Archive for the ‘Data Protection’ category

Complex Malware Installed by Simple Phishing Attacks

August 9th, 2017

A new JScript back door called Bateleur distributed by the FIN7 (a.k.a Carbanak) hacker group through phishing emails targeting U.S.-based restaurant chains has been identified by Proofpoint researchers.

The modus operands is simple. The receiver gets the email containing document which contains macro. The message of the email is “here is the check as discussed.”

The executed macro creates a scheduled task to run Bateleur which then sleeps for three seconds and then again executes Bateleur and then sleeps for 10 seconds. Finally, it deletes the scheduled task.

“The combined effect of these commands is to run Bateleur on the infected system in a roundabout manner in an attempt to evade detection,” the researchers note.

The JScript macro contains anti-sandbox and anti-analysis functionality.

“We continue to see regular changes to the tactics and tools used by FIN7 in their attempt to infect more targets and evade detection,” the researchers state. “The Bateleur JScript back door and new macro-laden documents appear to be the latest in the group’s expanding toolset, providing new means of infection, additional ways of hiding their activity, and growing capabilities for stealing information and executing commands directly on victim machines.”

Simon Taylor, vice president of products at Glasswall, mentioned that though the software is complex, a method of installing it is very straight forward through phishing email.

“Phishing is a tried and true method for attackers — largely because it is predictably and repeatedly successful,” he said.

“Historically, the security industry has attempted to change employee behaviour,” Taylor added. “But while education helps, cyber criminals are continuously adjusting their techniques and the authenticity of their messages in order to stay several steps ahead of their victims.”

“Humans are and always will be the weakest link in an organization, and going forward, defense and detection strategies must change to address these inevitable challenges,” Taylor said.

Cyber Resilience

____________________________________________________________________________________________

Alertsec is based on the 256-bit AES encryption algorithm and has the highest security certifications.

Qualys CEO mentions that WannaCry a “Godsend” for his Business

August 5th, 2017

Security vendor Qualys CEO Philippe Courtot mentioned that the WannaCry ransomware and the planned General Data Protection Regulations (GDPR) are “godsends” that will help the company to grow further. He said this during company’s second quarter fiscal 2017 earnings call.

Qualys revenue saw 14% increase compared to previous year. This year revenue is $55.3 million.  Company is now estimating growth of 17 to 18%.

“Recent attacks like WannaCry and Petya have made it clear that the days of scanning the network perimeter and a few critical servers are over,” Courtot said during his company’s earnings call. “Enterprises now require scalability, accuracy and speed in order to identify assets that are vulnerable and ensure they are rapidly and properly remediated, which is something traditional enterprise IT and IT security solutions cannot deliver effectively and at which Qualys excels.”

Qualys’ cloud platform consists of a host of expanding capabilities that help enterprises with vulnerability and security management tasks. It has also announced new SSL/TLS certificate and cloud visibility technologies which will further augment the cloud security platform.

Upcoming GDPR regulation is also the main contributing factor for the company growth. It will come into effect in May 2018 across the European Union (EU). GDPR makes it compulsory to take all possible efforts for the companies to ensure the security and the privacy of customer data.

“We see that GDPR is in fact a godsend for Qualys and we see the effect of that because specifically, it is now accelerating the digital transformation of many of the large European companies,” Courtot said.

The recent breaches due to WannaCry has boosted Qualys business prospect.

“WannaCry has been also a godsend for Qualys,” Courtot said. “People finally realize that instead of having to buy solutions that supposedly protect them, that in fact they better try to identify all of their assets and also identify the vulnerabilities on those assets because this is what WannaCry and then NotPetya absolutely demonstrated.”

____________________________________________________________________________________________

Alertsec’s cloud-based information security service provides an easy and convenient way to protect information on your organization’s laptops and computers.

IoT Security Bill

August 2nd, 2017

This week the Internet of Things Cybersecurity Improvement Act of 2017 was introduced by a bipartisan group of U.S. senators. The rules sets minimum conditions and requirements for the security of Internet-connected devices purchased by the U.S. government. It also provides legal protections to security researchers.

Features:

(1) Devices which are connected to the internet should be patchable

(2) Industry standard protocols should be implemented

(3) Hard-coded passwords that can’t be changed should be leveraged

(4) Security vulnerabilities should not be present

It also asked the Office of Management and Budget to create alternative security conditions for devices with limited data processing and software functionality.

As per the bill, the definition of an Internet-connected device “is capable of connecting to and is in regular connection with the Internet,” and “has computer processing capabilities that can collect, send, or receive data.”

“While I’m tremendously excited about the innovation and productivity that Internet of Things devices will unleash, I have long been concerned that too many Internet-connected devices are being sold without appropriate safeguards and protections in place,” Sen. Mark Warner said in a statement.

“This legislation would establish thorough, yet flexible, guidelines for Federal Government procurements of connected devices,” Warner added. “My hope is that this legislation will remedy the obvious market failure that has occurred and encourage device manufacturers to compete on the security of their products.”

Arxan Technologies VP EMEA Mark Noctor hopes that other government will also follow “While there has been useful work in the area from bodies such as ENISA in Europe, it appears that an act of law is the best way to get vendors to ensure security,” he said.

“While the focus on basic measures such as password management is a good starting point, we’d also like to see future legislation build on this to require more advanced security measures, such as using code hardening to protect a connected device’s software from being broken into and reverse engineered for malicious purposes,” Doctor said.

Security research is also provided legal protections.

“I’ve long been making the case for reforms to the outdated and overly broad Computer Fraud and Abuse Act and the Digital Millennium Copyright Act,” Sen. Ron Wyden said in a statement.

“This bill is a bipartisan, common-sense step in the right direction.”

“This bill is designed to let researchers look for critical vulnerabilities in devices purchased by the government without fear of prosecution or being dragged to court by an irritated company,” Wyden added. “Enacting this bill would also help stop botnets that take advantage of Internet-connected devices that are currently ludicrously easy prey for criminals.”

____________________________________________________________________________________________

No server, IT knowledge or training is needed as everything is included in an Alertsec subscription.

Cyber Insurance and Cloud Cyber Attacks

July 31st, 2017

According to the insurer Lloyd’s, a large cyber attack could cause $53 billion in economic losses which is almost same estimation as per 2012’s Superstorm Sandy. The report mentions the two possibilities. One where a disruptive attack which can lead to losses of $53 billion. Other includes an attack on computer operating systems which could lead to losses of $28.7 billion.

As per Lloyd’s estimation, the range of losses can vary between $15.6 billion to $121.4 billion. Average loss range is from $620 million for a large loss to $8.1 billion for an extreme loss.

“Just like some of the worst natural catastrophes, cyber events can cause a severe impact on businesses and economy, trigger multiple claims and dramatically increase insurers’ claims costs,” Lloyd’s CEO Inga Beale mentioned

“Underwriters need to consider cyber cover in this way and ensure that premium calculations keep pace with the cyber threat reality,” Beale added. “We have provided these scenarios to help insurers gain a better understanding of their cyber risk exposures so they can improve their portfolio exposure management and risk pricing, set appropriate limits and expand into this fast-growing, innovative insurance class with confidence.”

As per the RiskIQ study, cybercrime led to global economy $454 billion loss last year. it also mentioned that $858,153 is lost to cybercriminals every minute. Companies spent $142,694 per minute to protect.

“Today, an organization’s digital assets are subject to malware, malvertising, and phishing efforts on a scale never before seen, while rogue apps, domain and brand infringement, and social impersonation cause business disruption and material loss,” RiskIQ manager of content strategy Mike Browning wrote in a blog post examing the findings.

The report also mentioned that 818 pieces of unique malware are injected in the system per minute.

“As companies innovate Web, social, and mobile means to engage with their customers, partners and employees, threat actors will prey on business exposures and brands to capture users’ trust, access credentials, and sensitive data,” RiskIQ chief marketing officer Scott Gordon said in a statement. “This requires organizations to extend their security programs to monitor and mitigate threats outside the firewall.”

____________________________________________________________________________________________

Alertsec’s cloud-based information security service provides an easy and convenient way to protect information on your organization’s laptops and computers.

Series A round for Security Startup

July 23rd, 2017

The San Francisco-based cyber security startup Insight Engines recently raised $15.8 million in a Series A round of financing for its threat intelligence gathering tool Splunk also known as called Cyber Security Investigator.

August Capital led the funding round which was backed by Real Ventures, Data Collective, Splunk and its co-founder, Erik Swan. Simon Crosby, co-founder and CTO of Bromium, is also part of an investor group.

Company makes big data easy to explore and work with natural-language processing technologies. Cyber Security Investigator can detect and understand cyber threats by asking questions.

“In today’s day and age, advisories are always changing their patterns of attack, making static alerts ineffective defense,” Grant Wernick, co-founder and CEO of Insight Engines, told e-security Planet. “CSI [Cyber Security Investigator] levels the playing field, allowing the good guys to be dynamic in ways they never imagined possible.”

This technology can help fill the IT companies with the workforce gap.

“CSI helps bridge the hiring chasm between the need for talented individuals and the work force available,” said Wernick. “CSI is a force multiplier for the most advanced security teams who can now achieve more effective results in a fraction of the time. With CSI we have been able to transform physical security staff to augment cyber security operations, which has resulted in both significant cost savings and fresh perspectives for the enterprise.”

It also reduces time to zero in on cyber security issues.

“CSI empowers analysts to escape search fatigue by helping them analyze more of their data and spend less time searching,” he said. They can “spend more time focused on mitigating real threats and significantly less time focused on crafting esoteric queries. Using CSI, analysts no longer need to be big data specialists and can focus back on defending against an ever-increasing threat landscape.”

____________________________________________________________________________________________

Alertsec’s cloud-based information security service provides an easy and convenient way to protect information on your organization’s laptops and computers. 

Google Employee Data at Risk

July 13th, 2017

Google sent notification letters to a number of employees about the data breach. It mentioned that their names, contact information and payment card data may have been affected.

“This did not affect Google’s systems. However, this incident impacted one of the travel providers used by Googlers, Carlson Wagonlit Travel (CWT).” Statement reads.

CWT and Google were not breached. The report suggests that it was fourth party data breach. Google was working with third-party vendor CWT who was using Sabre’s SynXis CRS.

“CWT subsequently notified Google about the issue on June 16, 2017, and we have been working with CWT and Sabre to confirm which Google travellers were affected,” the company mentioned.

According to the reports, the attacker gained access to some of CWT’s hotel reservations made through Sabre’s SynXis CRS.

“However, because the SynXis CRS deletes reservation details 60 days after the hotel stay, we are not able to confirm the specific inforamtion associated with every affected reservation,” Google noted.

CyberGRX CEO Fred Kneip emailed eSecurity Planet that it is difficult to determine which vendors can cause a data breach.

“A company the size of Google, whose reputation depends in large part on its ability to keep data secure, has thousands of third parties in its digital ecosystem,” Kneip said. “Attackers are clearly focused on the weakest links within those ecosystems — third parties like HVAC vendors and travel agencies — in order to do real damage.”

A recent Bomgar survey of 608 IT professionals shows that an average of 181 vendors are provided access to a company network.

“Security professionals must balance the business needs of those accessing their systems — whether insiders or third parties — with security,” Bomgar CEO Matt Dircks said in a statement.

“As the vendor ecosystem grows, the function of managing privileged access for vendors will need to be better managed through technology and processes that provide visibility into who is accessing company networks, and when, without slowing down business processes,” Dircks added.

____________________________________________________________________________________________

Alertsec helps you comply with HIPAA, PCI and SOX requirements. The implemented encryption is powered by Check Point and has the highest security certifications: FIPS 140-2, Common Criteria EAL4 and BITS.

Content to Prevent Data Breach

July 3rd, 2017

Egnyte a Calif. based content collaboration and governance specialist has launched a new cloud-based solution which looks after insider threat. The product focus on IT security professionals. Nowadays distributed workspace needs shared information system which uses on-premises collaboration platforms or cloud-based services which may cause data breach.

“As users and organizations are more global and interdependent they need to share more content with each other and then need to do it in a secure way using EFSS [enterprise file synchronization and sharing] solutions not email attachments for instance,” Isabelle Guis, chief strategy officer at Egnyte mentioned.

“But as you hire contractors and have many places where your content resides (on-premises, cloud, cloud apps, etc.) it is very difficult to enforce the security policies at the repository level or even train all your users and new hires to properly handle their content.”

Data leaks can occur due to various loopholes.

“For example, a merger and acquisition folder could be shared via a public link and one of the intended recipients forwards the link to someone who should not see that data,” Guis said. “Or, a very common example – a disgruntled employee downloads all of ‘their’ work, which is actually the company’s IP [intellectual property], right before leaving your company and going to a competitor,” a situation allegedly at the center of the high-stakes Google-Uber lawsuit.

Egnyte product looks for sensitive content in the database.

Then it “provides real–time analysis of all the content within an organization and presents actionable insights to help administrators prevent these types of aforementioned data breaches,” Guis said.

“Egnyte Protect continuously analyzes an organization’s entire content environment and classifies the most sensitive information, such as credit card numbers, social security numbers, sensitive IP, HIPAA information, and much more,” she added. “Then, in real–time, Egnyte Protect identifies vulnerabilities, alerts administrators, and offers actions that can immediately fix any issue that is found across all of the organization’s content repositories.”

____________________________________________________________________________________________

Alertsec’s cloud-based information security service provides an easy and convenient way to protect information on your organization’s laptops and computers.

WannaCry ransomware attacked Honda

June 28th, 2017

Honda recently stopped its production at its Sayama, Japan plant due WannaCry ransomware.

The production facility manufactures 1,000 vehicles per day. The plant was started next day.

Along with Honda, Nissan and Renault also halted production at plants in Japan, Britain, France, Romania and India.

“We recommend that you revisit your security patches immediately and ensure that all of your networked computers can connect to kill switches.”Webroot senior threat research analyst Tyler Moffitt said.

Tripwire senior systems engineer Paul Norris mentioned that companies need to take steps to protect themselves.”Effective measures in defeating these sorts of attacks include implementing an effective email filtering solution that is capable of scanning content on emails, hazardous attachments and general content for untrusted URLs,” he said. “Another option would be to better educate the workforce on how to recognize a suspicious email from unknown senders, knowing not to click an untrusted URL, as well as not opening an unexpected attachment.”

RiskVision CEO Joe Fantuzzi mentioned that the Honda plant shutdown shows growing risks in the manufacturing industry. “While manufacturing hasn’t experienced the same attention as other sectors in regards to emerging ransomware trends, it’s now clear that WannaCry and other advanced threats pose severe and crippling risks to this sector, which among other things can halt production, expose blueprints and intellectual property, aid competitors and decimate profit margins, while taking weeks or months to be fully remediated,” he said.

“What’s more, manufacturing isn’t beholden to the same security and compliance standards as healthcare, financial services and other market verticals, making enforcement of consistent security standards even more difficult,” Fantuzzi added. “Consequently, it’s imperative that manufacturers categorize assets in terms of business criticality to see where their most important vulnerabilities reside because taking the initiative to find and prioritize critical vulnerabilities is a small investment in comparison to the long-term damage that could result if these vulnerabilities are ever found by cyber criminals and exploited.”

“Warding off cyber threats, including cyber espionage, is a top corporate priority across industries, but manufacturers and distributors need to do much more to protect their patents, designs and formulas, as well as their private company and employee information,” Jim Wagner, partner-in-charge of Sikich’s manufacturing and distribution practice, said in a statement.

____________________________________________________________________________________________

Alertsec’s cloud-based information security service provides an easy and convenient way to protect information on your organization’s laptops and computers.

Ransomware Attack at Airway Oxygen

June 25th, 2017

Michigan-based Airway Oxygen, Inc. recently suffered data breach due to ransomware attack. Facility is notifying patients that their PHI may have been affected. Airway Oxygen supplies medical equipment.  It mentioned that facility becomes aware of the breach when ransomware was installed in its technical infrastructure. The incident prevented Airway from accessing its own data.

Affected information included full names, home addresses, dates of birth, telephone numbers, diagnoses, types of services provided, and health insurance policy numbers. Bank account numbers, debit or credit card numbers, and Social Security numbers were not included in the breach.

As per the OCR tool, 500,000 individuals were affected by the breach.

“Since learning of the incident, we immediately took steps to secure our internal systems against further intrusion, including by scanning the entire internal system, changing passwords for users, vendor accounts and applications, conducting a firewall review, updating and deploying security tools, and installing software to monitor and issue alerts as to suspicious firewall log activity,” explained the statement, which was signed by Airway Oxygen President Stephen Nyhuis.

Facility in the statement mentioned that it has notified FBI. Also, the cyber security firm is hired to help in the investigation.

“We take the security of those with whom we work and their data very seriously and our team is working diligently to ensure breaches of this type do not happen in the future.”

As per the statement, facility mentioned that steps were taken to secure internal systems. Scanning of the technical infrastructure was carried out. Passwords were changed for the users. Vendor accounts are monitored and review is done for security firewall, security tools. New software installation is done to alert for any such incidents in future.

Customers are advised to place a credit fraud alert. Also, a toll-free number is provided to assist the users.

____________________________________________________________________________________________

Alertsec helps you comply with HIPAA, PCI and SOX requirements. The implemented encryption is powered by Check Point and has the highest security certifications: FIPS 140-2, Common Criteria EAL4 and BITS.

Series B funding for Trusona

June 17th, 2017

Before four months, Ariz.-based Trusona has Series A funding of $8 million. Now, they have got additional funding of $10 million in a Series B round. This new round was led by Microsoft Ventures along with existing investor Kleiner Perkins.

“Trusona offers businesses the ability to replace a static username and password combination (which can always be lost, stolen or compromised) with a more dynamic way to prove authentication online,” explained Ori Eisen, CEO and founder of Trusona. “With the Trusona app, users can log in with a single tap without typing any username or passwords.”

Trusona is expert in authentication and federated identity technologies for companies. TruToken is the patented technology of the company. It analyzes the physical magnetic signature of a card and the way of swiping the card by the user to determine fraud. It also offers two-step authentication process which involves TruVerify for logins and TruFidelity, which helps combat attacks during online transactions.

Cloud Security Alliance survey which was sponsored by Centrify mentioned that 22 percent of breaches in last year was caused due to stolen user and password. Other survey conducted by SailPoint Market Pulse mentioned that the stolen passwords are also sold.

“All you need is to register with the free Trusona app and the relying party (such as banks, healthcare providers, WordPress, streaming media, Salesforce, a company’s network, etc.) sends you a prompt,” added Eisen.

Trusona continuously tries to look for fraud transactions.

“What sets Trusona apart is its patented technology that uses the unique nature of each authentication to assure the transmission is authentic and not a session replay,” Eisen said. “Trusona’s patented anti-replay technology, infused in every solution, protects from malware that can replay static usernames and passwords to compromise any online account. This assures the right person is behind every digital interaction.”

Microsofts is impressed with this new technology.

“Identity management is a critically important and growing space,” said Nagraj Kashyap, corporate vice president of Microsoft Ventures, in prepared remarks. “Helping businesses and consumers move toward a safer and more secure digital world is a priority for Microsoft. We believe in the work Trusona is doing to give their enterprise clients peace of mind when it comes to data protection.”

____________________________________________________________________________________________

Alertsec’s cloud-based information security service provides an easy and convenient way to protect information on your organization’s laptops and computers.