The National Institute of Standards and Technology (NIST), the federal body that sets technology standards for governmental agencies, standards organizations, and private companies, has proposed barring some of the most vexing and nonsensical password requirements. Chief among them: mandatory resets, required or restricted use of certain characters, and the use of security questions.

Choosing strong passwords and storing them safely is one of the most challenging parts of a good cybersecurity regimen. More challenging still is complying with password rules imposed by employers, federal agencies, and providers of online services. Frequently, the rules—ostensibly to enhance security hygiene—actually undermine it. And yet, the nameless rulemakers impose the requirements anyway.

Stop the madness, please!

Last week, NIST released its second public draft of SP 800-63-4, the latest version of its Digital Identity Guidelines. At roughly 35,000 words and filled with jargon and bureaucratic terms, the document is nearly impossible to read all the way through and just as hard to understand fully. It sets both the technical requirements and recommended best practices for determining the validity of methods used to authenticate digital identities online. Organizations that interact with the federal government online are required to be in compliance.

A section devoted to passwords injects a large helping of badly needed common sense practices that challenge common policies. An example: The new rules bar the requirement that end users periodically change their passwords. This requirement came into being decades ago when password security was poorly understood, and it was common for people to choose common names, dictionary words, and other secrets that were easily guessed.

Since then, most services require the use of stronger passwords made up of randomly generated characters or phrases. When passwords are chosen properly, the requirement to periodically change them, typically every one to three months, can actually diminish security because the added burden incentivizes weaker passwords that are easier for people to set and remember.

Another requirement that often does more harm than good is the required use of certain characters, such as at least one number, one special character, and one upper- and lowercase letter. When passwords are sufficiently long and random, there’s no benefit from requiring or restricting the use of certain characters. And again, rules governing composition can actually lead to people choosing weaker passcodes.

The latest NIST guidelines now state that:

• Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords and
• Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

(“Verifiers” is bureaucrat speak for the entity that verifies an account holder’s identity by corroborating the holder’s authentication credentials. Short for credential service provider, “CSPs” are a trusted entity that assigns or registers authenticators to the account holder.)

In previous versions of the guidelines, some of the rules used the words “should not,” which means the practice is not recommended as a best practice. “Shall not,” by contrast, means the practice must be barred for an organization to be in compliance.

The latest document contains several other common sense practices, including:

1. Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.
2. Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.
3. Verifiers and CSPs SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords.
4. Verifiers and CSPs SHOULD accept Unicode [ISO/ISC 10646] characters in passwords. Each Unicode code point SHALL be counted as a single character when evaluating password length.
5. Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.
6. Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
7. Verifiers and CSPs SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant.
8. Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.
9. Verifiers SHALL verify the entire submitted password (i.e., not truncate it).

Critics have for years called out the folly and harm resulting from many commonly enforced password rules. And yet, banks, online services, and government agencies have largely clung to them anyway. The new guidelines, should they become final, aren’t universally binding, but they could provide persuasive talking points in favor of doing away with the nonsense.

NIST invites people to submit comments on the guidelines to dig-comments@nist.gov by 11:59 pm Eastern Time on October 7.

https://arstechnica.com/?p=2052508

Cybersecurity has no doubt entered the national dialogue when it comes to economic or even national security issues. By nature, cyber is a deeply technical endeavor, but organizational culture surrounding security has become as important as the tech wizardry itself. This is evidenced by Microsoft’s recent testimony before the House Homeland Security Committee around alleged security lapses (for instance, the tech giant was mired in the headline-grabbing SolarWinds breach that touched government agencies). It has now launched an initiative designed to shore up internal processes and boost security strength, along with favorability.

Still, the reception has been tepid at best: a scathing op-ed from former National Security Advisor Robert C. O’Brien warned against Microsoft becoming “a hackers’ superhighway.” Yet, with crippling ransomware attacks and other stealthy breaches on the rise, Microsoft is not the only company reevaluating or enhancing its approach to cybersecurity. So, what’s influencing today’s “security posture” — and how are CISOs actually affecting it? What’s their most effective strategy? Further, is the specter of personal legal or financial responsibility for security leaders, a la the initial fraud charges against SolarWinds’ former chief information security officer (CISO), catalyzing security or setting teams back?

This article will analyze the plight of today’s CISOs and their role in safeguarding an organization’s market presence and reputational status, which is the most significant internal driver. In fact, security’s impact on the business should hold more of the focus in high-level conversations — versus potentially ignoring weaknesses or devising ways to pin blame or financial responsibility on individuals. The conversation must evolve, as it takes a village to secure the hundreds of millions of customer dollars, or more, at stake. C-suite members would be remiss not to recognize and empower the battle-tested CISOs who are on the frontlines. But, what does that empowerment look like?

Getting the right leaders into CISO positions

To be clear, day-to-day security strategy starts with the CISO. Of course, cyber risk widens quite extensively beyond this individual, and is now often a CEO and board-level discussion. Still, the CISO provides requisite oversight and administration of the program.

So, first and foremost: a top business consideration must be who is sitting in the CISO chair. These individuals can no longer just be the highest-performing security administrator or even the brightest security strategist. Instead, they need to be big-picture business thinkers capable of connecting their work to organizational performance at the highest level.

This is not a new consideration — for years the industry has called on CISOs to enter these influential business conversations and guide their boards and executives. For traditionally technical folks, this can be a challenge; but there is a pool of talented leaders ready to step up.

The technical-strategic divide

True, SolarWinds has become a bogeyman for security leaders — considering recent enforcement action from the U.S. Securities and Exchange Commission (SEC) that singled out the company’s former CISO (though a majority of the charges have since been dropped). Still, the more imminent threat is not so much personal liability — though it’s on CISOs’ minds — but the gulf between security’s technical ins and outs and a deep understanding of its real impacts. In fact, cybersecurity missteps can be profound: impacting insurance premiums, litigation and even business contracts. These are waves coming together and crashing ashore at once.

This makes the CISO role increasingly important. Still, capable CISOs also need a receptive — and engaged — C-suite audience. In fact, the days of operating in a siloed corner of the business are long over. So, for one, a broader range of executive salaries should hinge on the company’s ability to stay cyber-secure. Business-wide failures should not be one person’s undoing.

Still, CISOs must be the catalyst — grounding execs in strategy and outlining preparatory measures. But, risk mitigation also demands broader buy-in. This will ultimately help teams contend with emerging threats and sustain or grow their company’s market position.

Getting those non-security leaders on-board

It’s well understood that top executives need to be clued into security strategy. But, the question becomes: How can CISOs more easily loop them in? Ultimately, it involves fine details and truly “nailing” those presentations and other regular discussions. It means translating cyber’s impact to dollars and cents, or customers won and lost. As a regular exercise, this will help educate various leaders, elevate CISOs and give cybersecurity the attention it deserves.

More specifically, CISOs can actually calculate potential financial losses from data breaches (they reached an all-time high of $4.45 million lost per incident in 2023), including costs of remediation, legal fees, and regulatory fines. They can also assess the impact of security incidents (internal or external) on customer trust, brand reputation, and potential revenue loss from decreased customer retention and acquisition. These are the keywords that will garner attention, and quickly.

Thanks to new methods, including metrics like cyber risk ratings, security teams can also leverage independent analyses that quantify performance — helping to set a baseline and ultimately get wider buy-in on budgets and solutions.

Moving forward

Surging ransomware attacks and recent rhetoric from tech giants have proven that cybersecurity is a highly complex, but more importantly consequential, area of the business. Both proper guardrails and leadership are necessary to boost organizational, and even national, cyber-resilience.

With this guidance and by pushing for broader participation, CISOs and their peers will be set up for success — more easily gauging risk levels, fortifying their systems and data, and keeping cybercriminals at bay.

https://www.securitymagazine.com/articles/101039-where-do-cisos-stand-in-an-era-cyberattacks-and-intense-scrutiny

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } .w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:5px;margin-top:16px;margin-bottom:16px}
.w3-card{box-shadow:0 2px 5px 0 rgba(0,0,0,0.16),0 2px 10px 0 rgba(0,0,0,0.12)}

In this episode of The Security Podcasts featuring Jill Knesek, CISO of Blackline, and former FBI Special Agent in the Cyber Crime Squad, we talk about balancing risk & innovation from a CISO’s perspective.

“The message I like to give is we can be both innovative and secure.,” Knesek says. “They’re not mutually exclusive, and they shouldn’t be. By shifting left and embedding strong security practices and controls earlier into our development lifecycle, we can lower the cost of the security and by including the security team in early phases of development of our new products, features or capabilities, the better integrated and seamless the security controls will be. But to do that, the CISO needs to engage with technology leaders. We have to have a relationship across the organization — working with the CTO, the CIO, and in many cases even the CFO — so we can proactively include some of these early conversations, during the ideation phase and development discussions. And that way, security becomes embedded into the new innovations that are rolling out.”

Or check it out on our Apple Podcasts or Spotify channels. Don’t forget to like, follow, and rate and review our podcasts!

https://www.securitymagazine.com/articles/100977-balancing-risk-and-innovation-a-ciso-perspective

Chief Information Security Officer (CISO) concerns over artificial intelligence (AI) were analyzed in a recent report by Team8. The survey found that 70% of CISOs’ budgets increased in 2024 compared to 2023.

Seventy-five percent of respondents said phishing attacks pose the greatest AI-powered threat to their organization, while 56% said deepfake enhanced fraud (voice or video) poses the greatest threat.

‘Lack of expertise’ (58%) and ‘Balancing security with usability’ (56%) are the two main challenges organizations face when defending AI systems. Forty-one percent of CISOs expect to explore purchasing solutions for managing the AI development lifecycle within the next 1-2 years. Additionally, many CISOs are prioritizing solutions for third-party AI application data privacy (36%) and tools to discover and map Shadow AI usage (33%).

Data protection tops issues not adequately addressed by existing solutions: CISOs identify several critical data security concerns that currently lack adequate solutions – insider threats and next-gen DLP (65%), third-party risk management (46%), AI application security (43%), human identity management (40%), and security executive dashboards (40%)

The survey found that 54% of CISOs reported that their personal well-being has been impacted due to concern about liability, while 32% have actively taken steps to mitigate personal legal risk, through actions such as seeking legal counsel, purchasing additional insurance or adjusting their contract. Meanwhile, 54% report experiencing significantly tighter scrutiny from their superiors over the past year despite their budgets and scope increasing.

https://www.securitymagazine.com/articles/101068-75-of-organizations-say-phishing-poses-the-greatest-ai-risk

Set 25, 2024 Marina Londei Attacchi, In evidenza, Malware, Minacce, News, Ransomware, RSS 0

---

I ricercatori di SentinelLabs di SentinelOne hanno scoperto una nuova variante del ransomware Mallox che usa una versione modificata del ransomware Kryptina per attaccare i sistemi Linux.

Mallox, del gruppo TargetCompany, è un ransomware-as-a-service (RaaS) in uso dal 2021 che viene usato ancora oggi da numerosi affiliati. Anche Kryptina è una piattaforma RaaS, anche se più recente di Mallox, e offre funzionalità per automatizzare payload, gestire più gruppi e campagne e configurare i requisiti di pagamento del riscatto, come la somma e il tipo di pagamento accettato.

Nonostante le feature, Kryptina non ha ricevuto l’attenzione che sperava dal mondo del cybercrimine, al punto che l’ideatore della piattaforma ha deciso di smettere di venderla e di pubblicarne il codice sorgente. In seguito, lo scorso maggio, i ricercatori di SentinelLabs hanno individuato un server di staging di un affiliato di Mallox che conteneva tutti i file sorgente di Kryptina, anche se modificati per supportare una nuova variante del ransomware.

“L’uso di Kryptina da parte di questo affiliato sembra essere singolare: le altre varianti Linux di Mallox non sono basate su Kryptina, complicando ulteriormente la relazione tra Kryptina e Mallox” spiegano i ricercatori di SentinelLabs.

Il nuovo ransomware, soprannominato “Mallox Linux 1.0”, usa le stesse routine di cifratura e decifratura di Kryptina e il template delle due note di riscatto è molto simile. A parte per i commenti modificati e la rimozione di qualsiasi riferimento ai creatori di Kryptina, il codice sorgente dei due ransomware è praticamente lo stesso.

Sul server i ricercatori hanno anche trovato delle cartelle relative a 14 potenziali vittime del ransomware. Alcune cartelle contenevano tool per la cifratura e decifratura dei file, mentre altre erano vuote: è probabile che si riferissero a vittime già designate ma non ancora colpite.

Il server conteneva inoltre KLAPR.BAT, un tool usato per neutralizzare la protezione dei prodotti di Kaspersky quando necessario, un exploit per sfruttare una vulnerabilità di privilege escalation in Windows 10 e 11 (CVE-2024-21338), numerosi dropper per Mallox (per Windows) e vari altri dropper e payload malevoli.

Secondo i ricercatori di SentinelOne, la presenza di una variante di Mallox derivata da Kryptina è indicativa di come il panorama dei ransomware stia diventando sempre più complesso, evolvendosi in un mix di toolset e codice ormai non più lineari. “L’adozione di Kryptina da un affiliato attivo di Mallox rappresenta una sorta di ‘evoluzione’ del malware. Ancora più importante, dimostra il diffuso trend della mercificazione dei ransomware“.

Visto che il codice sorgente di Kryptina è di dominio pubblico per i cybercriminali, è probabile che emergano nuove varianti basate su questo RaaS. La crescente complessità del panorama delle minacce richiede alle aziende di implementare soluzioni di protezione robuste, effettuare backup regolari e istruire i dipendenti sulle buone pratiche di sicurezza.

---

---

---

https://www.securityinfo.it/2024/09/25/scoperta-una-variante-del-ransomware-mallox-basata-su-kryptina/?utm_source=rss&utm_medium=rss&utm_campaign=scoperta-una-variante-del-ransomware-mallox-basata-su-kryptina

Un mese dopo essere stato arrestato a Parigi, Pavel Durov continua a far parlare di sé.

Le accuse della magistratura francese e la reazione di Durov

L’indagine entro cui è avvenuto l’arresto riguarda una serie di reati commessi via Telegram, la piattaforma di messaggistica istantanea di cui l’imprenditore russo è fondatore e CEO.

Tra le ipotesi al vaglio degli inquirenti spiccano il traffico di stupefacenti e la diffusione di materiale pedopornografico. Per Durov, che si è visto contestare ben dodici capi d’imputazione, il coinvolgimento nell’inchiesta deriva da una mancata collaborazione con le autorità che avrebbe reso più difficile individuare gli autori materiali di tali reati.

Si tratta del primo caso – almeno nel mondo occidentale – in cui le autorità scelgono di perseguire il responsabile di una piattaforma per i contenuti illeciti pubblicati su di essa: un parziale precedente si può riscontrare nella storia personale dello stesso Durov, che già nel 2014 entrò in conflitto con il Cremlino per essersi rifiutato di rivelare i dati relativi ad alcuni utenti anti-governativi attivi sul social VK.

Il 5 settembre, Durov aveva condiviso sul proprio canale Telegram la sua versione dei fatti.

Pur ribadendo come esistessero da sempre dei meccanismi di moderazione dei contenuti, il messaggio anticipava l’intento di modificare le policy per agevolare lo scambio di informazioni con le autorità inquirenti e prometteva di aggiornare quanto prima gli utenti sul processo in corso, finalizzato a rendere “safer and stronger” non solo i servizi forniti da Telegram ma l’intera industria dei social network.

Appena due settimane dopo, il medesimo canale ha diffuso la seguente comunicazione:

“La ricerca su Telegram è più potente rispetto ad altre app di messaggistica perché permette agli utenti di trovare canali pubblici e bot. Sfortunatamente, questa funzionalità è stata oggetto di abuso da parte di persone che hanno violato i nostri Termini di Servizio per vendere beni illegali.

Nelle ultime settimane un team dedicato di moderatori, utilizzando l’AI, ha reso la ricerca su Telegram molto più sicura. Tutti i contenuti problematici identificati nella ricerca non sono più accessibili. Se riesci ancora a trovare qualcosa di pericoloso o illegale nella ricerca su Telegram, segnalalo tramite @SearchReport.

Per scoraggiare ulteriormente i criminali dall’abuso della ricerca su Telegram, abbiamo aggiornato i nostri Termini di servizio e l’Informativa sulla privacy, assicurandoci che siano coerenti in tutto il mondo. Abbiamo reso chiaro che gli indirizzi IP e i numeri di telefono di coloro che violano le nostre regole potranno essere divulgati alle autorità competenti in risposta a valide richieste legali.

Queste misure dovrebbero scoraggiare i criminali. La ricerca su Telegram è pensata per trovare amici e tenersi aggiornati, non per promuovere beni illegali. Non permetteremo che dei malintenzionati [“bad actors”] mettano a rischio l’integrità della nostra piattaforma per quasi un miliardo di utenti”.

La nuova privacy policy di Telegram

Oltre a prevedere l’implementazione di meccanismi di moderazione più stringenti e la possibilità di segnalare a un apposito canale automatizzato eventuali contenuti illegali, le modifiche in atto implicano che d’ora in poi indirizzi IP e numeri di telefono degli utenti potranno essere trasmessi alle pubbliche autorità “in response to valid legal requests”.

A partire da questo aggiornamento, quindi, Telegram cambierà in modo sostanziale.

Resta da vedere come verranno attuate tali promesse e se verrà eliminata la possibilità di utilizzare l’app tramite indirizzi email temporanei o numeri di telefono virtuali, che consentirebbe di aggirare i limiti dei ToS.

Le nuove impostazioni segnano comunque un passo indietro in termini di tutela della privacy: un autentico cambio di rotta per Durov, il quale sin dagli inizi della sua ascesa imprenditoriale rivendica la difesa della riservatezza e dell’anonimato come cifra distintiva dei propri servizi.

Se in seguito alla notizia dell’arresto si era molto discusso delle possibili conseguenze sulla gestione dell’app di messaggistica, nonché sull’ecosistema dei social media in generale, oggi l’aggiornamento della privacy policy di Telegram conferma che i gestori delle piattaforme sono chiamati – volenti o nolenti – ad adattare i propri Termini di Servizio a politiche e normative che non considerano più gli ambienti digitali come “zona franca”, imponendo talvolta di sacrificare la privacy in nome della sicurezza.

https://www.ictsecuritymagazine.com/notizie/telegram-durov-privacy-policy/

Physical security isn’t an afterthought for organizations: it is critical infrastructure. Retailers, healthcare providers, municipalities, schools and all kinds of other organizations rely on security systems to keep their people and places safe. 

As the capabilities of security technology have evolved, many organizations are taking a broader view of their investments and understanding how they can deliver more value across their operations. From opportunities to modernize the workplace with tools like touchless door access to optimizing facilities planning using occupancy data or driving operational change with AI, forward-looking organizations are recognizing the benefit that a single cloud based platform for physical security can deliver across the enterprise. 

It’s important to caveat that before investing in security solutions, companies should first assess risks and threats to ensure their investment is right-sized for their needs. That means quantifying historical issues, the value of losses (or injuries), and the potential for inbound threats or security concerns. Once a security professional knows the level of investment needed and the kinds of solutions that are right for their organization, they can tackle what is often the biggest barrier: budgets. 

Here are three broader business benefits that security leaders can evaluate with stakeholders to help secure buy-in on new investments:

Insights for cross-functional partners

Visibility into how sites are being used isn’t just helpful for security teams, it can also benefit cross-functional partners in operations, compliance and even marketing. For instance, a manufacturer can leverage AI-powered analytics on their video security cameras to monitor for and send alerts when they detect abnormal or unsafe traffic patterns on their production floor, supporting their operations team’s continued focus on compliance. As technology continues to advance and systems become more integrated, there will be more opportunities for security technology to inform decision-making and day-to-day operations across all kinds of industries. 

Delivering a modern experience for employees and customers

Another significant benefit of investing in integrated security systems is an elevated employee or customer experience. Thanks to mobile access credentials, employees can easily access office spaces with a touchless entry experience. It’s easy to misplace a badge or key when one is rushing to work in the morning, but it’s rare that they would leave a phone behind — saving them the headache of contacting security to access the building. And an added bonus: security leads aren’t bogged down with updating and refreshing new badge cards every day, and can focus their attention on responding to active threats.

A secure workplace is not only an attractive feature for current and prospective employees, but also any person visiting an organization. Imagine going to see a family member who is in the hospital. A visitor walks up to the building, speaks through the hospital’s intercom system to security personnel, and checks in via the hospital’s guest system where they complete any necessary documentation — like a quick security screen — and both the visitor and the host get text alerts confirming the details of the visit. For the visitor, the experience is simple and frictionless from the minute they walk up to the building until the moment they exit. And for the healthcare staff, there’s easy visibility into everyone on the premises and reassurance that they have permission to be there.

Total cost of ownership savings

Upfront investment in cloud-based solutions can also lead to significant cost savings in the long run. Many organizations don’t take the total cost of ownership into account when evaluating physical security investments. The ongoing maintenance, security patches and headache of replacing worn-out or antiquated devices are often borne by individual sites and lost in operational budgets. Cloud based systems can eliminate that cost with centralized management and proactive maintenance, firmware and security upgrades, and alerting. These upgrades also deliver new capabilities, ensuring that the system can grow with the organization within a predictable cost.  

Investing in a cloud-based platform for physical security systems is a strategic move that can offer far-reaching benefits for employers and their organizations. By starting with a thorough risk assessment and layering on the cross-functional benefits of more capable systems, as well as the avoided cost of cloud-managed offering, security leaders can make a compelling case for change. As security threats and workplaces continue to evolve, such forward-looking investments are not only prudent but essential for long-term success and sustainability.

https://www.securitymagazine.com/articles/101031-the-value-of-security-building-the-foundation-for-modern-enterprises

When security researcher Johann Rehberger recently reported a vulnerability in ChatGPT that allowed attackers to store false information and malicious instructions in a user’s long-term memory settings, OpenAI summarily closed the inquiry, labeling the flaw a safety issue, not, technically speaking, a security concern.

So Rehberger did what all good researchers do: He created a proof-of-concept exploit that used the vulnerability to exfiltrate all user input in perpetuity. OpenAI engineers took notice and issued a partial fix earlier this month.

Strolling down memory lane

The vulnerability abused long-term conversation memory, a feature OpenAI began testing in February and made more broadly available in September. Memory with ChatGPT stores information from previous conversations and uses it as context in all future conversations. That way, the LLM can be aware of details such as a user’s age, gender, philosophical beliefs, and pretty much anything else, so those details don’t have to be inputted during each conversation.

Within three months of the rollout, Rehberger found that memories could be created and permanently stored through indirect prompt injection, an AI exploit that causes an LLM to follow instructions from untrusted content such as emails, blog posts, or documents. The researcher demonstrated how he could trick ChatGPT into believing a targeted user was 102 years old, lived in the Matrix, and insisted Earth was flat and the LLM would incorporate that information to steer all future conversations. These false memories could be planted by storing files in Google Drive or Microsoft OneDrive, uploading images, or browsing a site like Bing—all of which could be created by a malicious attacker.

Rehberger privately reported the finding to OpenAI in May. That same month, the company closed the report ticket. A month later, the researcher submitted a new disclosure statement. This time, he included a PoC that caused the ChatGPT app for macOS to send a verbatim copy of all user input and ChatGPT output to a server of his choice. All a target needed to do was instruct the LLM to view a web link that hosted a malicious image. From then on, all input and output to and from ChatGPT was sent to the attacker’s website.

[embedded content]

“What is really interesting is this is memory-persistent now,” Rehberger said in the above video demo. “The prompt injection inserted a memory into ChatGPT’s long-term storage. When you start a new conversation, it actually is still exfiltrating the data.”

The attack isn’t possible through the ChatGPT web interface, thanks to an API OpenAI rolled out last year.

While OpenAI has introduced a fix that prevents memories from being abused as an exfiltration vector, the researcher said, untrusted content can still perform prompt injections that cause the memory tool to store long-term information planted by a malicious attacker.

LLM users who want to prevent this form of attack should pay close attention during sessions for output that indicates a new memory has been added. They should also regularly review stored memories for anything that may have been planted by untrusted sources. OpenAI provides guidance here for managing the memory tool and specific memories stored in it. Company representatives didn’t respond to an email asking about its efforts to prevent other hacks that plant false memories.

https://arstechnica.com/?p=2052198

With the rapid pace of cloud adoption, organizations are quickly revolutionizing business operations but are having a harder time ensuring that systems are built and operated effectively and deployed with the proper cyber hygiene. Business growth experts say to move fast and break things but failing to implement appropriate cybersecurity controls simply doesn’t work because both the regulatory and threat landscape are evolving more rapidly than ever. 

Even before organizations embarked on huge digital transformation projects, most were behind in meeting regulatory compliance requirements because they relied on manual processes and tools, such as Excel spreadsheets and Word documents. Cloud adoption exacerbated those problems, leaving Chief Information Security Officers (CISOs) to manage large portfolios of applications sprawled across multiple environments and networks. Managing compliance in these complex and fluid environments is a near impossible task with traditional tools, and it’s going to get worse in the years ahead.  

Challenges of rapid cloud adoption

The accelerated shift to cloud services introduced a wide range of challenges, from more complexity to non-IT related governance, to increasingly ephemeral environments. These serverless systems scale up and down automatically based on load, making it difficult to maintain consistent asset inventories. Tracking and monitoring resources and gathering evidence to demonstrate compliance can be challenging in these environments unless continuous monitoring is in place. 

In addition, most organizations operate in hybrid and multi-cloud environments, which only adds to the complexity introduced by continuously changing cloud environments. Traditional governance, risk and compliance (GRC) tools haven’t evolved at the same pace, generating outdated and incomplete reports that aren’t worth the paper they’re printed on. Instead, CISOs must adopt solutions that continuously monitor security, identity, and access management across both public and private environments. 

Cloud native compliance

Many of the regulations in place today were built for infrastructure that was more static, thus simpler to document and harden. Yet the regulations themselves continue to evolve to keep up with cloud adoption, including GDPR and CCPA protections for data privacy in the cloud, data sovereignty, residency, transfer, and cybersecurity frameworks. These new and updated regulations all make it imperative for organizations to be able to manage compliance requirements in the cloud effectively. Continuous controls monitoring (CCM) is an emerging technology-based solution that can automate risk assessments and compliance workflows. This approach is indispensable for ensuring both security and regulatory compliance because it strengthens security protocols and embeds compliance within cloud operations. 

Some of the key benefits of CCM as a cloud-native GRC solution include: 

• Unifies disparate tools, controls, and evidence across environments. By collecting these diverse data sources, CCM tools can analyze and evaluate risk and control data from multiple platforms. 
• Increases accuracy, enabling security analysts to make decisions quickly based on real-time and near real-time data and analysis. 
• Enables the use of compliance as code standards, including the Open Security Controls Assessment Language (OSCAL) published by the National Institute of Standards and Technology (NIST), moving compliance and risk processes towards a modern DevSecOps approach. 

Compliance as code also facilitates machine-to-machine attestation, which provides the technology required for CCM. Together, these tools enable organizations to replace manual processes and add real-time visibility into their compliance and security procedures. 

Artificial intelligence & compliance

Based on the news, it appears that every organization is adding artificial intelligence (AI) capabilities into their solutions. As adoption of AI increases, threat actors will continue to make use of it to carry out more sophisticated attacks. At the same time, more regulations will emerge to govern the use of AI. AI also enables organizations to generate and deploy code faster than ever, increasing the need to radically improve compliance capabilities for cloud and hybrid environments. These changes place an additional compliance burden on internal teams to stop emerging threats, keep up with new regulations, and manage the volume of applications and services deployed in cloud environments. 

AI can help compliance and security teams by handling a lot of the more tedious compliance-related tasks, such as writing policy documents and drafting control implementation statements as well as enabling predictive analytics and gap detection. Still, it remains evident that AI introduces new attack vectors, both directly from malicious actors and from employees inadvertently exposing sensitive data or intellectual property. This balancing act is impossible without compliance tools designed to leverage the capabilities of cloud computing and AI in a secure and controlled manner.

Achieving compliance today & tomorrow in the cloud

Cloud environments are complicated and detecting and identifying risk quickly can be extremely difficult, resulting in significant issues with regulatory compliance. To overcome these challenges, organizations must adopt tools that enable compliance as code, using OSCAL to express control-based information easily, and continuous controls monitoring to enable automated monitoring and assessment of system controls. Cloud-native tools offer the best option for organizations seeking to improve GRC initiatives and prepare for the changes ahead. CCM strengthens security protocols and embeds compliance within cloud and development operations, streamlining the protection of digital assets in a quickly evolving landscape.

https://www.securitymagazine.com/articles/101027-ensuring-security-and-compliance-in-evolving-cloud-environments

Set 24, 2024 Marina Londei Attacchi, Malware, News, RSS 0

---

Il trojan Necro torna a colpire: dopo gli attacchi del 2019, durante i quali il malware veniva distribuito tramite CamScanner, un’applicazione di text recognition, i ricercatori di Kaspersky hanno scoperto nuove tracce del trojan in versioni piratate di Spotify e in alcune mod per WhatsApp, Minecraft, Stumble Guys e altre applicazioni note per Android.

Necro usa la steganografia per nascondere il codice malevolo ai controlli di sicurezza ed è in grado di scaricare payload malevoli che a loro volta eseguono file DEX, scaricano e installano nuove applicazioni, eseguono il tunneling e abbonano l’utente a servizi a pagamento; inoltre, alcuni moduli riescono a mostrare e interagire su inserzioni presenti in finestre non visibili, aprire link ed eseguire codice JavaScript.

Inizialmente i ricercatori di Kaspersky hanno individuato il trojan in un APK modificato di Spotify Plus. Il sito web che la pubblicizzava invitava gli utenti a scaricare una nuova versione dell’applicazione, ovviamente da una fonte non legittima, in maniera gratuita. Una volta scaricata e installata l’app, Necro inviava informazioni agli attaccanti sul dispositivo infetto e scaricava nuovi payload.

Il trojan era presente anche in applicazioni disponibili su Google Play come Wuta Camera, un’app per foto che conta oltre 10 milioni di download. Gli attaccanti sono riusciti a piratare la versione 6.3.2.148, quindi il consiglio è di aggiornare il prima possibile l’applicazione all’ultima versione.

Necro ha infettato inoltre mod per WhatsApp, Minecraft, Stumble Guys, Car Parking Multiplayer e Melon Sandbox, tra le applicazioni e i giochi più popolari tra gli utenti Android. I ricercatori di Kaspersky stimano che il trojan ha colpito 11 milioni di utenti Android.

La miglior difesa contro questo tipo di malware rimane sempre la prevenzione: è fondamentale scaricare applicazioni e plugin soltanto da fonti ufficiali. Poiché però anche le applicazioni sul Play Store sono a rischio, è importante dotarsi di soluzioni di protezione per i propri dispositivi e controllare attentamente le recensioni, soprattutto quelle con la valutazione minore.

---

---

---

https://www.securityinfo.it/2024/09/24/il-trojan-necro-ha-attaccato-11-milioni-di-utenti-android/?utm_source=rss&utm_medium=rss&utm_campaign=il-trojan-necro-ha-attaccato-11-milioni-di-utenti-android