way they stole private keys in the Mask, Crouching Yeti and APT18 attacks. Once these keys are stolen, the attackers can get access to other systems — and then it just goes from bad to worse. It’s critical that incident response and security teams realize that the only way that the attackers can *truly* be stopped from accessing these systems is by replacing the keys and certificates. Until then, they will continue to wreak havoc and cause more damage with elevated privileges, the ability to decrypt sensitive data in transit, and spoof systems and administrators. All it takes is one compromised key or vulnerable certificate to cause millions in damages. Hopefully, Sony will learn its lesson this go round.”

Until Next Friday… Have a Great Weekend!

Tags:

• Incident Management
• Management & Strategy

The United States is at the top of the list of countries with the most infections of point-of-sale (PoS) malware during the third quarter of the year, according to research from Trend Micro.

In its threat report for Q3, Trend Micro reported that the U.S. accounted for 30 percent of PoS malware infections. The next three places on the list – Taiwan, Philippines and Italy – each accounted for six percent of infections.

“Early this year, one of the largest retail companies in the U.S. disclosed that approximately 40 million consumer credit and debit card information was compromised as a result of a breach in its systems,” according to the report. “Not long afterward, Home Depot topped that record when it disclosed that more than 100 million customer records that included credit card information was stolen as a result of a payment systems breach. The threat actors behind these breaches attacked the retailers’ point-of-sale (PoS) systems. BlackPOS was implicated in the incident reported early this year, while BlackPOS version 2 was used in the Home Depot breach. This further indicates that PoS networks are highly accessible and vulnerable.”

The report identified three new pieces of PoS malware that were spotted during the third quarter: BrutPOS (Tibrun), Backoff (POSLOGR) and BlackPOS Version 2 (MEMLOG).

Recently, researchers at Trend Micro identified a new piece of PoS malware detected by the firm as TSPY_POSLOGR.K that is designed to read the memory associated with specific processes written in the .INI file. It then saves the data to files named “rep.bin” and “rep.tmp.”

“Based on the other PoS malware behaviors we observed, it appears to be designed as multicomponent malware similar to an earlier BlackPOS variant named TSPY_MEMLOG.A, as it might require another component to retrieve the dumped data,” Anthony Joe Melgarejo, threat response engineer at Trend Micro, explained in a blog post. “It is highly possible that this is deployed as a package.”

The report also noted a spike in online banking malware infections between the second and third quarters. As in the case of PoS malware, the United States was the most affected country, accounting for about 13 percent of infections.

“Our findings confirm that we are battling rapidly moving cybercriminals and evolving vulnerabilities simultaneously,” said Raimund Genes, CTO at Trend Micro, in a statement. “With this fluidity, it’s time to embrace the fact that compromises will continue, and we shouldn’t be alarmed or surprised when they occur.  Preparation is key and as an industry we must better educate organizations and consumers about heightened risks as attacks grow in volume and in sophistication. Understanding that cybercriminals are finding vulnerabilities and potential loopholes in every device and platform possible will help us confront these challenges so technology can be used in a positive way.”

Tags:

• NEWS & INDUSTRY
• Virus & Malware

WASHINGTON – Sony Pictures Entertainment is looking into whether North Korea may have been behind a major cyberattack on the studio last week, a news website reported.

The website re/code noted that the attack came as the studio neared release of a comedy about a CIA plot to assassinate its leader Kim Jong-Un.

“The Interview,” which stars Seth Rogen and James Franco as two journalists recruited by the CIA to bump off Kim, has infuriated the North Koreans, with state media warning of “merciless retaliation.”

Citing sources familiar with the matter, re/code on Friday said Sony and outside consultants were exploring the theory hackers operating in China carried out the attack last Monday on behalf of North Korea.

A North Korean link has not been confirmed, however, according to the sources.

An image posted on the Reddit social network from an individual claiming to be a former Sony employee showed a page with the words “Hacked by #GOP.”

It was unclear what GOP stands for, but some reports said the hacker group is called Guardians of Peace.

The posted image said unspecified demands must be met by Sony or important files would be released.

Tags:

• NEWS & INDUSTRY
• Cybercrime

Kaspersky Lab recently analyzed the activities of a threat group that has been targeting executive business travelers in the Asia-Pacific region.

The actors behind the cyber espionage campaign dubbed “<a href="http://redirect.viglink.com?key=11fe087258b6fc0532a5ccfc924805c0&u=http%3A%2F%2Fwww.securityweek.com%2Fdarkhotel-attackers-target-business-travelers-hotel-networks%22%3EDarkhotel%3C%2Fa%3E" use various techniques to distribute their sophisticated pieces of malware, such as highly customized spear-phishing, malicious Wi-Fi networks, and P2P sharing websites.

The attackers, which appear to speak Korean, have been compromising the networks of luxury hotels for the past four or five years, attempting to trick chief executives, senior vice presidents, sales and marketing directors, and researchers into downloading a backdoor disguised as software updates. Some of the pieces of malware used in these attacks date back to 2007, Kaspersky said.

Thousands of Darkhotel victims have been spotted all over the world, but most of them appear to be located in Japan, Taiwan, China, Russia and Korea. 

Security experts shared their thoughts on this campaign and provided some important recommendations for executives who travel often and don’t want sensitive corporate information to end up in the hands of cyber spies.

And the Feedback Begins…

Carl Wright, General Manager for TrapX Security:

“Organizations must understand that hackers are always looking for the path of least resistance. While enterprises today are generally doing a better job of securing their networks against intrusions from outsiders, they’re falling short when it comes to securing devices outside the corporate network.

As a result of this and an ever-increasing mobile workforce, we’re seeing hackers shifting their attention from attacking organizations head-on through their network and instead concentrate their efforts on individuals outside the corporate firewall. And what a better place to reach them than at the hotels they’re staying at while they’re on the road.

Executives must begin to treat every hotel, plane, bus, cab, cafe etc. as an extension of their corporate office and as such, they need to subject themselves to the same level of security and best practices imposed by their organization’s IT teams. This includes not clicking on suspicious links and making sure their communications to corporate HQ are secured through a proper VPN tunnel.”

Jack Daniel, Strategist at Tenable Network Security:

“Recent stories including the Darkhotel attacks have made it clear that travelers need to assess their information security risks and take reasonable precautions to protect their systems and information. As always, context is critical in deciding what is reasonable in your situation- for some travelers a little extra caution may be all that is needed, for others more aggressive actions such as dedicated (and possibly even disposable) hardware may be required.

A few universal basics can help everyone. Start with strong authentication, including using two-factor authentication everywhere possible and keeping your second factor devices (tokens, phones, cards, etc.) under your control at all times. Use VPNs any time you connect to any network not under your (or your organization¹s) control. Since different networks sometimes interfere with different VPN technologies it is a good idea to have more than one VPN endpoint to connect to, and ideally use more than one VPN technology (IPsec, SSL, etc.) to improve your chances of establishing a secure connection. Other fundamentals include taking no more information than you need for the trip, and limiting the systems and information you access while traveling.

Depending on the type and amount of technology you travel with, it may be best to simply keep all of your digital equipment with you at all times. For more advanced tips, such as the use of Wi-Fi firewalls, consult a trusted security professional.”

Idan Tendler, Fortscale CEO:

“The DarkHotel malware is just more evidence of the troubling vulnerability of networks when it comes to phishing campaigns and credentials theft. It is one of the reasons that networks will need turn their focus internally and adopt a more aggressive approach to security that includes analyzing users.

If a user’s behavior is thoroughly analyzed and profiled, an attacker could steal the user credentials but can’t imitate his historic behavior, which can immediately trigger red flags to the security team for deeper investigation.”

Jared DeMott, security researcher at Bromium:

“Wi-Fi attacks are a real threat, and not just in hotels. At most free Wi-Fi spots there is usually no guidance on secure connection: the user is left to figure it out, and hope it just works. Traveling business people typically are not technical experts either. So, using a device that prefers a VPN is helpful in preventing snooping once connected.  But, if initial connection pages attack with 0-day exploits, the browser is, as usual, a potential weak link without a way to isolate attacks.

I’d advise people to stay off Wi-Fi, in favor of a mobile hotspot. Understandably that can be difficult while in planes, or overseas where mobile devices may not function or be prohibitively expensive.” 

Alex Cox, Senior Manager, RSA-FirstWatch:

“My advice to travelers wishing to stay secure is to opt for the “overly paranoid” approach.

When executives travel they should assume that any open wifi access point has the potential to be malicious, especially in “convenience” areas, where Internet access is provided as a service, probably without a lot of security forethought. They should consider using an Internet access service through a portable wifi device via a cellular network (a MiFi is a popular version). This gives the user a self-contained source of internet access that is for their use only, and this method of connectivity has proven to be one of the more secure as far as eavesdropping and manipulation. That said, it must be configured and used correctly.

If an executive is travelling in a high-risk area, they should consider that any time their device is out of their direct physical control (airport, hotel room, vehicle, etc.) it has the potential to be tampered with. With that in mind, the traveler should keep physical control of the device as much as possible. It’s also a good idea for a high-risk traveler to bring a “clean” laptop and/or smartphone or tablet that doesn’t involve any of their work outside of what is currently needed. While traveling users should have increased suspicion of update notifications, emails with attachments and unknown links, or the request to install “helper” apps in order to access something.

It’s important to adopt an intelligence-focused mindset, to help understand the threat vectors and attackers that may be targeting the traveler.”

John Dickson, Principal at The Denim Group:

“I think the pressure from clients, shareholders or deadlines puts executives in a situation where they rarely think twice about hopping on a hotel Wi-Fi to conduct business. Couple that with the trust in brands – executives would assume Hilton, Hyatt, and others provide information security in addition to physical security and a clean room – and you have a dangerous mix.

Connecting [to Wi-Fi] itself is not completely terrible, but users should VPN-in as soon as they connect to the network for both e-mail and browsing purposes. Also, they should make sure their laptops and mobile devices have the most recent software updates, to make their computing devices less vulnerable to known, often exploited vulnerabilities. The thing to remember is that most security issues occur when two things happens: (1.) A user-initiated action, like clicking on an attachment or link or visiting a site hosting malware; and (2.) a latent vulnerability exists on the computing devices from which the user is browsing.

This was a well thought-out attack, and like most great attacks, is less about the technology and more about exploiting a known trust mechanism, in this case the strength of hotel chains’ brands.”

Oliver Tavakoli, CTO of Vectra Networks:

“There are two lessons that can be learned from the DarkHotel issue. The first is security architectures must be able to protect against attacks that exploit mobile users on guest Wi-Fi networks. The second is in the fast evolving threat landscape, “what the malware is doing” is more important than “what the malware is.

The BYOD Mobile Security Report published by the LinkedIn InfoSec Community revealed that exploits entering organizations via mobile devices is a top security concern in 2014. It is not possible to completely protect users from exploits when they travel and use public-access Wi-Fi networks at coffee shops or hotels. However, it is possible to detect the activities of an attacker who has breached the network perimeter through a traveling employee’s laptop. In a targeted attack, the attacker will use the infected laptop to perform reconnaissance, spread laterally, acquire data, and ultimately exfiltrate it in as stealthy a manner as possible. Real-time breach detection uses machine learning to detect these behaviors among the chatter in the network, even when the exploit or malware “walks” into an organization on a user’s laptop.

 

Just like there were multiple iterations of Conficker and the malware that was used to attack Target was “tweaked,” there could one day be a “DarkHotel 2.” Naming malware may satisfy a human need or assist in knowing whether the right detection signatures are deployed, but it is not relevant in advanced threat defense. Advanced threats, even when they start with simple tactics like spear phishing, are stealthy by nature and will use malware and C&C channels that slip past perimeter and endpoint security that use signatures and reputation lists. Detecting what the malware is doing will always have a higher likelihood – and multiple opportunities – of detecting a targeted attack than knowing what the malware is. Think of it this way, if you can name it, then it is no longer an advanced threat or a targeted attack. Ignoring the malware may only relegate you to being one of its first victims, and that is no fun.”

Ian Amit, ZeroFOX Vice President:

“First things first – nothing is revolutionary about Darkhotel. It uses the same tactics that penetration testers have been using at red team engagements for years. The only surprise is that the attack was found, albeit with a delay of 7 years.

Darkhotel leverages publicly available information and past behaviors to predict where and when an executive is traveling. Having that information at hand is critical for launching a pinpoint attack, and in most cases can be derived from a simple social media search. Once the target is located, the attack comes via the hotel wireless network. As usual, the human factor plays a lead role in enabling such attacks, and unfortunately, most of the information needed can be found on social media.

When traveling, follow the rule “no changes allowed” – no updates, no downloads, no new software or hardware installations. This will prevent almost every malware attack. For the extremely security-conscious traveler, a freshly installed laptop and phone are recommended, both of which should be disposed of at the end of the trip.”

Anup Ghosh, Founder and CEO, Invincea:

“The DarkHotel campaign sheds light on risks business travelers face when leaving the four walls of their enterprise networks. Business travelers need access to the Internet, of course, and the hotel networks is usually the gateway. Even if they are employing VPNs, the access point is the local hotel wireless net prior to being able to login via VPN. At this juncture, we have seen not only rogue Flash updates, but also drive-by exploits hosted on these hotel network pages that silently infect the traveller’s machine.

This isn’t confined to hotel networks, of course, as any public network with a network access login (coffee shops, airports) can be compromised accordingly. Airports would be particularly rich for business travelers and many incorporate advertising that can be subverted via third party ad networks.

Bottomline is business travelers need end point protection that stops targeted attacks and novel malware without requiring the corporate network.”

Tal Klein, VP of Strategy for Adallom:

“Captive portals are basically dressed up Men-in-the-Middle. I don’t particularly understand the hype around DarkHotel given that tools like Hak5’s Pineapple have demonstrated the ease with which people can be compromised by trusting captive portals, especially in hotel settings. My advice: Invest in a mobile carrier Mi-Fi. Most hotel internet connections are unbearably slower and more expensive than a Mi-Fi anyway.”

Ian Pratt, Co-founder & EVP, Products at Bromium:

“Attacks using Wi-Fi captive portals are certainly on the rise. The networks at hotels are particular attractive as information about the user’s name and the organization they work for is frequently available, enabling very targeted attacks. It is common for hotels to outsource provision of networking services, and hence these third parties become attractive targets to attackers to target visitors staying at many hotels. In some parts of the world state security services specifically take advantage of this.

 

A VPN is unable to help protect against many of these attacks. Most Wi-Fi networks require you to successfully sign-in to a captive portal page before they will allow you external access. In many cases it is the sign-in page itself that is malicious, and by the time the user has entered their surname and room number they will have been delivered an exploit tailored to their machine and compromised. Bringing a VPN up at this point plays directly into the attackers hands, bringing the infection onto the enterprise network.”

Paul Lipman, CEO of iSheriff:

“Darkhotel illustrates a fundamental hole in the typical approach to corporate cybersecurity. Organizations spend many millions of dollars to protect their networks against outside threats, investing in ever more sophisticated ways to defend their network infrastructure, applications, and data from attack. Despite all of this investment, roaming users are typically protected with nothing more than endpoint anti-virus, a technology that is woefully inadequate to protect against advanced persistent threats such as Darkhotel. Even worse, when an infected user later comes back into the office, any malware infection picked up “on the road” can instantly spider out across the network, multiplying the risk by orders of magnitude.

 

A cloud-based Web security solution provides a persistent layer of protection for roaming users, wherever or however they are connecting to the Internet. These services are constantly updated to cover the latest advanced threats, identifying them in the cloud in real-time, and blocking them before they can ever reach an end user’s device. In the case of Darkhotel, a user connecting through a cloud security layer would be fully protected through a “secure tunnel” from the device to the cloud security provider.”

Chris Messer, vice president of technology at Coretelligent:

“DarkHotel is a moderate threat for unsuspecting and non-technical users, and for users and organizations that have lax security safeguards present on traveling employee or executive devices.

 

This type of attack requires the potential victim to download a compromised update such as Adobe Flash or Google Toolbar from a compromised link or pop-up browser window. The user is then tricked into installing these updates as the attacker uses bogus digital certificates to “sign & validate” the compromised software to lead the user to believe they came from a trusted source. This compromised application then installs additional malicious software (Trojan, keylogger, etc.) on the victim’s machine, and then allows the attacker to track and collect data from their machine at will.

 

The good news is that this type of attack can be prevented if users follow good security practices and have reasonable security software and precautions put in place by IT:

 

• Individuals should avoid hotel wired and wireless Internet services all together, and instead rely on a company-provided mobile hotspot device, or tether via their mobile device. When individuals are required to leverage a hotel’s wired or wireless Internet, they should avoid performing any system administrative tasks or updates.

 

• Users should only transact business over a secure VPN connection and HTTPS secured sites. They should avoid sensitive sites such as banking sites for the duration of the hotel stay, if at all possible.

 

• Users should never click on any advertisements via the hotel Wi-Fi, and after logging into the wireless, make it a point to close and re-open their browsers to avoid re-using a questionable session.

 

• Individuals should ensure that they have a robust antivirus suite installed on their machine that has some sort of web filtering component. 

 Feel free to add your thoughts in the comments below, and until Next Friday…Have a Great Weekend!

Tags:

• Network Security
• NEWS & INDUSTRY
• Incident Management
• Risk Management
• Malware
• Management & Strategy

SAN FRANCISCO – US justice officials are scooping up mobile phone data from unwitting Americans as part of a sophisticated airborne surveillance program designed to catch criminals, the Wall Street Journal reported Thursday.

Small aircraft deployed by the US Marshals Service from at least five major airports have been taking to the skies with “dirtbox” equipment designed to mimic signals from cell towers, according to the Journal.

That in turn tricks mobile phones into revealing unique identifying numbers and general locations, according to the report.

The name “dirtbox” was said to be derived from an acronym of Digital Recovery Technology Inc., the Boeing subsidiary that makes the device.

The range of aircraft in the program covers most of the US population, the Journal reported, citing unnamed sources familiar with the operation.

Details of flights were not given, but they were said to take place regularly with each outing potentially gathering data from tens of thousands of mobile phones.

The Journal reported that the US Justice Department declined to comment for the story other than to say that its agencies comply with the law when it comes to surveillance.

Mobile phones are programmed to connect with the closest signal tower, but trust signals from towers or imposters when it comes to making decisions, hackers have demonstrated.

Boxes in planes could automatically assure mobile phones they are the optimal signal tower, then accept identifying information from handsets seeking connections.

Fake cell towers could then pass connections onto real signal towers, remaining as a conduit with the ability to tune into or block digital transmissions.

Hackers refer to such tactics as “man-in-the-middle attacks.”

The Journal quoted American Civil Liberties Union chief technologist Christopher Soghoian as calling the program “dragnet surveillance” that is “inexcusable.”

The program is reportedly in place to reveal locations of mobile phones associated with criminals or those suspected of crimes, but collect data about other handsets that connect, according to the Journal.

After sifting through data collected, investigators could determine the location of a targeted mobile phone to within about three meters, the report indicated.

Similar devices are used by US military and intelligence officials operating in other countries to locate terrorist suspects, according to the Journal.

Trust in US authorities has already been shaken by revelations about a sweeping Internet surveillance program.

Tags:

• NEWS & INDUSTRY
• Privacy
• Tracking & Law Enforcement

BrowserStack is back online after temporarily suspending service due to an attack.

The company stated it had been hacked after someone sent an email to customers claiming the company was shutting down and had failed to follow-through on promises related to security. Founded in 2011, BrowserStack is a cross-browser testing tool used to test websites and servers.

A copy of the email was posted to Pastebin.

“Not only do all of our administrators have access, but so does the general public,” the hacker claims in the email. “We have no firewalls in place, and our password policies are atrocious. All virtual machines launched are open to the public, accessible to anyone with the alpha password “nakula” on port 5901, a password which is stored in plaintext on every VM. As well, our infrastructure uses the same root passwords on all machines, which is also stored in plaintext on every VM launched (“c0stac0ff33″).”

“Given the propensity for cyber criminals to target infrastructure services such as ours, it is almost certain all of your data has been compromised,” the email states. “These passwords take no less than 15 minutes to find for anyone who is looking. We hope we have not caused you too much trouble, and to our enterprise customers who signed deals contracts based on a fabrication, we are equally sorry.”

It is not known whether any of the hacker’s claims in the email are true. According to BrowserStack, the hacker’s access was limited solely to a list of email addresses.

“All BrowserStack services are now up and running,” the company tweeted shortly after noon PST. “We are keeping a strong check and will email all users the entire analysis.”

The company said it will post a post-mortem of the attack.

BrowserStack serves some 25,000 customers and more than 520,000 registered developers across the world.

Tags:

• NEWS & INDUSTRY
• Cybercrime

Researchers at Palo Alto Networks identified a new piece of malware designed to target Mac OS X and iOS users. The threat, called WireLurker, has potentially affected hundreds of thousands of users, almost all of them located in China. 

Cybercriminals are distributing the threat by trojanizing OS X apps hosted on third party app stores. The 467 malicious apps uploaded to the Maiyadi App Store have been downloaded more than 350,000 times.

Once it infects a Mac, the malware downloads other malicious iOS application to the infected machine. When victims connect their iPads, iPhones or iPods via USB to the infected device, WireLurker installs the downloaded iOS applications onto them. The mobile component of WireLurker is capable of stealing information from infected devices.

The latest version of WireLurker is interesting because it can infect not only jailbroken devices, but also ones that haven’t been jailbroken. The threat can install the malicious iOS apps on non-jailbroken devices by signing them with a stolen code signing certificate.

Shortly after Palo Alto Networks disclosed details on WireLurker, researchers identified an older variant of the threat apparently designed to target computers running Microsoft Windows. 

The command and control servers used by the malware are currently offline and Apple has revoked the certificate used by the malware authors. However, experts believe WireLurker once again shows that Apple devices are not immune to malware.

And the Feedback Begins…

Ian Amit, Vice President of ZeroFOX:

“It’s interesting to see how malware is getting more holistic from an attack vector approach, utilizing technical vulnerabilities and elements, as well as human ones. This isn’t the first malicious code that is designed to “hop” between connected platforms, examples date back to variants such as Stuxnet that infected Windows based computers, which in turn affected Siemens PLCs. This is an interesting turn of events, as Apple’s iPhone is commonly considered a safe platform as long as it isn’t jailbroken.

Beyond the already familiar abuse of social interactions that allow the malware to run in the first place – essentially, having the victim ‘knowingly’ install it, WireLurker also abuses the trust between the victim’s PC and the iPhone connected to it, which grants it full access to the phone and it’s applications – apps can be backed up over USB, then restored to the phone, after the malware has modified them and inserted a backdoor.”

Greg Martin, CTO of ThreatStream:

“Wirelurker is being distributed via a 3rd party app-store called Maiyadi that is out of control of Apple.

The danger with third-party app stores such as Maiyadi is that Apple and Google have no vetting control of what gets added to 3rd party app stores, severely limiting their ability to protect end-users from running malicious apps. In-fact nearly all cases of known malware for the iPhones have originated from 3rd party app stores such as Cydia (App store for jailbroken iPhones) and now new ones like Maiyadi.

Monitoring these 3rd party app stores for malicious apps will become an opportunity for cyber security companies to help provide intelligence back to Apple and Google on what’s happening outside of their control.”

Steve Bell, security consultant, BullGuard:

“The really interesting thing about the WireLurker malware is the scale of the infection and how it is promulgated.  Because of the proprietary nature of Apple devices and the fact that apps are checked for malware before they go into the Apple store users have generally been protected in the past.

However, with an estimated 350,000 downloads of infected apps and the fact that the malware can also transfer via a USB port signals a serious notching up of hacker’s endeavours to hit Apple devices. In the US Apple users tend to stick to the Apple store which is wise. WireLurker shows precisely the danger of downloading apps from unregulated third party stores.

However, the use of a USB port to also transfer malware, while obvious and simple, could be potentially devastating. Without wishing to be alarmist, USB ports are an obvious vulnerability, and it’s not beyond the realms of possibility that hackers might use this to insert Trojans designed to lie dormant for a period. With Apple now putting its considerable weight behind Apple Pay, hackers have serious motivation.”

Carl Wright, General Manager for TrapX Security:

“What has enabled the success of the creators of WireLurker is the concept of transitive trust. This two-way approved relationship automatically created between parties has long been an Achilles heel to security professionals trying to ensure the validity of transactions on a more or less case by case bases.

This recent hack continues to illustrate the trade-off the end users must consider between that of maintaining security of the end point device and innovative new applications that may not be developed or certified by Apple.

In the end, the price may indeed be too extreme for corporations who desire to take advantage of end user BYOD.”

Jared DeMott, Security Researcher with Bromium Labs:

 “People still seem to think malware on the Mac is less likely than on Windows.  If this is true, it’s simply because attackers are less interested in Mac.  The relative attack surface is just as big (similar chance to find and exploit bugs) as on Windows or any other modern operating system.

In fact, my suspicion is that Macs really are exploited more than people realize.  But it’s either typically by better funded attackers, who know how to stay hidden, or because Apple in general does a better job at managing bad security press when compared to Windows.

This particular malware is distributed not in the form of an exploit, but in the form of pirated software.  China in particular, is known to run a lot of illegal software.  Thus, it’s not surprising the Chinese took the brunt of this round, considering the deployment mechanism.”

Mark Parker, Senior Product Manager, iSheriff:

“Wirelurker introduces a new threat vector in a place that was thought to be secure. The concept of using trojan software to download new threats is not new, that is something that has been in practice for many years. However, up to this point the software on iOS devices has been considered secure since the only software on the device would come through the heavily vetted Apple App Store.

By using the workstation’s USB connection as an avenue to surreptitiously install the Trojan applications, the protection afforded by the App Store is leap frogged in an effective manner. Since it has shown success, there is sure to be more advancement and copycats. The introduction of the mobile phone as a method of payment will increase the potential for attacks. Wherever there is money, there is always going to be Malware built to try to get access to that money.

This approach of using the workstation USB connection to another device could also be used in other “closed system” environments. Examples of this could be physical security system maintenance, or point-of-sale terminals that can only be maintained via a workstation USB connection, or similar method. It is always important to ensure that all workstations, even those of workers off-site, are protected from endpoint, web, and email based attacks at all times. The need for security doesn’t stop when the device leaves the network, especially in cases of workers that will be connecting to these types of devices.”

Kenneth Bechtel, Malware Research Analyst, Tenable Network Security:

 “With a resurgent BlackEnergy now targeting network routers and WireLurker spreading like wildfire across China’s iOS devices, this has been an interesting week to be in the malware business. But the thing to keep in mind is that despite the hype, neither of these threats herald an impending Internet apocalypse, though both deserve to be taken seriously.

WireLurker infects iOS through compromised OS X machines. Following successful malware trends, it is modular and updateable, having 467 applications hosted on the Maiyadi App Store (a third-party store hosted in China). This threat can now infect non-jail broken iOS devices simply by connecting an iPhone/ iPad/ iPod to a computer to sync the calendar or contacts list. This concept is very frightening to many users, and means it won’t be long before it spreads to countries outside of China.”

Michael Sutton, VP of Security Research for Zscaler:

 “We keep waiting for mobile malware to eclipse traditional PC malware but it turns out that we’re waiting for the wrong thing. We’ll never see the drive by downloads and fast spreading device to device malware that we’ve become accustomed to in the Windows world, due to the differing architectures of Windows vs Mobile operating systems. That doesn’t however mean that malware on mobile devices isn’t a concern, it just means that malware is being forced to evolve and adapt to a more restrictive environment.

This is especially true for iOS devices and WireLurker represents a new advance on that front. Whether or not Apple designed their Walled Garden for security purposes or not, the fact that iOS apps must primarily be installed only from the iOS App Store, where they can first be vetted by Apple, has made malicious apps on non-jailbroken devices a rare commodity. WireLurker took advantage of an exception to this rule.

WireLurker abuses the fact that there is another way to get apps onto non-jailbroken devices. Apple allows enterprise development teams to leverage Enterprise Provisioning as a means to push homegrown apps to employees without the hassle of hosting them in the App Store. The process is still restricted and requires the use of an Apple supplied code signing certificate and provisioning profiles pushed to devices, but it does provide an alternative. The authors of WireLurker appear to have stolen a legitimate code signing certificate from Hunan Langxiong Advertising Decoration Engineering Co. Ltd., in order to pushed apps to non-jailbroken devices via provisioning profiles.”

Steve Hultquist, chief evangelist at RedSeal:

“Trust. It’s the first requirement for security, but seldom considered by consumers. In the case of WireLurker, existing trust between an iOS device and a Mac becomes the surrogate for malware to infect the devices. When the Mac user mistakenly places trust in a third-party app site to only offer uninfected applications for download, it opens the door to infection of the Mac and then the iOS devices.

This is another example of the sophistication and automation of attacks that are growing inexorably into the future. Attackers are both more subtle and more capable than ever before. This attack resulted in over a quarter of a million infected downloads, in all likelihood impacting thousands of people and devices, all because of misplaced trust.

This attack and others that will follow underscore the need for proactive security efforts, from application design-for-security to trust architectures and automated analysis of potential access paths. Without automated proactive prevention, attacks will continue to grow in volume and impact. Enterprises need to take notice, since these consumer attacks are merely the ice above the water. The enterprise and governmental attacks are the bulk under the sea.”

Until Next Friday…Have a Great Weekend!

Tags:

A two-year study by Bitdefender sheds some light on the most popular types of scams on Facebook and who is falling for them.

The study examines more than 850,000 Facebook scams. Analyzing each of them revealed the following top five bait categories for attackers looking to hit users with spam, malware or other attacks: profile viewer scams (45.5 percent); Facebook functionality scams such as claims about adding a dislike button (29.53 percent); gift card/gadget giveaway scams (16.51 percent); celebrity scams such as death hoaxes (7.53 percent); and atrocity videos with subjects like animal cruelty (0.93 percent).

The report delves into psychological explanations as to why users fall for the traps.

“The most popular Facebook scam offers users the chance to see if they are still searched by a person for whom they may still have feelings for,” according to the report. “Their judgment tells them to avoid clicking on such a lure, but this rational censorship will come along with big emotional consumption. They often don’t even need to believe the link hides emotionally-important information, but they rather do it just to check things out.”

“There is also an additional element helping hackers to trick millions of users ever year,” the report notes. “The “profile viewer” message is customized, touching them on a personal level.”

Facebook functionality scams rely on the desire of users to make their image and experience better, while the giveaways play to greed – or in the case of giveaway scams aimed at gamers, competitiveness, Bitdefender researchers explain in the report.

“Though less present, the last two categories of Facebook scams are growing at a steady pace,” according to the report. “Celebrity sex tape scams and atrocity news (such as murders and child abuse) are attracting thousands of victims with every new campaign, as they also “include” alluring videos. In the attempt of creating a profile of the most gullible victims, Bitdefender’s behavior analysts discovered there is such a wide range of users falling for Facebook scams, that an exact profiling would be too restrictive.”

“In conclusion, anyone could fall victim to a Facebook scam at one point in his life, as cyber-criminals always pull the right psychological triggers.”

The whitepaper can be read here.       

Tags:

• NEWS & INDUSTRY
• Cybercrime