The Identity Theft Resource Center (ITRC) has released a report analyzing H1 data breach incidents for 2024. According to the report, there was a 490% rise in data breach victims in H1 of 2024 compared to H1 of 2023. Yet, Q2 had 732 publicly reported data breaches, which represents a 12% decrease from Q1. 

Security leaders weigh in 

Stephen Kowski, Field CTO at SlashNext: 

“The surge in breach victims is likely due to several large-scale breaches of major companies with extensive customer databases. Increased remote work has expanded the attack surface for many organizations. Additionally, more sophisticated attack methods powered by AI are allowing cybercriminals to breach defenses at an accelerated rate.

“Organizations should implement AI-powered controls across all messaging and communication channels to stop initial credential harvesting attempts. A zero trust security model with multi-factor authentication is crucial. While regular security awareness training is important, it’s insufficient alone against sophisticated phishing and social engineering attacks. Robust, AI-driven email and messaging security that can detect and block advanced threats in real-time is essential to mitigate large-scale data breach risks.

“Employee training plays a complementary role in preventing data breaches. While it can’t stand alone, well-designed security awareness programs help staff recognize evolving threats and reinforce best practices. Training should be frequent, engaging and include simulated phishing tests. However, human vigilance has limits. To truly mitigate risks, organizations must combine training with advanced technological defenses, particularly AI-powered controls across all communication channels. This dual approach addresses both the human factor and the sophisticated nature of modern cyber threats.

“Organizations need to adopt a proactive, multi-layered approach to security that combines technology, processes and people. This includes implementing advanced threat detection systems, regularly updating incident response plans and fostering a culture of security awareness. Transparency and quick response in the event of a breach are also crucial for maintaining consumer trust.”

Chris Morales, Chief Information Security Officer at Netenrich:

“Today, we’re seeing a rise in sophisticated, AI-enhanced attacks. Advanced persistent threats, supply chain vulnerabilities and highly convincing social engineering tactics are becoming more prevalent. Attackers leverage machine learning to create targeted phishing campaigns and even deepfakes for business email compromise. This evolution underscores the need for security operations to become more data-driven and adaptive.

“When it comes to the surge in breach victims, several factors are at play: expanded attack surfaces due to remote work and cloud adoption, more sophisticated ransomware attacks often involving data exfiltration and the democratization of attack tools through ransomware-as-a-service. We’re also seeing larger-scale breaches affecting millions of users at once. This surge not only highlights the urgent need for a paradigm shift in security operations, but it also underscores the need for immediate action, moving towards more proactive, data-driven strategies.

“Organizations should implement comprehensive SecOps solutions that provide holistic visibility across their IT environment. Leveraging advanced data engineering and AI within these frameworks can enable continuous, adaptive threat detection and response. Adopting a “zero-trust architecture,” which means that no user or system is by default trusted, even if they are inside the corporate network, is a crucial strategy. This approach, along with regular vulnerability assessments and employee cybersecurity training, is vital. The key is to build a continuous feedback loop in security operations, constantly learning and adapting to the evolving threat landscape.

“Organizations need to embrace continuous improvement and adaptation in their cybersecurity strategies. This involves regularly reassessing risk postures, investing in threat intelligence capabilities and fostering a culture of security awareness. The future lies in more autonomous, data-driven security operations, using AI and automation to handle routine tasks while freeing human analysts for strategic issues. By aligning people, processes and technology around a data-centric approach, organizations can significantly enhance their security posture and maintain customer trust in an ever-changing threat landscape, emphasizing the need for a holistic approach to cybersecurity.”

Justin Kestelyn, Head of Hacker Community Marketing at Bugcrowd:

“At the highest level, attack vectors are trending toward becoming more diversified, targeted and sophisticated — which is a reflection of the increasing number of well-financed and well-organized adversaries in recent years; malicious hacking is now big business. To be more specific, (1) phishing and other social engineering attacks have become extremely personalized, convincing, and effective; (2) adversaries have learned that attacking adjacent, relatively unhardened targets (e.g. in supply chain partners) offer productive lateral movement opportunities; and (3) generative AI is becoming a useful tool to help amplify existing techniques (e.g., for personalizing phishing attacks).

“The rise in breach victims is due to a combination of better technique (as described above) and more complex attack surface. With respect to the latter, companies have become very good at integrating public cloud providers in everything they do, using code written by third parties (e.g. open source libraries), and integrating data from multiple sources. That leads to an increase in attack surface complexity and security gaps, all of which are catnip for adversaries.

“The most urgent thing organizations can do is to become proactive about cybersecurity by first admitting and assuming that (1) vulnerabilities are inevitable, and (2) that adversaries are inspecting your attack surface for them every day. Leading with those assumptions will transform how cybersecurity is defined and done in your organization.

“The best way to prepare is to have access to solutions that evolve along with that landscape — for all their benefits, automated solutions are built to fight yesterday’s battles, not to handle emerging ones such as AI safety and security vulnerabilities. That’s where access to human ingenuity enters the chat, because nobody has built a tool that adapts to (and anticipates) the environment as quickly as the human mind. This approach is also critical for maintaining consumer trust because it signifies a commitment to doing everything proactively possible to protect their interests.”

https://www.securitymagazine.com/articles/100870-data-breach-victims-increased-by-490-since-the-first-half-of-2023

Kimberly Cheatle, U.S. Secret Service Director, has resigned. This resignation is in the wake of the recent assassination attempt against former president Donald Trump.

A hearing followed the assassination attempt, in which political leaders on both sides of the aisle expressed discontent with Cheatle’s testimony. House Oversight Committee Chairman James Comer of Kentucky said, “The American people have questions. They deserve answers. Congress deserves answers. You were subpoenaed today to provide answers, and, ma’am, you did not do that.”

Jointly, Rep. Jamie Raskin of Maryland and Comer released a letter calling on Cheatle to resign. The letter stated, “Today, you failed to provide answers to basic questions regarding that stunning operational failure and to reassure the American people that the Secret Service has learned its lessons and begun to correct its systemic blunders and failures.”  

At the hearing, Cheatle stated, “The Secret Service’s solemn mission is to protect our nation’s leaders. On July 13th, we failed. As the Director of the United States Secret Service, I take full responsibility for any security lapse.”

Cheatle says the Secret Service is cooperating with several ongoing investigations. 

https://www.securitymagazine.com/articles/100873-us-secret-service-director-kimberly-cheatle-resigns

Lug 23, 2024 Marina Londei Approfondimenti, News, RSS, Tecnologia 0

---

Le password sono ormai universalmente riconosciute come un metodo di autenticazione debole e andrebbero sostituite da meccanismi più robusti, come l’autenticazione multi-fattore e le passkey. Le passkey permettono di accedere ai propri dispositivi e account utilizzando codici e biometria, come l’impronta digitale, il riconoscimento facciale, il PIN o un codice temporaneo.

Questo meccanismo di autenticazione è considerato intuitivo e sicuro: le informazioni per il login vengono salvate solo sul dispositivo utente e i servizi esterni non accedono mai a questa informazione. Quando si crea una passkey, infatti, viene generata una coppia di chiavi, di cui una pubblica e una privata: quella pubblica viene condivisa con il sito web o l’applicazione a cui si vuole accedere, mentre quella privata rimane sul dispositivo utilizzato. Quando un utente vuole autenticarsi, gli è sufficiente usare le proprie credenziali biometriche o i codici per verificare la corrispondenza tra le due chiavi e procedere con il login.

Nonostante siano oggettivamente più sicure delle password, ci sono comunque dei limiti da considerare e gestire in maniera adeguata. In un post sul suo blog, Micah R Ledbetter, ingegnere e programmatore, spiega innanzitutto che nella maggior parte dei casi vengono abilitate di default, migrando gli account verso questo nuovo meccanismo di autenticazione.

È il caso per esempio di Apple che sta migrando gli account nelle nuove versioni di iOS e macOS, e gli utenti si ritrovano col dover creare obbligatoriamente una passkey per l’autenticazione e non possono scegliere altro provider per generarla.

In questo caso non si tratta di un problema legato alle passkey in sé, quanto piuttosto a un modo non molto corretto di gestirle. Il vero problema di questo meccanismo di autenticazione è una sorta di “discriminazione” esplicita tra le applicazioni: i siti web che utilizzano passkey sanno in quale applicazioni l’utente mantiene queste chiavi, e possono anche scegliere di supportarne alcune e non altre.

Le passkey e il problema di KeePassXC

Per esporre il problema, Ledbetter porta l’esempio di KeePassXC, un’applicazione open source per gestire le passkey. Un senior architect di Okta aveva evidenziato due problematiche importanti di questo tool: la prima è che KeePassXC non è compliant con l’implementazione richiesta per la verifica dell’autenticazione e per questo alcuni siti web potrebbero bloccare l’operazione. In questo caso l’utente non potrebbe effettuare il login e quindi usare il servizio.

Il secondo problema riguarda il fatto che KeePassXC consente di esportare le password senza cifrarle. Si tratta di un rischio di sicurezza molto elevato che non può essere risolto con un semplice avviso da mostrare agli utenti: occorre implementare dei meccanismi che impediscano a un utente di copiare una password senza cifratura.

È normale allora che molti servizi decidano di bloccare questo tipo di applicazioni: dal punto di vista di chi li eroga, una gestione insicura delle credenziali non è un pericolo solo per l’utente, ma anche per la compagnia stessa.

“D’altra parte, è negativo per la società se solo le entità controllate e autorizzate possono creare applicazioni con passkey, ed è negativo per gli utenti se non possono scegliere di utilizzare una particolare applicazione con passkey” spiega Ledbetter.

Il fatto che ci sia un modo per discriminare le applicazioni e uno standard per definire le chiavi permette ai fornitori di servizi di decidere quali applicazioni bloccare e quali accettare, e per di più forzare l’utente a riautenticarsi in qualsiasi momento.

Le passkey rimangono comunque un metodo robusto di autenticazione che andrebbe sempre preferito alle password, ma è necessario definire degli standard più precisi che non vadano a danno degli utenti. 

---

---

---

https://www.securityinfo.it/2024/07/23/le-passkey-sono-unottima-alternativa-alle-password-ma-hanno-dei-problemi/?utm_source=rss&utm_medium=rss&utm_campaign=le-passkey-sono-unottima-alternativa-alle-password-ma-hanno-dei-problemi

As artificial intelligence (AI) becomes increasingly embedded into society — at home and in the office — through virtual assistants, automated services and workplace productivity tools, there is a pressing need for regulatory guardrails and governance policies to protect consumer privacy and data rights. Corporate AI adoption presents organizations with a rising threat of potential privacy violations.

Shockingly, 45% of surveyed organizations have experienced unintended data exposure when implementing AI systems — a harsh reality check on their biggest pre-deployment fears. Despite 88% of respondents claiming to have data management strategies in place, a troubling 44% lack even basic measures like archiving policies and data lifecycle controls.

More data, more problems

This lapse in data management is particularly concerning given the amount of data consumed by AI solutions. Currently, 64% of organizations grapple with over one petabyte of data, and over 41% handle a staggering 500 petabytes or more. The potential for mishandling the troves of personal data contained within these datasets expands dramatically through the adoption of AI technology.

Compounding these risks, only 38% of executives currently offer AI training and education opportunities to employees — despite many executives citing generative AI as a “top investment priority.” This lack of formal education could enable preventable errors that compromise privacy. However, the stakes extend far beyond any individual corporation’s security protocols. Generative AI models, such as those from OpenAI and Google, are trained on massive volumes of data scraped from across the internet — likely containing sensitive personal communications, transaction histories and demographic details — all without explicit user consent. 

What’s more, it’s recently been found that more than 74% of the use of ChatGPT at work was through non-corporate accounts, and more than 90% of the use of Gemini (and its predecessor Bard) was through non-corporate accounts — underscoring the need for comprehensive education and policies surrounding the safe use of these tools, especially with the rise of BYOD policies. 

Governing the ungoverned: AI’s data consumption needs rules

As businesses rush to capitalize on AI’s competitive advantages with minimal guardrails, consumer faith in data privacy protections could emerge as an unintended sacrifice. Consequently, there is now an urgent need for national and international regulatory frameworks that enforce robust data management, transparency over AI data practices and penalties for privacy violations. Stricter data governance policies on an individual and company-wide basis are also essential.

Europe’s AI Act, the world’s first comprehensive AI law, is a strong start. It categorizes technology risk, ranging from “unacceptable” — which would see the technology banned — to high, medium and low hazard. Additionally, companies like Google have attempted self-regulation to avoid contributing to the spread of misinformation. While the United States has historically lagged behind Europe in data privacy regulation, individuals and organizations alike must push for federal standards surrounding trust and transparency in the coming years.

Beyond industry-wide regulation

Organizations must also do due diligence to protect users’ privacy and workplace data when using AI. An advanced information management strategy is crucial, prioritizing consistent and structured data classification and archiving policies, along with automated processes to effectively manage snowballing amounts of data. With strong data privacy protections and a clear understanding of who owns and uses our data, society can develop trust in AI and work towards productive, powerful and ethical use of these tools.

As AI continues to shape our world, safeguarding consumer privacy becomes paramount. Regulatory frameworks, education and robust data management are essential to ensure responsible and transparent AI practices — as society strives for a future where AI empowers individuals without compromising their fundamental rights. 

https://www.securitymagazine.com/articles/100869-unchecked-ai-threatens-consumer-privacy-regulation-is-crucial

Sumsub unveils the ‘2024 Fraudlympics,’ an awareness campaign displaying fraud data across a range of countries, industries and categories. The data reveals which nations are leading in categories such as: 

• Fraud by type (deep fakes, identity theft, etc.) 
• Fraud by document (driving license, passport, etc.)
• Fraud by industry (crypto, iGaming, etc.) 

In the awareness campaign, countries with the highest growth rates in these categories were noted with a gold medal. The data shows that Nigeria is marked with three gold medals, representing the highest growth rates for identity theft (748%), fraud in the crypto sector (1,056%) and forced verification (1,091%). Indonesia and China earned one gold medal each for identity theft (748%) and deepfake fraud (964%), respectively. 

As fraud tactics continue to evolve, organizations are encouraged to remain aware of fraud trends. According to the ‘2024 Fraudlympics’ campaign, AI-powered fraud attacks are a predominant technique utilized by malicious actors, including deepfake fraud attempts. AI-driven fraud attempts are predicted to increase in the coming years. 

https://www.securitymagazine.com/articles/100868-the-2024-fraudlympics-highlight-rising-trends-in-global-fraud

Nel panorama della sicurezza informatica, la minaccia di attacchi fisici tramite dispositivi USB malevoli è una realtà crescente. Tra questi, uno dei più insidiosi è il famigerato USBsamurai. Questo piccolo dispositivo, apparentemente innocuo, rappresenta una vera e propria bomba a orologeria per qualsiasi infrastruttura industriale. Scopriamo insieme di cosa si tratta, come funziona e quali misure adottare per difendersi.

Cos’è USBsamurai?

USBsamurai, è solo uno dei tanti impianti hardware maliziosi che vari ricercatori nel mondo hanno creato negli ultimi anni per testare e migliorare la postura di sicurezza di infrastrutture critiche aziendali ed industriali. Il loro comune denominatore è uno: COTTONMOUTH. Nome in codice di un impianto hardware sviluppato dal NSA e reso noto al pubblico da Edward Snowden nel 2013 (https://upload.wikimedia.org/wikipedia/commons/8/85/NSA_COTTONMOUTH-I.jpg). In sintesi, si trattava di un impianto hardware malevolo controllato da remoto via radio, mascherato da innocuo cavetto USB. Il quale, una volta collegato al computer vittima avrebbe permesso all’agente operativo di compromettere remotamente la macchina e dargli accesso illimitato ad essa e, potenzialmente, alla rete a cui tale PC era collegato.

USBsamurai, Origini e Ispirazione

Proprio come COTTONMOUTH, USBsamurai è un dispositivo di hacking. Tuttavia, a differenza del primo, è relativamente semplice da costruire con componenti COTS (Commercial off-the-shelf) facilemnte reperibili ed a basso costo (i.e. 15 EUR), mascherato da cavetto USB, progettato per eseguire attacchi informatici quando viene collegato a un computer o a un sistema industriale. A prima vista, sembra un comune cavo USB, ma al suo interno nasconde potenti funzionalità che lo rendono un’arma temibile.

Come Funziona USBsamurai?

Una volta collegato ad un computer vittima, USBsamurai può eseguire una serie di operazioni malevole in modo autonomo e quasi impercettibili. Ecco alcune delle sue caratteristiche principali:

• Automazione degli Attacchi: Può essere programmato per eseguire comandi specifici non appena viene collegato, come l’apertura di terminali, l’iniezione di comandi o l’installazione di malware.
• Interfaccia HID (Human Interface Device): Simula l’input di tastiera o mouse, permettendo di eseguire azioni come se fossero fatte dall’utente, bypassando molte delle misure di sicurezza standard.
• Raccolta di Informazioni: Può raccogliere dati sensibili dal sistema target e trasmetterli a un server remoto o salvarli localmente per un successivo recupero.
• Bypass di sistemi Air-Gapped Attraverso il controllo remoto via radio ed un protocollo di comunicazione sicuro basato su cifratura AES a 2.4GHz, USBsamurai è perfetto per essere utilizzato in ambienti “Air-Gapped”, poichè creare un canale di comunicazione alternativo e occulto tra l’attacante ed il sistema vittima. Un Air-Gap fisico implica la separazione fisica tra due sistemi informatici. Ad esempio, un’organizzazione quali una banca, un impianto nucleare, un complesso militare, può mantenere un sistema di rete completamente isolato da Internet o da qualsiasi altro sistema esterno.

Perché è Pericoloso per le Infrastrutture Industriali?

Le infrastrutture industriali sono particolarmente vulnerabili agli attacchi fisici per diverse ragioni:

• Accesso Fisico: In molte realtà industriali, il controllo dell’accesso fisico può non essere rigido come quello dei sistemi informatici, permettendo a un attaccante o un ignara vittima a cui è stato donato un device USB malizioso (i.e. vedasi casi noti di attacchi simili [1] [2] [3] [4] [5]) di collegare dispositivi USB con relativa facilità.
• Sistemi Critici: I sistemi industriali controllano processi critici che, se compromessi, possono causare danni significativi, fermare la produzione o addirittura mettere in pericolo vite umane.
• Obsolescenza Tecnologica: Molti impianti utilizzano hardware e software datati, spesso non più supportati o aggiornati, rendendoli particolarmente suscettibili agli attacchi.

Composto da un cavo USB classico, un ricetrasmettitore proveniente da mouse/tastiera wireless ed un firmware creato ad-hoc e disponibile in opensource su github, USBsamurai, una volta assemblato e programmato, può essere controllato a distanza.

USBsamurai non è solo un cavo, ma può essere facilmente utilizzato come impianto hardware interno per armare altri dispositivi USB, per esempio: un mouse, da poi donare/sostituire alla vittima.

USBsamurai in Azione

Osserva USBsamurai in azione in questi video dimostrativi:

1. Attacco simulato a una centrale nucleare
2. Compromissione di un impianto chimico
3. Presentazione del DEFCON demo labs

Nel seguente video è possibile vedere in azione USBsamurai. Il quale viene utilizzato per condurre un attacco nei confronti di una engineering workstation di un impianto nucleare (simulato) in cui viene inoculato un finto malware ransomware per spiegare anche ai meno esperti del settori di come, in determinati ambienti altamente critici, non ci si possa fidare nemmeno di un cavo USB (all’apparenza innocuo).

In questo video, invece, vengono presentati una serie di attacchi ad una simulazione di un infrastruttura industriale (i.e. impianto chimico) ed in particolare la conduzione del cosidetto air-gap bypass che va a colpire un’infrastruttura totalmente isolata con l’esterno. La quale, una volta compromessa con USBsamurai, ha portato all’esplosione del serbatoio di contenimento delle tossine e quindi allo sversamento delle stesse, senza che l’engineering workstation avvisasse il personale in anticipo dell’imminente incidente.

Infine, per i lettori più curiosi, si consiglia la visione della presentazione fatta a DEFCON demo labs:

Come Proteggersi da USBsamurai

USBsamurai rappresenta una minaccia concreta per qualsiasi infrastruttura industriale. La sua capacità di agire in modo invisibile e autonomo lo rende particolarmente pericoloso. È fondamentale che le aziende adottino misure di sicurezza adeguate per proteggere i loro sistemi da questa tipologia di attacchi, garantendo così la continuità operativa e la sicurezza delle loro operazioni. In un mondo sempre più interconnesso e automatizzato, la consapevolezza e la prevenzione sono le armi migliori contro le minacce emergenti. La difesa contro impianti hardware malevoli come USBsamurai richiede un approccio multilivello:

• Controllo degli Accessi Fisici: Implementare misure rigide per controllare chi può accedere alle aree sensibili e ai sistemi critici.
• Politiche di Sicurezza USB: Limitare l’uso di dispositivi USB non autorizzati (i.e. qualsiasi dispositivo USB e non concentrarsi esclusivamente sulle Flash Drives!) eb utilizzare software che possa rilevare e bloccare dispositivi USB malevoli (i.e. soluzioni DLP – Data Loss Prevention).
• Aggiornamenti e Patch: Assicurarsi che tutti i sistemi siano aggiornati e che siano applicate le patch di sicurezza più recenti.
• Educazione e Consapevolezza: Formare il personale sui rischi associati ai dispositivi USB di qualsiasi natura & forma (i.e. innocui cavetti USB inclusi).

Riferimenti e Note

[1] https://www.isssource.com/ics-alert-usb-malware-attack/

[2] https://www.powermag.com/dhs-usb-drives-spread-malware-in-control-system-environment-at-two-power-plants/

[3] https://unit42.paloaltonetworks.com/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/

[4] https://www.darkreading.com/ics-ot-security/to-damage-ot-systems-hackers-tap-usbs-old-bugs-and-malware

[5] https://www.securityweek.com/honeywell-usb-malware-attacks-on-industrial-orgs-becoming-more-sophisticated/

Articolo a cura di Luca Bongiorni

https://www.ictsecuritymagazine.com/articoli/sicurezza-industriale-usbsamurai-la-minaccia-invisibile-per-le-infrastrutture-industriali/

Trend Micro has observed an advanced persistent threat (APT) group exploiting vulnerabilities in Internet Explorer. The group, known as Void Banshee, is leveraging a recently patched vulnerability to infect victim machines with the Atlantida info-stealer. This is part of a multi-stage attack involving uniquely crafted URL files and impacting the Windows MSHTML Platform. 

The vulnerability in question is CVE-2024-38112, affecting Microsoft Internet Explorer v 11 – 11.1790.17763.0, Windows: before 11 23H2 10.0.22631.3880 and Windows Server: before 2022 10.0.20348.2582. 

Void Banshee exploits CVE-2024-38112 to infect targeted machines with the info-stealer, seeking sensitive data such as passwords, system information and cookies. Zip archives hosting malicious files are disguised as book PDFs in order to lure targets. These are often distributed through cloud-sharing websites, online libraries and Discord servers. These attacks are predominantly observed in North America, Europe and Southeast Asia. 

Security leaders weigh in 

Mr. Mayuresh Dani, Manager, Security Research, at Qualys Threat Research Unit:

“MHTML attacks are not new. A prime example we’ve seen in the past is CVE-2021-40444, where the delivery mechanism was a MSWORD file. CVE-2024-38112 in this case is somewhat similar and uses .URL files as a means of exploitation. The underlying premise in both these attacks is the ability of an attacker to call the older Internet Explorer instead of the more secure Chrome/Edge. Microsoft has taken a route of unregistering the “.mhtml” handler in .url files for this security update.

“This CVE is definitely important for the fact that it led to two patches, one for CVE-2024-38112 and another defense-in-depth patch for fixing the .hta evasion trick. Both these patches are important and were released this Patch Tuesday.” 

Callie Guenther, Senior Manager, Cyber Threat Research at Critical Start:

“MHTML (MIME HTML) is a web page archive format used to combine resources such as images, applets, and scripts into a single file. This is particularly useful for saving and sending complete web pages. MHTML files typically have a .mht or .mhtml extension and are often used by Microsoft Internet Explorer.

“CVE-2024-38112 is a vulnerability in the Microsoft MSHTML platform, which is a core component of Internet Explorer responsible for rendering web pages. This specific flaw allows for a spoofing attack, where an attacker can craft a malicious MHTML file that, when opened by the victim, could execute arbitrary code. The attack begins with a malicious MHTML file, often disguised as a legitimate internet shortcut file. By opening this file, the user inadvertently triggers the vulnerability, allowing the attacker to execute malicious scripts. These files are distributed through cloud-sharing services, Discord servers, and online libraries, increasing their reach.

“Microsoft addressed this vulnerability in its July 2024 Patch Tuesday release. Despite the patch, the vulnerability remains significant due to several factors:

1. “Delayed or Missed Updates: Many users and organizations may not immediately apply patches, leaving systems vulnerable.
2. Legacy Systems: Unsupported and outdated systems, such as old versions of Internet Explorer, are still in use and are prime targets for such vulnerabilities.
3. Evolving Attack Techniques: APT groups like Void Banshee continually adapt their tactics. Even after a patch is released, they can find new ways to exploit the vulnerability before widespread adoption of the update.

“The Void Banshee group has been actively exploiting this vulnerability to distribute the Atlantida info-stealer, targeting sensitive user data. The group’s focus on using cloud-sharing platforms and popular communication tools for distribution highlights their sophisticated approach and broad reach.

“The discovery and exploitation of CVE-2024-38112 by Void Banshee underline the critical importance of timely security updates and patch management. Even with a patch available, the risk persists due to the slow uptake of updates and the continued use of legacy systems. As always, defenders must prioritize awareness and prompt action to mitigate such vulnerabilities effectively.” 

https://www.securitymagazine.com/articles/100867-windows-users-targeted-with-zero-day-attacks-via-internet-explorer

A judge has dismissed a majority of the SEC lawsuit against SolarWinds, apart from securities fraud claims prompted by a statement on SolarWinds’s website that advertised the company’s security controls. The judge stated that SolarWinds previously acknowledged it had no obligation to disclose individual cyber incidents and no promised ability to prevent all cyber incidents. Furthermore, the judge asserted that anti-fraud laws do not obligate risk warnings to contain “maximum specificity.”

This lawsuit, which was filed last October, alleged that SolarWinds defrauded investors by hiding security vulnerabilities before and after a cyberattack targeted in the United States federal government. The SEC further alleged that SolarWinds downplayed the severity of the cyberattack’s impacts after it occurred. All claims against against SolarWinds and CISO Timothy Brown were dismissed for statements after the attack.  

In regard to the SolarWinds ruling, John Gunn, CEO of Token, provided the following commentary:

“The backdrop to this ruling is the recent SCOTUS decision in Loper that overturned the Chevron deference and placed a greater burden on regulatory agencies, including the SEC, to more clearly define regulatory requirements and to move decisions on penalties from agencies to the courts. 

“Anyone who sees this as SolarWinds being relieved from the consequences of their actions is overlooking the $26 million they paid to settle the shareholder class action lawsuit resulting from this incident and the staggering $2 billion loss in company value they have suffered since the incident was disclosed. These financial penalties have the biggest impact on other organizations’ motivation to pursue more stringent cybersecurity protections and disclosures.”

https://www.securitymagazine.com/articles/100866-a-majority-of-the-sec-lawsuit-against-solarwinds-has-been-dismissed

Lug 22, 2024 Marina Londei Attacchi, Hacking, Malware, Minacce, News, RSS 0

---

I ricercatori di Trend Micro hanno scoperto una variante Linux del ransomware Play che cifra i file solo quando si trova in un ambiente ESXi VMware. Il gruppo è attivo dal 2022, ma è la prima volta che esegue campagne attaccando i sistemi Linux.

Finora il ransomware ha colpito per lo più organizzazioni negli Stati Uniti, in particolare quelle del settore manifatturiero e dei servizi professionali. La variante Linux indica che il gruppo sta cercando di espandersi per colpire nuove vittime e aumentare i propri guadagni.

I ricercatori spiegano che il gruppo ottiene l’accesso iniziale ai sistemi tramite tecniche di phishing, sottraendo credenziali valide di utenti aziendali. In seguito, dopo aver stabilito la comunicazione, esegue una serie di tool per individuare altre macchine da infettare (Netscan), per il movimento laterale (PsExec), per la gestione dei comandi inviati dal server C2 (Coroxy backdoor) e per l’esfiltrazione dei dati (WinRAR e WinSCP).

La variante ESXi esegue una serie di comandi relativi a questo ambiente per capire se si trova effettivamente in un ambiente VMware; in caso positivo, prosegue con il flusso di infezione, altrimenti termina il processo e cancella tutti i file creati.

Tra i file cifrati ci sono anche quelli relativi alla VM, come le informazioni sui dischi, le configurazioni e i metadati. La maggior parte dei file cifrati contiene informazioni critiche sulle applicazioni e sull’utente della macchina. Dopo aver concluso il processo di cifratura, la variante Linux del ransomware appende l’estensione “.play” ai file risultanti e crea una nota per il riscatto nella directory di root contenente i link ai siti Tor del gruppo.

Secondo l’analisi dei ricercatori, l’URL da cui gli attaccanti scaricano il payload del ransomware è collegato a Prolific Puma, un altro gruppo di cybercriminali. Prolific Puma è noto per generare nomi di dominio tramite un algoritmo apposito e utilizzarli per offrire un servizio di link-shortening per gli altri attaccanti, i quali lo usano poi per eludere i controlli durante le campagne di phishing e malware.

Per proteggere efficacemente gli ambienti ESXi (e non solo) dai ransomware, i ricercatori ricordano di applicare regolarmente le patch e installare gli ultimi aggiornamenti disponibili, segmentare la rete e implementare meccanismi robusti per il controllo degli accessi. Per minimizzare la superficie di attacco è inoltre fondamentale disabilitare tutti i servizi e i protocolli non utilizzati. Infine, è opportuno pianificare ed eseguire backup regolari e risolvere le potenziali configurazioni errate degli ambienti di lavoro.

---

---

---

https://www.securityinfo.it/2024/07/22/scoperta-una-variante-linux-del-ransomware-play-che-colpisce-gli-ambienti-esxi/?utm_source=rss&utm_medium=rss&utm_campaign=scoperta-una-variante-linux-del-ransomware-play-che-colpisce-gli-ambienti-esxi

Automated at-scale attack campaigns now represent the vast majority of online threats, and are starting to blend together with targeted attacks. As the number of these attacks increases, so does the cyber risk for organizations.  

Unfortunately, the most common approaches to defense — including vulnerability management, phishing awareness, signature-based network and endpoint detection — are neither effective nor efficient in addressing these kinds of attacks because traditional third-party threat intelligence cannot provide adequate targeted attack visibility. 

In the second quarter of 2023, GreyNoise researchers observed a substantial change in the behavior of some regular internet scanning idioms. Inventory scans —where both benign and malicious actors perform regular checks for a given technology or specific vulnerability — significantly reduced in frequency and scale. The vast majority of these types of scans now come from benign sources. This, along with the speed at which organizations are compromised after the announcement of a new vulnerability, strongly suggests more capable attacker groups have their own form of “attack surface monitoring,” and use it to avoid tripping existing defenses. 

These targeted attacks threaten to circumvent existing defense capabilities and expose organizations to a new wave of disruptive breaches. In order to adequately protect their networks, defenders must evolve in response.

Honeypots are back in vogue 

Although there are countless sources of third-party intelligence about attacker behavior, many of them are the secondary outputs of some other security program. Managed service providers, hosting providers, endpoint and network security vendors use what they learn about the networks to defend the broader universe of organizations. Since the data is provided by the targeted organizations, it cannot be controlled. This intelligence is a byproduct of another business, with another business model. What’s more, threat intelligence providers cannot collect information about a potential attacker until they have actually attacked a protected network, which biases the data toward widespread attacks.

Another approach to threat intelligence relies on first party (i.e. “primary source”) data, derived from sensors that observe attacker behavior directly. When these sensors are designed to mimic vulnerable systems with the intent to attract attackers, they are referred to as honeypots. On a small scale, this approach is not effective, but when honeypots are deployed on a large scale it becomes possible to detect many internet-wide as well as targeted attacks. 

Honeypots offer some key advantages to defenders when used to complement traditional third-party threat intelligence, especially when addressing the threat of targeted attacks:

• Velocity. Honeypots avoid the operational lag of traditional threat intel because observations can be automatically tagged and distributed at machine speed.
• Proactivity. Rather than waiting until an attack has actually happened to collect data, honeypots can research and analyze the behavior of a potential attacker before the targeted system is compromised.
• Relevance. Instead of relying on inconsistent data collected from verticals, systems and various geographies that may or may not pertain to a specific defender, honeypots collect data from systems that are optimized to resemble key defender assets.
• Comprehension. Honeypot data is derived from its own network configuration, rather than depending on third party data.

In the past, honeypot programs have struggled due to several challenges with their operational security and detection capabilities. Because of this, few organizations currently have mature, effective honeypot programs. However, new advances in infrastructure automation, network traffic shaping, cloud computing and artificial intelligence can resolve these issues and make it possible to consistently identify novel attacks and reveal attacker infrastructure.

Defenders should define their honeypot strategy by identifying attack risks and intelligence gaps, assessing honeypot maturity and evaluating security partnerships for comprehensive visibility. 

6 criteria for a successful honeypot defense strategy

While honeypots are not a silver bullet, a mature honeypot program can fill the gaps in current intelligence approaches and effectively manage business risks. One of the key advantages is that they offer a unique opportunity to see what potential attackers are doing in real-time before a full-on incident takes place.  

Here are six criteria for a successful and effective honeypot defense strategy:

1. Ease of deployment. Advances in cloud technology and infrastructure orchestration have made it possible for network architecture to support streamlined operations. This enables new honeypots to be erected as redirects to established cloud resources, permitting resource-constrained teams to deploy and manage multiple honeypots that cover the systems and protocols they wish to defend. 
2. Flexible persona. In order to be effective, the apparent identity that a honeypot presents to scanners and attackers needs to be frequently updated in response to changing threats. Fortunately, the same cloud architectures that support easy deployments can also deliver dynamic personas. As attackers modify their targeted systems, in response to new vulnerabilities, new attack campaigns and new priorities, defenders need to be able to shift their honeypot networks in response. 
3. Credibility. Depending on what behavior defenders wish to observe, different levels of honeypot interaction are required (e.g. a clone of login pages, exposed vulnerabilities or even deeper). In many cases, it isn’t enough to imitate — the honeypot must actually become the thing that lures attackers. 
4. Completeness of data.  A successful honeypot program will collect all of the data that analysts, detection engineers and others require to block automated attacks and identify targeted ones. New honeypots collect more comprehensive data from packet capture and in-persona process, file and network actions, providing analysts with the data they need to observe, identify and understand novel activities and attacks. 
5. Automatic analysis. While an initial, unadvertised perimeter sensor will only see a trickle of background noise, once the honeypot presents a popular tech persona and is indexed, it will see a high volume of scan and attack traffic. This data can overwhelm defenders, undermining honeypot value. Manual approaches to analyzing this data are possible, but mature programs must increasingly leverage AI to assist in data labeling. 
6. Global visibility. The true value of honeypots is realized when the data can be effectively aggregated and compared with global threat data. An attack seen by one organization’s honeypots, but not globally, is a targeted attack. A honeypot program that empowers defenders to immediately and systematically contrast what they’re seeing with what’s happening worldwide represents a new source of truth on both mass attack campaigns and targeted activity, allowing defenders to understand, prioritize and respond to the threats that they are facing.

There will always be a need for the unique threat intelligence insights that only large, advanced honeypot networks can safely provide. Organizations that accurately scope their risk profile and honeypot maturity will be best positioned to make effective investments, equipping their defenders with the intelligence they need to deal with the evolving landscape of automated and targeted attacks.

https://www.securitymagazine.com/articles/100865-new-honeypot-techniques-for-addressing-targeted-attacks