Set 09, 2024 Stefano Silvestri Attacchi, Intrusione, Malware, News, Phishing, Tecnologia, Vulnerabilità 0

---

Nell’ultima settimana, il CERT-AGID (Computer Emergency Response Team dell’Agenzia per l’Italia Digitale) ha condotto un’analisi delle minacce informatiche rilevanti per lo scenario italiano.

L’indagine ha portato all’identificazione di 40 campagne malevole. Di queste, 22 erano mirate specificamente a obiettivi italiani, mentre le restanti 18 avevano una natura più generica, pur avendo comunque un impatto sul territorio nazionale.

A seguito di questa analisi, il CERT-AGID ha individuato 532 indicatori di compromissione (IoC) che sono stati prontamente messi a disposizione degli enti accreditati, permettendo loro di rafforzare le proprie difese contro potenziali attacchi informatici.

I temi più rilevanti della settimana

Nella settimana in esame, sono stati identificati 14 diversi temi utilizzati per diffondere campagne malevole in Italia. Tra questi, alcuni si sono distinti per la loro frequenza e impatto.

Il tema “Undelivered” è stato ampiamente sfruttato per campagne di phishing mirate agli utenti di Poste Italiane, Roundcube e cPanel, sia in contesti specificamente italiani che più generici.

L’argomento “Ordine” è stato principalmente impiegato per la diffusione di malware come FormBook, AgentTesla, Guloader e StrRat, oltre a una campagna di phishing generica. Il tema “Rinnovo” ha caratterizzato campagne di phishing italiane contro clienti di Aruba e Register.it.

Nel settore bancario una campagna di phishing ha preso di mira i clienti di Intesa Sanpaolo. Lo stesso argomento è stato utilizzato per diffondere il malware EagleSpy.

Il tema “Avvisi sicurezza” è stato sfruttato per campagne di phishing generiche, coinvolgendo tra gli altri MetaMask. I restanti temi hanno veicolato varie tipologie di malware e campagne di phishing.

Due eventi hanno attirato particolare attenzione. Il primo riguarda la terza campagna malevola in un mese che diffonde il malware Vidar attraverso PEC compromesse. Questa campagna si basa su email che richiedono il pagamento di false fatture insolute, inducendo il download del malware tramite un link.

Il secondo evento rilevante è una nuova campagna di phishing che utilizza un bot Telegram come centro di comando e controllo. Gli attaccanti sfruttano il tema Microsoft SharePoint per sottrarre credenziali attraverso email fraudolente.

Malware della settimana

Nel corso della settimana, sono state identificate sette famiglie di malware che hanno colpito l’Italia, ciascuna con caratteristiche e metodi di diffusione specifici.

AgentTesla si è manifestato in tre campagne distinte: due italiane, incentrate sui temi “Ordine” e “Delivery”, e una generica. Queste campagne hanno utilizzato email con allegati in formato ZIP, IMG e ISO come vettore di diffusione.

FormBook è stato rilevato in tre campagne: una italiana focalizzata sul tema “Contratti”, diffusa tramite email con allegati ZIP, e due generiche sul tema “Ordine”, che hanno sfruttato allegati 7Z e RAR. EagleSpy ha lanciato due campagne italiane legate al tema “Banking”. La peculiarità di queste campagne risiede nel metodo di diffusione, ossia un file APK scaricabile tramite un link condiviso via SMS.

LummaC è stato osservato in una campagna generica centrata sul tema “Sociale”, propagata attraverso email contenenti allegati ZIP. StrRat ha condotto una campagna italiana sul tema “Ordine”, diffondendosi mediante email con allegati JAR.

Vidar ha attuato una campagna italiana incentrata sul tema “Pagamenti”. Questa campagna si è distinta per l’utilizzo di PEC con allegati JS come mezzo di diffusione. È importante notare che questa minaccia è stata contrastata con il supporto attivo dei Gestori PEC.

Infine, Guloader ha lanciato una campagna generica sul tema “Ordine”, diffusa tramite email contenenti allegati 7Z e CMD.

Phishing della settimana

Nell’arco della settimana, le campagne di phishing hanno coinvolto tredici marchi noti. Tra questi, alcuni brand sono emersi come bersagli particolarmente frequenti, dimostrando la persistenza e l’evoluzione delle tattiche dei cybercriminali.

Aruba, Poste Italiane e cPanel si sono distinti per il numero di campagne di phishing a loro dedicate. Questi attacchi mirati sfruttano la fiducia che gli utenti ripongono in questi servizi ampiamente utilizzati, rendendo le truffe più credibili e potenzialmente più efficaci.

Tuttavia, il fenomeno più importante è stato l’elevato numero di campagne di phishing generiche rivolte ai servizi di webmail. Queste campagne non si concentrano su un singolo brand, ma mirano a ingannare gli utenti di vari servizi di posta elettronica.

L’obiettivo principale di questi attacchi è l’acquisizione di dati sensibili degli utenti, come credenziali di accesso, informazioni personali e, potenzialmente, dati finanziari.

Formati e canali di diffusione

L’analisi delle campagne malevole della settimana ha rivelato un panorama più diversificato rispetto alla settimana precedente, sia per i tipi di file dannosi che per i metodi di diffusione utilizzati.

In totale, sono stati identificati 11 diversi formati di file malevoli. I file ZIP sono emersi come i più frequenti, utilizzati in tre diverse occasioni. APK, IMG e 7Z sono stati ciascuno impiegato due volte, dimostrando una certa preferenza tra gli attaccanti.

Le restanti sette estensioni – EXE, ISO, JS, PS1, CMD, JAR e RAR – sono state rilevate una sola volta ciascuna, indicando una strategia di diversificazione da parte dei cybercriminali.

Per quanto riguarda i metodi di diffusione, le email si sono confermate il canale preferito, con 36 campagne distinte che hanno sfruttato questo mezzo. Gli SMS sono stati utilizzati in tre occasioni, mentre è stato registrato un singolo caso di utilizzo della Posta Elettronica Certificata (PEC).

---

---

---

https://www.securityinfo.it/2024/09/09/cert-agid-31-agosto-6-settembre-malware-vidar/?utm_source=rss&utm_medium=rss&utm_campaign=cert-agid-31-agosto-6-settembre-malware-vidar

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #f8f8f8; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content: ; display: block; text-align: center; font-size: 18px; color: #404144; }

United States school districts face many daunting issues in creating optimal learning environments, including providing students with security and safety. Students have a tough time engaging with classroom learning if they are fearful of attending school or worried about their safety and security. Many districts are seeking innovative solutions to secure their schools and protect students and staff.

As education systems work to address these challenges with limited resources, data-driven video technology has emerged as an effective solution. Open-platform video management software (VMS), smart cameras, sensors and intelligent analytics provide insights to identify and address potential safety and security threats. Technology advancements have made these systems more affordable and user-friendly for non-security and non-technical users.

While most schools have video security systems in place, these systems are often used only for reviewing incidents after the fact. However, VMS integrated with smart sensors can bring together information to help administrators understand their environment and make decisions in real time. 

Today’s advanced multi-sensor devices offer a wide range of capabilities that can significantly enhance safety, security and operational efficiency for schools and campuses. These intelligent sensors go beyond traditional security functions, providing valuable insights that empower administrators to proactively address potential issues.

Vape detection

One primary concern for educational institutions is the growing vaping epidemic. Multi-sensor devices equipped with advanced vape detection technology can identify the presence of vaping, smoking or other emissions in real time, even in challenging areas like restrooms and locker rooms. These sensors enable swift action and appropriate intervention by promptly alerting staff about vaping incidents.

In addition to vape detection, multi-sensor devices can monitor indoor air quality, tracking metrics such as temperature, humidity and volatile organic compounds (VOCs). This data helps schools maintain a healthy learning environment and quickly address any issues related to HVAC systems or air quality.

Audio analytics and keyword alerts

Audio analytics capabilities in today’s multi-sensor devices enable schools to detect and respond to potential threats or distress. Smart sensors can now recognize specific keywords associated with bullying, violence or vandalism, providing real-time alerts to staff members for rapid response and intervention.

These intelligent sensors go beyond traditional security functions, providing valuable insights that empower administrators to proactively address potential issues.

For example, a provider of multi-sensor devices, has developed a keyword alert system that uses simple phrases such as “help me,” “stop it,” and “emergency.” Unlike other systems that might rely on complex, predetermined keywords, a real-world approach ensures that students and staff can easily remember and use these phrases in emergencies. In addition to English, the devices can also respond to keywords and phrases from more than 20 other languages and dialects, including French, Japanese, Spanish and Korean.

“By using simple, intuitive keywords that people actually say during distress, we’re empowering students and staff to quickly and effectively alert authorities when they need help,” said Lance Parthemore, co-founder of Triton Sensors. “This is a powerful tool provided by AI-enabled technology.”

 Additionally, some multi-sensor devices prioritize privacy by not recording audio and only alerting to keywords spoken with intent, minimizing false alarms. This ensures that students feel safe and protected without compromising their privacy.

Occupancy monitoring and space utilization

Multi-sensor devices with people counting and occupancy monitoring features provide valuable insights into space utilization and crowd levels. This data can help schools optimize resource allocation, identify underutilized areas and ensure compliance with occupancy regulations. In an emergency, real-time occupancy information can assist first responders in locating and evacuating individuals quickly and efficiently.

The true power of multi-sensor devices is realized when they are integrated with data-driven, open platform video management software. An open platform VMS serves as a centralized hub for managing and analyzing data from various sensors and security systems, providing a unified view of the campus environment.

With an open platform VMS integration, schools can configure custom alerts, trigger event-driven actions and seamlessly share data across multiple systems. For example, when a keyword is detected by a device, the VMS can automatically notify relevant personnel, pull up live video feeds and initiate lockdown procedures if necessary.  

A comprehensive solution

A combination of robust policies, educational programs and advanced technology can prove highly effective in managing the problems schools face today. Integrating data-driven video systems and smart sensors represents a significant step toward creating a safer and healthier learning environment.

To harness the full potential of these technologies, school administrators must ensure that they are implemented thoughtfully. This means considering privacy issues, obtaining necessary permissions and ensuring that the technology is used ethically and responsibly. It is equally important to provide school staff training to effectively use these systems and respond appropriately to the data and alerts.

It is crucial to remember that technology is only part of the solution. By taking a holistic approach, schools can make significant strides in addressing school health and safety concerns, promoting a secure and nourishing environment for all students.

https://www.securitymagazine.com/articles/101005-enhancing-school-safety-leveraging-multi-sensor-devices-and-video-technology-software

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #f8f8f8; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content: ; display: block; text-align: center; font-size: 18px; color: #404144; }

In today’s rapidly evolving technological landscape, cyber and physical security convergence has become more critical than ever. With the rise of the Internet of Things (IoT) and the Industrial Internet of Things (IIoT), organizations face unique challenges in safeguarding digital and physical assets. This article explores the concept of security convergence, real-world incidents that illustrate its importance, and best practices for integrating cyber and physical security measures.

Understanding cyber and physical security convergence

Cyber and physical security convergence refers to the integration of traditional physical security measures with modern cybersecurity protocols. This holistic approach ensures that all potential entry points and vulnerabilities are addressed, providing comprehensive protection against a wide range of threats.

The rise of IoT and IIoT

IoT (Internet of Things) refers to the vast network of interconnected devices that communicate and exchange data over the Internet. These include smart home appliances, security cameras, and even smart refrigerators. IIoT (Industrial IoT), on the other hand, pertains to industrial applications of IoT, such as smart manufacturing systems and industrial control systems.

While both IoT and IIoT technologies offer significant benefits in terms of efficiency and convenience, they also introduce new vulnerabilities. Many IoT devices are designed with minimal security features, making them attractive targets for cybercriminals. A lack of stringent security measures in the design and deployment of these devices can lead to severe consequences.

Real-world incidents highlighting the need for convergence

Below are three notable incidents that highlight the need for convergence:

1. The Mirai Botnet Attack
The Mirai botnet attack in 2016 exploited vulnerabilities in IoT devices to launch a massive Distributed Denial of Service (DDoS) attack, disrupting major websites like Twitter, Netflix and Reddit. Mirai spread by scanning the internet for vulnerable IoT devices with default passwords. It used a list of 62 common default usernames and passwords to gain access to these devices. Once infected, the devices became part of the Mirai botnet, which could be controlled remotely to launch DDoS attacks. This incident underscored the critical need for robust security measures (including strict password policies) in IoT devices and the importance of regular firmware updates.

2. The Casino Fish Tank Hack
In 2018, a North American casino experienced a breach when hackers exploited vulnerabilities in an IoT-based fish tank monitoring system. The fish tank had sensors connected to a PC that regulated the tank’s temperature, food and cleanliness. The hackers manipulated a vulnerability in the thermometer to gain access to the casino’s network. Once inside the network, the attackers moved laterally to access the casino’s high-value databases. This case clearly illustrates the risks of integrating unsecured IoT devices into critical network infrastructures and highlights the importance of network segmentation and stringent access controls.

Many IoT devices are designed with minimal security features, making them attractive targets for cybercriminals. A lack of stringent security measures in the design and deployment of these devices can lead to severe consequences.

3. WannaCry Ransomware Attack
The WannaCry ransomware attack in 2017 affected numerous organizations worldwide, including hospitals and educational institutions. The ransomware exploited unpatched vulnerabilities in Windows operating systems, encrypting data and demanding ransom payments. This attack demonstrated the devastating impact of neglecting software updates and highlighted the need for proactive cybersecurity measures to protect against ransomware threats.

Best practices for integrating cyber and physical security

Adopting the following policies is crucial to mitigating the devastating impact of cybersecurity attacks on businesses and critical infrastructure.

• Comprehensive Risk Assessment: Organizations should conduct thorough risk assessments to identify potential vulnerabilities in both their physical and digital infrastructures. This involves evaluating IoT devices, network configurations and physical security measures to secure all potential entry points. Typical examples include assuring encryption, secure protocols, password management and more are in use.
• Regular Firmware and Software Updates: Keeping firmware and software up to date is crucial in protecting against known vulnerabilities. Manufacturers and integrators should ensure that IoT devices and other connected systems receive timely updates to mitigate security risks.
• Network Segmentation: Segmenting networks to isolate critical systems from less secure devices can prevent lateral movement by attackers. This involves creating separate network zones for IoT devices, sensitive data and operational systems, each with its own security protocols.
• Strong Access Controls: Implementing strong access controls, such as multi-factor authentication and role-based access, can significantly enhance security. Zero Trust, where no one is trusted by default, is the new emerging standard. This ensures that only authorized personnel can access sensitive systems and data.
• Employee Training and Awareness: Regular training programs can equip employees with the knowledge to recognize and respond to security threats. This includes understanding the importance of cybersecurity best practices, recognizing phishing attempts, and knowing how to report suspicious activities.
• Advanced Surveillance and Monitoring: Leveraging advanced surveillance systems with AI-powered analytics can enhance both physical and cybersecurity. These systems can detect unusual behavior, detect anomalies in a scene, recognize faces and identify potential threats in real-time, providing a proactive security approach.
• Collaboration with Trusted Vendors: It is essential to partner with reputable vendors who prioritize security in their products and services. Organizations should vet vendors for their security practices and ensure they adhere to industry standards and best practices. For devices like security cameras, ensure that vendors adhere to rigorous standards like FIPS 140-2 Level 3 from NIST (National Institute of Standards and Technology) to protect devices from attack.

The convergence of cyber and physical security is not just a trend but a necessity in the modern threat landscape. As the lines between physical and digital assets continue to blur, a unified approach to security can provide robust protection against a wide range of threats. By adopting best practices and leveraging advanced technologies, organizations can safeguard their assets, protect their data, and ensure the safety of their employees and customers.

https://www.securitymagazine.com/articles/101004-next-generation-security-blending-cyber-and-physical-strategies-for-optimal-protection

Researchers have discovered more than 280 malicious apps for Android that use optical character recognition to steal cryptocurrency wallet credentials from infected devices.

The apps masquerade as official ones from banks, government services, TV streaming services, and utilities. In fact, they scour infected phones for text messages, contacts, and all stored images and surreptitiously send them to remote servers controlled by the app developers. The apps are available from malicious sites and are distributed in phishing messages sent to targets. There’s no indication that any of the apps were available through Google Play.

A high level of sophistication

The most notable thing about the newly discovered malware campaign is that the threat actors behind it are employing optical character recognition software in an attempt to extract cryptocurrency wallet credentials that are shown in images stored on infected devices. Many wallets allow users to protect their wallets with a series of random words. The mnemonic credentials are easier for most people to remember than the jumble of characters that appear in the private key. Words are also easier for humans to recognize in images.

SangRyol Ryu, a researcher at security firm McAfee, made the discovery after obtaining unauthorized access to the servers that received the data stolen by the malicious apps. That access was the result of weak security configurations made when the servers were deployed. With that, Ryu was able to read pages available to server administrators.

One page, displayed in the image below, was of particular interest. It showed a list of words near the top and a corresponding image, taken from an infected phone, below. The words represented visually in the image corresponded to the same words.

<a href="https://rassegna.lbit-solution.it/wp-content/uploads/2024/09/found-280-android-apps-that-use-ocr-to-steal-cryptocurrency-credentials-3.png" class="enlarge" data-height="817" data-width="741" alt="An admin page showing OCR details.
“><img alt="An admin page showing OCR details.
” src=”https://rassegna.lbit-solution.it/wp-content/uploads/2024/09/found-280-android-apps-that-use-ocr-to-steal-cryptocurrency-credentials.png” width=”640″ height=”706″ srcset=”https://rassegna.lbit-solution.it/wp-content/uploads/2024/09/found-280-android-apps-that-use-ocr-to-steal-cryptocurrency-credentials-3.png 2x”>

“Upon examining the page, it became clear that a primary goal of the attackers was to obtain the mnemonic recovery phrases for cryptocurrency wallets,” Ryu wrote. “This suggests a major emphasis on gaining entry to and possibly depleting the crypto assets of victims.”

Optical character recognition is the process of converting images of typed, handwritten, or printed text into machine-encoded text. OCR has existed for years and has grown increasingly common to transform characters captured in images into characters that can be read and manipulated by software.

Ryu continued:

This threat utilizes Python and Javascript on the server-side to process the stolen data. Specifically, images are converted to text using optical character recognition (OCR) techniques, which are then organized and managed through an administrative panel. This process suggests a high level of sophistication in handling and utilizing the stolen information.

People who are concerned they may have installed one of the malicious apps should check the McAfee post for a list of associated websites and cryptographic hashes.

The malware has received multiple updates over time. Whereas it once used HTTP to communicate with control servers, it now connects through WebSockets, a mechanism that’s harder for security software to parse. WebSockets have the added benefit of being a more versatile channel.

Developers have also updated the apps to better obfuscate their malicious functionality. Obfuscation methods include encoding the strings inside the code so they’re not easily read by humans, the addition of irrelevant code, and the renaming of functions and variables, all of which confuse analysts and make detection harder. While the malware is mostly restricted to South Korea, it has recently begun to spread within the UK.

“This development is significant as it shows that the threat actors are expanding their focus both demographically and geographically,” Ryu wrote. “The move into the UK points to a deliberate attempt by the attackers to broaden their operations, likely aiming at new user groups with localized versions of the malware.”

https://arstechnica.com/?p=2047970

The White House Office of the National Cyber Director (ONCD) has released a guide to improve the security of the Border Gateway Protocol (BGP). BGP is essential to internet operation for more than 70,000 independent networks, as internet traffic is directed between networks via the BGP to determine the destinations reachable through those networks. The BGP is foundational to networks such as cloud providers, universities, internet service providers, energy companies, and federal, state, and local governments. By addressing this threat, the ONCD intends to confront an issue that has been a longtime threat to internet traffic security. 

“Securing internet routing has been a long-term effort. It is a difficult one because it takes a lot of different players all taking action to be useful,” says Ari Schwartz, Coordinator of the Center for Cybersecurity Policy and Law. “The ONCD’s roadmap is showing us how to get secure routing done and starting up the collective action efforts needed to get us to the finish line.”

The guide released by the ONCD supports adopting a Resource Public Key Infrastructure (RPKI) as a method to manage vulnerabilities within the BGP, including suggested actions applicable to all types of networks. The provided recommendations are important to operators and owners of critical infrastructure, government entities (both state and local), and any entity dependent on internet access for purposes of high value. 

Roger Grimes, Data-Driven Defense Evangelist at KnowBe4, commented, “We are decades late in securing BGP. Now we have a few good ways to better secure BGP. The United States government supports one of the methods… not the best… but an incremental way forward, and all we need to do is get vendors and organizations to implement it. Getting CISA involved is one great way to accomplish this. I’m not usually very optimistic for any good cybersecurity standard to be well-implemented in a timely manner, but I have great hope for this one. If it is pulled off like we all want it to, in a year or two, BGP will finally be harder to compromise than it has been for decades.”

Schwartz remarks, “The roadmap released by the ONCD marks just the beginning of a comprehensive and collaborative effort to secure our internet’s core ecosystem. We must continue to work across sectors to upgrade the infrastructure and address the evolving challenges in internet security and protect the integrity of our global networks.”

https://www.securitymagazine.com/articles/101013-security-leaders-respond-to-the-white-houses-internet-routing-guide

Most organizations struggle to manage multiple cloud security solutions – yet, multi-cloud adoption is surging, with 79% of businesses using more than one cloud provider. As evident by last year’s zero-day vulnerability in the MOVEit file transfer being exploited by the Clop ransomware group, this was one of the first times we’ve seen an attack demonstrate a shift in targeting cloud storage providers on such a massive scale. 

With so much room for error when organizations rely heavily on their cloud providers’ security controls, IT leaders need a way to decrease the likelihood of a cloud-based breach impacting their business. 

There is no better time for leaders to reassess their cloud security strategies, given increased security mandates and the shock signals that major vulnerabilities have caused across the industry. To jumpstart these conversations and get leaders’ heads out of the cloud and back to reality, here are four tips for better managing the risk of cloud-based attacks.

Continually ask the question, “How are we evaluating our cloud security posture?”

Hopefully, the obvious answer to this question is to ensure that proper processes and tooling are in place to help automate the review of the cloud security controls. There’s an increased demand for cloud computing infrastructure, which means the attack surface constantly changes and expands as resources are added. A Cloud Security Posture Management (CSPM) tool can help close some of these attack surfaces by ensuring organizations can easily identify and remediate risks and protect their data and critical infrastructure.

However, many firms with CSPM tools still lack basic security hygiene and fail to conduct regular security assessments and audits. By consistently running configuration reviews and working with a third party to perform cloud penetration testing, organizations can be one step ahead of threat actors and get proactive in assessing the strengths and weaknesses of their overall cloud security posture.

2. Follow the principle of least privilege to ensure that all cloud services are restricted to internal, authenticated access if public access is not required

The National Institute of Standards and Technology (NIST) defines the principle of least privilege as the idea “that a security architecture should be designed so that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.” While it can be standard practice, it’s best to avoid the use of overly permissive “basic” or “general” roles. This principle is particularly important when working in the cloud, as there are multiple layers of access controls that have to be considered. 

When an organization can restrict identity and access management (IAM) permissions to only those who truly need it – and regularly assess who has access to what – they can limit the blast radius in case of a breach. In the event of a breach, privilege restriction can also halt an attacker from having a suite of disruptive options once in an environment – blocking data access, lateral movement, or privilege escalation. Whenever possible, organizations must enforce and have additional security controls in place for those just-in-time occasions when identities need more advanced privileged access. 

3. Employ a layered security approach that uses both individual service configuration settings and organization-wide policies as an additional guardrail

A layered security approach confirms the complete protection of an organization’s valuable assets. The extra guardrail, implemented prior to a breach or vulnerability being identified or active, ensures all cloud services are restricted to internal, authenticated access – as inadvertent public or anonymous access can lead to the exposure of sensitive data. If a layered approach is not installed, resources can end up in a misconfigured and vulnerable state. Additionally, organizations can add guardrail products and policies to help automatically correct misconfigurations or drift configurations. All of these layers help organizations better identify cloud-based cyber threats by minimizing security gaps across networks before they cause massive damage.

4. Review the cloud provider’s shared responsibility model to determine what is within the customer’s responsibility for security

It’s important never to assume a cloud provider’s security practices are as comprehensive as they need to be in order to keep up with today’s evolving threat landscape. While many cloud providers conduct proactive security testing of their services, they haven’t received the same level of scrutiny or auditing that you’d expect to see from a financial institution or credit card processor. 

Last August, the DHS-led Cyber Safety Review Board started to dig into this issue in the hopes of setting clear expectations for cloud providers regarding security audit requirements and accountability. DHS stepping in should drive cloud providers to create more efficient remediation processes to help decrease their fix times – as there have been instances where cloud providers did not receive the immediate attention needed to help close major gaps. While there are complications with pushing fixes to global products, cloud providers should be evaluating their services and their ability to be agile when issues require fixes. Hopefully, this will be the push the cloud providers need to help proactively chase down and remediate these issues before someone else finds them.

While security leaders wait to see the repercussions of these investigations, they must acknowledge that additional steps are needed to ensure cloud provider resources are secure. A best practice for all teams is to review their cloud providers’ shared responsibility model to determine what responsibilities fall under the cloud provider versus the organization itself. Additionally, organizations should enable regular patch management practices to keep their software updated and upgrade all vulnerable and unsupported versions to supported versions that receive regular security updates.

Cloud providers need to step up their general security practices. But organizations need to as well if they have any hopes of avoiding the rise of cloud-based attacks. With 45% of breaches categorized as cloud-based and recent data indicating that 80% of organizations have undergone a cloud-based incident in the last year, now is the time to take these tips seriously and implement a proactive approach to security.

https://www.securitymagazine.com/articles/101019-four-cybersecurity-best-practices-for-keeping-heads-above-the-cloud

Data is living in more places than ever before, with workloads frequently shifting between on-premises and the cloud. Hybrid IT infrastructures and a proliferation of data and devices not only make it more expensive, complex and time-consuming to manage, but the data is also under constant attack from cybercriminals. Employees can pose a further risk if they accidentally delete or change data.

Research from Forrester illustrates the size of the problem. While over half (52%) of workloads in small and medium-sizes businesses (SMB) are running in the public cloud today, nearly three quarters of SMBs say their organization does not have the capability or capacity to train and upskill their employees as the cloud grows in complexity.

Ransomware attacks are also growing, making it even harder for businesses to keep their data secure. According to a report by Astra, there are now an estimated 19 attempted ransomware attacks every second. Most attacks include attempts to infect data backups, too, leaving many organizations with no choice but to pay the ransom, or risk data loss, reputational damage, financial losses and more.

Backups have always been the last line of defense against ransomware and other attacks – even more so in the face of rising cyber threats. In fact, dozens of global compliance frameworks already mandate backups, and compliance requirements are only increasing.

Hybrid systems create backup sprawl

A reliable, failsafe data protection and disaster recovery strategy should therefore be an organization’s first security investment. But, as attacks continue to surge, businesses are struggling to defend their increasingly complex hybrid infrastructures. Protecting business data wherever it is – across physical servers, mobile devices, SaaS platforms, remote users, collaboration tools and the cloud – may now require solutions from as many as nine or more vendors, as businesses have more environments to back up and need more tools to make this happen.

For example, these could include components from backup software vendors, server hardware manufacturers, hypervisor vendors, operating system vendors, storage and cloud storage vendors, PC backup and SaaS backup vendors – the list goes on.

Unfortunately, sometimes, a rush to implement new cloud services or enable remote access means that data performance takes priority over security considerations, leaving risky security gaps. Organizations may also fall into the trap of opting for cheaper backup solutions to cover each of their data environments, but being cost conscious on the front end often results in a more expensive solution that requires additional systems, infrastructure and administration time.

And, when it comes to cloud services, many businesses wrongly believe the cloud provider has their backup fully covered, when this is often not the case. Most Infrastructure-as-a-Service (IaaS) providers do not offer the storage of historical data or full data protection and recovery out of the box; their terms and conditions state that this is the responsibility of the cloud customer. Moreover, when cloud data is compromised or there is an outage or account lock, backups that are hosted in the same place as the original data will also be affected. To avoid getting caught out, cloud customers must put in place additional data protection measures that meet their own requirements in terms of recovery times and recovery points.

Getting the backup strategy right

To avoid backup sprawl and reduce the administrative burden, organizations should look for a single solution that allows them to create multiple backups of all their data, no matter where it is saved or processed. The first step is a careful audit to understand where the business data resides and how it is currently backed up. Ideally, the backup platform should cover on-premises servers, end devices, SaaS solutions and the public cloud. This makes backup processes more efficient and manageable, while giving better visibility across the entire organization.

Backups should always be immutable, meaning they can’t be changed. They must be verified for integrity and tested for usability – and stored in separate safe locations to avoid the risk of the backup files becoming infected.

Businesses also need to ensure their backup and recovery strategy covers all of the key recovery scenarios – from users losing files to system outages to ransomware attacks. Most organizations will need the ability to spin up a new production environment in case of an outage or cyber incident, to avoid costly downtime.

The cost of creating and managing backups is another important factor. ‘As-a-service’ backup solutions are usually more cost effective and the spend will be more predictable. And finally, as workloads keep switching between on-premises and the cloud, the backup solution must be adaptable enough to evolve with changing needs.

Ultimately, all businesses, no matter their size or industry, are at risk of ransomware and infected backups. Hackers don’t discriminate, so organizations need to assume they are always at risk and they must be prepared. Backups are an essential security tool, but in the age of hybrid infrastructures and remote working, a one-backup strategy is no longer enough. Only a flexible multi-backup strategy that covers the entire IT environment will reliably protect business data from both accidents and attacks.

https://www.securitymagazine.com/articles/101018-data-is-everywhere-what-this-means-for-a-backup-strategy

Research from IANS Research and Artico Search reveals the impact the global economy is having on security budgets. The research includes a survey of more than 750 CISOs from April to August 2024. 

The average budget growth has increased from 6% in 2023 to 8% in 2024. However, this rise is smaller than in previous years, as 2021 saw a growth rate of 16% and 2022 saw one of 17%. Meanwhile, almost two-thirds of CISOs report a higher budget, while a quarter report a flat budget. 12% of CISOs saw budget declines. 

Key findings from the report include: 

• IT is spending more on security, having spent 8.6% of its budget on security in 2020 and 13.2% in 2024. 
• Notable budget increases tend to be driven by external factors (such as breaches or other cyber incidents). Internal factors that may drive a notable increase include mergers of acquisitions.
• Staff growth decreased from 31% in 2022 to 16% in 2023. In 2024, staff growth has lowered to 12%. Still, more than one-third of CISOs report sustaining a consistent headcount. 

The report also found multiyear budget trends vary by sector. For instance, legal services, financial services, hospitality, retail and tech saw an average security budget growth. On the other hand, business services, consumer goods and services, and healthcare saw average declines. 

https://www.securitymagazine.com/articles/101012-new-research-shows-12-of-cisos-faced-budget-declines-in-2024

L’Intelligenza Artificiale resta la protagonista indiscussa del dibattito contemporaneo. Dato l’impatto dirompente dell’AI sulla vita pubblica e privata, le relative tecnologie appaiono oggetto di un’intensa attività normativa – sia nazionale, sia internazionale – tesa a disciplinarne principi, conseguenze ed effetti sui cittadini.

Nel solco di questo sforzo regolatorio si colloca anche il Documento di analisi n. 31, intitolato “Intelligenza artificiale: governance, responsabilità e privacy. L’impatto sul quadro normativo dei sistemi che mostrano un comportamento intelligente”, appena diffuso dall’Ufficio Valutazione Impatto (UVI) del Senato della Repubblica Italiana.

Intelligenza Artificiale: Definizioni, impatti e regolamentazione

Il testo parte dalla definizione di Intelligenza Artificiale adottata dalla Commissione europea nella Comunicazione (2018) 237, a norma della quale essa riguarda “sistemi che mostrano un comportamento intelligente, analizzando il proprio ambiente e compiendo azioni, con un certo grado di autonomia, per raggiungere specifici obiettivi”.

A seguire il documento ripercorre l’evoluzione dell’AI dal test di Turing ai Large Language Models (LMM), per arrivare ad analizzarne l’attuale stato di sviluppo e a riconoscerne l’ormai consolidata rilevanza in “tutte le attività dell’uomo, con ricadute non solo sul piano tecnologico ma anche giuridico, economico e sociale”.

Sul piano regolatorio vengono richiamati anzitutto gli atti dell’Unione Europea, come il Libro Bianco sull’intelligenza artificiale del 2020 e l’Artificial Intelligence Act (AIA), elaborato già a partire dall’anno successivo ma approvato nel 2024, che rappresenta il primo atto normativo al mondo teso a disciplinare compiutamente la materia.

Vengono citati anche il principio di trasparenza e l’approccio risk-based previsti dal legislatore comunitario, che sceglie di graduare i livelli di rischio – minimo, alto, inaccettabile – legati all’utilizzo dell’IA, imponendo regole via via più rigorose quanto maggiore sia il livello individuato.

Si menzionano inoltre l’Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence emanato dalla Casa Bianca nel 2023 e le norme adottate al riguardo da altri Paesi quali Cina, Svizzera e UK; nonché le iniziative di organizzazioni sovranazionali come l’ONU e il Consiglio d’Europa.

In particolare si ricorda come quest’ultimo abbia recentemente elaborato la Framework convention on Artificial Intelligence, Human Rights, Democracy and the Rule of Law, che sarà aperta alla firma a partire dal prossimo settembre.

Aspetti critici e responsabilità derivanti dall’uso dell’Intelligenza Artificiale

Il documento passa, poi, ad analizzare le problematiche connesse all’adozione dei sistemi di Intelligenza Artificiale.

La prima difficoltà individuata è l’assenza di una normativa specifica circa la responsabilità per i danni derivanti dai sistemi AI, che secondo un’indagine del 2020 rappresenta uno dei principali ostacoli alla sua adozione da parte delle imprese.

Da qui, l’opportunità di “integrare tale disciplina per poter fornire una maggiore tutela ai consumatori e agli operatori economici in tutto il Mercato comune europeo”.

Nel testo si ricorda che l’Italia è stata “tra i primi Stati membri a introdurre una disposizione sulla responsabilità civile per i veicoli a guida automatica, prevedendo l’obbligo di assicurazione per veicoli dotati «di tecnologie capaci di adottare e attuare comportamenti di guida senza l’intervento attivo del guidatore, in determinati ambiti stradali e condizioni esterne»”.

Fonte: Commissione europea

Vengono poi considerate le questioni relative al diritto d’autore, ricordando che da un lato “l’utilizzo di IA generativa pone delle criticità in relazione al materiale utilizzato per il cosiddetto training dei modelli stessi” e che, dall’altro, “si pone il problema della protezione del prodotto creato tramite strumenti di intelligenza artificiale generativa”.

Citando lo Study on the impact of Artificial Intelligence on the infringement and enforcement of copyright and designs pubblicato dall’European Union Intellectual Property Office (EUIPO) nel 2022, si sottolinea che “l’uso dell’IA è connesso a molteplici opportunità, drivers, limiti e preoccupazioni rispetto al rischio di violazione dei diritti di proprietà intellettuale”; concludendo che “nel disciplinare la protezione giuridica […] dovranno essere considerati fattori come il tipo di contenuto, il grado di intervento umano, la normativa applicabile (anche da un punto di vista di giurisdizione) e gli interessi che entreranno in gioco”.

Intelligenza Artificiale: Profili di Privacy e di Governance

L’ultima parte del documento di analisi si focalizza sugli aspetti legati alla protezione dei dati personali – facendo riferimento anche al complesso tema del Predictive Policing – e alla governance dell’AI.

Sotto il primo profilo si richiama ancora una volta l’AI Act, che contiene “disposizioni precise rispetto agli usi dell’IA ritenuti a rischio inaccettabile” vietando ad esempio “lo scraping non mirato delle immagini facciali, il riconoscimento delle emozioni sul luogo di lavoro e negli istituti di istruzione [e] la categorizzazione biometrica per dedurre dati sensibili, quali l’orientamento sessuale o le convinzioni religiose”.

In attesa della sua piena entrata in vigore si ricorda come abbiano trovato spazio vari interventi delle Autorità di settore, tra cui la limitazione provvisoria del trattamento dei dati degli utenti italiani imposta dal Garante Privacy italiano verso OpenAI.

Rispetto al secondo profilo, si sottolinea come esistano già diversi organismi deputati a coordinare le azioni di governance dell’Intelligenza Artificiale nel contesto comunitario.

Si tratta dell’Ufficio per l’IA e del Comitato europeo per l’IA, oltre alle nuove entità istituite dall’AIA: il “gruppo di esperti indipendenti” incaricato di fornire consulenze tecniche al suddetto Ufficio e il Forum consultivo, composto da una selezione di stakeholder rilevanti per la materia, che rappresenterà “un canale di feedback per la Commissione e il Consiglio, assicurando una rappresentazione bilanciata tra industria, start-up, PMI, società civile e ambiente accademico”.

In conclusione il documento del Senato, richiamando l’attività del legislatore nazionale – in particolare la Strategia Italiana per l’Intelligenza Artificiale 2024-2026, nella quale essa è considerata una “questione di sicurezza nazionale” – restituisce la complessità legata alla regolamentazione dell’Intelligenza Artificiale, ribadendo l’obiettivo di favorire “una trasformazione digitale inclusiva […] che sostenga la crescita economica e lo sviluppo sostenibile, in linea con i valori democratici condivisi e il rispetto dei diritti umani”.

L’Intelligenza Artificiale rappresenta una delle più grandi rivoluzioni tecnologiche della storia. Per coglierne appieno i benefici, minimizzando i rischi, è essenziale un approccio equilibrato che coniughi innovazione, etica e tutela dei diritti fondamentali. Solo attraverso una governance multilivello e un dialogo costante tra istituzioni, esperti e società civile sarà possibile plasmare un futuro in cui l’IA sia davvero al servizio dell’umanità.

AI Impact Assessment: valutare l’impatto dell’Intelligenza Artificiale

L’AI Impact Assessment (AIIA) sta emergendo come strumento cruciale per gestire i rischi e massimizzare i benefici dei sistemi di Intelligenza Artificiale. Questo processo di valutazione sistematica mira a identificare, analizzare e mitigare i potenziali impatti negativi dell’AI sulla società, l’economia e i diritti individuali.

L’Artificial Intelligence Act dell’UE introduce l’obbligo di condurre valutazioni d’impatto per i sistemi AI ad alto rischio. Questo requisito riflette la crescente consapevolezza che l’AI, pur offrendo enormi opportunità, può anche comportare rischi significativi se non adeguatamente regolamentata e monitorata.

Secondo il Joint Research Centre della Commissione Europea, l’AIIA dovrebbe essere concepito come un processo iterativo che accompagni lo sviluppo e l’implementazione dei sistemi AI lungo tutto il loro ciclo di vita.

Nel report “AI WATCH: Artificial Intelligence Impact Assessment”, il JRC sottolinea l’importanza di un approccio multidisciplinare che coinvolga esperti di diverse aree, dai tecnici agli esperti di etica e scienze sociali.

Gli elementi chiave di un AI Impact Assessment includono:

1. Analisi del contesto: valutazione dell’ambiente in cui il sistema AI verrà utilizzato.
2. Identificazione degli stakeholder: mappatura di tutti i soggetti potenzialmente influenzati dal sistema.
3. Valutazione dei rischi: identificazione e quantificazione dei possibili impatti negativi.
4. Misure di mitigazione: sviluppo di strategie per ridurre o eliminare i rischi identificati.
5. Monitoraggio continuo: implementazione di meccanismi per valutare l’impatto del sistema nel tempo.

L’OCSE, nel suo documento “State of implementation of the OECD AI Principles”, evidenzia come diversi paesi stiano già adottando framework specifici per l’AIIA.

Ad esempio il Canada ha sviluppato uno strumento di valutazione dell’impatto algoritmico per le agenzie governative, mentre il Regno Unito ha introdotto delle linee guida per l’uso etico dell’AI nel settore pubblico.

In Italia, il Comitato Nazionale per la Bioetica ha sottolineato l’importanza di integrare le valutazioni d’impatto dell’AI con considerazioni etiche. Nel parere “Intelligenza Artificiale e Medicina: Aspetti Etici”, il Comitato raccomanda che l’AIIA includa una valutazione approfondita delle implicazioni etiche, soprattutto in ambiti sensibili come la sanità.

L’AI Impact Assessment si configura quindi come un elemento chiave nella governance responsabile dell’Intelligenza Artificiale. Esso rappresenta un ponte tra l’innovazione tecnologica e la tutela dei diritti individuali, contribuendo a creare ecosistemi AI che siano non solo avanzati, ma anche etici e sostenibili.

La sfida per il futuro sarà quella di standardizzare le metodologie di AIIA, garantendo al contempo la flessibilità necessaria per adattarsi ai rapidi progressi tecnologici e alle diverse esigenze settoriali. Sarà essenziale, inoltre, promuovere una cultura della valutazione d’impatto tra gli sviluppatori e gli implementatori di sistemi AI, affinché l’AIIA diventi una prassi consolidata e non un mero adempimento normativo.

In conclusione, l’AI Impact Assessment si sta affermando come uno strumento indispensabile per guidare lo sviluppo e l’adozione responsabile dell’Intelligenza Artificiale, contribuendo a plasmare un futuro in cui l’innovazione tecnologica proceda di pari passo con il benessere sociale e la tutela dei diritti fondamentali.

https://www.ictsecuritymagazine.com/notizie/intelligenza-artificiale/

Set 06, 2024 Marina Londei Approfondimenti, Attacchi, In evidenza, Minacce, News, RSS 0

---

Il quishing non è una minaccia nuova, ma negli ultimi tempi sta interessando in particolare i possessori di auto elettriche. Il termine, combinazione di “QR code” e “phishing”, indica una tecnica di phishing che falsifica i codici QR con l’obiettivo di sottrarre informazioni sensibili da chi scansiona il codice.

Dopo aver scansionato il QR code, le vittime vengono reindirizzate su siti web malevoli per raccogliere credenziali o scaricano direttamente un malware che emula un software legittimo.

Pierluigi Paganini, ricercatore di sicurezza e fondatore di Security Affairs, spiega che, nel caso delle colonnine di ricarica, il codice QR contraffatto viene applicato su quello originale usato per effettuare il pagamento. Gli utenti navigano su un sito web falso che imita quello reale dove gli viene richiesto di inserire i propri dati sensibili, comprese le informazioni di pagamento; questi dati vengono poi inviati ai cybercriminali che li usano per altre attività fraudolente.

Paganini sottolinea che la diffusione del quishing nel mondo delle auto elettriche potrebbe avere un impatto negativo sull’adozione di questi mezzi: con la paura degli attacchi, la fiducia nell’infrastruttura pubblica di ricarica potrebbe calare e rallentare il passaggio alla mobilità green.

Per contenere questo fenomeno, i gestori delle stazioni di ricarica dovrebbero adoperarsi per mostrare il codice QR su uno schermo, non usando uno sticker attaccato alle colonnine. La manomissione delle stazioni di ricarica per alterare il codice è comunque possibile, ma è un’operazione molto complessa.

Agli utenti si chiede invece di preferire carte ricaricabili per usare le colonnine e di segnalare al gestore della stazione qualsiasi QR code che sembra essere stato manomesso o attaccato sopra il vecchio. Quando si naviga sul sito web del codice QR è importante verificare che il dominio sia corretto e che l’indirizzo inizi con HTTPS. 

Proteggersi dal quishing non è impossibile, ma per farlo bisogna prestare la massima attenzione quando si interagisce con le colonnine e segnalare qualsiasi aspetto sospetto.

---

---

---

https://www.securityinfo.it/2024/09/06/il-quishing-usato-nelle-colonnine-di-ricarica-delle-auto-elettriche/?utm_source=rss&utm_medium=rss&utm_campaign=il-quishing-usato-nelle-colonnine-di-ricarica-delle-auto-elettriche