Data Access Control Firm Immuta Raises $90 Million in Series D Funding

Cloud data access control solutions provider Immuta this week announced raising $90 million in Series D funding, which brings the total capital invested in the company to $169 million.

Founded in 2015, the Boston-based company offers a platform that data engineers and DataOps teams can use to automate data governance, security, access control and privacy protection.

The new funding, Immuta says, will help it capture rising demand for access control, as cloud data sets are becoming distributed across multiple platforms. The company plans to invest in product research and development, while also looking to expand its sales and marketing capacity.

The Series D funding round saw participation from new investors Greenspring Associates (which led the round), March Capital, NGP Capital, and Wipro Ventures, and existing investors Citi Ventures, Dell Technologies Capital, DFJ Growth, Intel Capital, Okta Ventures, and Ten Eleven Ventures.

“We’ve entered a new era in data and analytics fueled by ubiquitous cloud storage, new cloud data management tools, and the rise of DataOps. Traditional methods of data access control don’t work, don’t scale across cloud compute platforms, and can limit data utility. Immuta’s platform solves this problem elegantly without requiring data to be moved, copied, or manually provisioned,” Immuta’s CEO Matthew Carroll said.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/oU0oWGdNweE/data-access-control-firm-immuta-raises-90-million-series-d-funding

Healthcare IoT Cybersecurity Firm Cynerio Raises $30 Million

Healthcare IoT cybersecurity and asset management solutions provider Cynerio this week announced closing a $30 million Series B funding round. To date, the company has raised a total of $37 million.

Cynerio was founded in 2017 and it has offices in Israel and New York. The company has developed a platform that is designed to secure a wide range of systems, including medical and Internet of Medical Things (IoMT), enterprise IoT, and operational technology (OT).

Its clinically-intelligent platform provides automated asset discovery, helping cybersecurity teams identify security problems on their organization’s network and solve them.

The new injection of capital will help Cynerio improve its portfolio through expanding its channel program and transforming its existing Zero Trust solutions into a full-service security platform.

Furthermore, the company plans to use the funds to accelerate development and enhance support to existing customers. It will also invest in reinforcing its position on the North American market and in expanding globally.

The new funding round was led by ALIVE Israel HealthTech Fund, with participation from existing and new investors and co-investors.

“With the additional backing of ALIVE and their expertise in the US healthcare system, we’ll be able to continue advancing our product offerings to support healthcare providers, with unparalleled threat detection, preemptive security and response capabilities, while alleviating healthcare’s coinciding operational challenges,” Leon Lerman, CEO and co-founder of Cynerio, said.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/HKFavjvDUng/healthcare-iot-cybersecurity-firm-cynerio-raises-30-million

Alaska Health Department Website Targeted in Malware Attack

The Alaska health department website was the target of a malware attack, officials said.

A similar attack previously targeted the state’s court system.

The health department in a statement late Tuesday said its website was taken offline Monday while an investigation takes place. The statement did not say when the cyberattack was discovered, and Clinton Bennett, a department spokesperson, by email Wednesday said the department could not release that information “due to security reasons, and so we do not jeopardize the investigation.”

He responded the same way to a question about whether a ransom was demanded by those involved.

Investigators were trying to determine if any personal or confidential information was compromised, the department said.

Online COVID-19 vaccine appointment scheduling and data dashboards are hosted by outside sources and can be accessed through covid19.alaska.gov, the department said.

“At this time, there are no details about who initiated the attack, why they targeted DHSS, whether this attack is related to any other recent attacks, or how long the website may be down,” the Department of Health and Social Services said in its statement.

The chief justice of the Alaska Supreme Court said this month that a cybersecurity attack that resulted in the court system disconnecting its online services was first detected April 29 and that there was no ransom demand. The court system has been coming back online, announcing this week that the public could again access an online court case and records system and pay fines and fees online.

The court system said Tuesday that the ability to pay bail online was not yet restored.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/TWUL1VbdeLg/alaska-health-department-website-targeted-malware-attack

Endpoint Security Provider ThreatLocker Raises $20 Million

Endpoint security provider ThreatLocker this week announced that it secured $20 million in a Series B funding round that brings the total capital raised by the company to $24.5 million.

Founded in 2017, the Florida, U.S.-based company offers enterprise-level cybersecurity tools aimed at securing both servers and endpoints. By implementing a zero trust policy, ThreatLocker aims to prevent unauthorized software intrusions.

ThreatLocker claims its application whitelisting, storage control, and privileged access management solutions can prevent remote access attacks, malware, data theft, and internal IT disputes.

The new funding round, led by Elephant, will enable ThreatLocker to expand its global footprint and improve its products, the company says.

“ThreatLocker was created in response to the growing frustration around the existing tools in the cybersecurity market. As we head into this next major company milestone, our unyielding focus on innovation and strategic partnerships has proven to be effective as we continue to see impressive customer growth,” ThreatLocker CEO Danny Jenkins said.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/cqde4kJ-ilQ/endpoint-security-provider-threatlocker-raises-20-million

Vulnerability Exposes F5 BIG-IP to Kerberos KDC Hijacking Attacks

F5 Networks this week released patches to address an authentication bypass vulnerability affecting BIG-IP Access Policy Manager (APM), but fixes are not available for all impacted versions.

Tracked as CVE-2021-23008, the high-severity vulnerability allows for the bypass of BIG-IP APM AD (Active Directory) authentication if the attacker can hijack a Kerberos KDC (Key Distribution Center) connection using a spoofed AS-REP (Kerberos Authentication Service Response).

Authentication bypass is also possible from an AD server that the attacker has already compromised, F5 explains. The attacker could also bypass policies and gain unfettered access to sensitive workloads, according to identity protection firm Silverfort, whose researchers discovered the vulnerability.

“In some cases this can be used to bypass authentication to the Big-IP admin console as well,” the researchers say.

The Kerberos protocol leverages a client-server model for on-premise authentication, with KDC being an intermediary that holds shared secret keys and user access information. When attempting to access a resource, the KDC prompts for a username and password and also checks if the user has privileges to access that resource.

For the protocol to work, the user and the KDS authenticate to the server and the server authenticates to the client. If the Kerberos KDC authentication to the server is compromised, the attacker can hijack the connection between the client and the domain controller, thus bypassing authentication.

Such attacks typically exploit misconfigurations in Kerberos protocol implementations, and the same applies to F5 BIG-IP as well. Thus, an attacker can create a domain controller with a username identical to the admin’s username and target the flaw to authenticate to BIG-IP even if they do not know the correct password, by hijacking the KDC connection.

“For an APM access policy configured with AD authentication and SSO (single sign-on) agent, if a spoofed credential related to this vulnerability is used, depending how the back-end system validates the authentication token it receives, access will most likely fail. An APM access policy can also be configured for BIG-IP system authentication. A spoofed credential related to this vulnerability for an administrative user through the APM access policy results in local administrative access,” F5 notes.

BIG-IP APM versions 11.5.2 through 16.0.1 are known to be vulnerable. Fixes were included in BIG-IP APM versions 12.1.6, 13.1.4, 14.1.4, and 15.1.3, but no patches are available for the 11.x and 16.x branches.

As for mitigations, F5, which also credits Thierry Van Steirteghem from Exclusive Networks for reporting the vulnerability, suggests enabling multi-factor authentication (MFA), or host-level authentication.

This week, the company also released patches for a medium-severity vulnerability in BIG-IP APM (CVE-2021-23016) that could be abused to bypass internal restrictions and retrieve static content stored within APM.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/86VYA9DFkjQ/vulnerability-exposes-f5-big-ip-kerberos-kdc-hijacking-attacks

DigitalOcean Discloses Breach Involving Billing Information

Cloud solutions provider DigitalOcean has started informing some customers that their billing information may have been compromised after someone exploited a vulnerability in the company’s systems.

In an email sent to customers, DigitalOcean said the unauthorized access occurred between April 9 and April 22, 2021, but it was apparently only “confirmed” on April 26.

“An unauthorized user gained access to some of your billing account details through a flaw that has been fixed,” the company told customers.

DigitalOcean said only a “small percentage” of its customers were impacted and they do not need to take any action.

The exposed billing information includes name, address, payment card expiration date, the payment card’s last four digits, and the name of the bank that issued the card. The company highlighted that it does not store full credit card data so this type of information was not exposed.

“According to our logs approximately 1% of billing profiles were impacted,” Tyler Healy, VP of security at DigitalOcean, told SecurityWeek in an emailed statement. “This issue has been fixed and we have informed the impacted users and notified the relevant data protection authorities.”

On its website, DigitalOcean says more than one million developers from every country in the world use its services.

The company informed customers last year that it had exposed some of their data after a document was unintentionally made public, but claimed at the time it was confident that there was no malicious access to the document.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/ChohrSXNhAY/digitalocean-discloses-breach-involving-billing-information

Threat Detection Firm Vectra Raises $130 Million at $1.2 Billion Valuation

Threat detection and response solutions provider Vectra AI on Thursday announced that it has raised $130 million at a valuation of $1.2 billion, which makes the company the latest cybersecurity unicorn.

The funding, which brings the total raised by the firm to $350 million, was led by Blackstone Growth, with participation from existing investors. Vectra says it will use the money to improve its platform and expand into new markets and geographies.

Vectra offers threat detection solutions for cloud environments, data centers, IoT and other enterprise systems. It also provides products for threat hunting and conducting investigations, as well as for risk and compliance.

“Over the past year, we have witnessed a continuous series of the most impactful and widespread cyberattacks in history. To protect their employees and digital assets, our customers require security solutions that are smarter than today’s adversaries and provide coverage for cloud, data centers and SaaS applications,” said Hitesh Sheth, president and CEO at Vectra.

He added, “As we look to the future, Blackstone’s global presence, operational resources, and in-house technology expertise will help us achieve our mission to become one of the dominant cybersecurity companies in the world.”

More than a dozen cybersecurity companies have announced becoming a unicorn so far in 2021. Fraud prevention company Sift and DevSecOps firm Sysdig announced valuations exceeding $1 billion this week.

Some industry professionals have attributed this surge in unicorns to speculative strategies while others believe it’s a result of the growing importance of cybersecurity.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/4KkMn8fu0q8/threat-detection-firm-vectra-raises-130-million-12-billion-valuation

Apple Patches Security Bypass Vulnerability Impacting Macs With M1 Chip

Apple’s latest macOS updates patch three vulnerabilities that can be exploited to bypass security mechanisms, including one that has been exploited in the wild and one that impacts only Macs powered by the M1 chip.

It was reported earlier this week that one of the security holes patched in macOS Big Sur and Catalina (CVE-2021–30657) has been exploited by a piece of malware known as Shlayer to bypass security mechanisms designed by Apple to protect users against malicious files downloaded from the internet, specifically file quarantine, Gatekeeper and notarization.

File quarantine asks the user for confirmation when executing a file downloaded from the internet, Gatekeeper checks code-signing information to ensure an application comes from a trusted developer and it has not been tampered with, and notarization involves automatically scanning software for malicious content before it is allowed to run.

CVE-2021–30657 is related to script-based applications that do not contain an “Info.plist” configuration file being misclassified. The issue was detailed this week by Cedric Owens, the researcher who discovered the bug, Apple security expert Patrick Wardle, who described its root cause and developed a PoC exploit, and Apple device management company Jamf, whose researchers discovered that the Shlayer malware had been exploiting the vulnerability since at least January 2021.

Two other similar vulnerabilities have been patched by Apple with the release of the latest macOS updates: one discovered by Wojciech Reguła of SecuRing (CVE-2021-30658) and one by Rasmus Sten of F-Secure (CVE-2021-1810). However, these do not appear to have been exploited in malicious attacks.

Reguła told SecurityWeek that the vulnerability he found can only be triggered on Macs with the M1 chip. He will likely publish a blog post detailing his findings, but he has shared some high-level information about the flaw, which only impacts macOS Big Sur.

“[The vulnerability] abuses the ‘/System/Library/CoreServices/Applications/iOS App Installer.app’ system application that will install an iOS App (with .ipa extension) on M1 Macs,” the researcher explained.

In a PoC video shared with SecurityWeek, Reguła showed that an attacker needs to trick the targeted user into clicking on a link and installing an application, but no security prompts related to Gatekeeper are displayed before the malicious .ipa application is executed. He said he also leveraged an additional trick to prevent the operating system from assigning it the file quarantine attribute.

Gatekeeper bypass vulnerability

F-Secure published a blog post with a brief explanation of Sten’s findings, but the company is not releasing any technical details just yet to prevent exploitation.

Sten told SecurityWeek that the vulnerability he discovered is similar to the one that has been exploited in the wild — it can bypass all three security features — but it uses different mechanisms to achieve the same goal. This issue affects the Archive Utility component in macOS Big Sur and Catalina.

The flaw involves specially crafted ZIP archive files that the targeted user needs to download, unpack and execute in order to trigger the exploit. This results in the application contained in the ZIP file — it can be a piece of malware — getting executed without any warning to the user.

However, F-Secure noted in its blog post that applications downloaded from the official App Store are not impacted and apps delivered as macOS installer packages cannot exploit the vulnerability as they contain a certificate that is verified outside of Gatekeeper.

“The most likely scenario is a phishing attack or a web server compromise, where an attacker is able to serve a legitimate-looking web page masquerading as a legitimate software vendor,” Sten explained. “This can then be used to trick the user into downloading a malicious app masquerading as a legitimate app. By exploiting CVE-2021-1810 this app would be able to run when the user double-clicks on it despite the fact that it hasn’t been signed or notarised.”

A short video demo of the vulnerability in action was posted by Sten on Twitter.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/x-Pli6ip98g/apple-patches-security-bypass-vulnerability-impacting-macs-m1-chip

FluBot Android Malware Expected to Start Targeting U.S.

The FluBot Android malware is spreading fast across Europe using an SMS package delivery scheme and it’s soon expected to arrive in the United States as well, cybersecurity company Proofpoint warned this week.

Initially observed in Spain, FluBot has since expanded operations to reach Germany, Hungary, Italy, Poland, and the UK as well, with tens of thousands of malicious SMS messages that leverage FedEx, DHL, and Correos lures being sent hourly.

The malware is believed to have made over 7,000 victims in the UK alone, where the campaign operators were using more than 700 unique domains for the distribution of FluBot.

Proofpoint says that U.S. users have already started receiving German and English-language phishing SMS messages, suggesting that the threat actor is getting ready to expand to this country. The pattern is similar to how the attacks started in the UK, where users first received German messages and only then English ones.

The attack starts with the victim receiving a SMS message supposedly arriving from a delivery service, which includes links to compromised sites. When clicking the link, the victim is prompted to download a malicious app featuring the delivery service’s logo, but which has FluBot embedded within.

The application requires user interaction to gain privileges to use Android Accessibility Service, as well as for Notification access. Once it has received the necessary permissions, FluBot gains access to the entire device, acting “as spyware, SMS spammer, and credit card and banking credential stealers,” Proofpoint explains.

FluBot also sends the victim’s contact list to the command and control (C&C) server, to spread further, and can intercept SMS messages, USSD messages from service providers, and app notifications. It can also open pages in the browser, disable Google Play Protect, open a SOCKS connection for C&C communication, and uninstall applications.

Furthermore, the malware can display overlays for various banking apps, as well as for Google Play verification, and can validate captured credit card numbers locally and only then send them to the C&C.

“FluBot is likely to continue to spread at a fairly rapid rate, moving methodically from country to country via a conscious effort by the threat actors. As long as there are users willing to trust an unexpected SMS message and follow the threat actors’ provided instructions and prompts, campaigns such as these will be successful,” Proofpoint concludes.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/M0eGLRqXcwM/flubot-android-malware-expected-start-targeting-us

Several High-Severity Vulnerabilities Expose Cisco Firewalls to Remote Attacks

Cisco this week released patches for multiple vulnerabilities in Firepower Threat Defense (FTD) software, including high-severity issues that could be exploited for arbitrary command execution or denial-of-service (DoS) attacks.

Tracked as CVE-2021-1448 and having a CVSS score of 7.8, the command injection bug is mitigated by the fact that authentication and local access are required for successful exploitation. An attacker able to abuse it, however, may execute arbitrary commands as root on the underlying OS.

The flaw exists because user-supplied command arguments aren’t sufficiently validated, and affects Firepower 4100 and Firepower 9300 series appliances. No workarounds exist, but software updates to address the vulnerability are already available.

Another flaw rooted in insufficient validation impacts the software-based SSL/TLS message handler of FTD and could be abused to cause a DoS condition. The security hole is tracked as CVE-2021-1402 (CVSS score of 8.6).

Remote, unauthenticated attackers could exploit this vulnerability by sending a “crafted SSL/TLS message through an affected device.” However, messages that are sent to the affected device won’t trigger the bug, Cisco notes.

Affected devices include 3000 series industrial security appliances (ISAs), ASA 5512-X/ASA 5515-X/ASA 5525-X/ASA 5545-X/ASA 5555-X adaptive security appliances, Firepower 1000/2100 series, and Firepower Threat Defense Virtual (FTDv) products.

Four other DoS bugs addressed this week in FTD also impact Cisco Adaptive Security Appliance (ASA) software and could all be exploited remotely. Three of them (CVE-2021-1445, CVE-2021-1504, and CVE-2021-1501, CVSS score of 8.6) do not require authentication, while the fourth (CVE-2021-1493, CVSS score of 8.5) does.

Cisco says it is not aware of these vulnerabilities being exploited in attacks in the wild, but nonetheless recommends installing the available patches as soon as possible, to avoid possible cyber-security incidents.

Patches the tech giant released this week also address multiple medium-severity issues, including four in FTD software (two impact ASA software too), five in Firepower Management Center (FMC), one in Firepower Device Manager (FDM), and one in the Snort detection engine that affects multiple products.

Information on all of these vulnerabilities and on the patches released for them is available on Cisco’s security portal.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/-rI9kVmPtQ8/several-high-severity-vulnerabilities-expose-cisco-firewalls-remote-attacks