Samsung Messages bug may share your entire gallery without permission

Users of Samsung's Messages app are facing a weird issue. Several of them have confirmed their entire galleries of photos has been sent to a random contact, and the scary part is the whole process happened without leaving a trace (meaning the sent photos didn't show up at their end).

So... S9s have been sporadically sending the entire contents of one's gallery to a contact via SMS, and it doesn't show up on your side. Might be worth checking logs on your carrier's site, because it happened on my T-Mobile Note8

Last night around 2:30 am, my phone sent her my entire photo gallery over text but there was no record of it on my messages app. However, there was record of it on tmobile logs. Why would this happen?

It's been confirmed to be the Samsung Messages app

The bug reportedly appeared after the latest update of the Samsung Messages app. So irrespective of the Samaung device you're using as well as your carrier, you're affected if you have the update.

The only workaround currently available is to deny storage access to the app, something which you can do by heading to Settings -> Apps -> Samsung Messages -> Permissions -> Storage. There's no word from Samsung on the matter so far.


Source:  GSMArena 

Unpatched WordPress Flaw Gives Attackers Full Control Over Your Site

Last week we received a tip about an unpatched vulnerability in the WordPress core, which could allow a low-privileged user to hijack the whole site and execute arbitrary code on the server.

Discovered by researchers at RIPS Technologies GmbH, the "authenticated arbitrary file deletion" vulnerability was reported 7 months ago to the WordPress security team but remains unpatched and affects all versions of WordPress, including the current 4.9.6.

The vulnerability resides in one of the core functions of WordPress that runs in the background when a user permanently deletes thumbnail of an uploaded image.

Researchers find that the thumbnail delete function accepts unsanitized user input, which if tempered, could allow users with limited-privileges of at least an author to delete any file from the web hosting, which otherwise should only be allowed to server or site admins.

The requirement of at least an author account automatically reduces the severity of this flaw to some extent, which could be exploited by a rogue content contributor or a hacker who somehow gains author's credential using phishing, password reuse or other attacks.

Researchers say that using this flaw an attacker can delete any critical files like ".htaccess" from the server, which usually contains security-related configurations, in an attempt to disable protection.

Besides this, deleting "wp-config.php" file—one of the most important configuration files in WordPress installation that contains database connection information—could force entire website back to the installation screen, allegedly allowing the attacker to reconfigure the website from the browser and take over its control completely.

However, it should be noted that since the attacker can't directly read the content of wp-config.php file to know the existing "database name," "mysql username," and its "password," he can re-setup the targeted site using a remote database server in his control.

Once complete, the attacker can create a new admin account and take complete control over the website, including the ability to execute arbitrary code on the server.

"Besides the possibility of erasing the whole WordPress installation, which can have disastrous consequences if no current backup is available, an attacker can make use of the capability of arbitrary file deletion to circumvent some security measures and to execute arbitrary code on the web server," researchers say."

In a proof-of-concept video published by the researchers, as shown above, the vulnerability worked perfectly as described and forced the site to re-installation screen.

However, as of now, website admins should not panic due to this vulnerability and can manually apply a hotfix provided by the researchers.

We expect the WordPress security team would patch this vulnerability in the upcoming version of its CMS software.

Source:  TheHackerNews 

New Malware Family Uses Custom UDP Protocol for C&C Communications

Security researchers have uncovered a new highly-targeted cyber espionage campaign, which is believed to be associated with a hacking group behind KHRAT backdoor Trojan and has been targeting organizations in South East Asia.

According to researchers from Palo Alto, the hacking group, which they dubbed RANCOR, has been found using two new malware families—PLAINTEE and DDKONG—to target political entities primarily in Singapore and Cambodia.

However, in previous years, threat actors behind KHRAT Trojan were allegedly linked to a Chinese cyber espionage group, known as DragonOK.

While monitoring the C&C infrastructure associated with KHRAT trojan, researchers identified multiple variants of these two malware families, where PLAINTEE appears to be the latest weapon in the group's arsenal that uses a custom UDP protocol to communicate with its remote command-and-control server.

To deliver both PLAINTEE and DDKONG, attackers use spear phishing messages with different infection vectors, including malicious macros inside Microsoft Office Excel file, HTA Loader, and DLL Loader, which includes decoy files.

"These decoys contain details from public news articles focused primarily on political news and events," researchers explain.

"Additionally, these decoy documents are hosted on legitimate websites including a government website belonging to the Cambodia Government and in at least once case, Facebook."

Moreover, PLAINTEE downloads and installs additional plugins from its C&C server using the same custom UDP protocol that transmits data in encoded form.

"These families made use of custom network communication to load and execute various plugins hosted by the attackers," researchers say. "Notably the PLAINTEE malware’ use of a custom UDP protocol is rare and worth considering when building heuristics detections for unknown malware."

On the other hand, DDKONG has been in use by the hacking group since February 2017 and doesn't have any custom communication protocol like PLAINTEE, though it is unclear whether one threat actor or more only use this malware.

According to researchers, the final payload of both malware families suggests that the purpose of both malware is to conduct cyber espionage on their political targets; instead of stealing money from their targets.

Since RANCOR group is primarily targeting non-tech-savvy users, it is always advised to be suspicious of any uninvited document sent via an email and never click on links inside those documents unless adequately verifying the source.

Moreover, most importantly, make use of behavioral-based antivirus software that can detect and block such malware before it can infect your device, and always keep it and other apps up-to-date.

Source:  TheHackerNews 

WPA3 Standard Officially Launches With New Wi-Fi Security Features

The Wi-Fi Alliance today officially launched WPA3—the next-generation Wi-Fi security standard that promises to eliminate all the known security vulnerabilities and wireless attacks that are up today including the dangerous KRACK attacks.

WPA, or Wi-Fi Protected Access, is a standard designed to authenticate wireless devices using the Advanced Encryption Standard (AES) protocol and is intended to prevent hackers from eavesdropping on your wireless data.

However, in late last year, security researchers uncovered a severe flaw in the current WPA2 protocol, dubbed KRACK (Key Reinstallation Attack), that made it possible for attackers to intercept, decrypt and even manipulate WiFi network traffic.

Although most device manufacturers patched their devices against KRACK attacks, the WiFi Alliance, without much delay, rushed to finalize and launch WPA3 in order to address WPA2's technical shortcomings from the ground.

What is WPA3? What New Security Features WPA3 Offers?

WPA3 security standard will replace the existing WPA2 that has been around for at least 15 years and widely used by billions of devices every day.

The new security protocol provides some big improvements for Wi-Fi enabled devices in terms of configuration, authentication, and encryption enhancements, making it harder for hackers to hack your Wi-Fi or eavesdrop on your network.

On Monday, the Wi-Fi Alliance launched two flavors of latest security protocol—WPA3-Personal and WPA3-Enterprise—for personal, enterprise, and IoT wireless networks.
Here are some key features provided by the new protocol:

1.) Protection Against Brute-Force Attacks

WPA3 provides enhanced protection against offline brute-force dictionary attacks, making it harder for hackers to crack your WiFi password—even if you choose less complex passwords—by using commonly used passwords over and over again.

2.) WPA3 Forward Secrecy

WPA3 leverages SAE (Simultaneous Authentication of Equals) handshake to offer forward secrecy, a security feature that prevents attackers from decrypting old captured traffic even if they ever learn the password of a network.

3.) Protecting Public/Open Wi-Fi Networks

WPA3 strengthens user privacy in open networks through individualized data encryption, a feature that encrypts the wireless traffic between your device and the Wi-Fi access point to mitigate the risk of Man-in-the-Middle (MitM) attacks. To prevent such passive attacks, WPA3 could add support for Opportunistic Wireless Encryption (OWE).

4.) Strong Encryption for Critical Networks

Using WPA3 Enterprise, critical Wi-Fi networks handling sensitive information (such as government, , and industrial organizations), can protect their Wi-Fi connections with 192-bit encryption.

Wi-Fi Easy Connect

Alongside WPA3, the WiFi Alliance has also announced  a new feature, called Wi-Fi Easy Connect, that simplifies the process of pairing smart home gadgets (without any screen or display) to your router.

Wi-Fi Easy Connect is a replacement for Wi-Fi Protected Setup (WPS), which has been considered insecure.

With the support for Easy Connect, you will be able to pair your smart gadget with the router by simply scanning a QR code with your smartphone to have the Wi-Fi credentials automatically sent to the new smart device.

It should be noted that both WPA3 and Wi-Fi Easy Connect will not hit the mainstream right away. In fact, it is going to be a many-years-long process that will require new routers and smart gadgets to support WPA3.

Therefore, WPA2 will not stop working any time soon, and devices with WPA3 support will still be able to connect with devices that use WPA2 for the working of your gadgets, but WPA3 support will eventually become mandatory as adoption grows.

WPA3 is set to roll out later this year and is expected to hit mass adoption in late 2019, when it eventually become a requirement for devices to be considered Wi-Fi certified, according to the WiFi Alliance.


Source:  TheHackerNews 

Android Gets New Anti-Spoofing Feature to Make Biometric Authentication Secure

Google just announced its plan to introduce a new anti-spoofing feature for its Android operating system that makes its biometric authentication mechanisms more secure than ever.

Biometric authentications, like the fingerprint, IRIS, or face recognition technologies, smoothen the process of unlocking devices and applications by making it notably faster and secure.

Although biometric systems also have some pitfalls that are not hidden from anyone, as it has been proven multiple times in the past that most biometric scanners are vulnerable to spoofing attacks, and in most cases fooling them is quite easy.

Google announced today a better model to improve biometric security, which will be available from Android P, allowing mobile app developers to integrate an enhanced mechanism within their apps to keep users’ data safe.

New Biometric Metrics to Identify Spoofing and Imposter Attacks

Currently, the Android biometric authentication system uses two metrics—False Accept Rate (FAR) and False Reject Rate (FRR)—in combination with machine learning techniques to measure accuracy and precision of the user's input.

In brief, 'False Accept Rate' defines how often the biometric model accidentally classifies an incorrect input as belonging to the targeted user, while 'False Reject Rate' records how often a biometric model accidentally classifies the user's biometric as incorrect.

Moreover, for user convenience some biometric scanners also allow users to authenticate successfully with higher false-acceptance rates than usual, leaving devices open to spoofing attacks.

Google says none of the given metrics is capable enough to precisely identify if biometric data entered by a user is an attempt by an attacker to make unauthorized access using any spoofing or impostor attack.

In an attempt to resolve this issue, in addition to FAR and FRR, Google has now introduced two new metrics—Spoof Accept Rate (SAR) and Imposter Accept Rate (IAR)—that explicitly account for an attacker in the threat model.

"As their names suggest, these metrics measure how easily an attacker can bypass a biometric authentication scheme," Vishwath Mohan, a security engineer with Google Android team, says.

"Spoofing refers to the use of a known-good recording (e.g., replaying a voice recording or using a face or fingerprint picture), while impostor acceptance means a successful mimicking of another user's biometric (e.g., trying to sound or look like a target user)."

Google to Enforce Strong Biometric Authentication Policies

Based upon user's biometric input, the values of SAR/IAR metrics define if it is a "strong biometric" (for values lower than or equal to 7%), or a "weak biometric" authentication (for values higher than 7%).

While unlocking your device or an application, if these values fall under weak biometric, Android P will enforce strict authentication policies on users, as given below:

It will prompt the user to re-enter their primary PIN, pattern, password or a strong biometric if the device is inactive for at least 4 hours (such as when left at a desk or charging).

In case, you left your device unattended for 72-hours, the system will enforce policy mentioned above for both weak and strong biometrics.

For additional safety, users authenticated with weak biometric would not be able to make payments or participate in other transactions that involve a KeyStore auth-bound key.

Besides this, Google will also offer a new easy-to-use BiometricPrompt API that developers can use to set up a robust authentication mechanism in their apps to ensure maximum security of their users by completely blocking weak biometric authentication detected by two newly added metrics.

"BiometricPrompt only exposes strong modalities, so developers can be assured of a consistent level of security across all devices their application runs on," Mohan said.

"A support library is also provided for devices running Android O and earlier, allowing applications to utilize the advantages of this API across more devices."

The new feature would positively prevent unauthorized access to devices from thieves, spies and law enforcement agencies as well by locking it down to cripple known methods to bypass biometric scanners.


Source:  TheHackerNews 

Google Solves Update Issue for Android Apps Installed from Unknown Sources

If you are wondering how to receive latest updates for an Android app—installed via a 3rd party source or peer-to-peer app sharing—directly from Google Play Store.

For security reasons, until now apps installed from third-party sources cannot be updated automatically over-the-air, as Google does not recognize them as Play Store apps and they do not show up in your Google account app list as well.

Late last year, Google announced its plan to set up an automated mechanism to verify the authenticity of an app by adding a small amount of security metadata on top of each Android application package (in the APK Signing Block) distributed by its Play Store

This metadata is like a digital signature that would help your Android device to verify if the origin of an app you have installed from a third-party source is a Play Store app and have not been tempered, for example, a virus is not attached to it.

From early 2018, Google has already started implementing this mechanism, which doesn't require any action from Android users or app developers, helping the company to keep its smartphone users secure by adding those peer-to-peer shared apps to a user's Play Store Library in order to push regular updates.

Additionally, Google yesterday announced a new enhancement to its plan by adding offline support for metadata verification that would allow your Android OS to determine the authenticity of "apps obtained through Play-approved distribution channels" while the device is offline.

"One of the reasons we're doing this is to help developers reach a wider audience, particularly in countries where peer-to-peer app sharing is common because of costly data plans and limited connectivity," said James Bender, Product Manager at Google Play. "This will give people more confidence when using Play-approved peer-to-peer sharing apps."

It should be noted that this feature doesn’t protect you from the threat of installing apps from third-party sources; instead, it merely helps you receive latest updates for apps if their origin is Google Play Store.

Last year, as part of its mission, to secure Android ecosystem, Google also added built-in behavior-based malware protection for Android devices, called Google Play Protect, which uses machine learning and app usage analysis to weed out the dangerous and malicious apps.

Google Play Protect not only scans apps installed from official Play Store but also monitors apps that have been installed from third-party sources.

Moreover, Play Protect now also support offline scanning, which suggests that it will take care of newly introduced metadata verification as well.

Although Play Store itself is not completely immune to malware, users are still advised to download apps, especially published by reputable developers, from the official app store to minimize the risk of getting their devices compromised.



Source:  TheHackerNews

Oppo's all-screen Find X hides a pop-up selfie camera

Almost every phone manufacturer is trying to develop a handset with a truly edge-to-edge display. Most end up with a small notch, but others are finding new and unusual ways to hide the front-facing camera. Oppo, for instance, has packed a tiny motorized mechanism into its brand new Find X flagship. At a glance, it looks like a regular phone with a 6.4-inch, 1080p display -- but as soon as you launch the camera app, the top section slides up to reveal a 25-megapixel selfie shooter and a dual-camera system on the back. Close the application and the cameras will automatically disappear again.

It uses this pop-up trick for face unlock, too, complete with iPhone X-style infrared depth detection (nicknamed O-Face -- no, really) to securely sign you in most any lighting condition. Other party tricks will seem familiar, too, including portrait lighting effects for both front and rear photos as well as Omoji, Oppo's take on Animoji.

Otherwise, though, the Find X is everything you would expect from a high-end smartphone in 2018. The display curves on the left and right, similar to Samsung's Galaxy S9 Plus, but covers an even larger 93.8 percent of the phone's front. Inside you'll find a Qualcomm Snapdragon 845 processor, 8GB of RAM and 256GB of internal storage. There's also a 3,730mAh battery that supports a quick-charge system similar to OnePlus (Oppo and OnePlus are basically the same company.) You'll find 20- and 16-megapixel rear cameras on the back with depth-of-field effects and AI-based scene recognition. The phone doesn't support wireless charging, however, and there's no headphone jack. On the software side, you're getting Android 8.1 Oreo with Oppo's Color OS interface.

Oppo is a huge vendor, but its influence is mainly tied to Asia. The Find X, though, will be the first phone that the company officially sells in North America (availability wasn't mentioned) and Europe (due in August for €999). That's a big deal, though it will need carrier partnerships to stand out. The slide-out camera is novel, but I suspect it won't be for everyone. It's not the most discreet system, for instance, and when it's visible the phone's design looks a tad unbalanced. Still, it's a neat workaround, and one that feels similar to the Vivo Nex's pop-up camera.

Oh, and if you need something even more powerful? There's an Automobili Lamborghini special edition for €1,699 that not only gives you the obligatory carbon fiber effect and raging bull logo on the back, but an even faster charging system. It uses a 10V, 50W SuperVOOC adapter to bring the phone to a full charge in just 35 minutes. That's utter overkill for most people, but at least you're getting more than just a cosmetic tweak and some pretty packaging.

Source:  Engaget 

Nearly Half of All Web Apps Vulnerable to Unauthorized Access

New research from Positive Technologies has discovered that almost half (48%) of web applications are vulnerable to unauthorized access, with 44% placing users’ personal data at risk of theft.

What’s more, 70% of the apps Positive Technologies tested proved susceptible to leaks of critical information, whilst attacks on users are possible in 96% of them.

In fact, every app the firm assessed contained vulnerabilities of some sort, with 17% having vulnerabilities that would allow an attacker to take full control over the app.

The majority of detected vulnerabilities (65%) were a result of errors in application development – such as coding errors – with incorrect configuration of web servers accounting for a third of them.

However, the research did discover the percentage of web apps with critical vulnerabilities (52%) had declined for the second year in a row, down from 58% the previous year.

“Web application security is still poor and, despite increasing awareness of the risks, is still not being prioritized enough in the development process,” said Positive Technologies analyst Leigh-Anne Galloway. “Most of these issues could have been prevented entirely by implementing secure development practices, including code audits from the start and throughout.”

Speaking to Infosecurity Eoin Keary, founder and CEO, edgescan, agreed that steps need to be taken to improve application layer security.

“DevSecOps needs to be embraced such that security is throughout the development pipeline,” he said. “Application component security management (software components used by developers) is still not common place in terms of supporting frameworks and software components and is a common source of vulnerability.”



Source:  Infosecurity 

Phishing Campaigns Target Sports Fans, Consumers

Two phishing campaigns have been targeting consumers of both the FIFA World Cup and one of its longtime partners, Adidas. One campaign attempts to lure victims into clicking on a malicious link under the guise of downloading a World Cup schedule of fixtures and a result tracker, while the second promises a “free” $50-per-month subscription for Adidas shoes.

Today Check Point announced that it has discovered a new phishing campaign linked to the start of the World Cup that targets soccer fans. A known malware that is often used to install potentially unwanted programs (PUPs) and toolbars, adware or system optimizers called DownloaderGuide is embedded in the attachment. Researchers discovered nine different executable files delivered in emails with the subject: “World_Cup_2018_Schedule_and_Scoresheet_V1.86_CB-DL-Manager.”

First identified on 30 May, Check Point said the campaign peaked on 5 June but has re-emerged since the start of the games. “Events that attract huge amounts of popular interest are seen by cyber-criminals as a golden opportunity to launch new campaigns,” Maya Horowitz, Check Point’s threat intelligence group manager, said in today’s press release.

“With so much anticipation and hype around the World Cup, cyber-criminals are banking on employees being less vigilant in opening unsolicited emails and attachments. As such, it is critical that organizations take steps to remind their employees of security best practices to help prevent these attacks being successful," Horowitz said.

The second phishing campaign, which targets Adidas customers, uses a different tactic, luring victims in with a homographic link that uses a vertical line in place of where the “i” in Adidas should be. “The use of punycode-based homoglyph email and web domains are an increasingly used technique to spoof users in email phishing attacks,” said Matthew Gardiner, cybersecurity expert, Mimecast.

“Given the thousands of possible iterations of a domain that are now possible with these internationalized domain names and the thousands of available top-level domains that are also available, such as .co, .cf, .ml and many others, there is no possibility of preregistering these domains to keep them out of the hands of the bad actors. The only reasonable approach is to have automated email security controls to detect these types of impersonation attacks to protect your organization. Expecting your users to figure it out is increasingly unrealistic,” Gardiner said.

Source: Infosecurity 

Chinese Hackers Target National Datacenter in Watering Hole Spree

Researchers have uncovered a Chinese APT campaign designed to compromise government websites in a Central Asian nation by targeting a key datacenter.

Kaspersky Lab explained that by compromising the national datacenter, the APT27/LuckyMouse/EmissaryPanda group was able to gain “access to a wide range of government resources at one fell swoop.”

“Government entities, including the Central Asian ones also were a target for this actor before,” it added. “Due to LuckyMouse’s ongoing water-holing of government websites and the corresponding dates, we suspect that one of the aims of this campaign is to access web pages via the datacenter and inject JavaScripts into them.”

It’s not clear how the attackers targeted the datacenter in the first instance. Although they have used weaponized documents exploiting CVE-2017-118822 in the past, Kaspersky Lab believes employees may have been targeted by watering hole attacks.

Interestingly, the main command and control IP address was traced back to a Ukrainian ISP running a Mikrotik router that was hacked “in order to process the malware’s HTTP requests.”

The websites themselves were compromised to redirect visitors to instances of both ScanBox and BEeF. The former is a reconnaissance framework that collects information about the victim’s machine, including operating systems, language and location.

BEeF — the Browser Exploitation Framework — is a pen testing tool focused on the browser.

“The TTPs for this campaign are quite common for Chinese-speaking actors, where they typically provide new solid wrappers (launcher and decompressor protected with shikata_ga_nai in this case) around their RATs (HyperBro),” Kaspersky Lab concluded.

“The most unusual and interesting point here is the target. A national datacenter is a valuable source of data that can also be abused to compromise official websites. Another interesting point is the Mikrotik router, which we believe was hacked specifically for the campaign. The reasons for this are not very clear: typically, Chinese-speaking actors don’t bother disguising their campaigns. Maybe these are the first steps in a new stealthier approach.”



Source:  Infosecurity 

Russians Pose as Americans to Steal Data on Social Media

The Americans were targeted on social media by Russian agents on a mission to harvest personal information, The Wall Street Journal reported Wednesday.

The agents pretended to work for organizations promoting African-American businesses as a ruse to obtain personal information from black business owners during the 2016 presidential election campaign, according to the report.

Using names like "BlackMattersUS" and "Black4Black," the agents set up hundreds of accounts on Facebook and Instagram, the WSJ said.

As part of its efforts to address the abuse of its platform during the election, Facebook introduced a tool that would enable its members to determine if they had contact with Russian propaganda during that period. The tool doesn't address the problem of Kremlin agents masquerading as Americans, however.

Facebook did not respond to our request to comment for this story.

Defeating America Without Bullets

The Journal story came on the heels of President Donald Trump's Tuesday announcement that his administration was doing a "very, very deep" study of election meddling and would make "very strong" recommendations about the 2018 elections.

However, Adm. Michael Rogers, chief of the U.S. Cyber Command and head of the National Security Agency, last week told the Senate Armed Services Committee that the White House had not directed him to take any actions to counter potential Russian meddling in the 2018 elections.

"The impact of social media is very real," said Ajay K. Gupta, program chair for computer networks and cybersecurity at the University of Maryland.

"The lack of real attribution for social media content means that elections are being impacted by people who we don't know who they are," he told TechNewsWorld.

"Russians have said since the beginning of the Cold War they would be able to defeat America without firing a single bullet," Gupta added. "They couldn't do that as the U.S.S.R., but social media has given them another opportunity to try that."

Target of Opportunity

The latest revelation about Russian activity on social media during the elections lends credence to the idea that the Kremlin's goal is not to swing elections one way or another, but to weaken America's form of government.

One in four voters were considering staying away from the polls due to cybersecurity fears, according to a survey Carbon Black conducted last year, for example. If accurate, that could put the number who would not vote for that reason in the neighborhood of 55 million.

"This blended campaign of human intelligence and signals intelligence is dangerous for democracy," said Tom Kellermann, chief cybersecurity officer at Carbon Black.

Russia is into the long game, noted Tellagraff CEO Mark Graff.

"Hillary Clinton was a target of opportunity for the Russians in the 2016 election," he told TechNewsWorld.

"Their strategic goal was not to elect Donald Trump. The strategic goal was to disrupt American society, undermine our feelings of unity, undermine our faith in democracy," Graff maintained. "They've been trying to do that for over 50 years -- and now what they can do, using social media, is do it from the comfort of government buildings inside Russia."

What's a Social Network to Do?

Both Twitter and Facebook have made efforts to counter nation-state backed exploitation of their platforms, but the consensus is that more can be done.

"They must dynamically verify the identities of their users and filter illicit and inflammatory content," Carbon Black's Kellermann told TechNewsWorld.

"Facebook and Twitter are seemingly just learning how to combat this, and they both appear to be very late to the game," observed Brian Martin, director of vulnerability intelligence at Risk Based Security.

The social networks could deploy a number of measures, he told TechNewsWorld, ranging from monitoring the IP addresses of suspect accounts to refining their analyses of the language in posts, looking for key indicators of actors who don't speak English as their first language.

Users should have the option to flag suspected bots, so the social media companies could investigate and weed out bad actors, said Sherban Naum, senior vice president for corporate strategy and technology at Bromium.

Better Authentication

Credible news outlets should be given some kind of distinctive authentication, Naum also recommended.

Social media companies have certain "verified" users, but that appears to be inadequate. "Lots of bad guys are verified," he told TechNewsWorld.

"Twitter and Facebook could also publish trending information about bots and bad information so users can see what's trending that is legit and what's trending that is junk," Naum suggested.

What can consumers do to protect themselves?

Users should "approach social media with the same skepticism that they should be approaching email and scams," Risk Based Security's Martin advised.

"Someone offering you 100 million dollars is suspect, of course," he said.

"Someone that seems to have a 'magic bullet' showing a political figure is the next devil? Think about it more critically than you might otherwise," Martin cautioned. "Does the post have any evidence to back it up? Or is it just a compelling picture, that may have been doctored, and a catchy one-liner that invokes emotional responses?"

Source:  TECHNEWSWORLD 

Microsoft June 2018 Patch Tuesday Pushes 11 Critical Security Updates

It's time to gear up for the latest June 2018 Microsoft security patch updates.

Microsoft today released security patch updates for more than 50 vulnerabilities, affecting Windows, Internet Explorer, Edge, MS Office, MS Office Exchange Server, ChakraCore, and Adobe Flash Player—11 of which are rated critical and 39 as important in severity.

Only one of these vulnerabilities, a remote code execution flaw (CVE-2018-8267) in the scripting engine, is listed as being publicly known at the time of release. However, none of the flaws are listed as under active attack.

Discovered by security researcher Dmitri Kaslov, the publicly known vulnerability is a remote memory-corruption issue affecting Microsoft Internet Explorer.

The flaw exists within the IE rendering engine and triggers when it fails to properly handle the error objects, allowing an attacker to execute arbitrary code in the context of the currently logged-in user.

The most critical bug Microsoft patched this month is a remote code execution vulnerability (CVE-2018-8225) exists in Windows Domain Name System (DNS) DNSAPI.dll, affecting all versions of Windows starting from 7 to 10, as well as Windows Server editions.

The vulnerability resides in the way Windows parses DNS responses, which could be exploited by sending corrupted DNS responses to a targeted system from an attacker-controlled malicious DNS server.

Successful exploitation of this vulnerability could allow an attacker to run arbitrary code in the context of the Local System Account.

Another critical bug is a remote code execution flaw (CVE-2018-8231) in the HTTP protocol stack (HTTP.sys) of Windows 10 and Windows Server 2016, which could allow remote attackers to execute arbitrary code and take control of the affected systems.

This vulnerability originates when HTTP.sys improperly handles objects in memory, allowing attackers to send a specially crafted packet to an affected Windows system to trigger arbitrary code execution.

Next critical remote code execution vulnerability (CVE-2018-8213) affecting Windows 10 and Windows Server exists in the way the operating system handles objects in memory. Successful exploitation could allow an attacker to take control of an affected Windows PC.

"To exploit the vulnerabilities, an attacker would first have to log on to the target system and then run a specially crafted application," Microsoft explains in its advisory.

Microsoft has also addressed seven critical memory corruption bugs—one in Chakra scripting engine, three in Edge browser, one in the ChakraCore scripting engine, and one in Windows Media Foundation—all lead to remote code execution.

Rest CVE-listed flaws have been addressed in Windows, Microsoft Office, Internet Explorer, Microsoft Edge, ChakraCore, along with a zero-day bug in Flash Player that Adobe patched last week.
Users are strongly advised to apply security patches as soon as possible to keep hackers and cybercriminals away from taking control of their computers.

For installing security updates, simply head on to Settings → Update & security → Windows Update → Check for updates, or you can install the updates manually.


Source:  TheHackerNews 

FBI Arrest 74 Email Fraudsters Involved in Nigerian BEC Scams

The United States Department of Justice announced  Monday the arrest of 74 email fraudsters across three continents in a global crackdown on a large-scale business email compromise (BEC) scheme.

The arrest was the result of a six-month-long operation dubbed "Operation Wire Wire" that involved the US Department of Justice, the US Department of Homeland Security, the US Treasury, and the US Postal Inspection Service.

The international law enforcement authorities led by the FBI arrested 42 of the total 74 individuals involved in BEC scheme in the United States, 29 in Nigeria and 3 each in Canada, Mauritius, and Poland.

"Foreign citizens perpetrate many BEC scams. Those individuals are often members of transnational criminal organizations, which originated in Nigeria but have spread throughout the world," the DoJ says.

Moreover, the authorities seized nearly $2.4 million and recovered about $14 million in fraudulent transfers, according to the FBI, which estimates that businesses worldwide have lost up to $5.3 billion to BEC fraudsters since 2013.

Like most BEC scheme, the cybercriminals targeted both businesses and individuals, including many senior citizens and real estate purchasers, to steal millions using socially-engineered emails to convince them to make wire transfers to bank accounts controlled by the criminals.

In one case, the US Department of Justice alleged that two Nigerians living in Dallas, Texas, posed as a property seller and requested a $246,000 wire transfer from a real estate attorney, who lost $130,000 after the bank was notified of the fraud while $116,000 were frozen.

The US Department of Justice said such scams are "prevalent" and pledged to pursue and prosecute the perpetrators "regardless of where they are located."

"This operation demonstrates the FBI's commitment to disrupt and dismantle criminal enterprises that target American citizens and their businesses," said FBI Director Christopher A. Wray.

According to the DoJ, the fraudsters also targets individuals with romance, employment opportunities, fraudulent online vehicle sales, rental, and lottery scams. Sometimes they ask for valuable data like employee tax records instead of, or in addition to, money.
Since such email fraud attacks are on the rise, the law enforcement recommended people to educate themselves and organizations to educate their employees on BEC schemes to protect their businesses.

Are you already a victim of the BEC scheme? Please file a complaint with the IC3. You can also take a look at this IC3 public service announcement on BEC schemes.



Source:  TheHackerNews 

Thousands of Android Devices Running Insecure Remote ADB Service

Despite warnings about the threat of leaving insecure remote services enabled on Android devices, manufacturers continue to ship devices with open ADB debug port setups that leave Android-based devices exposed to hackers.

Android Debug Bridge (ADB) is a command-line feature that generally uses for diagnostic and debugging purposes by helping app developers communicate with Android devices remotely to execute commands and, if necessary, completely control a device.
Usually, developers connect to ADB service installed on Android devices using a USB cable, but it is also possible to use ADB wirelessly by enabling a daemon server at TCP port 5555 on the device.

If left enabled, unauthorized remote attackers can scan the Internet to find a list of insecure Android devices running ADB debug interface over port 5555, remotely access them with highest "root" privileges, and then silently install malware without any authentication.

Therefore, vendors are recommended to make sure that the ADB interface for their Android devices is disabled before shipping. However, many vendors are failing to do so.
In a Medium blog post published Monday, security researcher Kevin Beaumont said there are still countless Android-based devices, including smartphones, DVRs, Android smart TVs, and even tankers, that are still exposed online.

"This is highly problematic as it allows anybody — without any password — to remotely access these devices as ‘root’* — the administrator mode — and then silently install software and execute malicious functions," Beaumont said.

The threat is not theoretical, as researchers from Chinese security firm Qihoo 360's NetLab discovered a worm, dubbed ADB.Miner, earlier this year, that was exploiting the ADB interface to infect insecure Android devices with a Monero (XMR) mining malware.

Smartphones, smart TVs, and TV set-top boxes were believed to be targeted by the ADB.Miner worm, which managed to infect more than 5,000 devices in just 24 hours.

Now, Beaumont once again raised the community concerns over this issue. Another researcher also confirmed that the ADB.Miner worm spotted by Netlab in February is still alive with millions of scans detected in the past month itself.

  "@GossiTheDog inspired me to take a look back at the ADB.Miner worm, which I've been fingerprinting in February. It seems that it lives and it feels pretty well. I've checked out two days (4th, 5th of June) - about 40 000 unique IP addresses. I'll provide some deep analysis soon," Piotr Bazydło, IT Security researcher at NASK, tweeted.

Although it is difficult to know the exact number of devices due to Network Address Translation and dynamic IP reservations, Beaumont says "it is safe to say 'a lot.'"
In response to Beaumont's blog post, the Internet of Things (IoT) search engine Shodan also added the capability to look for port 5555. Based on the scanning IP addresses, the majority of exposed devices are found in Asia, including China and South Korea.

Kevin advises vendors to stop shipping products with Android Debug Bridge enabled over a network, as it creates a Root Bridge—a situation anybody can misuse the devices.
Since ADB debug connection is neither encrypted nor requires any password or key exchange, Android device owners are advised to disable it immediately.

Source:  The HackerNews 

Train Your Employees to Think for Themselves in Data Security

Employers have learned (the hard way) that one of the biggest security threats in the organization is their own staff.

A report published by Ipswitch looks at data breach causes to find out how rogue employees rank. An interesting find is that up to 75% of data breaches result from insider threats, while a separate report by Veriato  suggests that 90% of cybersecurity experts feel that their company is vulnerable to insider attacks. In fact, about 50% of the 472 professionals surveyed said they had suffered these attacks in the previous 12 months.

Deliberate or not, these threats are very real and as heavily as companies might invest in data security software, they are always going to be vulnerable because they continually ignore a large component of realizing fewer cybersecurity threats.

Since employees (insiders) have access to company information, they are technically a bigger danger to data security than the third party cyber-criminals who use all manner of innovative ways to gain access to personal data.

A curious business owner wants to know: Why must I involve employees in implementing data security when they have been shown to be a weak point in the same strategy?

1. Social engineering transcends security tools
Human error is often the weakest link in an otherwise ideal chain. From technology to literature, social engineering is the big boss you have to beat after meeting all the other mini-bosses.

By definition, social engineering involves the use of psychological tricks to manipulate people into revealing sensitive information about themselves. For an organization, once the hacker has your employee at this point, they can gain access to all the areas the employee can typically access. Through social engineering security awareness you can help your employees avoid the three commonest security scams thereby protecting your company as well: identity theft; vishing; and baiting.

Without adequate education on social engineering and covering that loophole, security tools are almost useless.

2. It’s part of their responsibility
Apart from preventing the catastrophic aftermath of social engineering, data security is the responsibility of every employee in the organization in this sense: if consumers expect organizations to protect their data, isn’t it the responsibility of employees to make sure the data doesn’t land in the wrong hands?

Dropbox's 2012 incident, during which hackers reportedly stole data belonging to over 60 million of Dropbox's  clients at the time, was attributed to employee negligence.

As reported, the hackers who used the password of the employee were able to access the company portal by reusing a password from the LinkedIn breach of the same year that exposed the emails and passwords of 117 million LinkedIn users.

Such an example shows that as a company, you can still unwillingly betray your customers. While Dropbox wasn’t entirely to blame, one of their employees reusing passwords was a great insight into the company’s internal security standards and more importantly, a good example for all employees on password don’ts.

3. It is now a common regulatory requirement
Through internet security awareness training, organizations are required to equip their staff with knowledge about data security. Some of the laws, regulations and industry codes include HIPAA, FTC Red Flags Rule and PCI DSS among others. While many SMEs don’t do any training to remain compliant, many conduct the training to avoid cyber-attacks.

These tips will help you implement a great training program:

1. Diversify your training methods. Have a mix of training techniques at your disposal including classrooms, videos, team discussions, newsletters, posters, etc.

2. Educate often. Conduct regular training in monthly, quarterly, or annual cycles.

3. There’s no one size that fits all. Different members at different levels will start learning at equally different points.
Don’t ignore industry regulations.

Don’t be like the owner who delegates the role of data security to themselves because it’s “too important.” If you really want to be stress-free, train your employees well and promote a culture of information security.

Source:  Infosecurity 

Facebook's Special-Access, Data-Sharing Deals

In the months that have followed Mark Zuckerberg's testimony before Congress, Facebook has repeatedly found itself in the headlines. Once again, it has come to light that the social media giant has been less than transparent, with the Wall Street Journal reporting that certain companies deemed to provide particular value to Facebook were placed on what was internally dubbed as "whitelists," granting them access to customer data.

Two companies identified as making the whitelist include the Royal Bank of Canada and Nissan Motor Co., a source familiar with the matter reportedly told the Journal. In addition to phone numbers, the information the companies were able to access included a "friend link" metric, which provided data on the degrees of separation among users and their friends.

While no additional names of whitelisted companies have been disclosed, Facebook has justified the deals, reportedly claiming that the access was granted with the intention of both improving the user experience and allowing third parties and partners the time needed to conclude their previously existing data-sharing projects.

Facebook acknowledged the "small group" had been granted extended access beyond 2015 May as part of what Ime Archibong, vice president of product partnerships, Facebook, called the company's consistent and principled approach to working with developers.

“As we were winding down over the year, there was a small number of companies that asked for short-term extensions, and that, we worked through with them,” Archibong reportedly said. “But other than that, things were shut down.”

This newest whitelist revelation is separate from the data-sharing partnerships with device makers that was reported last week. A Facebook spokeswoman is reported to have confirmed that the company has been sharing users’ data with at least 60 different device producers, including Apple, Microsoft and Samsung, since 2007.

Despite its claim to have stopped third-party access to information on users's friends back in 2015, NordVPN wrote that "Facebook does not internally consider device makers to be third parties, so it did not disclose the fact that it was sharing the same exact data with those companies."

Source:  Infosecurity 

RIP Yahoo Messenger, 1998-2018

First they came for AOL Instant Messenger, and killed it off on December 15 of last year. Now they're aiming for Yahoo Messenger, one of the original chat services. It is scheduled to die on July 17 this year. If you want to, you can download your chat history for the next six months by accessing this link.

Oath, the Verizon-owned company that currently runs Yahoo Messenger, hasn't announced any plans to replace it with something that could become an actual competitor to the likes of WhatsApp or Facebook Messenger.

It's funny how, many years ago when someone said "messenger" you naturally assumed they meant Yahoo's, and today your brain automatically thinks of Facebook's. Times, they definitely are a changin'.

Yahoo Messenger launched on March 9, 1998 as Yahoo Pager, and then got its iconic rebranding on June 21, 1999. Thus, on July 17, 2018, when it's scheduled to be put down, it will be exactly 20 years, 4 months, and 8 days old. Too young to go? You'll be the judge of that.

Oath took this opportunity to remind everyone about Yahoo Squirrel, which is an invite-only group messaging app, currently in beta. You need to request access to the beta in order to use it, because hey, that worked for Gmail in 2004 so it has to still be a valid launch strategy, right?

Don't be surprised if Squirrel will be euthanized at some point in the near future as well. You may not hear about that, though - while some have fond memories of Yahoo Messenger, we're betting that there aren't a lot of people who've ever heard of Squirrel.

Source:  gsmarena 

Instagram is working on bringing long-length videos & 4K contents

It was reported yesterday that Instagram is working on bringing long-length videos and now according to close sources to Techcrunch, the company will offer a dedicated space featuring scripted shows, music videos and more in vertically oriented, full-screen, high-def 4K resolution.

It is also reported that Instagram is meeting with popular social media stars and content publishers to learn more about how their video channels would work elsewhere. Surprisingly, Instagram is also lining up partners to announce the long-form video effort tentatively scheduled for June 20th. Users can expect a kind of videos you see from YouTube creators which often range from 5 to 15 minutes.

Furthermore, Instagram will also eventually creators and publishers monetize longer videos, though it hasn’t finalized how accompanying ads like pre-rolls and mid-breaks or revenue splits would work. The longer videos will have swipe-up to open a link which will give creators an advantage to drive traffic to their websites, e-commerce stores or event ticketing.

As for Instagram long-term videos, the section will spotlight a collection of popular videos, and provide a “continue watching.” Users will also see the long-form clips featured on authors’ profiles near the Stories Highlights bubbles. However, Instagram will not allow to shoot and post long-form videos, as the section will only allow pre-made video uploads. There is no time frame as to when this feature would roll out or what it would be named.

Source: Techrunch 

VPNFILTER MALWARE IMPACT LARGER THAN PREVIOUSLY THOUGHT

Researchers say the impact of the VPNFilter malware discovered last month is larger than originally reported.

On Wednesday, Cisco Talos researchers said they now believe the malware has infected twice the number of router brands than previously stated. They added that Vpnfilter also delivers a more potent punch than they originally thought, and have identified a previously unidentified malicious malware module.

On May 23, Talos researchers first reported that Russian-speaking threat actors, with links to the BlackEnergy APT group, were behind the VPNFilter malware that infected 500,000 router brands (ranging from Linksys, MikroTik, NETGEAR and TP-Link as well as small office network attached storage (NAS) devices).

At the time, known malicious capabilities of VPNFilter included bricking the host device, executing shell commands for further manipulation, creating a ToR configuration for anonymous access to the device, or maliciously configuring the router’s proxy port and proxy URL to manipulate browsing sessions.

In updated research, Cisco Talos said the range of targeted routers now includes those made by manufacturers ASUS, D-Link, Huawei, Ubiquiti, UPVEL and ZTE, bringing the total number of router models targeted by VPNFilter adversaries to 75.

“These new discoveries have shown us that the threat from VPNFilter continues to grow,” Talos wrote in a technical breakdown of the malware on Wednesday.

A closer examination of VPNFilter also demonstrates that the malware has the capability to infect more than the targeted routers and NAS devices — and can traverse into the networks that those devices support.

“If successful, the actor would be able to deploy any desired additional capability into the environment to support their goals, including rootkits, exfiltration capability and destructive malware,” researchers wrote.

To boot, Talos said that it has found a new stage-three module capable of injecting malicious content into web traffic as it passes through targeted network devices. Researchers identified the module as “ssler,” or an “endpoint exploitation module — JavaScript injection.”

“At the time of our initial posting, we did not have all of the information regarding the suspected stage-three modules. The new module allows the actor to deliver exploits to endpoints via a man-in-the-middle capability (e.g. they can intercept network traffic and inject malicious code into it without the user’s knowledge),” researchers wrote.

An additional “dstr” (device destruction module) component to the malware was also identified, which is “used to render an infected device inoperable by deleting files necessary for normal operation,” researchers wrote. “It deletes all files and folders related to its own operation first before deleting the rest of the files on the system, possibly in an attempt to hide its presence during a forensic analysis.”

Lastly, researchers discussed new insights into a stage-three packet-sniffer module that they said was targeting industrial control system traffic. The sniffer specifically singled out the SafeStream Gigabit Broadband VPN router TP-LINK R600VPN.

“VPNFilter is still in full force, in the wild, infecting a broader set of devices than known previously, which makes it quite concerning still,” wrote Derek Manky, global security strategist with Fortinet FortiGuard Labs, in an email. “This is a good example of how even exposed campaigns can continue to move with velocity.”

Source:  Threatpost 

DNA TESTING SERVICE MYHERITAGE LEAKS USER DATA OF 92 MILLION CUSTOMERS

Account data tied to 92 million users of the genealogy and DNA testing service MyHeritage were found on a third-party “private” server in a breach that exposed usernames and passwords of customers.

The breach is the largest since last year’s Equifax leak of 147.9 million pieces of private data ranging from Social Security numbers, birth dates, addresses and some driver’s license numbers.

Users who signed up for the service before October 26, 2017 are impacted, according to a MyHeritage statement released on Monday regarding the incident.

“Today, June 4, 2018 at approximately 1 p.m. EST, MyHeritage’s chief information security officer received a message from a security researcher that he had found a file named myheritage containing email addresses and hashed passwords, on a private server outside of MyHeritage,” the statement reads.

The company did not elaborate on the ownership or origin of the server. It did however confirm that the data originated from MyHeritage and included email addresses and hashed passwords of 92,283,889 users. No other data, such as user financial information, DNA and genealogy specifics, was found on the server hosting the data.

“We have no reason to believe that any other MyHeritage systems were compromised… Other types of sensitive data such as family trees and DNA data are stored by MyHeritage on segregated systems, separate from those that store the email addresses, and they include added layers of security. We have no reason to believe those systems have been compromised,” the firm said.

The Israeli-based MyHeritage said the hash key differs for each customer password, suggesting they were salted and hashed, making it harder for cybercriminals to decode the 92 million individual coded passwords.

The company noted it was complying with recently enacted General Data Protection Regulation (GDPR) rules form the European Union, given its multinational customer base. “We are taking steps to inform relevant authorities including as per GDPR,” the company said. Under GDPR rules, passed May 25, companies with customers inside the EU have 72 hours to report a breach after becoming aware of the incident.

The genealogy and DNA testing service company said it would be implementing two-factor authentication features for user accounts as well.

DNA databases have come under closer scrutiny as more online companies commoditize the service, offering genetic sequencing at low prices and warehouse the data. Privacy activist warn while DNA databases can be a boon when it comes to tracking down and arresting people such as Joseph James DeAngelo, the alleged “Golden State Killer,” DNA samples can also be leaked and abused by criminals or by over-reaching law enforcement officials.

Source:  Threatpost 

Machine Learning Doesn't Mean AI or End of Humans

The introduction of AI and machine learning should not mean a decision of man or machine, but one of man and machine bringing combined skills together.

Speaking at Infosecurity Europe 2018, Christopher Morales, head of security analytics at Vectra Networks, looked at 'Building Security That Works, Machine Learning Fundamentals for Cybersecurity Professionals' admitted that there is confusion around what AI, machine learning and deep learning are.

“AI is the output of what you’re trying to do, and do things that is a repetitive task,” he said. “Machine learning is the method and the means to AI, but it is not AI itself.”

Morales went on to say that deep learning is part of machine learning, and there are two types: supervised or unsupervised. Supervised means it is task driven, “you give it input and have X data and you get Y output.” With unsupervised, he explained that you “have the X but no Y, a set of data and no outputs.”

Explaining unsupervised machine learning, Morales said that as conference delegates “we’ve been clustered by a vendor."

He went to address algorithms, saying that if you have a single algorithm and you’re using it to do a job, that is not really AI, that is about using the right tool for the job. “Look at the task and who administrates the system, and if you want to find a remote access trojan, that is a good use of supervised learning as you are being specific on what you are looking for and how to apply it,” he said.

Moving on to how this can help with security, Morales said that pattern matching has been done for years, and users have focused on understanding what malware is, and with machine learning you can focus on what it does rather than what it is – and match it to that decision.

“Focus on behavior and how it relates to an attack, and focus on what to do and what it is doing to you now.”

He went on to encourage users to train systems on a subset of tools and what it looks like when an attacker wants to get on your network, and apply it to the network so it looks for any tool doing the same behavior.

“Unsupervised learning is good at learning local context and what people do, and in this case security research on what an attacker actually does,” he said.

He concluded by saying that the real value of AI is in replicating human tasks, but what you get out is to reduce the workload of the human. “We need to realize that machines are not going to replace humans, and in most instances they increase the human‘s work,” he said.

“But in security machines and humans are inherently different: machines are good at memorizing data and repetitive tasks and do it fast in multiple tasks, and humans are good at being creative and looking at context. It is not man or machine, but a combination of machines doing tedious work so humans can focus on creative work.”

Source: Dan Raywood  infosecurity 

How to Design Security Awareness Programs & Drive Smart Security Behavior

At Infosecurity Europe 2018, Dr Jessica Barker, co-founder of Redacted Firm, discussed practical ways to build security awareness programs that can drive better user behaviors.

The first step is assessing “what your organization looks like on paper, and knowing about your organization in terms of the sector, the size, the geography – what are the most important information assets, which are the biggest threats and what would be the most damaging thing that could happen to the organization.”

Once you have that understanding of the baseline characteristics of the organization on paper, you can move onto “understanding them in real life,” Dr Barker said, and the key thing that must be done here is speaking to people within the organization “to find out what is actually happening, because as we know, what is happening day-to-day among the employees of an organization will be a very different picture to what you see on paper.”

Dr Barker added that a good level of security awareness does not always equate to good security understanding and changes in behavior, “so when we talk about awareness we need to think about what the outcome is that we want – we don’t want people to be aware just for the sake of it, we want to see changed behaviors.”

Her advice for doing that is to “work backwards” to create a culture in which people are engaged through experiences of what good security behavior is, and making “cybersecurity personal is one of the best ways to get through to people.

“If you really want to change behaviors,” she concluded, “you need to think about intrinsic motivation and what you can do that is really going to tap into their [users’] internal rewards system.”

Source:  infosecurity 

Malware Targets Users of Online Banking Service

After noticing a browser extension communicating with a suspicious domain, researchers analyzed the Google Chrome extension named Desbloquear Conteudo (unblock content) and found that it was a rare banker malware.

The extension, identified as HEUR:Trojan-Banker.Script.Generic has been removed from Chrome Web Store. According to Vyacheslav Bogdanov, researcher, Kaspersky Lab the man-in-the-middle (MitM) extension for Chrome was targeting users of Brazilian online banking services with the goal of collecting user logins and passwords in order to pilfer their savings.

MitM attacks redirect the victim’s web traffic to a spoof website. While the target is under the impression they are connected to a legitimate site, the flow of traffic to and from the real bank site is actually being redirected through an attacker's site so that the criminal can harvest the personal data they are after.

What's interesting about this particular extension is that the developers made no effort to obfuscate its source code. Instead, they opted for a MitM attack using "the WebSocket protocol for data communication, making it possible to exchange messages with the C&C [command-and-control] server in real time. This means the C&C starts acting as a proxy server to which the extension redirects traffic when the victim visits the site of a Brazilian bank."

This particular extension used the Proxy Auto Configuration technology, which enabled additional functions beyond the one written in JavaScript for most modern browsers. The FindProxyForUrl function was replaced with a new task that redirected traffic from the Brazilian bank to the malicious server. Attackers added malicious code to the webpage using cef.js script in order to intercept the user’s one-time password.

Because the malware was targeting Brazilian users, Bogdanov suggested that the browser extension had the additional function of adding cryptocurrency mining scripts to the banking sites users visited.

“Browser extensions aimed at stealing logins and passwords are quite rare in comparison to adware extensions, but given the possible damage that they can cause, it is worth taking them seriously. We recommend choosing proven extensions that have a large number of installations and reviews in the Chrome Web Store or other official services. After all, despite the protection measures taken by the owners of such services, malicious extensions can still penetrate them,” Bogdanov said.

Source:  Infosecurity 

Windows Server 2019 embraces SDN

Software-defined networking in Windows Server 2019 includes, virtual network peering and encryption, auditing and IPv6 support.

When Windows Server 2019 is released this fall, the updates will include features that enterprises can use to leverage software-defined networking (SDN).

SDN for Windows Server 2019 has a number of components that have attracted the attention of early adopters including security and compliance, disaster recovery and cusiness continuity, and multi-cloud and hybrid-cloud

Virtual-network peering

The new virtual networking peering functionality in Windows Server 2019 allows enterprises to peer their own virtual networks in the same cloud region through the backbone network.  This provides the ability for virtual networks to appear as a single network.

Fundamental stretched networks have been around for years and have provided organizations the ability to put server, application and database nodes in different sites. However, the challenge has always been the IP addressing of the nodes in opposing sites.  When there are only two static sites in a traditional wide area network, the IP scheme was relatively static.  You knew the subnet and addressing of Site A and Site B.

However, in the public cloud and multi-cloud world – where your target devices may actually shift between racks, cages, datacenters, regions or even hosting providers – having addresses that may change based on failover, maintenance, elasticity changes, or network changes creates a problem.  Network administrators have already  spent and will drastically increase the amount of time they spend addressing, readdressing, updating device tables, etc to keep up with the dynamic movement of systems.

With Vnet Peering, while the external location and fabric that the host and applications systems are running in may drastically change, the virtual network remains consistent.  No need to change source and target addresses within the application, no need for Web and Database pairs to change settings.

Virtual-network encryption

Another significant improvement in Windows Server 2019 is the ability for virtual-network traffic to be encrypted between virtual machines.  Traffic encryption is not new to the industry, however having the encryption built in to the operating system as the basis of hypervisor communications, server communications and application communications provides both flexibility and that in the past was frequently done at the application layer.

Now with Vnet encryption, entire subnet communications between host servers can be protected, and all network traffic within that network is automatically encrypted.  For organizations looking to ensure communications between a Web server and a database server is encrypted, Vnet encryption in Windows Server 2019 can be enabled. Since the communications is at the network/subnet level, if additional Web frontends and backend databases needed to be added, all those servers join the same encrypted communication stream, offloading the secured communications away from the application itself, improving performance and efficiency.



Source:  NETWORK WORLD 

Cybercriminals Work Around Road Blocks

Though somewhat deterred by the major takedown of two popular underground marketplaces, cybercriminals have found alternative solutions that are growing more popular, according to new research from Digital Shadows. 


A new report, Seize and Desist: The State of Cybercrime in the Post-AlphaBay and Hansa Age, found that the cybercriminal community has only been slightly quieted by the Operation Bayonet takedown of AlphaBay and Hansa, which forced tens of thousands of vendors and buyers to find new places to conduct business. Mistrust and fear have contributed to the decline of centralized marketplaces, as has the significant cost factor involved in establishing a new market.


Rather than investing in new marketplaces, criminals are focusing their processes and procedures on improving marketplace security and trust in existing sites. These tactics include blockchain DNS, user vetting and site access restrictions, domain concealment, and migration to chat and peer-to-peer (P2P) networks.


Vetting and limiting the user base is an additional challenge for site operators, who need to ensure only reputable and genuine users have access, particularly since forum users are skeptical of each other, aware that law enforcement can be posing as sellers. 


To confront the issues of trust, communities have created a forum life cycle, a process by which administrators can limit new users’ access to a forum through mechanisms such as posting limits and area access restrictions.


Moving away from the centralized marketplace in favor of a more diffuse model was trending even before Operation Bayonet, and criminals are now using Telegram to conduct transactions across decentralized markets and messaging networks.


"Over the last six months, the Digital Shadows analyst teams have detected over 5,000 Telegram links shared across criminal forums and dark web sites, of which 1,667 were invite links to new groups," the report said. These covered a range of services, including cashing out, carding and cryptocurrency fraud.


Rick Holland, CISO and VP of strategy at Digital Shadows, said, “The FBI takedown has for now made the dark web marketplace model less viable. As it stands, the marketplace model appears to be in decline, but it would be naive to assume that law enforcement efforts such as Operation Bayonet have drastically reduced cybercriminal risks to both businesses and consumers." 


"Instead," he continued, "as recent developments have shown, cybercriminals have taken to incorporating new processes, technologies and communication methods to continue their operations. The barriers to entry have shifted upwards and criminals are more likely to be deceived by each other. However, cybercrime ‘will find a way.’”

Source:  infosecurity 

Facebook defends sharing user data with mobile OEMs

Facebook is defending its privacy and data management practices again after the New York Times on Sunday reported that the social media giant has entered into agreements over the last decade to share user data with at least 60 mobile device manufacturers, in an effort to make its services and experiences available to device owners via integrated APIs.

According to the Times, these partnerships, which reportedly were extended to companies like Apple, Amazon, BlackBerry, Microsoft and Samsung, raise concerns that the company may not have been fully complying with a 2011 FTC consent decree -- a suggestion that could once again turn up the heat on Facebook following its Cambridge Analytica data-sharing controversy.

The Times further reports that the data sharing agreements, 22 of which have already been phased out (in April, Facebook announced it would wind down access to the APIs), have allowed Facebook's OEM partners to access the personal data of users' friends without their explicit consent -- even those who previously denied permission to share information with third parties.

Despite Facebook leadership's contention that they have largely prohibited third parties like Cambridge Analytica from accessing such user data since 2015, they apparently excluded OEMs from these restrictions, the Times  report states.

In a blog post, Facebook defended itself by explaining that mobile device manufacturers are considered trusted partners who essentially act as extensions of Facebook.
"Given that these APIs enabled other companies to recreate the Facebook experience, we controlled them tightly from the get-go," states the blog post, authored by Ime Archibong, Facebook's VP of product partnerships. "These partners signed agreements that prevented people's Facebook information from being used for any other purpose than to recreate Facebook-like experiences. Partners could not integrate the user's Facebook features with their devices without the user's permission. And our partnership and engineering teams approved the Facebook experiences these companies built."

Facebook also disputed the Times' claims about OEMs having access to users' friends' information, asserting that "friends' information, like photos, was only accessible on devices when people made a decision to share their information with those friends."



Source:  SC 

Samsung is making a Snapdragon-powered PC

Samsung is the latest device manufacturer to take a chance on Snapdragon-powered PCs, joining the ranks of HP, ASUS and Lenovo. In addition to its new Snapdragon 850 chipset, Qualcomm announced today that the Galaxy phone maker will be integrating the card "in a future device." Given Samsung already makes Windows-powered convertibles like the Galaxy Book, which are portable enough to meet Microsoft's requirements for the "Always Connected PC" ecosystem, it's entirely possible that the upcoming device is a 2-in-1.

Since connected PCs are supposed to be smartphone-like in battery life and cellular connectivity, Samsung's expertise as a smartphone maker could give it an edge over traditional laptop brands. There aren't too many other details available, so all we can really do now is imagine and speculate on what that device might look like. Meanwhile, this collaboration is a significant one for Qualcomm as it continues to grow its list of partners for the Windows on Snapdragon platform.



Source:  Samsung 

Researchers power tiny medical implant from over 100 feet away

Researchers at MIT are working on tiny implantable devices that can communicate and be powered wirelessly. In the future, they could be used to deliver drugs, treat disease or monitor conditions from inside a human body. Because the devices don't require a battery, they can be pretty small and the prototype the research team has been working with is about the size of a grain of rice. But the researchers think they can get the devices to be even smaller than that.

Traditionally, using radio waves to communicate with a device inside of a human body has been difficult because the waves spread out as they pass through human tissue. But the MIT researchers, working with scientists at Brigham and Women's Hospital, created a new type of antenna system that overcomes this problem and has allowed them to communicate and power their implantable devices from a significant distance. When the device was embedded 10 centimeters deep within a pig, the researchers could send power to it from up to a meter away. When the device was just under the skin's surface, it was able to be powered from as far as 38 meters away.

"There's currently a tradeoff between how deep you can go and how far you can go outside the body," Fadel Adib, an assistant professor in MIT's Media Lab, said in a statement. "Even though these tiny implantable devices have no batteries, we can now communicate with them from a distance outside the body," he added. "This opens up entirely new types of medical applications."

The scientists are now working to improve the system's efficiency and expand the distances from which they can communicate with the devices. Their work will be presented at the Association for Computing Machinery Special Interest Group on Data Communication annual conference in August.



Source:  Engadget