Security Intelligence

This is exactly what we did and why we did it in the early 2000s. The company (of about 700 people) standard was "baggy pantsing"[0]. Of course there was etiquitte. You only ever emailed smaller groups (your team, your floor, rtc) - never all staff. You always explained to a newbie so they didn't feel too embarassed or singled out - and they always got a heads up during training. Our small team of 15 got pretty crazy though. Rebinding keys, replacing all the icons with My Little Pony or Hello Kitty custom sets, etc. It became a good competition and a great way to blow off steam in a high output role, and as a byproduct built in good physical security. 0. https://securityintelligence.com/dont-get-pantsed-embrace-a-culture-of…

The US govt can also do a lot better. The very agency they formed to counter cyber threats and alert against(CISA) itself got hacked because they failed to patch or remediate, and led to a serious leak of sensitive chemical industry information among others. Because they failed to follow their own security advisory. And they won't even put out a report detailing the hack like MS did. > According to an early report on the breach, an anonymous source said that the compromised systems were the Infrastructure Protection (IP) Gateway, which houses critical information about the interdependency of U.S. infrastructure, and the Chemical Security Assessment Tool (CSAT), which houses private sector chemical security plans. > CSAT is an online portal that contains highly sensitive information that determines which facilities are considered high-risk under the Chemical Facility Anti-Terrorism Standards (CFATS). > CISA declined to confirm or deny which of their systems were taken offline. https://securityintelligence.com/news/cisa-hackers-key-systems-offline… > In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed SSL VPN, while Ivanti Policy Secure (IPS) is a network access control (NAC) solution. > Now, CISA itself has fallen victim to a cyberattack involving Ivanti products.

For what it's worth, the GitHub README.md calls it a Zero day so they apparently didn't give Apple any heads up to prepare for the release of the exploit. While a same day/same week fix is ideal, 23 days isn't that bad given a QA cycle. Patches for Meltdown/Spectre are just still their way out/not yet released for Microsoft's Server OSes for a point of comparison [1]. I wish I could have found something newer, but according to Symantec the average resolution time found in their 2015 study was 69 days[2]. The last time Apple rushed a fix out.. it didn't go so well[3]. Now, while I'm waxing poetic, I may as well frighten you with a recent RAND corp study about how long Zero Days can be known privately before publicly disclosed [4]. It also doesn't take too long to weaponize them [5]. This stuff sucks and is really nerve racking for anyone involved in security even tangentially. It's really easy to criticize but I guarantee that anyone on Hacker News who has written any meaningful software has released a security flaw. If you think you haven't you're absolutely kidding yourself and should reevaluate your stance. [1] https://social.technet.microsoft.com/Forums/windowsserver/en-US/4f1032… [2] https://www.symantec.com/connect/blogs/guide-zero-day-exploits [3]…

I'm engaging in pedantry here, but computer science has proofs. When we have hardware level security vulnerabilities, I trust my device as far as I can throw it. Proofs are only sound and valid in maths. https://securityintelligence.com/news/apple-m-series-chips-hardware-fl… Everything Apple's done yields verifiable security - but it's not "provably secure". The two are distinct, and when you try to sell to me with bad language I get squinty-eyed. Especially since "confidential computing" already exists on x86/AWS, and I struggle to see the difference. It just sounds like Apple marketing to me. > don’t totally discount the idea of designing a system that has provable security properties They're only as provable as your assumptions/givens. Given a hardware vuln, where is your security now?

Source, with a lot more details: https://securityintelligence.com/posts/new-research-exposes-iranian-th…

I see "the banking trojan then overlays the app" which isn't swapping the icon. Overlay malware is well known on Android, e.g. https://securityintelligence.com/posts/new-android-banking-trojan-targ… https://github.com/geeksonsecurity/android-overlay-malware-example

Source, without all the TechCrunch "OMG Hackers" stuff: https://securityintelligence.com/posts/package-delivery-cybercriminals… Do everyone a favor, mister mod.

That's simply not correct, kronos was well documented before his arrest. https://securityintelligence.com/the-father-of-zeus-kronos-malware-dis… https://myonlinesecurity.co.uk/an-employee-has-been-terminated-malspam… 2016 post referencing kronos with samples https://www.virustotal.com/en/file/2ba17c2fbdd4127d7a63951b307ec8f9c9a… 2014 sample tagged as kronos https://www.virustotal.com/en/file/3bd4b8caf9ae975bd41dbee1f1719cf7be3… another 2014 kronos sample

It's really easy to trick people to commit crimes. Post a bunch craigslist job postings for a non-existant bank QA job that pays $100/hr. Have them withdraw the cash from the ATM, deposit it into their bank and wire the money out to an international bank. https://securityintelligence.com/the-most-common-schemes-for-targeting…

>The part that makes no sense to me is that swatting is even possible, there are enough indicators that the call is not originating from the location indicated by the caller. Google search SS7. https://securityintelligence.com/ss7-vulnerability-isnt-a-flaw-it-was-… https://www.wired.com/2017/05/fix-ss7-two-factor-authentication-bank-a… https://www.theregister.co.uk/2017/05/03/hackers_fire_up_ss7_flaw/ TLDR; the SS7 protocol (which cell phones operate on) is extremely unsafe and vulnerable.

That's one of the problems with cheap domains in the sub $5 range. Some gTLD registries (.space included) thought it was a good idea to offer them really cheap, but what they got were mostly spammers which puts you in a bad neighborhood. There are a few others which you may want to avoid according to this report: https://securityintelligence.com/enticing-clicks-with-spam/

Still hasn't presented any evidence. He punished North Korea with more sanctions for the Sony breach by executive order. https://www.scribd.com/document/251531426/North-Korea-Sanction Many analysts still say it was a disgruntled employee https://securityintelligence.com/who-hacked-sony-new-report-raises-mor…

I'm leaning towards the browser vendors on this one, AV software has been sloppy and has been known to enlarge the attack surface area. Here's an example from earlier this year. https://securityintelligence.com/news/bad-medicine-symantec-antivirus-… @VessOnSecurity whines about a lack of hooks for AV to hang on in Google Chrome, but kind of laughs at the hooks that Microsoft Office offers (we didn't need them anyway, we read before Office opens the file, etc.) That cavalier attitude makes me uncomfortable.

https://news.ycombinator.com/item?id=11826431 https://securityintelligence.com/compromised-before-my-very-eyes-how-i… https://www.reddit.com/r/teamviewer/comments/4m7j4a/i_covered_one_of_t…

I think the BBC reporter likely got confused. However it seems http://securityintelligence.com/ibm-x-force-researcher-finds-significa… is a blog post about a 19 year old remotely exploitable bug being fixed recently, so it seems like if anything the link should go there.

One of the first comments there with the partial ARM opcode map shows why this vulnerability is "theoretical" - you can overflow the buffer, but the bytes written to the buffer are restricted so much (values will always be between 43 and 126) that it would be nearly impossible to write useful exploit code. The details are here: http://securityintelligence.com/android-keystore-stack-buffer-overflow…

Most enterprise security tools could pick this up the night it became a CVE, or IBM QRadar could.... http://securityintelligence.com/heartbleed-vulnerability-security-inte…

North Korean state-sponsored criminal fraud activities: https://www.zdnet.com/article/north-korea-s-apt38-hacking-group-behind… https://www.cnn.com/2019/03/01/politics/north-korea-cyberattacks-cash-… Connections between specific Russian financial crime organizations and the Russian government are much harder to pin down as people who try to investigate ties between the Russian mob and the Russian government often wind up dead. However, the Russian government is well known to be tightly linked connected to Russian organized crime[0]. Given the sheer scale of Russian financial fraud operations--Carbanak stole upwards of a billion USD[1]--the balance of probabilities suggest these operations exist with the tacit approval of the Russian government. [0] https://bpr.berkeley.edu/2019/12/16/gangs-and-gulags-how-vladimir-puti… [1] https://securityintelligence.com/carbanak-how-would-you-have-stopped-a…

To get an idea of what happened when, this happened months before the Snowden leaks were published: "“As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion,” the company said on Feb. 22, 2013." Kaspersky identified the attacker group for the first time in 2011, two years before: https://securityintelligence.com/news/butterfly-effect-chaos-reigns-fr… "According to eWEEK, the Wild Neutron group was first identified and named by Kaspersky Lab in 2011, and it went after high-profile corporate IP in 2013." The group is very careful in using the obtained information: "Vikram Thakur, senior manager at Symantec, believed that the Butterfly attacks are financially and not politically motivated, noting to CSO Online that the attackers are extremely careful with the information they obtain. So far, there’s no evidence of any high-profile IP for sale on the Dark Web, and while the data could be used for insider trading, there has been no odd stock market movement after the thefts occur. Vice president of security firm Fasoo, Ron Arden, said it’s possible that the group also employs insiders who are willing to deliberately compromise their accounts and give malicious actors access to five-year plans or financial statements."

As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself, but seems relatively straightforward if you have a programming background. tl;dr: YARA rules are a method of categorizing malware based on their characteristics. So the PDF here released a YARA rule to determine a specific piece of malware used in the hack (it's not clear to me what it identifies, other than a PHP script). For convenience, here's the YARA rule presented in the PDF formatted to be more readable: rule PAS_TOOL_PHP_WEB_KIT { meta: description = "PAS TOOL PHP WEB KIT FOUND" strings: $php = "<?php" $base64decode = /\='base'\.\(\d+\*\d+\)\.'_de'\.'code'/ $strreplace = "(str_replace(" $md5 = ".substr(md5(strrev(" $gzinflate = "gzinflate" $cookie = "_COOKIE" $isset = "isset" condition: (filesize > 20KB and filesize < 22KB) and #cookie == 2 and #isset == 3 and all of them } [1] https://securityintelligence.com/signature-based-detection-with-yara/ [2] http://yara.readthedocs.io/en/v3.5.0/writingrules.html EDIT: formatting

> Specifically, it related to Microsoft Secure Channel, known as Schannel, Microsoft's software for implementing secure transfer of data. I'm confused... The article says this research relates to the SChannel vulnerability being patched this month and cites IBM Researchers[1] finding it, but the link to the blog post showing the work is towards OLE and not SChannel. Also, Microsoft has mentioned that they found[2] the SChannel vulnerability through an internal audit. To me, it seems the research is talking about CVE-2014-6332[3], which shows the patch as MS14-064. MS14-066 is the patch for the SChannel vulnerability. Either BBC is confused on which patch they're trying to report on, or I am. Anyone similarly confused as I am? [1] http://securityintelligence.com/ibm-x-force-researcher-finds-significa… [2] http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-t… [3] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6332