Nearly 2000 WordPress Websites Infected with a Keylogger

More than 2,000 WordPress websites have once again been found infected with a piece of crypto-mining malware that not only steals the resources of visitors' computers to mine digital currencies but also logs visitors' every keystroke.
Security researchers at Sucuri discovered a malicious campaign that infects WordPress websites with a malicious script that delivers an in-browser cryptocurrency miner from CoinHive and a keylogger.

Coinhive is a popular browser-based service that offers website owners to embed a JavaScript to utilise CPUs power of their website visitors in an effort to mine the Monero cryptocurrency.

Sucuri researchers said the threat actors behind this new campaign is the same one who infected more than 5,400 Wordpress websites last month since both campaigns used keylogger/cryptocurrency malware called cloudflare[.]solutions.

Spotted in April last year, Cloudflare[.]solutions is cryptocurrency mining malware and is not at all related to network management and cybersecurity firm Cloudflare. Since the malware used the cloudflare[.]solutions domain to initially spread the malware, it has been given this name.

The malware was updated in November to include a keylogger. The keylogger behaves the same way as in previous campaigns and can steal both the site's administrator login page and the website's public facing frontend.

If the infected WordPress site is an e-commerce platform, hackers can steal much more valuable data, including payment card data. If hackers manage to steal the admin credentials, they can just log into the site without relying upon a flaw to break into the site.

The cloudflare[.]solutions domain was taken down last month, but criminals behind the campaign registered new domains to host their malicious scripts that are eventually loaded onto WordPress sites.
The new web domains registered by hackers include cdjs[.]online (registered on December 8th), cdns[.]ws (on December 9th), and msdns[.]online (on December 16th).

Just like in the previous cloudflare[.]solutions campaign, the cdjs[.]online script is injected into either a WordPress database or the theme's functions.php file. The cdns[.]ws and msdns[.]online scripts are also found injected into the theme's functions.php file.

The number of infected sites for cdns[.]ws domain include some 129 websites, and 103 websites for cdjs[.]online, according to source-code search engine PublicWWW, though over a thousand sites were reported to have been infected by the msdns[.]online domain.
Researchers said it's likely that the majority of the websites have not been indexed yet.

"While these new attacks do not yet appear to be as massive as the original Cloudflare[.]solutions campaign, the reinfection rate shows that there are still many sites that have failed to properly protect themselves after the original infection. It’s possible that some of these websites didn't even notice the original infection," Sucuri researchers concluded.

If your website has already been compromised with this infection, you will require to remove the malicious code from theme's functions.php and scan wp_posts table for any possible injection.
Users are advised to change all WordPress passwords and update all server software including third-party themes and plugins just to be on the safer side.


Source:
 The HackerNews 

Critical Flaw Hits Popular Windows Apps Built With Electron JS Framework

A critical remote code execution vulnerability has been reported in Electron—a popular web application framework that powers thousands of widely-used desktop applications including Skype, Signal, Wordpress and Slack—that allows for remote code execution.
Electron is an open-source framework that is based on Node.js and Chromium Engine and allows app developers to build cross-platform native desktop applications for Windows, macOS and Linux, without knowledge of programming languages used for each platform.


The vulnerability, assigned as the number CVE-2018-1000006, affects only those apps that run on Microsoft Windows and register themselves as the default handler for a protocol like myapp://.
"Such apps can be affected regardless of how the protocol is registered, e.g. using native code, the Windows registry, or Electron's app.setAsDefaultProtocolClient API," Electron says in an advisory published Monday.
The Electron team has also confirmed that applications designed for Apple's macOS and Linux are not vulnerable to this issue, and neither those (including for Windows) that do not register themselves as the default handler for a protocol like myapp://.
The Electron developers have already released two new versions of their framework, i.e. 1.8.2-beta.4, 1.7.11, and 1.6.16 to address this critical vulnerability.

"If for some reason you are unable to upgrade your Electron version, you can append—as the last argument when calling app.setAsDefaultProtocolClient, which prevents Chromium from parsing further options," the company says.

End users can do nothing about this vulnerability; instead, developers using Electron JS framework have to upgrade their applications immediately to protect their user base.

Much details of the remote code execution vulnerability have not been disclosed yet, neither the advisory named any of the vulnerable apps (that make themselves the default protocol handler) for security reason.
We will update you as soon as any details about the flaw come out.



Source:  TheHacker News 

The $6bn Crime: 17 Million UK Consumers Hit Last Year

Cybercrime cost 17 million UK consumers an estimated £4.6bn ($6bn) last year, according to Symantec.

The vendor polled over 21,000 adults across 21 markets, including 1000 in the UK, to compile its 2017 Norton Cyber Security Insights Report.

Globally, cyber-criminals stole £130bn ($172bn) from 978 million consumers in those countries.

The UK’s mature online economy contributed a hefty chunk of the £20.7bn taken from 98.2 million European consumers during the period. Even more telling, each victim of cybercrime is said to have lost nearly two working days (14.8 hrs) dealing with the aftermath of the incident.

Just one in 12 UK consumers suffered a ransomware file lock-down, with over a fifth (22%) failing to regain access to their data despite paying the ransom.

The 44% of total British netizens that claimed never to back-up could be playing a risky game.

“Handing the hackers money simply continues to fund their efforts with no guarantee that you’ll personally be able to regain access to your digital life,” warned Nick Shaw, general manager of Norton EMEA. “In the case of ransomware, crime pays, and we can all take some simple steps to thwart their efforts.”

Tellingly, cybercrime victims were more likely to use the same online password across all their accounts: 20% versus 12% of non-victims.

Cybercrime is becoming more frequent: 60% of those who have suffered an attack in the past were hit in the past year, including 37% who handed over info after being phished, 40% who had their home Wi-Fi cracked, a third who were conned into fraudulent purchases and more than a quarter who fell for tech support scams.

Yet 28% of UK victims think they’re able to protect their data from future attacks and 26% think they’re at low risk of being hit again, according to the report.

“Consumers’ actions revealed a dangerous disconnect: despite a steady stream of cybercrime sprees reported by media, too many people appear to feel invincible and skip taking even basic precautions to protect themselves,” said Shaw. “This disconnect highlights the need for consumer digital safety and the urgency for consumers to get back to basics when it comes to doing their part to prevent cybercrime.”

Source:  Info-Security 

UK’s Top Law Firms at Risk After 1m+ Credentials Found on Dark Web

The UK’s top law firms are at serious risk of unauthorized network intrusions after new research revealed over one million breached credentials on the dark web.

RepKnight studied 620 domains belonging to 500 of the UK’s law firms and found 1.16 million corporate email addresses on various sites which collect previously stolen or leaked credentials.

What’s more, more than half of these had been posted in the past six months, and 80% had an associated password – often available in clear text or hashed values which can be easily cracked, the vendor claimed.

“This puts those staff – and the law firm’s network – at significant risk from ‘credential stuffing’ attacks, where bots are used to repeatedly try the same username and password on multiple sites,” the report continued. “Perhaps more serious are ‘spear phishing’ attacks or identity fraud, where those credentials are used as part of a targeted cyber-attack on that individual.”

The vast majority of these credentials were taken from third-party breaches such as the one at LinkedIn, where law firm employees had signed up with their work credentials.

However, their appearance on dark web sites with associated passwords plunges their employers into a potentially alarming situation, if those credentials are used to access the corporate network, craft spear-phishing emails loaded with malware, or even attempt CEO fraud.

Any leaks of highly sensitive client or employee data could result in heavy fines under the GDPR.

The legal sector is coming under increasing scrutiny from cyber-criminals looking to tap the wealth of lucrative information such firms hold.

A quarter (24%) of SME-sized firms in the sector suffered a cyber-attack last year, with the figure rising to 36% for London-based companies, according to NatWest.

Meanwhile, two major US law firms were hacked in 2016 for information subsequently used in a $4m insider trading scam.

Both the Panama Papers and Paradise Papers leaks also came about after offshore law firms were targeted.

Source:  Info-Security 

High-Profile Twitter Accounts Hit by Turkish Propaganda Campaign

A Twitter campaign purportedly carried out by Turkish hacker group ‘Ayyildiz Tim’ has targeted the accounts of several high-profile individuals to spread political propaganda, according to McAfee.

In a blog post on the firm’s website Christiaan Beek, lead scientist & principal engineer, and Raj Samani, chief scientist and McAfee fellow, explained that upon investigating the recent events McAfee Advanced Threat Research discovered the Twitter account of the Indian ambassador to the United Nations was taken over on January 13 and used to spread pro-Pakistan and pro-Turkey postings.

“What seemed to be a single event soon became a targeted campaign that we discovered in cooperation with our partner SocialSafeGuard,” the pair wrote, with the accounts of Borge Brende, president of the World Economic Forum, Eric Bolling and Greta Van Susteren, both of Fox News, also targeted.

“Once the accounts were compromised, the attackers direct-messaged the account contacts with propaganda for their cause or with a link to convince them to click on a phishing site that would harvest the Twitter credentials of the victim.”

When looking at the source code of the malicious pages, McAfee found several Turkish-language segments, with ‘Ayyildiz Tim’ claiming responsibility for the attacks.

“There is also evidence that private messaging history has been accessed from certain compromised accounts of prominent figures, along with other sensitive or confidential information such as private phone numbers and emails,” McAfee added.

“These tactics demonstrate the use of authority and social validation as subconscious levers to invoke victim interaction,” Samani told Infosecurity. “Whilst these methods are typical for email, Twitter is a relatively new channel for such activities.

“Twitter users – or anyone using social media – should always be wary of the potential for criminals to take control of their account. This news proves the importance of double checking that the appropriate security controls are in place. Using Twitter’s log in verification is an essential extra layer of security that could well prevent many successful attacks.”

Source:  info- security 

Report Details 100+ Domains at Risk from IDN-Related Spoofing

Researchers have warned of a major phishing threat posed by domain names spoofed using International Domain Name (IDN) homographs.

Attackers can use IDN characters to mimic Latin script, and thus lure unsuspecting users into visiting phishing sites that are “pixel-perfect renditions of the brands they’re impersonating,” according to Farsight Security.

While the security challenges around IDNs are well known, the firm conducted its own research into the area, revealing several real-world examples to underline the scale of the problem.

From October 17 2017 to January 10 2018 the firm observed 125 top domains being subverted by over 116,000 homographs.

“We observed IDN homographs mimicking 125 top ‘phish-worthy’ domains including large content providers, social networking giants, financial websites, luxury brands, cryptocurrency exchanges, and other popular websites,” explained the vendor’s Mike Schiffman.

One example is a phishing site using IDN characters to spoof "Facebook."

Other big name brands affected included Apple, Adobe, Amazon, Bank of America, Cisco, Coinbase, Credit Suisse, eBay, Bittrex, Google, Microsoft, Netflix, New York Times, Twitter, Walmart, Yahoo, Wikipedia, YouTube and Yandex.

From an end-user perspective the best form of defense is to be suspicious of any unsolicited email regardless of sender — especially ones featuring enticing statements or account log-in links.

Enabling phishing filters, safe browsing and 2FA for log-ins will also help to combat the risk of phishing and account hijacking.

“If you operate a popular website that allows users to interact with one another, log in, purchase and/or download things, chances are your brand (and therefore your users) will be on some target list for phishers and other internet criminals,” continued Schiffman.

“You will want to pay attention to the IDN space, and either try to register IDN domain names proactively that could be used to impersonate your brand, or subscribe to a service that allows you to monitor recent IDN homograph registration and use in an attempt to impersonate your brand.”

Source:  Info-Security 

Skygofree — Powerful Android Spyware Discovered

Security researchers have unveiled one of the most powerful and highly advanced Android spyware tools that give hackers full control of infected devices remotely.
Dubbed Skygofree, the Android spyware has been designed for targeted surveillance, and it is believed to have been targeting a large number of users for the past four years.

Since 2014, the Skygofree implant has gained several novel features previously unseen in the wild, according to a new report published by Russian cybersecurity firm Kaspersky Labs.

The 'remarkable new features' include location-based audio recording using device's microphone, the use of Android Accessibility Services to steal WhatsApp messages, and the ability to connect infected devices to malicious Wi-Fi networks controlled by attackers.

Skygofree is being distributed through fake web pages mimicking leading mobile network operators, most of which have been registered by the attackers since 2015—the year when the distribution campaign was most active, according to Kaspersky's telemetry data.

Italian IT Firm Behind Skygofree Spyware?

Researchers at Kaspersky Lab believe the hacker or hacking group behind this mobile surveillance tool has been active since 2014 and are based in Italy—the home for the infamous 'Hacking Team'—one of the world's bigger players in spyware trading.

"Given the many artifacts we discovered in the malware code, as well as infrastructure analysis, we are pretty confident that the developer of the Skygofree implants is an Italian IT company that works on surveillance solutions, just like HackingTeam," said the report.

Kaspersky found several Italian devices infected with Skygofree, which the firm described as one of the most powerful, advanced mobile implants it has ever seen.

Although the security firm has not confirmed the name of the Italian company behind this spyware, it found multiple references to Rome-based technology company "Negg" in the spyware's code. Negg is also specialised in developing and trading legal hacking tools.

Skygofree: Powerful Android Spyware Tool

Once installed, Skygofree hides its icon and starts background services to conceal further actions from the user. It also includes a self-protection feature, preventing services from being killed.

As of October last year, Skygofree became a sophisticated multi-stage spyware tool that gives attackers full remote control of the infected device using a reverse shell payload and a command and control (C&C) server architecture.

According to the technical details published by researchers, Skygofree includes multiple exploits to escalate privileges for root access, granting it ability to execute most sophisticated payloads on the infected Android devices.

One such payload allows the implant to execute shellcode and steal data belonging to other applications installed on the targeted devices, including Facebook, WhatsApp, Line, and Viber.
"There are multiple, exceptional capabilities: usage of multiple exploits for gaining root privileges, a complex payload structure, [and] never-before-seen surveillance features," the researchers said.

Skygofree’s control (C&C) server also allows attackers to capture pictures and videos remotely, seize call records and SMS, as well as monitor the users' geolocation, calendar events and any information stored in the device's memory.

Besides this, Skygofree also can record audio via the microphone when the infected device was in a specified location and the ability to force the infected device to connect to compromised Wi-Fi networks controlled by the attacker, enabling man-in-the-middle attacks.

The spyware uses "the Android Accessibility Service to get information directly from the displayed elements on the screen, so it waits for the targeted application to be launched and then parses all nodes to find text messages," Kaspersky said.

Kaspersky researchers also found a variant of Skygofree targeting Windows users, suggesting the authors' next area of interest is the Windows platform.

The best way to prevent yourself from being a victim is to avoid downloading apps via third-party websites, app stores or links provided in SMS messages or emails.

Source:  The Hacker News 

"In the Underworld" - What can Cybersecurity learn from the World of 1980s' Professional Crime?

If you have any doubts about the value of field research, Laurie Taylor's "In the Underworld" will settle them. This practical and unorthodox work of criminology described the world of 1980s' professional crime, in which Professor Taylor's travels and interviews were ably assisted by no less than John McVicar himself.

As a long-time Radio 4 broadcaster (he's still going), you'd expect Laurie Taylor to educate, inform, and entertain. Within "In the Underworld", the education is instructive, the information is both surprising and alarming, and the entertainment is richly comic. The experience may have been influential in one respect at least: he later made the radio series "Speaking as an Expert" in which he successfully impersonated a wide range of specialists – including an IBM consultant (with their permission, of course).

The flavor of the book is best conveyed by one successful heist of a million pounds; back then, a million pounds was actually worth something. Sadly, it was a million pounds in luncheon vouchers. Well - at least you could eat luncheon vouchers, unlike Bitcoin.

“The Beauty of a Good Con”: effective countermeasures then and now
The security practitioner can learn much from this book. The chapter on cheque book fraud explains how the evolution of countermeasures (the improvements in cheque book design) effectively contained this fraud within a few years.

So the fraudsters moved on to travelers cheques. It turns out that the hard part for them wasn't stealing the travelers cheques, but being able to forge a signature fluently. The pressure of being watched by a teller while signing really did make this far harder to do.

Today, we hear a lot about biometric forgery. Supervision would be an effective countermeasure. It's not often that one can build this kind of supervision into biometric authentication, but if you can use facial recording alongside authentication, this might be a good deterrent.

“Enter Robbers Armed”: shifting from security guards to data encryption
Just the chapter title "Robbing Banks with a Pen" may now seem quaint but even in the book, John McVicar also reminisces: “‘Except when we used to do the smash-and-grab', said John nostalgically, as though describing a childhood prank. (I was beginning to wonder if it had been a mistake to stay on Pernod for a whole evening.)"

Those days were already long gone due to on-street bollards, security screens and improvements to jewelry shelves in the 1960s. So, physical security improvements can indeed be effective and rather quickly too. Given those rapid returns for physical security, information security professionals should ask themselves why, in the 21st century, we are still using passwords.

“Hoisting and Tweedling”: the evolution of social engineering
The chapter on confidence trickery is the most directly relevant to information security today. Nowadays we call it social engineering, as practiced by email and phone – and on a much larger scale.

In the social engineering kill chain, we can disrupt the lure (the convincing email) or the hook (the crucial action, like clicking on the link in that email). Today, email lures are very effective: there are no more spelling mistakes to set alarm bells ringing and each email can be carefully targeted at a specific individual. Targeting is only going to get worse with the vast quantities of leaked identity data out there.

So here are three pieces of advice for any employee concerned about a potential email lure.

Recheck the sender. Don't rely on what the email actually said – if in any doubt, phone them or forward the email (don't reply to it) and wait for confirmation. If your organization uses signed email, check the signature. Remember, they contacted you – not the other way round.

Think again, before taking the second step. If you did click the link, don't fill in your password. If you did open an attachment, don't override a warning.

Don't be hasty. Any hint of urgency, pressure or temptation in the email is a warning sign. If it looks like it is from someone important, recheck the sender again.
For security professionals wondering how to mitigate the threat of email lures:

If you are planning to use signed email, check it is available everywhere, including on mobile devices.

Tailor email training to high-risk groups such as executives, finance staff and IT administrators.

Reinforce the role of business managers. Remind them to let their staff know beforehand when they will be out of contact, and to warn their staff not to trust any email that tells them to bypass normal business procedures.

At the time, Laurie Taylor agreed with one conclusion: professional criminals were a dying breed, partly due to advances in police computing. In the early 1980s, he could hardly have foreseen how they would simply move to the internet, stealing from the comfort of their homes instead.

Source:  Info-Security 

Kremlin-Linked Hackers Target Senate Ahead of Mid-Terms

Russian state-linked hackers accused of targeting Democratic Party officials ahead of the 2016 US presidential election have turned their focus on the Senate, according to Trend Micro.

The group known as Pawn Storm, Fancy Bear, Sednit and APT 28, set up phishing sites designed to ape the ADFS (Active Directory Federation Services) of the upper chamber, the security vendor claimed.

“By looking at the digital fingerprints of these phishing sites and comparing them with a large data set that spans almost five years, we can uniquely relate them to a couple of Pawn Storm incidents in 2016 and 2017,” explained senior threat researcher, Feike Hacquebord.

“The real ADFS server of the US Senate is not reachable on the open internet, however phishing of users’ credentials on an ADFS server that is behind a firewall still makes sense. In case an actor already has a foothold in an organization after compromising one user account, credential phishing could help him get closer to high profile users of interest.”

These tactics were used to devastating effect on the Democratic National Committee (DNC) ahead of the presidential election, with highly sensitive emails subsequently leaked under the online moniker Guccifer 2.0.

Hillary Clinton has claimed the revelations exposed in those leaks helped to turn the electorate against her during the race for the White House.

The timing of the latest phishing attempts is key, given the mid-term elections later this year.

The US is not the only country Russian-linked hackers are looking to destabilize: they’ve also targeted political organizations in Iran, France, Germany, Montenegro, Turkey, and Ukraine, according to Trend Micro.

It forms a key part of the Putin administration’s information warfare campaign against the West, alongside fake news and propaganda spread via bots and shills on social media.

There’s evidence to suggest fake Russian accounts on Twitter and Facebook also looked to sow discord ahead of the Brexit vote in 2016.

Source:  info-security 

Warning: New Undetectable DNS Hijacking Malware Targeting Apple macOS Users

A security researcher has revealed details of a new piece of undetectable malware targeting Apple's Mac computers—reportedly first macOS malware of 2018.

Dubbed OSX/MaMi, an unsigned Mach-O 64-bit executable, the malware is somewhat similar to DNSChanger malware that infected millions of computers across the world in 2012.

DNSChanger malware typically changes DNS server settings on infected computers, allowing attackers to route internet traffic through malicious servers and intercept sensitive information.

First appeared on the Malwarebytes forum, a user posted a query regarding unknown malware that infected his friend's computer that silently changed DNS settings on infected macOS to 82.163.143.135 and 82.163.142.137 addresses.

After looking at the post, ex-NSA hacker Patrick Wardle analysed the malware and found that it is indeed a 'DNS Hijacker,' which also invokes security tools to install a new root certificate in an attempt to intercept encrypted communications as well.

After looking at the post, ex-NSA hacker Patrick Wardle analysed the malware and found that it is indeed a 'DNS Hijacker,' which also invokes security tools to install a new root certificate in an attempt to intercept encrypted communications as well.

"OSX/MaMi isn't particularly advanced - but does alter infected systems in rather nasty and persistent ways," Patrick said.

"By installing a new root certificate and hijacking the DNS servers, the attackers can perform a variety of nefarious actions such as man-in-the-middle'ing traffic (perhaps to steal credentials, or inject ads)" or to insert cryptocurrency mining scripts into web pages.

Besides this, the OSX/MaMi macOS malware, which appears to be in its initial stage, also includes below-mentioned abilities, most of which are not currently activated in its version 1.1.0:

Take screenshots

Generate simulated mouse events

Perhaps persist as a launch item

Download and upload files

Execute commands

The motive, author(s) behind the malware, and how it is spreading are currently unknown.

However, Patrick believes that the attackers could be using lame methods like malicious emails, web-based fake security alerts/popups, or social-engineering type attacks to target Mac users.
To check if your Mac computer is infected with MaMi malware, go to the terminal via the System Preferences app and check for your DNS settings—particularly look for 82.163.143.135 and 82.163.142.137.

According to VirusTotal, a multi-engine antivirus scanner, none of 59 popular antivirus software is detecting this malware at this moment, so you are advised to use a 3rd-party tool such as a firewall that can detect and block outgoing traffic.
You can also install a free open-source firewall for macOS named 'LuLu,' created by Patrick and available at GitHub, which blocks suspicious traffic and prevents OSX/MaMi's from stealing your data.

According to VirusTotal, a multi-engine antivirus scanner, none of 59 popular antivirus software is detecting this malware at this moment, so you are advised to use a 3rd-party tool such as a firewall that can detect and block outgoing traffic.

You can also install a free open-source firewall for macOS named 'LuLu,' created by Patrick and available at GitHub, which blocks suspicious traffic and prevents OSX/MaMi's from stealing your data.

Source:  TheHackerNews 

Malware Serves Up Porn Ads in Kids' Apps

A malware built to display porn ads within mobile apps, including a large number of children’s games, has been uncovered in Google Play.

Check Point researchers have found the new and nasty malicious code, dubbed AdultSwine, hiding in around 60 game apps. So far, they’ve been downloaded between 3 million and 7 million times.

AdultSwine does a range of things, starting with displaying ads from the web that are often highly inappropriate and pornographic. However, it also attempts to trick users into installing fake security apps and tries to dupe users to register and pay for premium services. It’s also built to be flexible, so its authors in the future could expand their sites to other malicious activities, such as credential theft.

The inappropriate ads being displayed come from two main sources, Check Point said: mainstream ad providers and the malicious code’s own ad library (where the porn ads stem from). All of these are displayed to children on a rotating basis while they play the infected games.

On the scareware front, AdultSwine displays an ad that claims the user’s device is infected by a virus.

“Should the user press the notification of ‘Remove Virus Now’ he is redirected to an app in the Google Play Store with a somewhat questionable connection to virus removal,” said the researchers in an analysis. “An experienced eye could easily foresee this tactic, though a child playing a game app is easy prey for such nefarious apps.”

When it comes to the fraudulent premium services, AdultSwine initially displays a pop-up ad saying that the user is entitled to win an iPhone by simply answering four short questions. If the user clicks through, the malicious code eventually asks him to enter his phone number to receive the “prize,” which, of course, is a ploy. The malware then uses the number to register for premium services.

“Although for now this malicious app seems to be a nasty nuisance, and most certainly damaging on both an emotional and financial level, it nevertheless also has a potentially much wider range of malicious activities that it can pursue, all relying on the same common concept,” Check Point warned. “Indeed, these plots continue to be effective even today, especially when they originate in apps downloaded from trusted sources such as Google Play.”

To avoid victimization, parents should examine the apps that their kids download and educate their children on fraud and how to spot it.

Source:  Info-Security 

South Korea Considers a Bitcoin Ban, Sparking Outrage

South Korean regulators are mulling a ban on cryptocurrency trading, sparking outrage across the nation.

The justice minister, Park Sang-ki, said this week that the government was preparing legislation to halt the trading of Bitcoin, Monero and other virtual money.

Trading is a popular pastime in South Korea, the world’s most wired country. Its young, tech-savvy populace has seized on virtual currency as a way to earn cash amid an economy that offers dwindling job prospects for millennials, despite its relative wealth as a nation. With Bitcoin pricing exploding over the last few months, many people have earned quite a bit. About a third of the 941 office workers surveyed in December by Saramin, a South Korea-based job portal, have traded virtual currency; out of those, more than 80% made money from it, and about 20% made a whopping average return of 425% on their investment, according to the survey.

The average Korean investor owns around 5.66 million won ($5,260) in virtual currencies.

“Tax it as much as you want but don’t shut it down. My life depends on it,” one petitioner wrote on the president’s website, according to Reuters. The petition there has drawn more than 120,000 signatures against a ban, as of Friday.

Regulators are concerned that the casino-like, speculative nature of the virtual marketplace has resulted in a bubble that is destined to burst, and they worry that economic catastrophe for whole swaths of the population could follow.

“On one hand, there is a growing part of their population who has adopted cryptocurrencies and are using them to great success both for investment purposes and for direct business uses as well,” Nathan Wenzler, chief security strategist at AsTech, told Infosecurity. “These advocates are becoming more reliant on cryptocurrencies and typically support their use as being an inevitable trend that will only become more heavily adopted as time goes on. However, there are those that claim it's too risky and too volatile, and should the cryptocurrency market collapse, the government of South Korea would have to pick up the slack for the economic damage that would cause.”

There’s another dimension as well, according to Joseph Carson, chief security scientist at Thycotic, a Washington, D.C., based provider of privileged account management (PAM) solutions, having to do with cryptocurrency mining and taxation.

“China announcing they are going to clamp down on bitcoin mining…impacts China’s energy consumption and we could see a ripple effect around the world,” he said via email. “With the end of many countries’ tax years looming, the expectation is that many will dump Bitcoin to ensure they do not get hit with a huge capital gains tax bill. This could be seen as the wall at the end of the tunnel.”

He added, “I’m sure South Korea does not want to see their economy crash and significant GDP wiped overnight in value. The world is watching with huge anticipation.”

Then there are the cybersecurity concerns: For one thing, illicit mining of cryptocurrency by cybercriminals is skyrocketing and is responsible in many ways for the exploding value of currencies like Monero. Also, hacks on exchanges are not infrequent. In July, personal details on 30,000 people were stolen from South Korea-based crypto-currency exchange Bithumb, leading to the theft of funds from their Bitcoin and Ethereum accounts. The company, one of the largest exchanges for virtual currencies in the world, said the data theft happened after an employee's PC was hacked. From there, the hackers used the information to text and call users to con them out of their authentication codes, which were then used to steal funds from the accounts.

Another South Korean Bitcoin exchange, YoBit, was forced to close in December after suffering two major cyber-attacks in one year. It claimed it was “very sorry” but filed for bankruptcy after it suffered the December attack, less than eight months after the first.

In any event, South Korea has much to consider.

“By entertaining the notion of a ban on cryptocurrency trading, South Korea is evaluating whether or not the government can successfully manage the risk of what would happen if those cryptocurrencies collapsed while also promoting what they state is less immoral behaviors due to their view that cryptocurrency trading is akin to gambling and may lead to even worse offenses,” said Wenzler. “This ban, though, would impact a growing number of citizens and could cause a huge backlash against the government, both immediately and in any voting situation. At this point, it may be too early to guess at what a ban on cryptocurrency trading would do to South Korea, either economically or politically, but as the number of South Koreans who use cryptocurrencies increases, this issue will become more challenging to address at a national level.”

Source:  info-security 

SCADA Apps Riddled With Major Flaws

Mobile applications used in industrial control system (ICS) environments are shot through with vulnerabilities, exposing mission critical processes and infrastructure to attack, according to new research.

IOActive teamed up with IoT specialist Embedi to study 34 mobile applications used in Supervisory Control and Data Acquisition (SCADA) systems — selected at random from the Google Play store.

The number of these apps is growing all the time, so the researchers wanted to see if they’re unduly exposing organizations to the risk of external attack or accidental insider threats.

They found a staggering 147 vulnerabilities altogether — an increase of 1.6 per app from 2015, when the team found 50 issues in 20 such apps.

The top five security weaknesses were: code tampering (94% of the apps studied), insecure authorization (59%), reverse engineering (53%), insecure data storage (47%) and insecure communication (38%).

IOActive explained that the problem comes down to developers rushing apps to market without incorporating security by design.

“There’s not much an end-user can do to fix bugs in a mobile application themselves. The fixes will need to be done by the vendors,” IOActive principal security consultant, Jason Larsen, told Infosecurity.

“A good start would be transparency. If an application is built using secure programming practices and has gone through a review, documenting that would go a long way.”

In fact, attackers don’t even need physical access to the victim’s smartphone. If a user downloads a fake malicious app by mistake then that malware could attack the vulnerable application, the firm claimed.

IOActive recommended SCADA app developers to think carefully about security, noting the OWASP Top 10, OWASP Mobile Top 10 2016, and the 24 Deadly Sins of Software Security could help guide them through best practices.

“This is simply a continuation of the current Industrial Internet of Things (IIoT) trend,” warned IOActive security consultant, Alexander Bolshev. “Over the past two years, the number of applications on Google Play Store has doubled, and some of these applications have been installed 1000-10,000 times.”

Source:  info-security 

macOS Malware Creator Charged With Spying on Thousands of PCs Over 13 Years

The U.S. Justice Department unsealed 16-count indictment charges on Wednesday against a computer programmer from Ohio who is accused of creating and installing spyware on thousands of computers for more than 13 years.
According to the indictment, 28-year-old Phillip R. Durachinsky is the alleged author of FruitFly malware that was found targeting Apple Mac users earlier last year worldwide, primarily in the United States.
Interestingly, Durachinsky was just 14 years old when he programmed the first version of the FruitFly malware, and this full-fledged backdoor trojan went largely undetected for several years, despite using unsophisticated and antiquated code.

The malware was initially discovered in January 2017 by Malwarebytes and then Patrick Wardle, an ex-NSA hacker, found around 400 Mac computers infected with the newer strain of FruitFly. However, Wardle believed the number of infected Macs would likely be much higher.

The malware is capable of advanced surveillance on macOS devices with the ability to remotely take control of webcams, microphones, screen, mouse, and keyboards, as well as install additional malicious software.

Since the source code of Fruitfly also includes Linux shell commands, the researchers believe the malware would work just fine on Linux operating system.

From 2003 to January 2017, Durachinsky used spyware, which was later named FruitFly, to gain access to thousands of computers belonging to individuals, companies, schools, a police department, and a subsidiary of the U.S. Department of Energy.

Durachinsky allegedly used the malware to steal the personal data of victims, including their tax records, banking records, medical records, login credentials, photographs, Internet searches, and potentially embarrassing communications.

"He is alleged to have developed computer malware later named “Fruitfly” that he installed on computers and that enabled him to control each computer by accessing stored data, uploading files, taking and downloading screenshots, logging a user’s keystrokes, and turning on the camera and microphone to surreptitiously record images and audio," the DoJ says.

Besides installing Fruitfly, Durachinsky is also accused of producing child pornography, as in some cases, the malware alerted him if a user typed any pornography term. It’s likely such action would prompt recording.

Durachinsky is facing charges of Computer Fraud and Abuse Act violations, Wiretap Act violations, production of child pornography, and aggravated identity theft.

However, the charges are merely allegations at this time, and the defendant is presumed innocent unless proven guilty beyond a reasonable doubt in a court of law.

Source:  TheHacker News 

As Cloud Looms, Security Tops IT Resilience Investment

When it comes to investments in IT resilience, cybersecurity initiatives top the to-do list for most IT departments, as cloud leads the way as the No. 1 threat concern.

According to Syncsort’s 2018 State of Resilience report, which surveyed 5,632 IT professionals globally, ongoing, high-profile hacking attacks, data breaches, disruptive natural disasters and escalating storage and data accessibility needs are top concerns for most businesses. Overall, security is the top initiative that most companies will pursue in the next 24 months (49%). The majority of professionals chose virus protection (71%), malware protection (67%), patch management (53%), and intrusion detection and prevention (IDP, 52%) as their top organizational investments in security today.

IT pros see cloud as the top security challenge: The report found that IT leaders are entrusting critical applications to the cloud, but with concerns. About 43% identify it as their top security challenge for the coming year.

“Certainly, the shared resource pools and always-on features of cloud have introduced the possibility of new security breaches – including data loss, weak identity management, insecure APIs, denial of service attacks, account hijacking and advanced persistent attacks, which infiltrate systems over a period of time,” the firm said in the report.

The second greatest perceived challenge for IT departments is the increasing sophistication of attacks (37%). “Cunning criminals have sharpened their craft, conducting exploratory raids over months, invading systems, hiding their tracks, and deploying malware that can fool customers with bogus messages or extract and steal valuable data – the lifeblood of most companies.”

Ransomware meanwhile appeared as the No. 3 challenge confronting respondents, though Syncsort’s analysis was dubious as to the actual impact: “IT professionals are naturally aware of this phenomenon, as a result of worldwide media coverage. Yet, a considerable majority of professionals in this study had never been attacked by ransomware or were not aware that they had been; a miniscule number had paid to get data back, as mentioned in a subsequent section of this report. It remains to be seen whether ransomware is the flavor of the moment or will be a recurring trend.”

Despite these concerns, internal security audits are infrequent, the report found. Nearly two-thirds of companies perform security audits on their systems, but the most common schedule was to do it on an annual basis (39%). Another 10% of respondents audit every two years or more, which, given an ever-changing IT environment, could expose a company to risk.

The report also found that data sharing is seen as critical but challenging. About half (53%) of companies surveyed have multiple databases and share data to improve business intelligence, largely through scripting (42%), followed by backup/restore/snapshot processes and FTP/SCP/file transfer (38% each). The average company uses two different methods, adding to the complexity. In turn, this bolsters security concerns.

“IT leaders are under immense pressure to provide an enterprise infrastructure that can sustain severe threats and secure vital information while enabling data accessibility and business intelligence,” said Terry Plath, vice president, Global Services, Syncsort. “Business resilience requires the right mix of planning and technology, and this survey did a thorough job of uncovering how businesses are tackling this increasingly complex and multi-faceted challenge.”

Source:  Threatpost 

FBI Boss: We Don’t Want Backdoors, but We Do Want Access to Encrypted Devices

The FBI has nearly 7800 devices it can’t access because of encryption, according to its director, who repeated calls yesterday for tech providers to find a solution to the issue that doesn’t involve creating backdoors.

In a speech to the International Conference on Cyber Security, Wray claimed the Feds were unable to access 7775 encrypted devices last year — far higher than the 6900 figure touted in October.

He argued this was fast becoming an “urgent public safety issue” which would only get worse over time unless US technology companies engineer a “responsible” solution.

“We’re not looking for a ‘back door’ – which I understand to mean some type of secret, insecure means of access,” he said. “What we’re asking for is the ability to access the device once we’ve obtained a warrant from an independent judge, who has said we have probable cause.”

However, experts have argued that the only way to give the FBI what it’s asking for is indeed engineering a de facto backdoor.

This would put the privacy and security of hundreds of millions of devices potentially at risk if it fell into the wrong hands, and could even be abused by over-reaching law enforcers, whilst putting pressure on providers like Apple to do the same in countries with poor human rights records, the argument goes.

Whilst admitting a possible solution “isn’t so clear-cut,” Wray’s main line of argument was that US companies lead the world in innovation, so they should be able to find a way to allow law enforcers limited access to devices for which they have a warrant, without breaking security for law-abiding users.

He also claimed that US tech firms are already acceding to requests for customer data by foreign governments, although crucially didn’t go as far as to claim firms like Apple had broken their own encryption to do so.

“The FBI supports information security measures, including strong encryption,” said Wray. “But information security programs need to be thoughtfully designed so they don’t undermine the lawful tools we need to keep this country safe.”

The news comes as researchers unveiled a new end-to-end encrypted group chat protocol, dubbed Asynchronous Ratcheting Tree (ART).

Facebook and Oxford University teamed up on the project, which overcomes inadequacies in current solutions where if one member of the group is hacked then all conversations can be accessed.

This latest innovation in encrypted messaging is unlikely to go down well with law enforcers on either side of the Atlantic.

Source:  Info-Sec 

Reddit Users Lose Bitcoin Tips After Third-Party Breach

Reddit has confirmed that one of its email providers, Mailgun, has been breached, resulting in the hacks of user profiles and their linked cryptocurrency accounts.

Attackers infiltrated Reddit accounts using password reset emails sent via the third-party vendor. Several Redditors also reported that their Bitcoin Cash tip accounts had been emptied out.

Despite the alarming details, Reddit urged the public to maintain perspective, noting that the attackers “did not have access to either Reddit’s systems or to a Redditor’s email account,” adding that the number of confirmed impacted users is less than 20 so far.

“On 12/31, Reddit received several reports regarding password reset emails that were initiated and completed without the account owners’ requests,” Reddit explained in a post. “We have been working to investigate the issue and coordinating with Mailgun, a third-party vendor we’ve been using to send some of our account emails including password reset emails,” it continued. “A malicious actor targeted Mailgun and gained access to Reddit’s password reset emails….We know this is frustrating as a user, and we have put additional controls in place to help make sure it doesn’t happen again.”

Mailgun, for its part, said that it has identified the attack vector—an employee’s compromised email account—and has patched the issue.

“On January 3, 2018, Mailgun became aware of an incident in which a customer’s API key was compromised and immediately began diagnostics to help determine the cause and the scope of impact,” Mailgun CTO Josh Odom wrote in a post. “We immediately closed the point of access to the unauthorized user and deployed additional technical safeguards to further protect this sensitive portion of our application.”

He added that the attack affected less than 1% of Mailgun’s entire customer base.



Source:
 Info-Security 

Cloud Workloads at Risk from Security, Management & Compliance Failures

New research from WinMagic has revealed that security, management and compliance challenges are affecting the benefits businesses get from using the cloud within their infrastructures.

The firm polled 1029 IT decision makers in the UK, Germany and US and discovered that whilst 98% of respondents use the cloud, 33% admitted that data residing there is only partially encrypted. What’s more, 39% said they do not have unbroken audit trails across virtual machines in the cloud, something that can leave them exposed to risks. Unsurprising then that 58% said security was their top concern on future workloads in the cloud, whilst protecting sensitive data from unauthorized access (55%) came in second.

WinMagic’s research also revealed confusion as to compliance of data stored in the cloud. A worryingly low 39% felt they were ultimately responsible for this, with 20% believing responsibility rests solely with the cloud service provider and the same percentage thinking they were covered by their cloud service provider’s SLA. This confusion is particularly concerning given the fact that GDPR will come into force in little over five months.

“The stakes for companies were already high, with data breaches increasing in frequency and scale,” said Mark Hickman, chief operating officer at WinMagic. “EU GDPR reinforces the care that must be taken with data. The simple fact is that businesses must get the controls in place to manage their data, including taking the strategic decision that anything they would not want to see in the public domain, must be encrypted.”

Finally, cloud adoption is taking its toll on the majority of IT enterprise teams, with over half spending more time on management tasks than ever before and needing to use more management tools to get jobs done.

“At its heart, using heterogeneous cloud environments is making it harder for businesses to manage security and compliance, leaving staff firefighting rather than focusing on new projects that will benefit their businesses,” Hickman added.

Source: Info-Security 

WPA3 Set to Secure Public Wi-Fi Networks in 2018

Wi-Fi is about to get more secure this year with the launch of the new WPA3 protocol, the industry body behind it has announced.

The Wi-Fi Alliance — which is comprised of tech stakeholders including Apple, Cisco, Intel, Microsoft and Qualcomm — made the announcement at CES on Monday.

When it lands later this year, WPA3 will offer new features to simplify and enhance security for users and service providers on personal and enterprise networks, the body claimed.

One feature, individualized data encryption, should finally help to mitigate one of the biggest challenges facing users of public Wi-Fi networks — others on the same network snooping on their sessions.

It will do this by creating a secure encrypted channel for each user on the network.

The Alliance also pointed to two other new features which “will deliver robust protections even when users choose passwords that fall short of typical complexity recommendations, and will simplify the process of configuring security for devices that have limited or no display interface.”

It is believed the former will include steps to prevent attackers brute-forcing the Wi-Fi passwords of other users on the same network, and stopping them from making multiple log-in attempts.

“Wi-Fi security technologies may live for decades, so it’s important they are continually updated to ensure they meet the needs of the Wi-Fi industry,” said Joe Hoffman of SAR Insight & Consulting. “Wi-Fi is evolving to maintain its high-level of security as industry demands increase.”

At the same time, the Wi-Fi Alliance announced enhancements to the WPA2 protocol used by most companies today.

It claimed testing improvements will reduce the likelihood of vulnerabilities resulting from network misconfiguration and safeguard managed networks with centralized authentication.

The update to WPA2 is long overdue. The protocol has been around for well over a decade and recently took a major hit when researchers discovered a serious vulnerability (KRACK) which could allow attackers to eavesdrop on users’ data.

Source:  info-security 

Tories left Red-Faced After HTTPS Gaffe

UK Prime Minister, Theresa May, saw her major Cabinet reshuffle overshadowed yesterday after the governing Conservative Party seemingly allowed its SSL certificate to expire.

Visitors to the Tory Party’s website were greeted with browser-based warnings such as: “Your connection is not private. Attackers might be trying to steal your information from www.conservatives.com (for example, passwords, messages or credit cards).”

The security alert was the result of a basic IT admin error: allowing the political party’s SSL certificate to expire so that it could no longer guarantee a secure HTTPS connection for users.

HTTPS is fast becoming the de facto standard for websites, thanks in part to tools such as Let’s Encrypt and HTTPS Everywhere, which allow web managers to switch to the more secure protocol for free.

The percentage of web pages loaded by Firefox using HTTPS stood at over two-thirds (67%) as of January 2018 — that’s over 63 million active certificates.

The UK government issued an order in autumn 2016 mandating all departments switch to the more secure protocol from October 1 that year.

However, cyber-criminals have also been making use of such tools to help hide malware from security filters. A report from 2016 claimed that almost half of all cyber-attacks in the preceding 12 months made use of malware hidden in encrypted traffic.

The Conservative Party’s IT-related woes didn’t end with the HTTPS gaffe yesterday: it was left further embarrassed after an official tweet was posted congratulating new chairman, Chris Grayling.

There was just one problem with the tweet: Grayling wasn’t appointed the party’s new chairman at all, that job went to former immigration minister Brandon Lewis.

The tweet was swiftly deleted, and the party's SSL certificate has now been renewed.

However, the mistake didn’t go unnoticed on Twitter, where eagle-eyed commentators voiced their views.

This post from journalist Solomon Hughes is typical:

“Conservative Website is down because they forgot to do an IT update. Because they didn't update, the Conservative Party can't communicate.”

Source:  infosecurity-magazine 

APPLE RELEASES SPECTRE PATCHES FOR SAFARI, MACOS AND IOS

Apple released iOS 11.2.2 software Monday for iPhones, iPads and iPod touch models that patch for the Spectre vulnerabilities. A macOS High Sierra 10.13.2 supplemental update was also released to bolster Spectre defenses in Apple’s Safari browser and WebKit, the web browser engine used by Safari, Mail, and App Store.

This is the second update for Apple since last week’s revelation of the massive processor vulnerabilities, Meltdown and Spectre, impacting CPU’s worldwide. Apple previously released mitigations against Meltdown with updates that included iOS 11.2, macOS and tvOS 11.2.

Monday’s three updates include macOS High Sierra 10.13.2 supplemental, Safari 11.0.2, and iOS 11.2.2. The updates “includes security improvements” to mitigate the two known methods for exploiting Spectre identified as variants “bounds check bypass” (CVE-2017-5753/Spectre/variant 1) and “branch target injection” (CVE-2017-5715/Spectre/variant 2).

Apple said the Safari 11.0.2 update is available for OS X El Capitan 10.11.6 and macOS Sierra 10.12.6. The macOS High Sierra 10.13.2 supplemental update includes security updates for Safari and WebKit. iOS 11.2.2 is for iPhone 5s and later, iPad Air and later, and iPod touch 6th generation.

According to experts, the Spectre vulnerability, variant is much more difficult attack to carry out than Meltdown because it breaks the isolation between different applications. But, at the same time, it will also be harder to patch.

There is also a greater sense of urgency with Spectre. A Meltdown attack scenario requires an attacker to already have a foothold on the targeted system. Spectre opens up certain types of remote attack scenarios such as browser-based attacks, according to researchers.

Last week Mozilla, along with Microsoft and Google, updated the code in their browsers to increase them time it takes to execute certain Java commands that could exploit the Spectre flaws, making it exponentially harder – but not impossible – to exploit.

“A JavaScript attack being able to pull memory contents of the browser and could result in pulling credentials and session keys, which bypasses a lot of a lot of security protections,” said Jimmy Graham, director of product management at Qualys in a previous interview with Threatpost.

Apple is not releasing any additional technical details of the patches, including what – if any – penalty patches may have on device performance.

Source:  threatpost 

[Guide] How to Protect Your Devices Against Meltdown and Spectre Attacks

Recently uncovered two huge processor vulnerabilities called Meltdown and Spectre have taken the whole world by storm, while vendors are rushing out to patch the vulnerabilities in its products.

The issues apply to all modern processors and affect nearly all operating systems (Windows, Linux, Android, iOS, macOS, FreeBSD, and more), smartphones and other computing devices made in the past 20 years.

What are Spectre and Meltdown?

We have explained both , Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753, CVE-2017-5715), exploitation techniques in our previous article.

In short, Spectre and Meltdown are the names of security vulnerabilities found in many processors from Intel, ARM and AMD that could allow attackers to steal your passwords, encryption keys and other private information.  

Both attacks abuse 'speculative execution' to access privileged memory—including those allocated for the kernel—from a low privileged user process like a malicious app running on a device, allowing attackers to steal passwords, login keys, and other valuable information.

Protect Against Meltdown and Spectre CPU Flaws

Some, including US-CERT, have suggested the only true patch for these issues is for chips to be replaced, but this solution seems to be impractical for the general user and most companies.
Vendors have made significant progress in rolling out fixes and firmware updates. While the Meltdown flaw has already been patched by most companies like Microsoft, Apple and Google, Spectre is not easy to patch and will haunt people for quite some time.
Here's the list of available patches from major tech manufacturers:

Windows OS (7/8/10) and Microsoft Edge/IE

Microsoft has already released an out-of-band security update (KB4056892) for Windows 10 to address the Meltdown issue and will be releasing patches for Windows 7 and Windows 8 on January 9th.

But if you are running a third-party antivirus software then it is possible your system won’t install patches automatically. So, if you are having trouble installing the automatic security update, turn off your antivirus and use Windows Defender or Microsoft Security Essentials.

"The compatibility issue is caused when antivirus applications make unsupported calls into Windows kernel memory," Microsoft noted in a blog post. "These calls may cause stop errors (also known as blue screen errors) that make the device unable to boot."

Apple macOS, iOS, tvOS, and Safari Browser

Apple noted in its advisory, "All Mac systems and iOS devices are affected, but there are no known exploits impacting customers at this time."
To help defend against the Meltdown attacks, Apple has already released mitigations in iOS 11.2, macOS 10.13.2, and tvOS 11.2, has planned to release mitigations in Safari to help defend against Spectre in the coming days.

Android OS

Android users running the most recent version of the mobile operating system released on January 5 as part of the Android January security patch update are protected, according to Google.

So, if you own a Google-branded phone, like Nexus or Pixel, your phone will either automatically download the update, or you'll simply need to install it. However, other Android users have to wait for their device manufacturers to release a compatible security update.
The tech giant also noted that it's unaware of any successful exploitation of either Meltdown or Spectre on ARM-based Android devices.

Firefox Web Browser

Mozilla has released Firefox version 57.0.4 which includes mitigations for both Meltdown and Spectre timing attacks. So users are advised to update their installations as soon as possible.
"Since this new class of attacks involves measuring precise time intervals, as a partial, short-term mitigation we are disabling or reducing the precision of several time sources in Firefox," Mozilla software engineer Luke Wagner wrote in a blog post.

Google Chrome Web Browser

Google has scheduled the patches for Meltdown and Spectre exploits on January 23 with the release of Chrome 64, which will include mitigations to protect your desktop and smartphone from web-based attacks.

In the meantime, users can enable an experimental feature called "Site Isolation" that can offer some protection against the web-based exploits but might also cause performance problems.

"Site Isolation makes it harder for untrusted websites to access or steal information from your accounts on other websites. Websites typically cannot access each other's data inside the browser, thanks to code that enforces the Same Origin Policy." Google says.

Here's how to turn on Site Isolation:
Copy chrome://flags/#enable-site-per-process and paste it into the URL field at the top of your Chrome web browser, and then hit the Enter key.
Look for Strict Site Isolation, then click the box labelled Enable.

Once done, hit Relaunch Now to relaunch your Chrome browser.

Linux Distributions

The Linux kernel developers have also released patches for the Linux kernel with releases including versions 4.14.11, 4.9.74, 4.4.109, 3.16.52, 3.18.91 and 3.2.97, which can be downloaded from Kernel.org.

VMware and Citrix

A global leader in cloud computing and virtualisation, VMware, has also released a list of its products affected by the two attacks and security updates for its ESXi, Workstation and Fusion products to patch against Meltdown attacks.

On the other hand, another popular cloud computing and virtualisation vendor Citrix did not release any security patches to address the issue. Instead, the company guided its customers and recommended them to check for any update on relevant third-party software.

Source:  TheHackerNews 

Huge Flaws Affect Nearly Every Modern Device; Patch Could Hit CPU Performance

UPDATE: Researchers have finally disclosed complete technical details of two kernel side-channel attacks, Meltdown and Spectre—which affect not only Intel but also systems and devices running AMD, ARM processors—allowing attackers to steal sensitive data from the system memory.
____________
The first week of the new year has not yet been completed, and very soon a massive vulnerability is going to hit hundreds of millions of Windows, Linux, and Mac users worldwide.
According to a blog post published yesterday, the core team of Linux kernel development has prepared a critical kernel update without releasing much information about the vulnerability.

Multiple researchers on Twitter confirmed that Intel processors (x86-64) have a severe hardware-level issue that could allow attackers to access protected kernel memory, which primarily includes information like passwords, login keys, and files cached from disk.

The security patch implements kernel page-table isolation (KPTI) to move the kernel into an entirely separate address space and keeps it protected and inaccessible from running programs and userspace, which requires an update at the operating system level.

"The purpose of the series is conceptually simple: to prevent a variety of attacks by unmapping as much of the Linux kernel from the process page table while the process is running in user space, greatly hindering attempts to identify kernel virtual address ranges from unprivileged userspace code," writes Python Sweetness.

It is noteworthy that installing the update will hit your system speed negatively and could bring down CPUs performance by 5 percent to 30 percent, "depending on the task and processor model."

"With the page table splitting patches merged, it becomes necessary for the kernel to flush these caches every time the kernel begins executing, and every time user code resumes executing."

Much details of the flaw have been kept under wraps for now, but considering its secrecy, some researchers have also speculated that a Javascript program running in a web browser can recover sensitive kernel-protected data.

AMD processors are not affected by the vulnerability due to security protections that the company has in place, said Tom Lendacky, a member of the Linux OS group at AMD.
"AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against," the company said.

"The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault."

The Linux patch that is being released for ALL x86 processors also includes AMD processors, which has also been considered insecure by the Linux mainline kernel, but AMD recommends specifically not to enable the patch for Linux.

Microsoft is likely to fix the issue for its Windows operating system in an upcoming Patch Tuesday, and Apple is also likely working on a patch to address the vulnerability.

Source:  TheHackerNews 

Hundreds of GPS Location Tracking Services Leaving User Data Open to Hackers

Security researchers have unearthed multiple vulnerabilities in hundreds of GPS services that could enable attackers to expose a whole host of sensitive data on millions of online location tracking devices managed by vulnerable GPS services.

The series of vulnerabilities discovered by two security researchers, Vangelis Stykas and Michael Gruhn, who dubbed the bugs as 'Trackmageddon' in a report, detailing the key security issues they have encountered in many GPS tracking services.

Trackmageddon affects several GPS services that harvest geolocation data of users from a range of smart GPS-enabled devices, including children trackers, car trackers, pet trackers among others, in an effort to enable their owners to keep track of where they are.
According to the researchers, the vulnerabilities include easy-to-guess passwords (such as 123456), exposed folders, insecure API endpoints, and insecure direct object reference (IDOR) issues.
By exploiting these flaws, an unauthorized third party or hacker can get access to personally identifiable information collected by all location tracking devices, including GPS coordinates, phone numbers, device model and type information, IMEI numbers, and custom assigned names.

What's more? On some online services, an unauthorized third party can also access photos and audio recordings uploaded by location tracking devices.

The duo said they have been trying to reach out to potentially affected vendors behind the affected tracking services for warning them of the severity of these vulnerabilities.

According to the researchers, one of the largest global vendors for GPS tracking devices, ThinkRace, may have been the original developer of the flawed location tracking online service software and seller of licenses to the software.

Although four of the affected ThinkRace domains have now been fixed, the remaining domains still using the same flawed services continue to be vulnerable. Since many services could still be using old versions of ThinkRace, users are urged to stay up-to-date.

"We tried to give the vendors enough time to fix (also respond for that matter) while we weighted this against the current immediate risk of the users," the researchers wrote in their report.
"We understand that only a vendor fix can remove user’s location history (and any other stored user data for that matter) from the still affected services but we (and I personally because my data is also on one of those sites) judge the risk of these vulnerabilities being exploited against live location tracking devices much higher than the risk of historic data being exposed."

In many cases, vendors attempted to patch the vulnerabilities, but the issues ended up re-appearing. Around 79 domains still remain vulnerable, and researchers said they did not know if these services would be fixed.

"There have been several online services that stopped being vulnerable to our automated proof of concept code, but because we never received a notification by a vendor that they fixed them, it could be that the services come back online again as vulnerable," the duo said.

You can find the entire list of affected domains on the Trackmageddon report.
Stykas and Gruhn also recommended some suggestions for users to avoid these vulnerabilities, which includes removing as much data from the affected devices as possible, changing the password for the tracking services and keeping a strong one, or just stopping to use the affected devices until the issues are fixed.

Source:  TheHackerNews