Posted on

Q4 2017 DDoS Trends Report: Financial Sector Experienced 40 Percent of Attacks

Verisign’s Q4 2017 DDoS Trends Report – Volume 4, Issue 4, 4th Quarter 2017
Click to DownloadVerisign has released its Q4 2017 DDoS Trends Report, which represents a unique view into the attack trends unfolding online, through observations and insights derived from distributed denial of service (DDoS) attack mitigations enacted on behalf of Verisign DDoS Protection Services and security research conducted by Verisign Security Services.

The largest volumetric and highest intensity DDoS attack observed by Verisign in Q4 2017 was a multi-vector attack that peaked at approximately 53 Gigabits per second (Gbps) and around 5 Million packets per second (Mpps). The attack consisted of a wide range of attack vectors including TCP SYN and TCP RST floods, DNS amplification attacks, Internet Control Message Protocol (ICMP) floods, and invalid packets.

Mitigation Peaks by Quarter from Q1 2016 to Q4 2017

Key DDoS Trends and Observations:

  • Forty-two percent of DDoS attacks were User Datagram Protocol (UDP) floods.
  • Eighty-two percent of DDoS attacks mitigated by Verisign in Q4 2017 employed multiple attack types.
  • The Financial industry, representing 40 percent of mitigation activity, was the most frequently targeted industry for Q4 2017. The IT/Cloud/SaaS industry, previously the most targeted industry, experienced the second highest number of DDoS attacks, representing 33 percent of mitigation activity.

Collaboration is Critical for Effective DDoS Mitigation

Collaboration is vital for effective distributed denial of service (DDoS) mitigation. A mitigation response could often benefit from the involvement of a number of stakeholders. In an ideal scenario, all groups could work to mitigate the DDoS attack and bring the organization’s critical systems back to optimal levels as quickly as possible. This level of complex coordination has traditionally been carried out using telephones and emails. However, there are other options for mitigation providers to help facilitate automated collaboration during a DDoS mitigation. A standard method of signaling for mitigation assistance upstream could simplify and streamline the process of coordinating the many components usually deployed in a DDoS mitigation. This is where DDoS Open Threat Signaling (DOTS) comes into play.

Read the report to learn more about DDoS Open Threat Signaling.

For more DDoS Trends in Q4 2017, download the full report, and be sure to check back in a few months when we release our Q1 2018 DDoS Trends Report.

Read the Full Article here: >CircleID – Cybercrime News, Opinions and Blogs

Posted on

Microsoft Won’t Patch a Severe Skype Vulnerability Anytime Soon

A serious vulnerability has been discovered in Microsoft-owned most popular free web messaging and voice calling service Skype that could potentially allow attackers to gain full control of the host machine by granting system-level privileges to a local, unprivileged user.

The worst part is that this vulnerability will not be patched by Microsoft anytime soon.

It’s not because the flaw is unpatchable, but because fixing the vulnerability requires a significant software rewrite, which indicates that the company will need to issue an all-new version of Skype rather than just a patch.

The vulnerability has been

discovered

and reported to Microsoft by security researcher Stefan Kanthak and resides in Skype’s update installer, which is susceptible to Dynamic Link Libraries (DLL) hijacking.

According to the researcher, a potential attacker could exploit the “functionality of the Windows DLL loader where the process loading the DLL searches for the DLL to be loaded first in the same directory in which the process binary resides and then in other directories.”

The exploitation of this preferential search order would allow the attacker to hijack the update process by downloading and placing a malicious version of a DLL file into a temporary folder of a Windows PC and renaming it to match a legitimate DLL that can be modified by an unprivileged user without having any special account privileges.

When Skype’s update installer tries to find the relevant DLL file, it will find the malicious DLL first, and thereby will install the malicious code.

Although Kanthak demonstrated the attack using the Windows version of Skype, he believes the same DLL hijacking method could also work against other operating systems, including Skype versions for macOS and Linux.

Kanthak informed Microsoft of the Skype vulnerability back in September, but the company told him that the patch would require the Skype update installer go through “a large code revision,” Kanthak

told

ZDNet.

So rather than releasing a security update, Microsoft decided to build an altogether new version of the Skype client that would address the vulnerability.

It should be noted that this vulnerability only affects the Skype for the desktop app, which uses its update installer which is vulnerable to the DLL hijacking technique. The Universal Windows Platform (UWP) app version available from the Microsoft Store for Windows 10 PCs is not affected.

The vulnerability has been rated as “medium” in severity, but Kanthak said, “the attack could be easily weaponized.” He gave two examples, which have not been released yet.

Until the company issues an all-new version of Skype client, users are advised to exercise caution and avoid clicking on attachments provided in an email. Also, make sure you run appropriate and updated anti-virus software that offers some defence against such attacks.

This is not the first time Skype has been dealing with a severe security flaw. In June 2017, a

critical flaw in Skype

was revealed before Microsoft released a fix for the issue that allowed hackers to crash systems and execute malicious code in them.

Last month, among several messaging applications, Skype was also dealing with a critical remote code execution

vulnerability in Electron

—a popular web application framework widely-used in desktop applications.

Read the Full Article here: >The Hacker News [ THN ]

Posted on

Hackers Exploit ‘Telegram Messenger’ Zero-Day Flaw to Spread Malware

A zero-day vulnerability has been discovered in the desktop version for end-to-end encrypted Telegram messaging app that was being exploited in the wild in order to spread malware that mines cryptocurrencies such as Monero and ZCash.

The Telegram vulnerability was uncovered by security researcher Alexey Firsh from Kaspersky Lab last October and affects only the Windows client of Telegram messaging software.

The flaw has actively been exploited in the wild since at least March 2017 by attackers who tricked victims into downloading malicious software onto their PCs that used their CPU power to mine cryptocurrencies or serve as a backdoor for attackers to remotely control the affected machine, according to a

blogpost

on Securelist.

Here’s How Telegram Vulnerability Works

The vulnerability resides in the way Telegram Windows client handles the RLO (right-to-left override) Unicode character (U+202E), which is used for coding languages that are written from right to left, like Arabic or Hebrew.

According to Kaspersky Lab, the malware creators used a hidden RLO Unicode character in the file name that reversed the order of the characters, thus renaming the file itself, and send it to Telegram users.

For example, when an attacker sends a file named "photo_high_re*U+202E*gnp.js" in a message to a Telegram user, the file’s name rendered on the users’ screen flipping the last part.

Therefore, the Telegram user will see an incoming PNG image file (as shown in the below image) instead of a JavaScript file, misleading into downloading malicious files disguised as the image.

"As a result, users downloaded hidden malware which was then installed on their computers," Kaspersky says in its press release published today.

Kaspersky Lab reported the vulnerability to Telegram and the company has since patched the vulnerability in its products, as the Russian security firm said: "at the time of publication, the zero-day flaw has not since been observed in messenger’s products."

Hackers Used Telegram to Infect PCs with Cryptocurrency Miners

During the analysis, Kaspersky researchers found several scenarios of zero-day exploitation in the wild by threat actors. Primarily, the flaw was actively exploited to deliver cryptocurrency mining malware, which uses the victim’s PC computing power to mine different types of cryptocurrency including Monero, Zcash, Fantomcoin, and others.

While analyzing the servers of malicious actors, the researchers also found archives containing a Telegram’s local cache that had been stolen from victims.

In another case, cybercriminals successfully exploited the vulnerability to install a backdoor trojan that used the Telegram API as a command and control protocol, allowing hackers to gain remote access to the victim’s computer.

"After installation, it started to operate in a silent mode, which allowed the threat actor to remain unnoticed in the network and execute different commands including the further installation of spyware tools," the firm added.

Firsh believes the zero-day vulnerability was exploited only by Russian cybercriminals, as "all the exploitation cases that [the researchers] detected occurring in Russia," and a lot of artifacts pointed towards Russian cybercriminals.

The best way to protect yourself from such attacks is not to download or open files from unknown or untrusted sources.

The security firm also recommended users to avoid sharing any sensitive personal information in messaging apps and make sure to have a good antivirus software from reliable company installed on your systems.

Read the Full Article here: >The Hacker News [ THN ]

Posted on

Hackers Exploit ‘Telegram Messenger’ Zero-Day Flaw to Spread Malware

A zero-day vulnerability has been discovered in the desktop version for end-to-end encrypted Telegram messaging app that was being exploited in the wild in order to spread malware that mines cryptocurrencies such as Monero and ZCash.

The Telegram vulnerability was uncovered by security researcher Alexey Firsh from Kaspersky Lab last October and affects only the Windows client of Telegram messaging software.

The flaw has actively been exploited in the wild since at least March 2017 by attackers who tricked victims into downloading malicious software onto their PCs that used their CPU power to mine cryptocurrencies or serve as a backdoor for attackers to remotely control the affected machine, according to a

blogpost

on Securelist.

Here’s How Telegram Vulnerability Works

The vulnerability resides in the way Telegram Windows client handles the RLO (right-to-left override) Unicode character (U+202E), which is used for coding languages that are written from right to left, like Arabic or Hebrew.

According to Kaspersky Lab, the malware creators used a hidden RLO Unicode character in the file name that reversed the order of the characters, thus renaming the file itself, and send it to Telegram users.

For example, when an attacker sends a file named "photo_high_re*U+202E*gnp.js" in a message to a Telegram user, the file’s name rendered on the users’ screen flipping the last part.

Therefore, the Telegram user will see an incoming PNG image file (as shown in the below image) instead of a JavaScript file, misleading into downloading malicious files disguised as the image.

"As a result, users downloaded hidden malware which was then installed on their computers," Kaspersky says in its press release published today.

Kaspersky Lab reported the vulnerability to Telegram and the company has since patched the vulnerability in its products, as the Russian security firm said: "at the time of publication, the zero-day flaw has not since been observed in messenger’s products."

Hackers Used Telegram to Infect PCs with Cryptocurrency Miners

During the analysis, Kaspersky researchers found several scenarios of zero-day exploitation in the wild by threat actors. Primarily, the flaw was actively exploited to deliver cryptocurrency mining malware, which uses the victim’s PC computing power to mine different types of cryptocurrency including Monero, Zcash, Fantomcoin, and others.

While analyzing the servers of malicious actors, the researchers also found archives containing a Telegram’s local cache that had been stolen from victims.

In another case, cybercriminals successfully exploited the vulnerability to install a backdoor trojan that used the Telegram API as a command and control protocol, allowing hackers to gain remote access to the victim’s computer.

"After installation, it started to operate in a silent mode, which allowed the threat actor to remain unnoticed in the network and execute different commands including the further installation of spyware tools," the firm added.

Firsh believes the zero-day vulnerability was exploited only by Russian cybercriminals, as "all the exploitation cases that [the researchers] detected occurring in Russia," and a lot of artifacts pointed towards Russian cybercriminals.

The best way to protect yourself from such attacks is not to download or open files from unknown or untrusted sources.

The security firm also recommended users to avoid sharing any sensitive personal information in messaging apps and make sure to have a good antivirus software from reliable company installed on your systems.

Read the Full Article here: >The Hacker News [ THN ]

Posted on

Download: The 2017 State of Endpoint Security Risk Report

To determine the cost and impact of evolving threats, the Ponemon Institute, a preeminent research center dedicated to data privacy and protection, surveyed 665 IT and security leaders.

The 2017 State of Endpoint Security Risk Report

Their responses indicate today’s organizations are struggling to secure their endpoints, and paying a steep cost for each successful attack — $5 million for a large organization or an average of $301 per employee.

Get the full report here.

Attacks are evolving

This year, over 40% of US businesses were compromised due to fileless attacks and exploits. Overwhelmingly, respondents cited that over-reliance on traditional endpoint security has left organizations exposed to significant risk. Report findings include:

  • 54% of businesses were comprised in 2017.
  • Fileless attacks are almost 10x more likely to succeed than file-based attacks.
  • False positive rates for existing endpoint security solutions are nearing 50%.
  • A successful attack costs an organization on average $301 per employee — or over $5million for a large organization.

Read the Full Article here: >Help Net Security – News

Posted on

Domain Theft Strands Thousands of Web Sites

Newtek Business Services Corp. [NASDAQ:NEWT], a Web services conglomerate that operates more than 100,000 business Web sites and some 40,000 managed technology accounts, had several of its core domain names stolen over the weekend. The theft shut off email and stranded Web sites for many of Newtek’s customers.

An email blast Newtek sent to customers late Saturday evening made no mention of a breach or incident, saying only that the company was changing domains due to “increased” security. A copy of that message can be read here (PDF).

In reality, three of their core domains were hijacked by a Vietnamese hacker, who replaced the login page many Newtek customers used to remotely manage their Web sites (webcontrolcenter[dot]com) with a live Web chat service. As a result, Newtek customers seeking answers to why their Web sites no longer resolved correctly ended up chatting with the hijacker instead.

The PHP Web chat client that the intruder installed on Webcontrolcenter[dot]com, a domain that many Newtek customers used to manage their Web sites with the company. The perpetrator can be seen in this chat using the name “admin.” Click to enlarge.

In a follow-up email sent to customers 10 hours later (PDF), Newtek acknowledged the outage was the result of a “dispute” over three domains, webcontrolcenter[dot]com, thesba[dot]com, and crystaltech[dot]com.

“We strongly request that you eliminate these domain names from all your corporate or personal browsers, and avoid clicking on them,” the company warned its customers. “At this hour, it has become apparent that as a result over the dispute for these three domain names, we do not currently have control over the domains or email coming from them.”

The warning continued: “There is an unidentified third party that is attempting to chat and may engage with clients when visiting the three domains. It is imperative that you do not communicate or provide any sensitive data at these locations.”

Newtek did not respond to requests for comment.

Domain hijacking is not a new problem, but it can be potentially devastating to the victim organization. In control of a hijacked domain, a malicious attacker could seamlessly conduct phishing attacks to steal personal information, or use the domain to foist malicious software on visitors.

Newtek is not just a large Web hosting firm: It aims to be a one-stop shop for almost any online service a small business might need. As such, it’s a mix of very different business units rolled up into one since its founding in 1998, including lending solutions, HR, payroll, managed cloud solutions, group health insurance and disaster recovery solutions.

“NEWT’s tentacles go deep into their client’s businesses through providing data security, human resources, employee benefits, payments technology, web design and hosting, a multitude of insurance solutions, and a suite of IT services,” reads a Sept. 2017 profile of the company at SeekingAlpha, a crowdsourced market analysis publication.

Newtek’s various business lines. Source: Newtek.

Reached via the Web chat client he installed at webcontrolcenter[dot]com, the person who claimed responsibility for the hijack said he notified Newtek five days ago about a “bug” he found in the company’s online operations, but that he received no reply.

A Newtek customer who resells the company’s products to his clients said he had to spend much of the weekend helping clients regain access to email accounts and domains as a result of the incident. The customer, who asked to remain anonymous, said he was shocked that Newtek made little effort to convey the gravity of the hijack to its customers — noting that the company’s home page still makes no mention of the incident.

“They also fail to make it clear that any data sent to any host under the domain could be recorded (email passwords, web credentials, etc.) by the attacker,” he said. “I’m floored at how bad their communication was to their users. I’m not surprised, but concerned, that they didn’t publish the content in the emails directly on their website.”

The source said that at a minimum Newtek should have expired all passwords immediately and required resets through non-compromised hosts.

“And maybe put a notice about this on their home page instead of relying on email, because a lot of my customers can’t get email right now as a result of this,” the source said.

There are a few clues that suggest the perpetrator of these domain hijacks is indeed being truthful about both his nationality and that he located a bug in Newtek’s service. Two of the hijacked domains were moved to a Vietnamese domain registrar (inet.vn).

This individual gave me an email address to contact him at — hd2416@gmail.com — although he has so far not responded to questions beyond promising to reply in Vietenamese. The email is tied to two different Vietnamese-language social networking profiles.

A search at Domaintools indicates that this address is linked to the registration records for four domains, including one (giakiemnew[dot]com) that was recently hosted on a dedicated server operated by Newtek’s legacy business unit Crystaltek [full disclosure: Domaintools is an advertiser on this site]. Recall that Crystaltek[dot]com was among the three hijacked domains.

In addition, the domain giakiemnew[dot]com was registered through Newtek Technology Services, a domain registration service offered by Newtek. This suggests that the perpetrator was in fact a customer of Newtek, and perhaps did discover a vulnerability while using the service.

Read the Full Article here: >Krebs on Security

Posted on

The Key IoT Security Questions You Need To Ask

Microsoft IoT Security

An Internet of Things (IoT) solution offers a multitude of business benefits from decreased operational costs to new revenue streams. But it also comes with a host of security considerations, including an ever-changing array of regulatory compliance requirements, demanding expert navigation and acute attention to detail.

Below I’ve listed some of the critical questions to ask when deploying a secure IoT solution. To learn more about IoT security, be sure to register for the IoT in Action event in San Francisco on February 13.

How secure are your things?

For starters, the actual devices must be secure. In the next few years, a new wave of innovation will drive down costs and inundate the market with internet-connected devices in every price range, from electronic toys to manufacturing sensors. In anticipation of this, my Microsoft colleagues have identified The seven properties of highly secure devices. I have listed out each of these properties below, along with the fundamental questions you must ask:

  1. The hardware-based root of trust: Does each device have a unique identity that is inseparable from the hardware?
  2. Small trusted computing base: Is most of the device’s software outside its trusted computing base?
  3. Defense in depth: Does your device software have multiple layers of protection built-in?
  4. Compartmentalization: Are you using hardware-enforced barriers to stop failures from propagating to other components?
  5. Certificates-based authentication: Do your devices use certificates (vs. passwords)?
  6. Renewable security: Can the device’s software be updated automatically to a more secure state?
  7. Failure reporting: Do you have a solution in place to report software failures to the manufacturer?

How secure are your connections? 

More to the point, when you’ve got a bunch of devices talking to each other over the internet, how will you safeguard data confidentiality and integrity? When choosing an IoT monitoring and connection solution, make sure that it is using industry-proven data encryption. Solutions like the Azure IoT Suite secure the internet connection between the IoT device and IoT hub using the Transport Layer Security (TLS) standard.

Another question to ask is how you will prevent unsolicited inbound connections from wreaking havoc on your devices? Make sure that only devices are allowed to initiate connections and not the IoT hub. And speaking of the IoT hub: make sure that the one you’re using has the capability of maintaining a per-device queue – meaning that it can store messages for devices and wait for the devices to connect. For more on this topic, be sure to read IoT security from the ground up.

How secure is your cloud solution?

Is your cloud provider following rigorous security best practices? When choosing a cloud provider, make sure you pay careful attention to how they are handling the following areas.

  1. Network traffic segregation: Is IoT traffic segregated from other network traffic using an IoT gateway or other means?
  2. Monitoring: How is network traffic being monitored? How will you know if any credentials are compromised or if unmanaged devices are accessing your cloud services?
  3. Security controls: How well do you know your cloud provider’s SLA (service-level agreement)? Which security controls are being maintained by your provider and which will you need to address internally?
  4. Encryption and security key management: Does your IoT solution allow you to define access control policies for each security key? Is data in the cloud encrypted?

Have you registered for IoT in Action in San Francisco, CA on February 13, 2018?

These questions only scratch the broad surface of IoT security. To learn more about securing your IoT solution, register for this free, one-day event. You’ll hear from the researchers behind The seven properties of highly secured devices and see an IoT solution come to life before your eyes. You’ll also get insights into how Microsoft addresses IoT security through its Azure solutions. Plus, connect with partners who can help you bring your IoT solution from concept to reality. View the full agenda.

The post The Key IoT Security Questions You Need To Ask appeared first on ReadWrite.

Read the Full Article here: >ReadWriteWeb

Posted on

Consumers prefer security over convenience for the first time ever, IBM Security report finds

A new study by IBM Security surveying 4,000 adults from a few different regions of the world found that consumers are now ranking security over convenience. For the first time ever, business users and consumers are now preferring security over convenience. TechRepublic spoke with executive security advisor at IBM Security Limor Kessem to discuss this new trend.

“We always talk about the ease of use, and not impacting user experience, etc, but it turns out that when it comes to their financial accounts…people actually would go the extra mile and will use extra security,” Kessem said. Whether it’s using two factor authentication, an SMS message on top of their password, or any other additional step for extra protection, people still want to use it. Some 74% of respondents said that they would use extra security when it comes to those accounts, she said.

Read the Full Article here: >Hack In The Box

Posted on

7 steps for getting your organization GDPR-ready

GDPR-ready organizationWhile the EU has had long established data protection standards and rules, its regulators haven’t truly commanded compliance until now. Under the General Data Protection Regulation (GDPR), financial penalties for data protection violations are severe – €20 million (about $24.8 million USD) or 4 percent of annual global turnover (whichever is higher), to be exact.

What’s more is that GDPR does not merely apply to EU businesses, but any organization processing personal data of EU citizens, regardless of location. That said, organizations need to take real steps to improve how they collect and manage data.

At its core, GDPR compliance is about following sensible information management practices. However, oftentimes, business users do not follow their organization’s information governance policies, whether it’s because storing content in these platforms is tedious or simple ignorance of the rules. Compliance with the GDPR will therefore require practical steps which both improve employee awareness and the practices that make it more likely people will follow the rules.

But doing this is easier said than done, and business leaders need practical, actionable strategies that they can implement to meet the new requirements. Here are seven steps to help organizations improve data management and close the GDPR compliance gap.

1. Get explicit customer consent

From fitness apps to online checkouts and contracts, companies are collecting more consumer data than ever before. Under GDPR, be clear about what information you’re collecting and how it will be used, and have a legal document in place that clearly outlines both. Another option is to only collect data you need – if you don’t need to know a person’s ethnicity for a specific reason, consider eliminating those prompts on your website.

2. Centralize data storage

As far as possible, you should unify your central content repository. Aim to store all personal customer data in one environment, or connect on-premises and cloud deployments. If this is not possible, make sure that departments have one single space for storing data. Eliminate shadow IT and train all staff to be compliant with these practices.

3. Audit the information you have

One of the easiest ways to begin complying with the GDPR is to perform an audit of all the information you currently hold, and search for any personally identifiable information that may exist across your organization. Move what you want to keep to a central repository and delete the rest.

4. Make subject access information easy to find

As of May 2018, consumers will have the right to demand a ‘subject access request,’ in which companies must be able to provide them with a file containing all the information you hold on them. To be compliant, you will need to confidently collect data from all your systems about a specific customer, which may involve collecting data from multiple systems, so have the technology and processes in place to do so.

5. Security, security, security

Companies must store any data they collect via internal systems in a secure platform, so assess your current cybersecurity measures, make sure basic security procedures such as encryption and password protection are in place and then promote best security practices amongst members of your organization.

6. Implement accountable records management

Personal customer information that your staff receives must be recorded centrally, have permissions and metadata tags applied and be destroyed when no longer required. Don’t keep paper records, and implement strict, automated processes about how long you hold onto this information and when it’s no longer needed.

7. Honor customers’ right to be forgotten

The GDPR will allow consumers to demand that an organization deletes any data they hold on them. In order to honor this, be sure that all personal information is moved to this central environment so it can be easily and thoroughly removed.

Improved data management and information governance is good for everyone, but it’s becoming critical for GDPR compliance, and organizations that don’t get on board will end up paying both financially and legally. These seven steps will have you well on your way to revamping how your organization stores data and make for a more secure and organized business environment.

Read the Full Article here: >Help Net Security – News