I published the following diary on isc.sans.org: “Another Day, Another Malicious Behaviour“.
Every day, we are spammed with thousands of malicious emails and attackers always try to find new ways to bypass the security controls. Yesterday, I detected a suspicious HTTP GET request: … [Read more]
[The post [SANS ISC Diary] Another Day, Another Malicious Behaviour has been first published on /dev/random]
A cybersecurity company has found out who hacked Yahoo
A report released by the cybersecurity company InfoArmor on Wednesday has revealed that 500 million accounts of Yahoo was hacked by an Eastern European criminal gang. Earlier it was suspected that it was a state sponsored group behind the act.
InfoArmor is quite confident that the act was performed by a criminal gang whereas Yahoo released a report stating that it was conducted by a nation state actor. InfoArmor provides big companies and businesses with protection against identity theft online. They also said that the data acquired by the hackers was sold of to at least 3 different clients which includes one state sponsored group.
Read more http://fortune.com/2016/09/29/yahoo-hacked-by-eastern-european-gang-cybersecurity-firm-says/
The post A Cyber Security Firm Has Revealed Who Hacked Yahoo appeared first on Cyber Security Portal.
I published the following diary on isc.sans.org: “SNMP Pwn3ge“.
Sometimes getting access to company assets is very complicated. Sometimes it is much easier (read: too easy) than expected. If one of the goals of a pentester is to get juicy information about the target, preventing the IT infrastructure to run efficiently (deny of service) is also a “win”. Indeed, in some business fields, if the infrastructure is not running, the business is impacted and the company may lose a lot of money. Think about traders… [Read more]
[The post [SANS ISC Diary] SNMP Pwn3ge has been first published on /dev/random]
This post was authored by Angela Mckay, Director of Cybersecurity Policy, CPP US
I started working in the cybersecurity space in almost 15 years ago, first as an engineer for BellSouth Telecommunications and then supporting the Department of Homeland Security’s (DHS) Office of Cybersecurity and Communications in several key roles at Booz Allen Hamilton, before joining Microsoft in 2008. In those years I learned that in at least one respect I was unusual, even exceptional: unlike most of my colleagues and peers, I was a woman.
Diversity in cybersecurity matters for a very practical reason. Those seeking to breach cybersecurity are willing and able to exploit any flawed thinking, any inadvertent blind spot. Cybersecurity teams that fall into group-think or are blind to alternative ways of working through challenges are more likely to miss things and enable hostile actors. Teams that include people with different expertise, backgrounds, genders, ages, cultures are more likely to deliver robust cybersecurity outcomes; implicit assumptions can be more easily challenged and the fullest range of insights on what can go wrong (and hence what can be done) can be gathered.
Diversity also matters from a business perspective. Microsoft’s goal of empowering every person and organization across the world means that our technology needs to reflect the different needs and perspectives of the people who will use it. These perspectives and requirements cross cultural, gender, social and age lines, and our teams need to be able to cross those lines too, even in cybersecurity.
Recently, I had an opportunity to host an event, “Women in Cybersecurity: Opportunities and Experiences” at the Microsoft offices in Washington, D.C. The event addressed the concerning deficit of women in the cybersecurity arena and also explored avenues for making a career in this field attractive for a more diverse range of people.
Fred Humphries, who leads Microsoft’s U.S. government affairs, made an excellent point in his opening remarks: achieving gender balance in the cybersecurity workforce is important but part of doing so is better acknowledging women already active in the sector. Events such as “Women in Cybersecurity” should be a platform for pushing for that acknowledgement. So I’d like to take a moment to acknowledge the impressive women I was honored to join as moderator for a discussion of the practical challenges and opportunities for women in the cybersecurity field.
• Brooke Hunter is chief of staff and director of strategic initiatives at New America’s Open Technology Institute. Her career path started in policy-related work in Washington D.C., not just on technology but on media and workplace diversity.
• Valecia Maclin, director of cybersecurity and special missions at Raytheon, began (like me) as an engineer, transitioning into the cybersecurity space at a time when it was moving from being a technical, backroom issue to a significant business, government and societal concern.
• Dena Graziano, Symantec’s director of federal government affairs started in the policy space, working on Capitol Hill, including for the House Homeland Security Committee and the Judiciary Committee, all of which brought her into privacy and security sphere.
• Emily Schneider, cybersecurity consultant at Deloitte & Touche LLP, entered cybersecurity from a distinctly non-technical background, studying literature before going to law school and supporting federal clients in the identity management sector.
As the panel itself shows, there are multiple career paths into the cybersecurity sector for women, so the question is what is hindering our numbers and contributions?
All the panelists found common ground on the challenges facing women. Even with technical experience and skill, the importance of speaking confidently was underscored as a way of ensuring different, opinions were heard. The ability to ask questions and insist on answers was also seen as essential, especially in more technical areas.
The panel discussion and the event’s group exercises and side-bar conversations, confirmed my belief that cybersecurity can and must benefit from diverse contributions from diverse people. By setting clear professional as well as personal priorities, women in particular can and should build strong careers in this space, not least because they (we) are well suited to foster collaboration in increasingly diverse cybersecurity teams. It is, therefore, up to businesses, from leaders like Microsoft to fresh start-ups, to encourage women to engage in the cybersecurity field, and it is up to women to take on the opportunities that cybersecurity offers.
Was 2015 the year the industry finally eradicated Java exploitation? Well, not quite, but the good news is we’re getting there.
It should be no surprise that encounters with Java exploits continued to decrease significantly in the second half of 2015 — All of the most commonly encountered exploits target vulnerabilities that were addressed with security updates years ago. While Java was once the vehicle of choice for attackers, modern browser technologies have rendered such exploits largely ineffective.
This is good news for IT security teams is that they can now concentrate more resources on emerging threats like those that have been targeting Adobe Flash. Despite the positive trend, it doesn’t mean organizations can ignore the threat of Java exploits entirely. As you can see in the graph below, some of the more common Java-based threats are still out there. While they are occurring much less frequently than they were years ago, organizations still need to ensure they are protected.
The fact that these numbers continue to decline is likely due to several important changes in the way web browsers evaluate and execute Java applets. The default web browser in Windows 10 is Microsoft Edge, which does not support Java or other ActiveX plug-ins at all. This in effect eliminates the possibility of Java exploits being delivered within the browser.
Other browsers are also built to eliminate or mitigate exploits:
The fact that new browsers are flexing muscles in the security space is good news, but the bad news is that some threats still persist. The chart above shows that each of these exploits is in decline, but they are all risks that security teams should be aware of, especially where there are out-of-date Java installations:
For a thorough analysis on the state of malware in the latter half of 2015, take a look at our latest Security Intelligence Report. And for a high-level look at the top ten trends and stats that matter most to security professionals right now, be sure and download our 2016 Trends in Cybersecurity e-book.
What do security analysts when they aren’t on fire? They hunt for malicious activity on networks and servers! A few days ago, some suspicious traffic was detected. It was an HTTP GET request to a URL like hxxp://xxxxxx.xx/south/fragment/subdir/… Let’s try to access this site from a sandbox. Too bad, I landed on a login page which looked like a C&C. I tried some classic credentials, searched for the URL or some patterns on Google, in mailing lists and private groups, nothing! Too bad…
Then, you start some stupid tricks like moving to the previous directory in the path (like doing a “cd ..”) again and again to finally… find another (unprotected) page! This page was indexing screenshots sent by the malware from compromised computers. Let’s do a quick ‘wget -m’ to recursively collect the data. I came back a few hours later, pressed ‘F5’ and the number of screenshots increased. The malware was still in the wild. A few hours and some ‘F5’ later, again more screenshots! Unfortunately, the next day, the malicious content was removed from the server. Hopefully, I got copies of the screenshots. Just based on them, it is possible to get interesting info about the attack / malware:
Here is a selection of interesting screenshots (anonymized). The original screenshots were named “<hostname>_<month>_<day>_<hour>_<min>_<sec>.jpg”. Based on the filename format, it seems that the malware is taking one screenshot per minute. I renamed all the files with their MD5 hash to prevent disclosure of sensitive info.
[The post Go Hunt for Malicious Activity! has been first published on /dev/random]
The police is using a secret device to spy on your phone
The Harris Corp’s Stingray surveillance device is a long kept secret among the law enforcement agency for more than 15 years.
But a team of researchers were able to get there hands on manuals of the Harris device that spans over 200 pages that details how cellular surveillance is done.
The devices have been kept a secret from the public because they believe that if found out, criminals could use it in their favor.
This extremely powerful device can spy on modern phones without the notice of the user and can reveal almost everything they do on their phone.
The post A Surveillance Device From Police Reveals How They Are Able To Spy On Phones appeared first on Cyber Security Portal.
One of the most common cyber-attack vehicles we’ve seen over the years involves so-called “exploit kits.” These are collections of exploits bundled together and sold as commercial software or as a service.
A typical kit includes a collection of web pages with exploits for several vulnerabilities in popular web browsers, browser add-ons, or other types of software. When an attacker installs the kit on a web server, visitors to the attacker’s malicious webpage who don’t have appropriate security updates installed are at risk of their computers being compromised through drive-by download attacks.
One reason exploit kits are so dangerous to both consumers and businesses is that an attacker needn’t be a skilled hacker to use one. Prospective attackers can buy or rent exploit kits on malicious hacker forums and other outlets. Lower skilled attackers can use the kits to perform sophisticated attacks, which contributes to the fact that they have become so widespread over time. In fact, exploit kits accounted for four of the ten most commonly encountered threats during the second half of 2015 according to our 2016 Trends in Cybersecurity e-book.
To protect your organization, it’s important that your security teams understand which exploits and exploit kits are being used most often by attackers. The graphic below shows the most frequently encountered exploits noted in our latest Security Intelligence Report, and we detail three of the more common exploits, and the kits they are a part of, below.
Most frequently encountered exploits noted in our latest Security Intelligence Report
Axpergle is the most common exploit, commonly found in the Angler exploit kit. It targets Internet Explorer, Adobe Flash Player and Java. Exploit kit authors frequently change the exploits included in their kits in an effort to stay ahead of software publishers and security software vendors. Exploits targeting zero-day vulnerabilities — those for which no security update has yet been made available by the vendor — are highly sought after by attackers, and the Axpergle authors added several zero-day Flash Player exploits to the kit in 2015.
Other exploit kits were encountered at much lower levels. Encounters involving the RIG exploit kit (also known as Redkit, Infinity, and Goon, and detected as HTML/Meadgive) more than doubled from summer to fall of 2015, but remained far below those involving Angler.
Encounters involving the Sweet Orange kit (detected as Win32/Anogre), the second most commonly encountered exploit kit in the first quarter of 2015, decreased to negligible levels by the end of the year.
Keeping your software up to date is one of the most effective defenses against exploit kits and their ever-evolving attacks.
To keep up with all the latest news about exploit kits, as well as viruses, malware and other known threats, make sure to bookmark the Microsoft Malware Protection Center blog for frequent updates. And for a high-level look at the top 10 trends and stats that matter most to security professionals right now, be sure and download the 2016 Trends in Cybersecurity e-book.
Many of the CIOs and CISOs that I talk to, have, over time, developed mature vulnerability assessment methodologies and security updating processes. But frequently, I find that the focus of these processes is squarely on keeping Microsoft operating systems and browsers up to date. Of course vulnerabilities in popular operating systems or browsers have the potential to affect a broad audience. Another reason for this focus is that Microsoft has made updating relatively easy by offering updates via Windows Update, Microsoft Update, and via various tools like Windows Server Update Services and others.
But data from our latest Security Intelligence Report suggests that customers need to keep all of their software up-to-date, not just Microsoft software.
In the last half of 2015 there were nearly 3,300 vulnerability disclosures across the industry, of which 305 were in Microsoft products. With more than 90 percent of reported vulnerabilities occurring outside the Microsoft portfolio, organizations need to monitor their entire technology stack to minimize their risk.
Microsoft products accounted for less than 10 percent of industrywide vulnerabilities in the second half of 2015.
This is consistent with previous years as well. The software industry worldwide includes thousands of vendors, and historically, vulnerabilities for Microsoft software have accounted for between three and ten percent of disclosures in any six-month period.
To find out what’s happening in the world of software vulnerabilities across your IT environment, take some time to review our latest Security Intelligence Report and the information available through the National Vulnerability Database (NVD), the U.S. government’s repository of standards-based vulnerability management data. And for a high-level look at the top ten trends and stats that matter most to security professionals right now, be sure and download our 2016 Trends in Cybersecurity e-book.
Are you seeking a position as a Security Analyst in a company? You may have a lot of questions. This post aims to help you with the hardest part of getting the job; the interview.
First things first, the IT world is currently facing threats that are increasingly tough to deal with and the need of talent is on the rise. This means that most companies are now digging for candidates who are able to demonstrate top notch skills with critical thinking as the most important part of their skill set.
The best way to impress your interviewer is to know more than just the basics. Since companies are demanding high end talent, they are probably looking for someone who can go beyond the basics. For example, if you can learn the inside outs of your field, such as current technology, its usage and implementation, you may be able to easily impress the interviewer.
If you are completely new to the field of cybersecurity and security analyst, it is imperative that you start reading some material on the world of IT security.
Experts have said this time and time again. Cybersecurity is all about showing your practical skills. So make sure your resume has plenty of projects listed down. Whether you did something voluntarily or during your classroom lab adventures, you need to show your interviewers that you have been busy with practical stuff.
Communication is the number one thing when it comes to being a security analyst. You will be working alongside a team of other IT professionals where you will have to communicate a lot. You should naturally be a team player.
Show your interviewer how well you can do when you work with a good team. Show them examples of your previous projects you completed with a group of other people.
Last but not the least, have a mindset of an explorer and adventurer. You must keep learning on new stuff if you want to excel in the cyber security world. Keep in mind both the defensive and offensive technologies are evolving day after day and it is getting tougher and tougher to fight back cybercrime. Learn new technologies and list them down in your resume so your interviewers can know that you are willing to spend time learning new things.
The post Important Interview Tips For Security Analyst Job Seekers appeared first on Cyber Security Portal.
Man suicides after roommate cyber bullied him constantly
A New Jersey appeals court has thrown out a conviction of a ex Rutgers University student who posted a video of his roommate kissing another man, causing him to commit suicide.
Dharun Ravi was originally convicted in 2012 on 15 different charges including bias intimidation. He also led a group of other students to spy on his roommate in 2010.
After being constantly bullied, Clementi, 18, decided to commit suicide. He jumped off George Washington Bridge a week later from the incident and instantly died from his injuries. The death of the student started a national debate over cyber bullying.
Read more details http://www.metro.us/news/new-jersey-man-gets-new-trial-in-clementi-cyberbullying-case/jZzpii—IL6JdSF25qYQAegir0Ic2g/
The post Man Gets A New Trial In New Jersey Over Cyberbullying Case appeared first on Cyber Security Portal.
I published the following diary on isc.sans.org: “Collecting Users Credentials from Locked Devices“.
It’s a fact: When a device can be physically accessed, you may consider it as compromised. And if the device is properly hardened, it’s just a matter of time. The best hacks are the ones which use a feature or the way the computer is supposed to work. To illustrate this, let’s review an interesting blog post published yesterday[1]. It demonstrates how easy it is to steal credentials from a locked computer… [Read more]
[The post [SANS ISC Diary] Collecting Users Credentials from Locked Devices has been first published on /dev/random]
We all have a habit of posting footage of luggage, passport and boarding passes on social media to impress our friends when we are going on a fun trip.
But a new study suggests that an airplane boarding pass contains a lot of information that is hidden from plain sight in a small barcode.
Additionally, the passenger’s first and last name are also visible inside the bar code with additional information such as destination, origin and whether he/she is a frequent passenger. It takes only little effort for a cyber criminal to crack this code and obtain all personal data about you.
Read more http://www.huffingtonpost.com/entry/boarding-pass-photos-security_us_56157460e4b021e856d350bb
The post Here’s why you should never post your boarding pass photo on social media appeared first on Cyber Security Portal.
When it comes to patching and updating software vulnerabilities, operating systems and web browsers seem to get all the love.
But in reality, vulnerabilities in those two types of software usually account for a minority of the publicly disclosed vulnerabilities published in the National Vulnerability Database (NVD), the U.S. government’s repository of standards-based vulnerability management data.
Where are the rest of the vulnerabilities? The majority are in applications (i.e. software that doesn’t ship as part of operating systems or browsers), and unless you’re spending time protecting those too, your application layer could be a big chink in your IT armor. CIOs, CISOs and their security teams need to focus on assessing and patching known vulnerabilities in all business apps, or they could in fact be missing the bulk of the vulnerabilities that exist in their environments.
Vulnerabilities in applications other than web browsers and operating system applications accounted for 44.2% of all disclosures in the second half of 2015.
But separating core OS applications and web browsers from the rest of the application layer can be a bit murky. Comparing vulnerabilities that affect a computer’s operating system to vulnerabilities that affect other components, such as applications and utilities, requires a determination of whether the affected component is part of an operating system. This determination is not always simple and straightforward, given the componentized nature of modern operating systems.
For example, some programs (like photo editors) ship by default with operating system software, but can also be downloaded from the software vendor’s website and installed individually. Linux distributions, in particular, are often assembled from components developed by different teams, many of which provide crucial operating functions such as a graphical user interface (GUI) or Internet browsing.
To help companies navigate this issue and facilitate analysis of operating system and browser vulnerabilities, the Microsoft Security Intelligence Report distinguishes among four different kinds:
With those distinctions in mind, the latest SIR reports that disclosures of vulnerabilities in applications decreased in the second half of 2015, but remained the most common type of vulnerability during the period, accounting for 44.2 percent of all disclosures — a big number that any organization’s security team should be paying attention to.
Meanwhile, the other categories are important too. Core operating system vulnerability disclosures increased dramatically from the first half of the year, moving into second place at 24.5 percent. Operating system application disclosures decreased slightly to account for 18.6 percent, while browser disclosures increased by more than a third to account for 12.8 percent.
The key to keeping any organization safe is to stay on top of all disclosures, no matter which part of the stack they belong in. To stay on top of possible vulnerabilities across your software stack, take a look at our latest Security Intelligence Report and the information available through the NVD. And for a high-level look at the top 10 trends and stats that matter most to security professionals right now, be sure and download our 2016 Trends in Cybersecurity e-book.
If you’ve been using Google for voice communication, whether through Android or Gchat, chances are that everything you said so far on the platform has been recorded.
For Google, just talking is enough to trigger automatic recording of voice conversations. The company quietly records every conversation that happens through the medium.
This feature was introduced by Google to let people make searches with voice control. Also recording voices enables Google to enhance it’s language recognition system which is responsible for giving results when you do a voice based search.
You can also listen to these recordings and if you wish, you can also delete the information stored which was collected.
The post Google Records Your Voice Conversations – Here’s How To Delete Them appeared first on Cyber Security Portal.
I published the following diary on isc.sans.org: “Malware Delivered via ‘.pub’ Files“.
While searching for new scenarios to deliver their malwares[1][2], attackers launched a campaign to deliver malicious code embedded in Microsoft Publisher[3] (.pub) files. The tool Publisher is less known than Word or Excel. This desktop publishing tool was released in 1991 (version 1.0) but it is still alive and included in the newest Office suite. It is not surprising that it support also macros… [Read more]
[The post [SANS ISC Diary] Malware Delivered via ‘.pub’ Files has been first published on /dev/random]
I published the following diary on isc.sans.org: “Maxmind.com (Ab)used As Anti-Analysis Technique“.
A long time ago I wrote a diary[1] about malware samples which use online geolocalization services. Such services are used to target only specific victims. If the malware detects that it is executed from a specific area, it just stops. This has been seen in Russian malware’s which did not infect people located in the same area … [Read more]
[The post [SANS ISC Diary] Maxmind.com (Ab)used As Anti-Analysis Technique has been first published on /dev/random]
Earlier this week, Dropbox suffered a hack and had its users force reset passwords that it claims were stolen in a 2012 breach. The following message was given to the users.
Our security teams are always watching out for new threats to our users. As part of these ongoing efforts, we learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2012.
Our analysis suggests that the credentials relate to an incident we disclosed around that time
If you haven’t logged in on Dropbox, you will have to change your passwords. Furthermore, if you started using Dropbox before mid 2012, you should also reset your password.
The hack was so big that a file was obtained sized around 5GB which contained the details of 68,680,741 accounts.
The post 68 million passwords were dumped online in recent Dropbox hack appeared first on Cyber Security Portal.
