EU, Mideast Nations Look to Train at Cyprus Security Center

Three European Union member nations and three Middle Eastern countries are looking to train personnel in border, customs, maritime and cybersecurity techniques at a cutting-edge U.S.-funded facility in Cyprus that is expected to be ready early next year, the Cypriot foreign minister said Thursday.

The Cyprus Center for Land, Open-Seas, and Port Security (CYCLOPS) is scheduled to start operating on Jan. 16, 2022, Foreign Minister Nikos Christodoulides said after inspecting the under-construction facility with U.S. Ambassador Judith Garber.

Christodoulides said Cyprus was selected for the center because the Mediterranean island nation is located on the southeastern end of the EU and because it enjoys good relations with the nations in the Mideast.

“Officials from neighboring countries as well as from EU member states will receive the kind of training required to counter common threats of a non-military nature,” he said.

CYCLOPS will include state-of-the-art equipment and a mobile facility to train officials on how to best protect key infrastructure projects and conducting cyber investigations and border screening. The U.S. will provide equipment and training staff.

Cypriot government spokesman Kyriakos Koushos said U.S. President Joe Biden considers Cyprus a “significant partner” in bolstering regional security in the east Mediterranean and has pledged to further strengthen U.S.-Cyprus relations.

Biden made the remarks in a letter addressed to Cypriot President Nicos Anastasiades, Koushos said. In the letter, the U.S. president looks forward to working with Anastasiades to deal with issues of common interest in the east Mediterranean, the spokesman said.

Cyprus and the United States forged closer security links in recent years, culminating in the 2019 congressional approval of the Eastern Mediterranean Energy and Security Partnership Act, which underscored U.S. support for an energy-based partnership between Greece, Cyprus and Israel.

Under the act, the U.S. is providing ethnically divided Cyprus with funding for military training and has partially lifted an arms embargo that was enacted 33 years ago to prevent a potential arms race from harming peace talks with the country’s breakaway Turkish Cypriots.

Cyprus has licensed ExxonMobil to prospect for oil and gas in waters where the island nation has exclusive economic rights.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/I4KZrNo9kJc/eu-mideast-nations-look-train-cyprus-security-center

Serious Vulnerabilities Found in CODESYS Software Used by Many ICS Products

Researchers have discovered 10 vulnerabilities — a majority rated critical or high severity — in CODESYS industrial automation software that is used in many industrial control system (ICS) products.

Researchers at Russian cybersecurity company Positive Technologies identified the vulnerabilities in various products made by CODESYS. They initially found the flaws in a programmable logic controller (PLC) made by WAGO, but further analysis showed that the issues were actually introduced by CODESYS software that is used by more than a dozen manufacturers for their PLCs, including Beckhoff, Kontron, Moeller, Festo, Mitsubishi, HollySys and several Russian firms.

Six of the vulnerabilities have been rated critical and they can be exploited using specially crafted requests for remote code execution or to crash the system. The three flaws rated high severity can be leveraged for DoS attacks or remote code execution using specially crafted requests.

The remaining security bug has been rated medium severity and it can be exploited to disrupt targeted systems.

Learn more about vulnerabilities in industrial systems at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series

Some of the vulnerabilities can be exploited only by an authenticated attacker or if the controller is not protected by a password, but Positive Technologies says some of the weaknesses can be exploited simply by having network access to the targeted device.

“The vendor rated some of these vulnerabilities as 10 out of 10, or extremely dangerous,” explained Vladimir Nazarov, head of ICS security at Positive Technologies. “Their exploitation can lead to remote command execution on PLC, which may disrupt technological processes and cause industrial accidents and economic losses.”

CODESYS has released updates for its CODESYS V2 web server, Runtime Toolkit and PLCWinNT products to address the vulnerabilities. The vendor has published separate advisories for the critical-, high- and medium-severity issues, and advises customers to install the updates.

Positive Technologies was sanctioned recently by the U.S. government for allegedly supporting Kremlin intelligence agencies. However, the company said it will continue to responsibly disclose the vulnerabilities found by its employees in the products of major U.S. companies.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/WA0pCJtMkqs/serious-vulnerabilities-found-codesys-software-used-many-ics-products

XDR Platform Provider SentinelOne Files for IPO

Endpoint security firm SentinelOne has publicly filed its S-1 registration statement with the SEC for an initial public offering (IPO) of its stock.

The company plans to list its Class A common stock on the New York Stock Exchange (NYSE) under the ticker symbol “S.”

Founded in 2013, SentinelOne has created a platform that has evolved from a general endpoint protection solution to what the company describes as a “full XDR cybersecurity platform” that includes AI-based endpoint protection, endpoint detection and response (EDR), IoT control, and protection for container and cloud workloads.

SentinelOne Logo

The company achieved “unicorn” status in early 2020 when it raised $200 million in a Series E round. In late 2020 its valuation jumped past $3 billion after raising $267 million in a Series F founding round, which brought the total raised by the company to a whopping $696.5 million.

While the number of shares to be offered and price range for the proposed offering have not yet been determined, industry chatter suggests the company’ valuation could be in the $10 billion range as a public company. The company could raise up to another $100 million through the IPO, according to its S-1.

According to its prospectus, the company has more than 4,700 customers, with revenue for fiscal 2020 and fiscal 2021 of $46.5 million and $93.1 million, respectively, representing growth of 100% year-over-year. The company said revenue for the three months ended April 30, 2020 and 2021 was $18.0 million and $37.4 million, respectively, representing year-over-year growth of 108%.

The company reported a net loss of $76.6 million and $117.6 million for fiscal 2020 and fiscal 2021, respectively, and $26.6 million and $62.6 million for the three months ended April 30, 2020 and 2021, respectively.

In February 2021, SentinelOne said it would spend $155 million to acquire log management startup Scalyr, beefing up a crucial technology piece to drive its ambitions in the enterprise cybersecurity market and speed up its push into the lucrative XDR category.

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Previous Columns by Mike Lennon:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/aeCXVB349do/xdr-platform-provider-sentinelone-files-ipo

White House Urges Private Companies to Help in Fight Against Ransomware

In an open letter, the White House this week urged corporate executives and business leaders to take the appropriate measures to protect their organizations against ransomware attacks, only days after meat-packaging giant JBS fell victim to such an attack.

The memo, signed by Anne Neuberger, deputy national security advisor for cyber and emerging technology, mentions the recent increase in the number of ransomware incidents, as well as the Biden administration’s response to such attacks targeting government and private sector organizations.

In response to a series of cyberattacks that affected U.S. critical infrastructure both directly and indirectly – including the SolarWinds incident and the Colonial Pipeline attack – President Joe Biden signed an executive order on improving the cyber-defenses of “vital institutions.”

Furthermore, the White House announced sanctions against multiple Russian individuals and companies, and revealed plans to step up its game on fighting ransomware.

“These efforts include disrupting ransomware networks, working with international partners to hold countries that harbor ransomware actors accountable, developing cohesive and consistent policies towards ransom payments and enabling rapid tracing and interdiction of virtual currency proceeds,” Neuberger notes in this week’s memo.

In the letter, Neuberger also underlines that private businesses too have “a critical responsibility to protect against these threats,” listing a series of steps that all organizations can take to improve their resilience against ransomware and other cyber-threats.

These include implementing multi-factor authentication, detection and response, and encryption, keeping data backed up, keeping systems and applications up to date, employing a skilled security team and auditing their work, and implementing network segmentation.

“Ransomware attacks have disrupted organizations around the world, from hospitals across Ireland, Germany and France, to pipelines in the United States and banks in the U.K. The threats are serious and they are increasing. We urge you to take these critical steps to protect your organizations and the American public,” Neuberger continues.

The suggested steps, however, are not new. In fact, they represent common sense when it comes to building an organization’s security and are likely already implemented by most organizations out there. Threat actors, however, relentlessly search for possible weaknesses in defenses and attempt to exploit even the smallest gap they find.

“From what we have observed, ransomware attacks usually start with either tricking an employee into executing a malicious payload, or by exploiting internet-exposed systems. To protect against cyber-attacks it is critical that you train employees against social engineering attacks,” Felipe Duarte, security researcher at Appgate, said in an emailed comment. The adoption of a Zero Trust approach can also help organizations strengthen their security posture, he says.

According to Kunal Anand, chief technology officer at Imperva, in addition to providing guidelines, the federal government should do more to help enterprises and small businesses in the U.S. protect themselves from ransomware and other cyberattacks.

“Instead of focusing on defensive and reactive measures, the Biden administration needs to take a more effective position – aimed at providing tactical support and resources. The U.S. government should be looking at setting up departments that can help the private sector, or an Emergency Cybersecurity Center for broadcasting threats and attacks to everyone,” Anand said.

“At a time when the nation is under siege by ransomware attacks that are disrupting daily life, the U.S. Government needs to ask industry leaders to donate their time – whether it’s helping provide recommendations, setting up resource groups, etc. This should be seen as a patriotic duty,” he added.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/wWJI82N8L6k/white-house-urges-private-companies-help-fight-against-ransomware

Supreme Court Limits Prosecutors’ Use of Anti-Hacking Law

The Supreme Court on Thursday limited prosecutors’ ability to use an anti-hacking law to charge people with computer crimes.

Conservative and liberal justices joined to vote 6-3 to overturn the conviction of a police sergeant who used a work database to run a license plate search in exchange for money. The justices ruled prosecutors had overreached in using the federal Computer Fraud and Abuse Act to charge him. The case is important guidance in narrowing the scope of the law.

Lawyers for the police sergeant had warned when the case was argued in late November that if the court ruled against him it could have sweeping consequences. They argued it could make a federal crime out of using a computer for virtually any unauthorized purpose, from “checking sports scores at work to inflating one’s height on a dating website.”

The court agreed, rejecting the arguments of former President Donald Trump’s administration for a broad reading of the statute. Trump’s three appointees to the court joined the three liberals to rule for the police sergeant. Justice Amy Coney Barrett, Trump’s most recent appointee, wrote for the majority that the government’s interpretation of the law “would attach criminal penalties to a breathtaking amount of commonplace computer activity.” She said if the government’s interpretation of the law were correct then “millions of otherwise law-abiding citizens are criminals.”

“Employers commonly state that computers and electronic devices can be used only for business purposes. So on the Government’s reading of the statute, an employee who sends a personal e-mail or reads the news using her work computer has violated” the law, she wrote.

The Computer Fraud and Abuse Act became law in 1986 and was a response by Congress to a growing need to address computer crimes. It imposes criminal liability on anyone who “intentionally accesses a computer without authorization or exceeds authorized access.”

A majority of the justices concluded that the law “does not cover those who … have improper motives for obtaining information that is otherwise available to them.”

In a dissent, Justice Clarence Thomas said that an “ordinary reader of the English language” would have concluded that the police sergeant in the case exceeded his “authorized access.” And he called the majority’s interpretation of the law “contrary to the plain meaning of the text.” He was joined by fellow conservatives Chief Justice John Roberts and Justice Samuel Alito.

The case in which the justices ruled involved Nathan Van Buren, a police sergeant in Cumming, Georgia. As part of his job, he had access to a law enforcement database of license plate and vehicle registration information. As part of an FBI sting operation Van Buren was asked to conduct a license plate search in exchange for money. After he ran the search, prosecutors charged him with fraud and with violating the Computer Fraud and Abuse Act.

Van Buren was convicted on both counts and sentenced to 18 months in prison. He argued the Computer Fraud and Abuse Act didn’t apply because he accessed a database that he was authorized to access.

Van Buren’s lawyer, Jeffrey Fisher, wrote in an email: “We’re very pleased with the Court’s opinion and are glad that the CFAA is now restricted to its proper reach.” A spokeswoman for the Department of Justice did not immediately respond to an email requesting comment.

The case is Van Buren v. United States, 19-783.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/GW9tQeFvKx8/supreme-court-limits-prosecutors-use-anti-hacking-law

Nigerian Arrested in US for Hacking Payroll Services Company

A Nigerian national was arrested recently in the United States on charges related to hacking into user accounts at a payroll processing company, to steal payroll deposits.

The man, Charles Onus, 34, who was arrested in San Francisco on April 14, is accused of participating in a scheme that resulted in the compromise of approximately 5,500 user accounts at an unnamed human resources and payroll services company in the U.S.

In 2017 and 2018, Onus allegedly employed a credential stuffing attack to gain unauthorized access to user accounts at the targeted company.

According to the indictment, the unauthorized access allowed the man to divert roughly $800,000 in payroll funds to prepaid debit cards, including some he controlled.

Onus was charged with two counts of computer fraud, one count of receipt of stolen money, and one count of wire fraud, which carry maximum sentences between five and twenty years in prison, as well as one count of aggravated identity theft, which carries a mandatory sentence of two years in prison (served consecutively to any other sentence imposed).

“Charles Onus allegedly participated in a scheme that stole nearly $1 million by hacking into a payroll processing company’s system to access user accounts and divert payroll to prepaid debit cards he controlled. As alleged, Onus did this as effectively as someone who commits bank burglary, but with no need for a blowtorch or bolt-cutters,” Manhattan U.S. Attorney Audrey Strauss said.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/i5uJJMgP8QA/nigerian-arrested-us-hacking-payroll-services-company

Two Carbanak Gang Members Sentenced to 8 Years in Prison

Two members of the notorious Carbanak cybergang were sentenced to 8 years in prison, Kazakhstani authorities announced this week.

While they did not reveal the names of the sentenced individuals, the Kazakh authorities did say that they were accused of stealing roughly $4.7 million from two banks in the country between 2016 and 2017, as well as of attempting to steal $18.5 million more.

The stolen funds were transferred to 250 payment cards that were then distributed for cash out at ATMs across Europe, including in Belgium, the Czech Republic, Estonia, France, Germany, the Netherlands, Russia, Spain, and Switzerland.

“The rest of the members of this criminal organization have been identified and are on the international wanted list,” a translation of the sentencing announcement reads.

Tracked as Carbanak, Anunak and Cobalt, the gang evolved its malware and moved to more sophisticated attacks around 2016, employing a custom version of the Cobalt Strike pen testing tool.

[ READ: Historical Breadcrumbs Link Magecart 5 to Carbanak Group ]

Employing spear-phishing emails, the threat actors targeted bank employees with their malware, which provided them with access to a victim institution’s network, including the servers that controlled automated teller machines (ATMs).

Using this unauthorized access, the attackers would instruct ATMs to dispense cash at specific times, when money mules were present to collect the money. The hackers also transferred funds to bank accounts they controlled, and even modified account balances so they could withdraw large amounts of cash.

Working with the Russian and Moldovan mafia, the hackers often laundered the proceeds using Bitcoins. More than100 financial organizations in 40 countries were targeted, with total losses estimated to exceed €1 billion ($1.24 billion).

The mastermind behind the operation, a Ukrainian national referred to as “Denis K,” was arrested in Spain in 2018. Other members of the gang were reportedly Russian and Ukrainian nationals.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/KQQa1OxUnPI/two-carbanak-gang-members-sentenced-8-years-prison

Exabeam Lands $200M Investment, Replaces CEO

Exabeam, a late-stage startup in the data analytics and SIEM space, has landed a new $200 million funding round that values the company at $2.4 billion.

The announcement of Exabeam’s latest Series F funding, described as a “growth round,” coincides with news that co-founder and CEO Nir Polak will be replaced by former ForeScout chief executive Michael DeCesare.

Polak, who was Exabeam’s first CEO, will remain with the company and assume the role of board chairman.

DeCesare, a veteran cybersecurity executive who did leadership stints at McAfee and ForeScout Technologies, where he guided the company to a public markets exit in 2017.

Exabeam, founded in 2013 to jostle for market share in the SIEM (Security Information and Event Management) space, competes with the likes of Splunk, LogRhythm and IBM to help defenders store, log and parse corporate data at scale.

The company says it expects to use the new money to “fuel scale, product innovation and extend the company’s leadership” in what is described as a trusted cloud SecOps platform.

The latest investment was led by the Owl Rock division of Blue Owl Capital and supported by existing investors Acrew Capital, Lightspeed Venture Partners and Norwest Venture Partners.

[ ANALYSIS: Inside the Battle to Control Enterprise Security Data Lakes ]

Entrepreneurs and investors are competing aggressively for ownership and control of the massive data lakes powering enterprise security programs and Exabeam is among a wave of entrenched companies providing realtime data monitoring and visibility to defenders.

“[This investment gives us the opportunity to triple down on our R&D efforts and continue engineering the most advanced UEBA, XDR and SIEM cloud security products,” the company said in a statement.

Exabeam says it has more than 400 resellers and about 500 technology integrations with leading IT and security companies including cloud network, data lake and endpoint vendors such as CrowdStrike, Okta and Snowflake.

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. Ryan is a journalist and cybersecurity strategist with more than 20 years experience covering IT security and technology trends. He is a regular speaker at cybersecurity conferences around the world.
Ryan has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s career as a journalist includes bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Follow Ryan on Twitter @ryanaraine.

Previous Columns by Ryan Naraine:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/S-V2L7s7PIQ/exabeam-lands-200m-investment-replaces-ceo

[redacted] Emerges From Stealth to Help Companies Pursue, Disrupt Adversaries

[redacted] emerged from stealth mode on Tuesday with $35 million in Series B funding and a cyber defense and response solution that enables organizations to pursue and disrupt adversaries.

[redacted] was founded in 2015 by Max Kelly, who serves as the company’s CEO, and John Hering. Kelly previously worked at the NSA, the US Cyber Command and at Facebook as CSO. Hering founded cybersecurity firm Lookout and served as its CEO.

The San Francisco, California-based company says it has developed a platform that can help organizations defend their systems and respond to attacks. [redacted]’s platform notifies users when a threat has been detected and provides information on the actions being taken in response.

The company claims it can also help customers turn the tables on attackers by disrupting their operations and holding them accountable.

“Overall, we operate within a legal framework that’s been established in court to support this activity. We are using civil law to engage in the same tactics that police use under criminal law. We will tailor the solution to have the greatest impact against the adversary,” Kelly told SecurityWeek.

“There’s a lot of different ways we do that. It can involve publicly outing their infrastructure so the security community as a whole can take it down. It could mean working with law enforcement to provide information they need to take appropriate action.

“If a malicious actor goes after one of our clients and they realize the repercussions of their actions, it sends a message,” Kelly added.

The company says these “pursuit” capabilities are powered by a highly experienced team and partnerships with governments and agencies worldwide.

The latest funding secured by [redacted], which brings the total raised by the company to $60 million, was led by Ten Eleven Ventures, with participation from Valor Equity Partners and SVB Capital.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/wbvNNiJWoEU/redacted-emerges-stealth-help-companies-pursue-disrupt-adversaries

Swedish Public Health Agency Says Disease Database Targeted in Cyberattacks

The Swedish Public Health Agency (Folkhälsomyndigheten) is currently investigating several attempts to hack into SmiNet, a database that stores reports of infectious diseases, including COVID-19 cases.

SmiNet was shut down on Thursday, after the agency identified several attempts to gain unauthorized access to the database, but it was restored by Friday night.

On Thursday, the Public Health Agency announced that it had shut down the database to prevent hacking attempts, and immediately launched an investigation into the matter. The incident was also reported to the relevant authorities.

“Work is underway to investigate as quickly as possible whether anyone may have accessed sensitive personal data from the database, as well as sort out and rectify any deficiencies,” a translation of the agency’s announcement reads.

Initial evidence suggests that the attackers were not able to access any of the information contained within the database, but the investigation continues.

“It is still unclear whether unauthorized persons may have accessed sensitive information,” the agency said.

In a follow-up announcement on Saturday, the agency said it had brought the SmiNet database back online with some adjustments, which involve “certain restrictions on data reporting.”

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/XLW5ZlUXDk8/swedish-public-health-agency-says-disease-database-targeted-cyberattacks