msm1267 writes: Two critics of the government's Going Dark arguments against strong cryptography and encrypted secure messaging applications released a paper that describes a taxonomy of available encryption workarounds available to law enforcement.
The paper is not proscriptive. Instead, it explains the technological advantages and shortcomings to six workarounds available to the FBI and local law enforcement in criminal investigations. The paper also explains potential tech and legal hurdles to each.
It also explains difficult conceptual areas for policymakers, many of whom are not schooled technologists and are much more likely to be swayed by emotional and political arguments against crypto, without solid technical reasoning.
msm1267 writes: Recent academic work looking at the degradation of security occurring when HTTPS inspection tools are sitting in TLS traffic streams has been escalated by an alert published Thursday by the Department of Homeland Security.
DHS’ US-CERT warned enterprises that running standalone inspection appliances or other security products with this capability often has a negative effect on secure communication between clients and servers.
“All systems behind a hypertext transfer protocol secure (HTTPS) interception product are potentially affected,” US-CERT said in its alert.
HTTPS inspection boxes sit between clients and servers, decrypting and inspecting encrypted traffic before re-encrypting it and forwarding it to the destination server. A network administrator can only verify the security between the client and the HTTP inspection tool, which essentially acts as a man-in-the-middle proxy. The client cannot verify how the inspection tool is validating certificates, or whether there is an attacker positioned between the proxy and the target server.
msm1267 writes: Security researchers say malicious traffic generated by exploit kit infections has dropped off 300 percent since 2015. A number of high-profile arrests, including the takedown of the criminals behind the Lurk Trojan and the Angler Exploit Kit, are largely contributing to the silence among exploit kit purveyors on the black market.
Criminals, however, aren't staying still. The dropoff in exploit kit traffic has coincided with a resurgence of some old-school malware distribution techniques such as macro malware and other email-based attacks that are largely responsible for the spread of ransomware, banking Trojans and other threats.
msm1267 writes: Malicious traffic stemming from exploits against the Apache Struts 2 vulnerability disclosed and patched this week has tapered off since Wednesday.
Researchers at Rapid7 published an analysis of data collected from its honeypots situated on five major cloud providers and a number of private networks that shows a couple of dozen sources have targeted this vulnerability, but only two, originating in China, have actually sent malicious commands.
Cisco Talos said on Thursday that attacks had risen sharply since word leaked of publicly available exploits and a Metasploit module. But it conceded that it was difficult to ascertain whether probes for vulnerable Apache servers could be carried out benignly.
Rapid7 said that in a 72-hour period starting Tuesday, a handful of events cropped up peaking at fewer than 50 between 11 a.m. and 6 p.m. Wednesday.
“We are really seeing limited attempts to exploit the vulnerability,” said Tom Sellers, threat analyst and security researcher at Rapid7.
msm1267 writes: FBI Director James Comey resurrected the Going Dark debate over strong encryption Wednesday at a cybersecurity conference at Boston College. Comey said the bureau has 1,200 devices it cannot decrypt that were seized at the end of last year; the director used this data point as an illustration of how secure messaging apps and strong encryption hamper criminal and national security investigations.
Comey said it was time for an "adult conversation" about strong encryption, and said that secure apps such as Signal and WhatsApp that offer end-to-end encryption are now default tools for criminals such as drug dealers and pedophiles, whereas prior to the Snowden leak, they were almost exclusively the purview of nation-state actors.
msm1267 writes: Linux providers are busy developing and pushing out patches for a vulnerability in an obscure networking protocol that could allow a local attacker to crash the kernel and elevate privileges.
Google software engineer Andrey Konovalov privately disclosed the vulnerability on Monday. The use-after-free bug could expose Linux servers to memory-based attacks that would allow an attacker to gain root-level privileges and execute code. Konovalov said he will give admins a few days to patch before publishing his proof-of-concept exploit.
The vulnerability, CVE-2017-6074, affects only the IPv6 implementation of the Linux kernel’s Datagram Congestion Control Protocol (DCCP). DCCP is used to manage network traffic congestion on the application layer; it works on both IPv4 and IPv6. No known exploits are in the wild for this bug. In fact, DCCP is largely turned off in most Linux implementations; Red Hat said it combed years-worth of customer support cases and was unable to find any reports of customers having turned it on.
The Linux kernel has been patched, while Linux providers are rolling out patches for their various implementations.
ad454 writes: Today, 10 years after of SHA-1 was first introduced, we are announcing the first practical technique for generating a collision. This represents the culmination of two years of research that sprung from a collaboration between the CWI Institute in Amsterdam and Google. We've summarized how we went about generating a collision below. As a proof of the attack, we are releasing two PDFs that have identical SHA-1 hashes but different content.
msm1267 writes: Recent attacks against insecure MongoDB, Hadoop and CouchDB installations represent a new phase in online extortion, born from ransomware’s roots with the promise of becoming a nemesis for years to come.
“These types of attacks have grown from ones of opportunity to full-scale automated and systematic assaults targeting misconfigured servers containing sensitive data that can be easily hijacked,” said Zohar Alon, co-founder and CEO, security firm Dome9.
Security researchers at Rapid7 estimate that 50 percent of the 56,000 vulnerable MongoDB servers have been ransomed. When it comes to similar misconfigured databases; 58 percent of the 18,000 vulnerable Elasticsearch servers have been ransomed and of the 4,500 CouchDB servers vulnerable 10 percent have been ransomed.
“It’s about the path of least resistance for hackers interested in the biggest potential reward,” said Bob Rudis, chief data security officer at Rapid7. “Hackers have decided it’s easier to end-run an enterprise’s multi-million dollar security system and instead simply target an open server.”
msm1267 writes: Macro-based malware has crossed the divide between the Windows and Mac platforms.
A cybercrime group whose command and control infrastructure resolves to an IP address geo-located in Russia is using a Word document laced with a malicious macro that executes solely on macOS.
Following the same script as similar Windows-based attacks, the attached documents have a luring subject line, in this case: “U.S. Allies and Rivals Digest Trump’s Victory – Carnegie Endowment for International Peace.docm.” Once a user tries to open the attachment, they’re presented with a familiar dialogue box instructing them that macros must be enabled to view the document. If the macro is enabled, it executes its payload which then tries to download the open source EmPyre post-exploitation agent.
msm1267 writes: Microsoft will not rush out an emergency patch for a zero-day vulnerability disclosed on Wednesday in the Windows implementation of the Server Message Block protocol.
Researcher Laurent Gaffie found a zero-day vulnerability in SMBv3 and released a proof-of-concept exploit. He privately disclosed the issue to Microsoft on Sept. 25 and said that Microsoft told him it had a patch ready for its December patch release, but decided to wait until its scheduled February update to release several SMB patches rather than a single fix in December. Microsoft considers vulnerability, a remotely triggered denial-of-service bug, a low-risk vulnerability.
"Windows is the only platform with a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible. Our standard policy is that on issues of low risk, we remediate that risk via our current Update Tuesday schedule," a Microsoft spokesperson said in an email statement. The next scheduled Microsoft update is Feb. 14.
Gaffie said the vulnerability is specifically a null pointer dereference in SMB and it affects Windows Server 2012 and 2016. He added that a joint analysis between himself and Microsoft concluded that code execution doesn’t seem possible through an exploit of this vulnerability.
Google responded on Wednesday with news that it would begin blocking.js files in Gmail attachments, starting Feb. 13, because of such security concerns.
“Similar to other restricted file attachments, you will not be able to attach a.js file and an in-product warning will appear, explaining the reason why,” Google said.
Google already blocks more than 30 file types as attachments in Gmail, including.cmd,.exe,.jar,.lib,.scr,.vbs and many others.
Google acknowledges that there may be business cases necessitating the sharing of.js files, but will not allow it in email, instead suggests sharing via Google Drive or other cloud-based storage options.
The Feb. 13 start date will be rapid release only, Google said, with a scheduled release set for two weeks later.
msm1267 writes: A sizable and dormant Twitter botnet has been uncovered by two researchers from the University College London, who expressed concern about the possible risks should the botmaster decide to waken the accounts under his control.
Research student Juan Echeverria Guzman and his supervisor and senior lecturer at the college Shi Zhou said the 350,000 bots in the Star Wars botnet could be used to spread spam or malicious links, and also, more in line with today’s social media climate, it could start phony trending topics, attempt to influence public opinion, or start campaigns that purport a false sense of agreement among Twitter users.
Compounding the issue is a larger botnet of more than a half-million bots that the researchers have uncovered since their initial research. That research, the two academics said, will be shared in a future paper. In the meantime, the Star Wars botnet dataset is available for study; the researchers said the data is tens of times larger than any public collection on Twitter bots.
The researchers also said they have not shared their data with Twitter yet because they are waiting for their current research to be approved in a scientific journal.
“We would also like to give researchers a chance to get the dataset by themselves before they are gone, this is why we have not reported to Twitter directly, but we will as soon as the paper gets accepted,” Echeverria Guzman said.
msm1267 writes: GoDaddy has revoked, and begun the process of re-issuing, new SSL certificates for more than 6,000 customers after a bug was discovered in the registrar’s domain validation process.
The bug was introduced July 29 and impacted fewer than two percent of the certificates GoDaddy issued from that date through yesterday, said vice president and general manager of security products Wayne Thayer.
“GoDaddy inadvertently introduced the bug during a routine code change intended to improve our certificate issuance process,” Thayer said in a statement. “The bug caused the domain validation process to fail in certain circumstances.”
GoDaddy said it was not aware of any compromises related to the bug.
msm1267 writes: Burlington Electric Department general manager Neale Lunderville explains how his Vermont electric distribution utility was dragged into the center of a potential geopolitical nightmare shortly before the start of the New Year weekend.
Lunderville recaps the three days that thrust Burlington Electric into the national spotlight after the Washington Post wrongly reported that the utility was penetrated by Russian hackers.
Those reports came on the heels of a DHS alert on Grizzly Steppe, activities by two Russian APT groups alleged to have hacked the DNC. Lunderville also covers how benign indicators of compromise shared by DHS played a role in a long, disruptive weekend for his organization.