Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×

Submission + - China Joins Russian Cyberattacks Against Europe (esecurityplanet.com) 4

Submitted by storagedude
storagedude writes: A SaaS security company says a spike in cyber attacks from Russia and China in recent weeks suggests the two countries may be coordinating their cyber efforts.

The effort may or may not be coordinated, but other threat analysts also note unusual Chinese cyber activity in Europe coinciding with Russia unprovoked war against Ukraine.

Ben Read, Mandiant's Director of Intelligence Analysis, told eSecurity Planet "that we've seen similar activity to Google with China targeting Europe/Ukraine, but no indication it's coordinated with Russia."

The Google threat landscape update issued yesterday notes that Mustang Panda or Temp.Hex, a China-based threat actor, targeted European entities with lures related to the Ukrainian invasion, such as malicious attachments with file names like ‘Situation at the EU borders with Ukraine.zip’. Contained within the zip file is an executable of the same name that is a basic downloader that when executed, downloads several additional files that load the final payload, Google said.

“Targeting of European organizations has represented a shift from Mustang Panda’s regularly observed Southeast Asian targets,” Google said.

SaaS Alerts, which helps managed service providers (MSPs) manage and protect customers' SaaS apps, mentioned the finding in conjunction with the release of its annual SaaS Application Security Insights (SASI) report.

"Over the last several weeks, SaaS Alerts has seen a sharp rise in activity from countries with consistently high levels of both attempted and successful attacks originating within their borders — Russia and China," the company said in a statement. "The vast volumes of data analyzed suggests these countries may even be coordinating attack efforts. Per analysis available from SaaS Alerts, attack trend lines that compare Russia and China show almost the exact same pattern."

The surge in cyber activity reported by SaaS Alerts and others coincides with the build-up to Russia's unprovoked attack against Ukraine, and yesterday Resecurity Inc. reported that hackers – some linked to Russian GRU military intelligence – breached computers at nearly two dozen U.S. liquified natural gas (LNG) companies and the FBI reported that Russia-connected Ragnar Locker ransomware had hit at least 52 critical infrastructure companies as of January.

U.S. security agencies have issued a number of alerts on critical security infrastructure protection in recent months, including a network security framework released just last week.

Submission + - SPAM: Russia, China May Be Coordinating Cyber Attacks: SaaS Security Firm

Submitted by storagedude
storagedude writes: A SaaS security company says a spike in cyber attacks from Russia and China in recent weeks suggests the two countries may be coordinating their cyber efforts.

SaaS Alerts, which helps managed service providers (MSPs) manage and protect customers' SaaS apps, mentioned the finding in conjunction with the release of its annual SaaS Application Security Insights (SASI) report.

"Over the last several weeks, SaaS Alerts has seen a sharp rise in activity from countries with consistently high levels of both attempted and successful attacks originating within their borders — Russia and China," the company said in a statement. "The vast volumes of data analyzed suggests these countries may even be coordinating attack efforts. Per analysis available from SaaS Alerts, attack trend lines that compare Russia and China show almost the exact same pattern."

eSecurity Planet checked with some well-known threat intelligence services, and while they didn't conclude that the attacks are coordinated, they confirm that China has increased cyber activities in Ukraine and Europe.
Ben Read, Mandiant's Director of Intelligence Analysis, told eSecurity Planet "that we've seen similar activity to Google with China targeting Europe/Ukraine, but no indication it's coordinated with Russia."

The surge in cyber activity reported by SaaS Alerts and others coincides with the build-up to Russia's unprovoked attack against Ukraine, and yesterday Resecurity Inc. reported that hackers – some linked to Russian GRU military intelligence – breached computers at nearly two dozen U.S. liquified natural gas (LNG) companies and the FBI reported that Russia-connected Ragnar Locker ransomware had hit at least 52 critical infrastructure companies as of January.

U.S. security agencies have issued a number of alerts on critical security infrastructure protection in recent months, including a network security framework released just last week.
Link to Original Source

Submission + - Focus on Network Egress for Critical Infrastructure Security: SANS (esecurityplanet.com)

Submitted by storagedude
storagedude writes: SANS Outlines Critical Infrastructure Security Steps as Russia, U.S. Trade Cyberthreats

With critical infrastructure security a key concern in the wake of the Russian invasion of Ukraine, one SANS Institute official is recommending that network operators forget defense for now and immediately focus on network egress for signs of an attack.

SANS Principal Instructor Mick Douglas proposed those measures in a Twitter thread that has generated a lot of interest among cybersecurity pros, reports eSecurity Planet. SANS plans to repost the work soon as a blog.

"This list is a triaged set of stuff an org should do *right freaking now* if they've not done so already," Douglas wrote. "It's an awful choice, but if I only get one network change right now... I'm taking tighter egress."

"Watch your egress," he said. "Firewalls work both ways. Carefully monitor outbound traffic. DMZ servers RESPOND to external requests. Look for DMZ systems initiating outbound. This is what 'phoning home' [command and control, or C2] looks like."

He also recommended application allowlisting and monitoring through means such as Windows SRUM and Linux auditd or sysmon.

"You *must* know how your systems are being used for two reasons," Douglas said. The first is for blocking any app not on your accepted list. The second reason is for "living off the land" (LOL) attacks, or using native functionality such as PowerShell to bypass security controls. "They are what state sponsored attackers use when pressured to do so," he said. "They allow attackers to bypass your AV, and yes likely your EDR."

"Because many orgs over rely on EDR and SIEM now, LOL attacks are highly successful. Attackers blend in. They are using core parts of the OS against you. None of your tools will stop these... Do NOT believe your heuristics or ML/AI based tool will save you either."

Douglas said his small five-year-old company has bypassed "every single control" in a $17,000 lab. "I can emulate most orgs, or a significant portion of them," he said. "If my boutique infosec consultancy has these resources...what does a state sponsored one have?"

"Prevent isn't possible. Try anyway. Move to a detect and respond model. That's our path to victory."

Submission + - Log4j Log4Shell Flaw Unleashes Slew of Attacks, Security Responses (esecurityplanet.com)

Submitted by storagedude
storagedude writes: The Log4Shell critical flaw found in the widely used Log4j open-source logging tool has unleashed a slew of cyber attacks targeting everything from cryptomining to data theft to botnets that target Linux systems.

In addition to the expected Log4j emergency patch from the Apache Software Foundation, the vulnerability has inspired some unusual defenses, like a “vaccine” released by Cybereason that disables the vulnerability until admins get a chance to apply the patch.

The flurry of activity was sparked by both the severity of the vulnerability — a 10.0, the highest level — as well as the ease of exploiting it.

"Bad actors need only send a string that includes the malicious code, which then gets parsed and logged by Log4j and loaded into a server," according to eSecurity Planet. "From there, hackers can gain control of the system that is running the software, giving them a platform for launching a variety of attacks."

“Because of its large attack surface and the innate severity of remote code execution, security researchers are notably calling this a ‘shellshock’ vulnerability,” said John Hammond, senior security researcher at Huntress Labs. “All threat actors need to trigger an attack is one line of text."

Submission + - Tape Won't Work for Ransomware Protection. Here's Why. (esecurityplanet.com) 4

Submitted by storagedude
storagedude writes: With the release of LTO-9, just about every tape vendor has pushed its wares as a solution to the ransomware problem. After all, is there any backup technology that's more air-gapped?

Tape IS great for backup — just not so much for recovery. Writing for eSecurity Planet, Henry Newman notes that not only is disk about 80% cheaper than LTO tape, but even an entry-level RAID card can restore data 6 times faster than tape.

"Backup is not about backing up the data, but the time it takes to restore that data to meet your business requirements," writes Newman.

"Tape drives are not striped, but disks generally are put into stripe groups," he writes. "With RAID controllers and/or software RAID methods, you can easily get many 10s of GB/sec of bandwidth to restore data from a single set of SAS connections. Doing that with tape is very expensive and requires architectural planning. So the bottom line is you can surely backup to tape and it is cost effective – for backup, that is. If you actually need to restore that data quickly, you have my best wishes."

Tape may have a better bit error rate than disk, but disk can be architected in a way that removes that reliability advantage, he notes.

"Tape vendors often state that the BER (bit error rate) of tape is far better than disk, which is 100% true, but you can make up for tape’s advantage with RAID methods that check the reliability of your data and ensure that what you wrote is what you read. This has been the case with RAID since the early 1990s, with parity check on read to validate the data. With other ANSI standard techniques – which sadly are not used often enough – such as T10 PI/DIX you can achieve data integrity on a single device equal to or greater than tape. The net-net here is disk is far faster than tape, as there is native striping that has been in use at least since the 1980s with RAID methods, and disk can achieve equal data integrity to tape."

"The most often overlooked part of data backup is the recovery part – the longer it takes to restore your data, the more damage it can do to your business," Newman writes.

He concludes: "Yes, tape can be air gapped but so can disk. Does tape provide better protection against ransomware? Likely, but is it so much slower than disk that you can turn off your system and turn on when you need to. Does having slower restoration make tape a better defense against a ransomware attack? As far as I can see, the marketing claims made by tape vendors do not hold up to a rigorous engineering analysis. If you want to use tape, that is your choice and there might be good reasons, but disk-based backups can be air gapped just like tape, for lower cost and with a much faster recovery time. Why tape vendors are making claims such as this, I will leave it to readers to speculate."

Submission + - Palo Alto Networks Enters Small Biz, Home Security Markets (esecurityplanet.com)

Submitted by storagedude
storagedude writes: Palo Alto Networks may have the best security of any enterprise security company, boasting an unbroken string of stellar independent security tests and a long history of pioneering new technologies like next-generation firewalls and XDR. So it's big news that the company announced today that it's moving way down market with a Wi-Fi 6 router system that targets small businesses and home users.

Okyo, as the device is called, offers malware, ransomware, phishing and remote attack protection, automated device discovery and online activity monitoring, and Wi-Fi 6 performance. At $349 a year for 30 devices and $449 for unlimited devices, it's a bargain for small businesses and companies with remote workers and offices. But for the consumer market, where vendors like Bitdefender and Sophos offer machine learning-based antivirus protection for about $100 a year, not so much. Still, with Palo Alto's threat intelligence and security technology behind it, home users desiring top security now have an option — if they're willing to pay a considerable premium for it over other options.

It's great news for small businesses. For consumers, let's hope other high-end vendors follow — and the price comes down.

Submission + - In Novel Attack Technique, Salesforce Email Service Used for Phishing Campaign (esecurityplanet.com)

Submitted by storagedude
storagedude writes: In a novel attack technique, Israeli security researchers discovered that cybercriminals were subscribing to Salesforce in order to use its email service to launch a phishing campaign and thus bypass corporate security defenses like whitelisting.

The researchers, from email security service provider Perception Point, said bad actors are sending phishing emails via the Salesforce email service by impersonating the Israel Postal Service in a campaign that has targeted multiple Israeli organizations.

In a blog post, security analysts Miri Slavoutsky and Shai Golderman wrote that this is the first time they had seen attackers abuse Salesforce services for malicious purposes.

“Mass Email gives users the option to send an individual, personalized email to each recipient, thus creating the perception of receiving a unique email, created especially for you,” Slavoutsky and Golderman wrote. “Spoofing attempts of Salesforce are nothing new to us. Attackers spoof emails from Salesforce for credential theft, is a typical example. In this case, the attackers actually purchased and abused the service; knowing that most companies use this service as part of their business, and therefore have it whitelisted and even allowed in their SPF records.”

Shlomi Levin, Perception Point’s co-founder and CTO, told eSecurity Planet that given how whitelisting a trusted source can result in security breaches, “it is essential to employ a zero-trust attitude combined with a strong filtering mechanism to any content that enters the organization no matter the source: email, collaboration tools or Instant Messaging.”

Stephen Banda, senior manager of security solutions at cybersecurity vendor Lookout, agreed with the researchers that it's a new approach by malicious actors.

“The practice of legitimately signing up for an email service with the full intention of using it for malice is an innovative strategy,” Banda said. “This breach should be a warning to all service providers to conduct extensive due diligence into who is requesting access to their services so that this type of scam can be avoided in the future.”

“There are ways to detect spoofing but in this case the emails look authentic and are also coming from where they say they are coming from,” said Saumitra Das, CTO of cybersecurity firm Blue Hexagon. "This means that attackers have got through the first email firewall both from a threat intelligence signature perspective of blocking known bad sources and also in some sense the instinct of the user themselves to be suspicious of what something is. It is common for attacks to get through email security solutions, but then well-trained or savvy users are the next line of defense. This [use of a legitimate email service] increases the chances of those users also clicking on links or downloading attachments.”

Submission + - Tech Giants, Others Pledge Money and Training for Cybersecurity at White House (esecurityplanet.com)

Submitted by storagedude
storagedude writes: At a White House meeting this week with President Biden, Microsoft and Google promised to spend $30 billion over the next few years to improve cybersecurity, while Apple, Amazon, IBM, the University of Texas system, Code.org, Girls Who Code and others announced efforts to improve training and education to help close the cybersecurity skills gap.

Some of the efforts are noteworthy, like IBM's pledge to "train 150,000 people in cybersecurity and partner with more than 20 historically black colleges and universities (HBCUs) to create Cybersecurity Leadership Centers to close the skills gap and create a more diverse workforce," eSecurity Planet reported.

Microsoft is also pledging to help improve tech diversity, with expanded security training partnerships with community colleges and non-profit agencies.

But Microsoft's pledge to spend $20 billion on security by design and advanced security solutions and Google's plan to spend $10 billion over five years to expand zero trust programs had Chris Gonsalves, vice president of research at Channelnomics, wondering why they weren't doing these things already.

“When Microsoft said, ‘Oh, we’re committed to making our products secure and resilient,’ what are you doing now?” Gonsalves said. “That should be part of their charter already. But for them to throw numbers around in the double-digit billions of dollars shows a real commitment there.”

Analyst Rob Enderle said the meeting was a start, but that collaboration between companies has a ways to go.

“Collaboration between the companies, which is occurring, is still likely below what it needs to be given the level of threat, and this meeting may have helped improve that,” Enderle told eSecurity Planet. “Their most significant impact will likely be collectively sharing the nature of new threats and designing AI [artificial intelligence]-based solutions that deal with these current threats and those that will emerge in the future.”

He wished for more participation from security companies at the meeting, which was the culmination of efforts that began after the Colonial Pipeline ransomware attack in May.

“Given the threat is very high for a catastrophic security breach, something that causes hundreds or thousands of deaths like what almost happened to the water system in Florida, it seems we still aren’t taking the threat as a nation seriously enough,” Enderle said.

Submission + - An Investment Firm Built Its Own SIEM. Here's How. (esecurityplanet.com)

Submitted by storagedude
storagedude writes: SIEM (security information and event management) is one of the most expensive and complicated security tools that companies use. Even cloud-based ones take months to deploy.

Unhappy with the cost and data limitations of their vendor-built solution, engineers at Two Sigma Investments in NYC built their own. It took 9 months — not too much more than your typical SIEM deployment time — and the result is saving them $3.5 million in upfront licensing and $600k in annual maintenance. Ingestion rates increased from 1TB to 5PB with no slowdown, and pertinent alerts now take seconds instead of minutes.

They did it with Google Cloud and BigQuery, and the Linux-based log processor Fluent Bit and Fluenta data aggregator.

Security Engineer Bret Rubin told the recent Black Hat conference, “We never have to store archive logs from BQ or pay any search for older data. In our previous system, we often rolled off long data sets because we didn’t have storage capacity, and index size affected performance.”

Submission + - SPAM: Open Source Security: A Big Problem

Submitted by storagedude
storagedude writes: The Open Source Security Foundation (OpenSSF) has some compelling statistics to back its agenda for bold action to secure open source software “end to end, at massive scale.”

FOSS (free and open source software) constitutes 80-90% of any piece of modern software, including .NET, JavaScript and Python. 84% of these codebases had at least one vulnerability in one study, with the average having 158 per codebase. And it takes on average 4 weeks to get a vulnerability resolved once the project is alerted to it, even as the time between vulnerability disclosure and exploit creation has dropped from 45 days to 3 or less.

“The number of vulnerabilities in the wild outpaces the speed at which the security community can patch or even identify them,” and automated attacks are quickly weaponizing even little-publicized flaws, OpenSSF member Jennifer Fernick, SVP and head of global research at NCC Group, told the Black Hat conference today.

The group of more than 50 tech giants, open source-based companies, security firms and open source users like JP Morgan Chase want to focus their efforts on securing the most critical libraries, components, and projects, a wise approach that should benefit everything using the same codebase, and a number of training, design, testing and vulnerability disclosure and patching projects are in the works to help users gauge and improve the security of projects.

Of course, there's also the timeless advice of giving back to the open source community, a message the group is also emphasizing.

“We all use the software,” said Intel Director of Security Communications Christopher Robinson. “Let’s all find ways to help improve it.”
Link to Original Source

Submission + - FBI, CISA Reveal Most Exploited Vulnerabilities (esecurityplanet.com)

Submitted by storagedude
storagedude writes: The FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) joined counterparts in the UK and Australia today to announce the top 30 vulnerabilities exploited since the start of the pandemic.

The list, a joint effort with the Australian Cyber Security Centre (ACSC) and the UK's National Cyber Security Centre (NCSC), details vulnerabilities — primarily Common Vulnerabilities and Exposures (CVEs) — "routinely exploited by malicious cyber actors in 2020 and those being widely exploited thus far in 2021."

Many of the vulnerabilities are known ones for which patches exist, so they can typically be easily fixed. The agencies also recommended a centralized patch management system to prevent such oversights going forward.

Most of the vulnerabilities targeted in 2020 were disclosed during the last two years. "Cyber actor exploitation of more recently disclosed software flaws in 2020 probably stems, in part, from the expansion of remote work options amid the COVID-19 pandemic," said a CISA statement. "The rapid shift and increased use of remote work options, such as virtual private networks (VPNs) and cloud-based environments, likely placed additional burden on cyber defenders struggling to maintain and keep pace with routine software patching."

The vulnerabilities include a number of well publicized ones from major vendors like Citrix, Microsoft, Fortinet, VMware and others, so a good portion of the blame can be placed on those who just aren't being vigilant with patching.

Submission + - A New Approach to Finding Cybersecurity Talent (esecurityplanet.com) 3

Submitted by storagedude
storagedude writes: Alan Paller, founder of the SANS Technology Institute, has launched an initiative aimed at finding and developing cybersecurity talent at the community college and high school level through a game developed by the UK's James Lyne. That game is already the basis of a UK program that has reached 250,000 students, and Paller hopes the U.S. will adopt a similar model to help ease the chronic shortage of cybersecurity talent.

Paller's Cyber Talent Institute has already reached 29,000 students in the U.S., largely through state-level partnerships, but playing the game isn't the same as becoming a career-ready cybersecurity pro. By tapping high schools and community colleges, the group hopes to “discover and train a diverse new generation of 25,000 cyber stars by the year 2025.”

Paller told eSecurity Planet:

"SANS is an organization that finds people who are already in the field and makes them better.

"What CTI is doing is going down a step in the pipeline, to the students, to find the talent earlier, so that we don’t lose them. Because the way the education system works, only a few people seem to go into cybersecurity. We wanted to change that.

"You did an article earlier this month about looking in different places for talent, looking for people who are already working. That’s the purpose of CTI. To reach out to students. It’s to go beyond the pipeline that we automatically come into cybersecurity through math, computer science, and networking and open the funnel much wider. Find people who have not already found technology, but who have three characteristics that seem to make superstars — tenacity, curiosity, and love of learning new things. They don’t mind being faced with new problems. They like them. And what the game does is find those people. So CTI is just moving to earlier in the pipeline."

Submission + - SolarWinds and Kaseya Attacks Shake Faith in SaaS Model (channelinsider.com)

Submitted by storagedude
storagedude writes: First SolarWinds, now Kaseya: SaaS software heavily used by managed service providers (MSPs) has now been the target of two successful cyberattacks. The ability of SaaS software to exponentially amplify attacks through MSPs and their customers represents a big challenge to SaaS and the service provider model. Custom IT management platforms wouldn't be an easy solution to the problem, but on-premises installed and managed software could get another look as a result of the attacks. ITSM vendors can expect pressure from MSPs to improve security protections, and those who are successful could gain a market advantage.

Slashdot Top Deals

Anyone can make an omelet with eggs. The trick is to make one with none.

Close