Blog – Page 22

Hackers Now Targeting Point Of Sale Systems

September 6, 2018 by Joseph Martin

There’s a new threat to point of sale (POS) systems coming out of Russia, according to security researchers from Booz Allen Hamilton. The malware, which they’re calling “RtPOS” isn’t bleeding edge technology, and does not approach the level of sophistication of other recently discovered strains, but that doesn’t mean it should be taken lightly. These strains include RawPOS, MajikPOS, UDPOS, and Treasure hunter.

In its current incarnation, it has a limited feature set and is basically a RAM scrapper. Once deployed, it will watch a PC’s RAM looking for text patterns, which are saved to a local DAT file. Of interest, it doesn’t currently appear to have any sort of networking capability, so when the data is collected and stored, it has no means of actually porting it to a command and control server (yet).

There are two competing theories as to why this software is the way it is. One theory is that it’s simply a rough draft. A work in progress. Although relatively benign in its current incarnation, it would be quite easy for the authors to add enhancements to the code, and possibly to update the software remotely, turning this “nonthreatening” software into a true menace in the blink of an eye.

Another theory is that RtPOS is one part of a multi-part, much more subtle attack. The purpose of the software is simply to infect and collect data, leaving it to a separate process to exfiltrate the data at irregular intervals, which would be more difficult to detect, and unlikely to draw attention.

At present, there’s no clear indication which theory is correct, but both ideas are disturbing. As ever, vigilance is the key. Hardly a day goes by that researchers somewhere in the world don’t discover some new threat. This is but the latest.

Hackers Make More Money Than Is Spent On Cybersecurity

September 5, 2018 by Joseph Martin

Quick question – how much do the world’s cyber criminals make every sixty seconds?

If you guessed a quarter of a million dollars, you’d be wrong. If you doubled that value, you’d be wrong again.

According to research conducted by RiskIQ, cybercriminals are raking in a cool million dollars per minute, compared with businesses spending $171,233 per minute on security measures. It’s a lopsided battle, and businesses aren’t winning.

Some other interesting tidbits culled from the company’s research. Every sixty seconds:

Four new potentially vulnerable web components are discovered.

A new website appears running the CoinHive cryptocurrency mining script.

1.5 companies fall victim to a ransomware attack, with an average cost to the victimized company of $15,221.

In addition to that, RiskIQ discovered that a site running the CoinHive script was deleted every ten minutes, and that a new phishing domain appears about every five minutes.

Raef Meeuwisse, a security researcher and author, had this to say about the report and its findings:

“Cybercrime and cybersecurity co-exist in a constant cycle of innovation. As one particular criminal trend towards a particular technique increases, so the security functions create or strengthen the required defenses.

However, it is evident at both the level of personal and organizational cybersecurity that spending is unusually low. In fact, most of these cybercriminals are not going after the hard targets with great defenses, they are targeting the low hanging fruit – and there is still far too much of it.”

The simple truth is that until and unless we start taking cybersecurity more seriously, and until the aforementioned “low hanging fruit” ramps up spending to properly secure their systems, we can expect to see the number of cybercrimes continue to increase. Unfortunately, despite the crimewave, there doesn’t seem to be much motivation to do that.

High Frequency Audio Computer Monitors May Expose Screen Activity

September 4, 2018 by Joseph Martin

It may sound like something straight out of a science fiction movie, but recently, researchers have made a disturbing discovery. Using nothing more than an off-the-shelf microphone, it’s possible for an attacker to determine what content you’re viewing on your computer monitor.

The researchers tested a variety of LCD screens (with both LED and CCFL backlighting) and observed that the high-pitched noise made by the monitors changed as the content displayed on the screen changed.

The research team tested a variety of methods of recording audio data from the monitors in question, and found that they could capture sufficient data with a few methods. First, a smartphone positioned near the screen, second a compromised smart virtual assistant (like Google Home or Amazon’s Alexa), and third, using a parabolic microphone from up to ten meters distant.

Even more disturbing, the researchers discovered that an attacker could correctly identify the website a victim was looking at with up to 97 percent accuracy if the microphone was close to the monitor, and with 90.9 percent accuracy with microphones placed at some distance.

Worst of all, subtle changes in the pitch of your display screen make it possible for hackers to identify what specific characters are being displayed with an accuracy that ranged from 88 percent (more distant microphones) to 98 percent (microphones in close proximity to the monitor). This makes it entirely possible to glean passwords and other sensitive information.

Granted, this is an extremely exotic form of attack that requires a great deal of advance preparation by the attacker. Because of this, it’s unlikely that it will see widespread use anytime soon. Even so, it’s something that a careful and determined hacker could do right now using off the shelf technology, and there’s very little the victim could do to prevent it.

While we’re unlikely to see equipment manufacturers take the necessary steps to mask acoustic emanations, robust on-site physical security measures would make detection of this type of attack fairly easy.

Millions Of T-Mobile Customers Data May Have Been Leaked

September 4, 2018 by Joseph Martin

Telecommunications giant T-Mobile is the latest victim of a large-scale data breach, with personal data belonging to more than two million of its customers having been leaked. The exposed information included customer name, phone number, email address, billing zip code, account number and whether the account was pre-paid or post-paid.

As bad as that is, it could have been far worse. Fortunately, no financial information, passwords, or social security numbers were compromised.

According to the official statement released by T-Mobile, their security team shut down the “unauthorized capture of some information” on August 20th of this year. The statement did not provide specific details about how the hackers got into the company’s servers, and only provided an estimate of the total number of customer records impacted.

The statement read, in part:

“We take the security of your information very seriously and have a number of safeguards in place to protect your personal information from unauthorized access. We truly regret that this incident occurred and are so sorry for any inconvenience this has caused you.”

T-Mobile has reached out to law enforcement and has contacted all customers who were impacted by the breach.

Although no passwords were compromised, if you received a notification from the company that information about your account was compromised, it would be wise to change your password just to be safe. Be on guard against phishing attacks that may target you based on the information that was gleaned via the breach.

This is but the latest in a long and growing stream of high profile breaches this year, but it is by no means the largest. Earlier this year, for example, Car phone Warehouse suffered a breach that impacted all of its ~10 million customers. As ever, vigilance is the key.

Android Malware Could Access Your Pictures And Calls

September 1, 2018 by Joseph Martin

Android users have a new threat to contend with, according to a sixteen-page whitepaper outlining a new malware strain.

The paper was published by a group of security researchers working for Bitdefender. They identified a robust new strain of malware called “Triout.”

According to the report, although they just discovered the malware a month ago, there are indications that it has been in use since at least mid-May of this year.

Among other things, it can:

Steal call log data

Collect and steal SMS messages

Record every call taking place on the phone

Upload recordings of those calls to a remote server

Send the phone’s GPS coordinates to a remote server

Upload a copy of every picture taken with the phone’s camera to a remote server

Hide from the user’s view

These are robust, highly advanced features that require extensive, detailed knowledge of the Android OS. Typically, malware of this type is used by nation-state hackers with deep pockets, or by well-heeled networks of cybercriminals. At this point, there’s no clear indication which category Triout’s creators fall into.

The malware strain has been found masquerading as a legitimate app, but the team has been unable to trace it back to its source of origin. At this point, there’s no clear indication where it’s coming from. The first sample was uploaded to VirusTotal from Russia, but subsequent samples were uploaded from an Israeli IP address.

The researchers note that despite its advanced feature set, the group responsible appears to have made a mistake:

“What is striking…is that it’s completely obfuscated, meaning that simply by unpacking the cloned app’s .apk file, full access to the source code becomes available….this could suggest that the Triout framework may be a work-in-progress, with developers testing features and compatibility with devices.”

Survey Shows Teens Are Concerned About Their Screen Time

August 31, 2018 by Joseph Martin

According to a recent survey conducted by Pew Research Center, 54 percent of teens say that they spend too much time on their cellphones.

Acknowledging you have a problem is the first, necessary step toward correcting it, and the survey reports that significant percentages of teens are taking steps to do just that.

The Survey Specifically States:

52 percent of teens report that they are actively trying to cut back on their mobile phone use

57 percent report that they’re taking steps to limit the amount of time they spend on social media

58 percent report that they’re cutting back on the time they spend playing video games

Some other interesting and noteworthy statistics collected via the survey include the following:

72 percent of teens say that they often or sometimes check for messages and notifications first thing in the morning, just after waking up.

56 percent of teens report feeling lonely or anxious if they find themselves separated from their cherished phones.

36 percent of parents admit that they, like their teen children, spend too much time on their phones.

51 percent of teens report that their parents are distracted by their phones when teens try to have a conversation with them.

57 percent of parents say they set screen time restrictions for their teens in an attempt to limit phone use.

Smartphones are deeply embedded in our day to day activities, so these numbers are perhaps unsurprising.

What is both surprising and more than a little disturbing is the fact that a significant percentage of both teens and parents report that excessive cellphone use impacts their school and work performance, with 31 percent of teens admitting that their phone is a source of distraction that causes them to lose focus in school, and 39 percent of parents reporting that they lose focus at work for the same reason.

Unfortunately, while the statistics are illuminating, there are no easy solutions here. There’s little evidence that self-imposed use limits are having an impact.

Encrypted Chats Are Now Available In Skype

August 30, 2018 by Joseph Martin

Earlier this year, Microsoft announced that it had entered into a partnership with Open Whisper Systems, the makers of the Signal app. The purpose of the partnership was to bring Signal’s open source, end-to-end encryption protocol to Skype.

As of the latest Skype builds, that is now a reality. Stable versions of Skype have been released for Windows, macOS, Linux, android, and iOS. If you haven’t yet upgraded to the latest versions and want to begin making use of the new protocol, you should upgrade to Skype v8.15.0.306 if you’re an Android user, or Skype v8.28.0.41 if you’re a Windows user.

The new feature is called “Skype Private Conversations.” To access it, just press the “+Chat” button at the top of your contacts sidebar and select “New Private Conversation.”

A couple of caveats here. First, both parties will have to have the latest version of Skype to make use of the feature. Second, a new private conversation needs to be started from each device.

Assuming that’s the case, Skype sets up keys to encrypt the conversation. Note that as the name of the protocol indicates, this is end-to-end encryption, which means that the messages remain in an encrypted state even while in transit between the two devices that are communicating.

It’s a good feature, and a long-overdue addition that makes Skype even more useful. At present, however, the implementation is a bit cumbersome. It won’t see widespread adoption until a majority of the Skype user base has upgraded to the latest version.

Nonetheless, this is an excellent development that will, over the medium term, make communications more secure. Be sure your team is aware, and if you want to begin using encrypted chat right away, make sure that all users upgrade to the latest version.

Gmail Releases New Confidential Mode

August 29, 2018 by Joseph Martin

Google has introduced a new Gmail feature called “Confidential Mode,” which seeks to make sending and receiving important or sensitive emails more secure. Unfortunately, it may have inadvertently created as many problems as it solves.

Here’s how the new feature works, and why you may be leery of using it:

To send a confidential email, compose your message as normal, and then, click the “lock” icon located at the bottom of the email screen. When this button is pressed, you’ll be presented with a number of options that will enable you to specify a self-destruct time ranging from one day to five years. The email will auto-delete after the amount of time specified.

You’ll also be able to specify whether the email requires a password to open, and of course, giving you the ability to set that password. Also, a message sent in Confidential mode cannot be forwarded to any other user or be printed out.

The new service works across all email systems because Confidential messages aren’t actually sent. The user will get a notification that they’ve received a confidential mail, and a link to click to access it, which points back to Google’s own servers where the email is housed.

Given this, the sender of the message also has the ability to selectively remove access to confidential emails if one was inadvertently sent to the wrong recipient.

All of that sounds great in theory, but there’s a problem. That’s exactly how phishing attacks work.

Security professionals have sounded the alarm that hackers will quickly begin spoofing Google’s new service, pointing the links in their messages toward their own servers. When users are prompted to provide their login credentials to see the message, they’ll be handing access to their email account over to the hackers. Google has not yet responded to or commented on this flaw in their new system. Use with caution.

If You Use Photoshop, Update Immediately

August 28, 2018 by Joseph Martin

Do you use Photoshop? Does anyone who works for you use it? If so, you’ll want to apply the latest security patch immediately.

Two new vulnerabilities were discovered after the release of Adobe’s regularly scheduled August 2018 security patch update. This prompted the company to take the unusual step of releasing an emergency, out-of-band update to correct the issue.

These two newly discovered vulnerabilities (tracked as CVE-2018-12810 and CVE-2018-12811) impact Adobe photoshop CC2017, v18.1.5 and earlier 18.x versions, and Adobe Photoshop CC 2018, v19.1.5 and earlier 19.x versions.

It was discovered and initially reported by Kushal Arvind Shah, a security researcher with FortiGuard Labs. The vulnerabilities allow hackers to exploit a pair of critical memory corruption flaws, which allows a them to remotely execute malicious code on the target user’s machine.

Again, it must be stressed that neither of these issues were addressed by the company’s regularly scheduled patch update released earlier this month. Although if you haven’t yet applied that patch, you should. It addresses a total of eleven different security flaws spread across a number of the company’s products including: Flash Player, Acrobat, Reader, Experience Manager and Creative Cloud.

To get the fix for the Photoshop vulnerabilities, you’ll need to go to the company’s website and download the out of band patch designed specifically to address this issue.

It should be noted that both issues, while having been assigned a severity rating of “Critical,” have only been given a priority rating of three. This suggests that these flaws have not been exploited in the wild. That, however, is simply a matter of time. If members of your creative team employ Photoshop to generate graphics for your business, applying the latest patch should be a top priority. To do anything less is to invite an attack against your business.

New Intel Vulnerability Named Foreshadow Found

August 27, 2018 by Joseph Martin

Intel has had a tough time of things so far this year. The most recent trouble stems from yet another newly discovered security flaw in the company’s processors, bearing the inelegant name of “L1 Terminal Fault,” or “Foreshadow” by those who have discovered it.

The attack can take one of three different shapes (so far), and ultimately allows a hacker to access sensitive data stored in the computer’s memory or on third-party cloud-based storage services. This sensitive data includes passwords, pictures, other sorts of data files, and encryption keys.

The three variants of the attack have been grouped into two distinct categories, known as Foreshadow and Foreshadow NG (Next Gen).

The standard Foreshadow variant (Reference CVE-2018-3615) targets Intel’s Software Guard Extensions (SGX), which is new technology designed by intel to help keep user data from falling into the wrong hands, even if the whole system comes under attack.

As the researchers who discovered it describe it:

“Foreshadow enables an attacker to extract SGX sealing keys, previously sealed data can be modified and re-sealed. With the extracted sealing key, an attacker can trivially calculate a valid Message Authentication Code (MAC), thus depriving the data owner from the ability to detect the modification.”

The Foreshadow: Next Generation attack (reference CVE-2018-3620 and CVE-2018-3646) targets virtualization environments like those used by large cloud-based service providers like Microsoft and Amazon.

From the researchers again:

“Using Foreshadow-NG, a malicious program running on the computer might be able to read some parts of the kernel’s data. As the kernel has access to data stored by other programs, a malicious program might be able to exploit Foreshadow-NG to access data belonging to other programs.

Foreshadow is different from Meltdown as it targets virtual machines and SGX, in addition to data stored in the operating system’s kernel (which was targeted by Meltdown).”

According to Intel, none of these attacks have been seen in the wild, but of course, that’s just a matter of time now. No word from Intel yet on a time frame to address these issues, but stay tuned.