Log inRegister

Fraud News

tap-n-ghost Image: Maruyama et al.

Modern Android smartphones are susceptible to a new type of attack named "Tap 'n Ghost" that can induce fake finger taps to take unwanted actions.

The attack exploits flaws at both the software and hardware level and has been proven to work even against the most recent smartphone models.

It works against most NFC-enabled smartphones with capacitive touchscreens -- which is the most common smartphone touchscreen technology today.

Generating fake screen taps

The Tap 'n Ghost attack -- discovered and documented by three academics from the Waseda University in Tokyo -- works using an attack rig that consists of a 5mm thick copper sheet connected to a DDS signal generator, a high-voltage transformer, a battery pack, NFC readers/writers, and a small computer (laptop, Raspberry Pi).

This rig might look bulky, but the research team says it can be embedded inside regular tables, coffee tables, or any other furniture object on which a victim might place their smartphone.

tap-n-ghost attack rigtap-n-ghost attack rig Image: Maruyama et al.

The attack itself consists of two steps. Once a user has placed their smartphone near the attack rig to be in the smartphone's NFC range (of 4 to 10cm), the NFC readers/writers can get basic info about a device and trigger one of three actions.

It can make the user's smartphone open and access a specific URL (doesn't require any interaction), it can ask the smartphone to pair a rogue Bluetooth device (requires interaction), or it can ask the user to connect to a malicious WiFi network (requires interaction).

This works because, by default, Android devices always look for nearby NFC transmissions, at all times.

At this point, the attack moves in the second phase where the attacker can use the copper plate to induce electrical disturbances into the touchscreen.

Because capacitive touchscreens are a collection of electrodes that exchange small currents between each other during a touch interaction, the extra induced noise can cause ghost taps on the screen, either on a vertical or horizontal axis.

tap-n-ghost flawstap-n-ghost flaws Image: Maruyama et al.

These fake taps can be used to hijack a user's original tap on a "No" button and apply it on the "Yes" one, allowing the smartphone to connect to a rogue WiFi network, or approve a malicious Bluetooth connection.

The Waseda research team says it tested the Ghost 'n Tap attack on seven smartphone models and were successful on five.

tap-n-ghost teststap-n-ghost tests Image: Maruyama et al.

The attack doesn't work only on smartphones, but also on any NFC-enabled device with a capacitive touchscreen, such as ATMs, voting machines, display screens, and others.

The research team says it worked with the Japan Computer Emergency Response Team (CERT) to notify the several smartphone manufacturers about this new attack vector.

"We demonstrated the attack to them and confirmed that the attack is applicable to their latest model," researchers said.

Not a universal threat

Fortunately, the Tap 'n Ghost attack isn't something that can be used against any user. First and foremost, the range of the attack is limited and requires that the user place their device(s) near a disguised attack rig.

Second, because each smartphone model uses different capacitive touchscreen technologies, special signals at different frequencies are needed per phone model. This means that the attacker needs to know a victim's smartphone model beforehand and configure the attack rig accordingly.

Furthermore, the Waseda team says the attack can be easily mitigated at both the software and hardware level. For example, the Android OS could be modified to introduce a popup that asks the user for permission before a device initiates any NFC operation. Second, signal noise protection can be added to capacitive touchscreen technologies.

More on this research can be found in a whitepaper named "Tap 'n Ghost: A Compilation of Novel Attack Techniques against Smartphone Touchscreens."

Related cybersecurity coverage:

Geo-Specific , Governance , Healthcare

Many of the Problems Are Also Common in the U.S.(HealthInfoSec) • May 31, 2019    Audit Identifies Australian Health Sector Security Weaknesses

Weak security controls and practices are putting Australian patients' data at high risk for cyberattacks, according to a new government audit in Victoria, Australia's second most populous state.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

The report issued on May 29 assessed whether the Victoria public health sector is taking effective steps to protect patient data.

Similar to Canada's healthcare system, Australia has a hybrid national public and private healthcare system in which a government program, Medicare, pays for some medical expenses - such as care provided in a public hospital - with optional private insurance policies available to help pay for costs not covered by Medicare.

The Victorian Audit-General's Office scrutinized several entities - including security of three public hospitals as well as two areas of the state's Department of Health and Human Services.

Common Struggles

Many of the security weaknesses VAGO identified - including in access and ID management practices and user awareness - are similar to the findings of U.S. government watchdog agencies in their security audits of the U.S. Department of Health and Human Services as well as U.S. Medicare and Medicaid healthcare providers and contractors (see: Audit: HHS Info Security Program Not Effective). That's because overall, thehealthcare sector faces many of the same challenges across the globe.

"The nature of healthcare today from an information and data perspective is so complex," says Mac McMillan, CEO of security consultancy CynergisTek. "Keeping staff aware of all of the things that they need to know that could potential hurt them or the organization is a definite challenge. Add to that the third-party risks that continue to grow, the exponential spread of devices and new pressures to share more information and access, and you have a very attractive target surface for cybercriminals who understand how hard it is to secure everything."

A Breach Target

Healthcare had more data breaches than any other business sector in Australia in the first quarter of this year, according to the Office of the Australian Information Commissioner.

VAGO in its audits found that Victoria's public health system is "highly vulnerable to the kind of cyberattacks recently experienced by the National Health Services in England, in Singapore and at the a Melbourne-based cardiology provider, which resulted in stolen or unusable patient data and disrupted hospital services," the report notes.

"There are key weaknesses in health services' physical security, and in their logical security, which covers password management and other user access controls," the report says. "Staff awareness of data security is low, which increases the likelihood of success of social engineering techniques such as phishing and tailgating into corporate areas where information communication and technology infrastructure and servers maybe located."

VAGO notes it exploited those weaknesses in all the audited agencies and accessed patient data to demonstrate the significant and present risk to the security of patient data and hospital services.

"The audited health services are not proactive enough and do not take a whole hospital approach to security that recognizes that protecting patient data is not just a task for their IT staff."

The report notes that DHHS' Digital Health branch supports improved cybersecurity in the sector by developing guidance materials, running awareness and training sessions and funding information communication and technology infrastructure upgrades.

"It has also developed a set of 72 baseline cybersecurity controls for health services to improve the maturity of health services' practices," VAGO writes.

Not Fully Implemented

The report points out, however, that no Victoria health service examined has fully implemented all 72 controls

"The audited agencies implemented 57 percent of the foundational controls. The audited health services advise that key barriers to implementing the controls are a lack of dedicated funding for cybersecurity projects and limited staff availability," the report states. "It is vital that health services take a proactive approach and implement the controls, as each health service is responsible for the security of their patient data and ICT systems."

ID and Access Management

The report also notes that the Victoria health services agencies "rarely used" multifactor authentication for healthcare staff, information communication and technology worker and administrator accounts.

"The hard-to-believe but simple truth is that multifactor authentication is still viewed as something that interferes with convenience or workflows."
—Mac McMillan, CynergisTek

"We identified examples where audited agencies were still using default account names and passwords on key devices, including servers," the report notes. "Default account names and passwords are set by manufacturers when they first produce a device and are easy to find on the internet. In one audited health service, we accessed patient data in the hospital because the third-party system had a default account name and password."

Vendor Management

VAGO notes that it's common for healthcare service providers to outsource key components of their IT operations to third parties, including the Health Technology Solutions arm of DHHS.

"Despite this, organizations remain accountable for protecting the security of patient data and need to assure themselves that vendors act appropriately," the report notes. This, too, creates risk.

"HTS has not fully implemented DHHS's cybersecurity controls and has many of the same security weaknesses as health services. There is a particular need to improve staff awareness of common social engineering techniques," the report notes.

Common Struggles

The lack of multifactor authentication implementation is a common problem across the healthcare sector worldwide, McMillan says.

"The hard-to-believe but simple truth is that multifactor authentication is still viewed as something that interferes with convenience or workflows," McMillan says. "However those same individuals that complain about the few seconds delay that multifactor authentication causes almost certainly engage in on-line banking or purchasing where they use it routinely. Convenience is still the number one enemy of security."

VAGO Recommendations

VAGO made more than a dozen recommendations to Victoria's DHHS to address the problems identified and bolster security. Among the recommendations:

The DHHS Digital Health unit should review and expand its 72 cybersecurity controls where appropriate; The DHHS Health Technology Solutions unit and all Victorian health services providers should implement all cybersecurity controls of the Digital Health unit; All Victorian health services providers should implement multifactor authentication for all information and communication technology staff and administrator accounts.

The VAGO report notes that the audited DHHS units and hospitals concurred with its recommendations.

Governance , IT Risk Management , Legacy Infrastructure Security

Security Experts Warn Exploits Are Coming(@Ferguson_Writes) • May 31, 2019    Microsoft Sounds Second Alarm Over BlueKeep Vulnerability

Microsoft has issued a second security warning over BlueKeep, a recently discovered vulnerability in its Remote Desktop Protocol service that could enable attackers to use a worm-like exploit to take over devices running unpatched older Windows operating systems.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

The software giant took the unusual step Thursday of issuing a second alert within a month concerning the BlueKeep flaw as security researchers expressed growing concerns that bad actors are rapidly developing exploits and that proof-of-concept code has already leaked online.

In a new message, Simon Pope, director of incident response for the Microsoft Security Response Center, compared BlueKeep to EternalBlue, the Windows vulnerability that later opened the door to the WannaCry and NotPetya ransomware attacks of 2017. Pope warned that with reports of nearly 1 million Windows devices vulnerable to this flaw, security teams need to apply the patch that Microsoft issued with its first warning on May 14 (see: 1 Million Windows Devices 'Vulnerable to Remote Desktop Flaw').

"It's been only two weeks since the fix was released and there has been no sign of a worm yet. This does not mean that we're out of the woods," Pope warns. "If we look at the events leading up to the start of the WannaCry attacks, they serve to inform the risks of not applying fixes for this vulnerability in a timely manner."

The vulnerability affects only older versions of Microsoft's Windows operating system, some of which are no longer supported by the company. The flaw affects Windows XP, Windows 7, Windows 2003 and Windows Server 2008, the company notes. Newer versions of Windows, including Windows 8 and Windows 10, are not affected.

Looking for Exploits

In his note, Pope notes that Microsoft security researchers are "confident that an exploit exists" for BlueKeep and that's it only a matter of time before threat actors take advantage of unpatched machines to spread their malware. He adds that it only took about 60 days between the issuing of the EternalBlue patch and the first attacks attributed to WannaCry in 2017 (see: After 2 Years, WannaCry Remains a Threat).

Independent security researchers have spotted proof-of-concept code designed to exploit this vulnerability, which is designated CVE-2019-0708.

British security researcher Marcus Hutchins, who discovered the "kill switch" that helped stem the WannaCry attacks two years ago, warns that some people are posting fake code to GitHub and other software repositories to hide or obscure the truly dangerous exploits being developed.

These warnings about proof-of-concept code and the urgency of patching come after Robert Graham of the security firm Errata Security wrote a May 28 blog about his finding that about 950,000 unpatched devices running older versions of Windows are still vulnerable to exploits based on BlueKeep. Additional, Security firm GreyNoise Intelligence warned on May 24 that at least one threat actor is scanning networks looking for systems that are susceptible to BlueKeep.

Meanwhile, security vendors Zerodium, McAfee, Kaspersky, Check Point, MalwareTech and Valthek, have developed exploits for BlueKeep but are keeping that code private. This demonstrates, however, that a determined attacker could take advantage of the vulnerability.

Protecting Older Versions of Windows

The BlueKeep vulnerability was first spotted by the U.K.'s National Cyber Security Center and Microsoft issued its patch for it on May 14 as part of this month's Patch Tuesday security update. If a threat actor can access and exploit Blue Keep, the attacker could "execute arbitrary code on the target system. An attacker could then install programs; view, change or delete data; or create new accounts with full user rights," according to the May 14 alert.

Microsoft has also warned that because the BlueKeep vulnerability does not require user interaction, an exploit could spread malware from one vulnerable machine to another within a network in the same way that the WannaCry ransomware was "wormable."

"It only takes one vulnerable computer connected to the internet to provide a potential gateway into these corporate networks, where advanced malware could spread, infecting computers across the enterprise," Microsoft's Pope warns in his Thursday post. "This scenario could be even worse for those who have not kept their internal systems updated with the latest fixes, as any future malware may also attempt further exploitation of vulnerabilities that have already been fixed."

Governance , Privacy

Attorney Sadia Mirza on the Impact of Emerging Privacy Legislation(SecurityEditor) • May 31, 2019     Sadia Mirza, cybersecurity, information governance and privacy attorney, Troutman Sanders LLP

Post-GDPR, the California Consumer Privacy Act was the first piece of U.S. legislation to emerge - but it's hardly the last. Attorney Sadia Mirza of Troutman Sanders talks about the potential impact of CCPA and other pending privacy legislation.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

"2018 was a huge year for privacy," Mirza says. "It's important to follow what's going on in California right now because it's going to be shaping a lot of the other laws that are going to be popping up in the United States."

In video interview at Information Security Media Group's recent Fraud and Breach Summit in Chicago, Mirza discusses:

GDPR's impact on U.S. legislation; Key tenets of CCPA; What security professionals need to know about pending privacy bills.

Mirza, cybersecurity, information governance and privacy attorney at Troutman Sanders, focuses her practice on the financial services industry.

) • May 30, 2019     5 Minutes   

On the sixth stop of a multi-city tour, ISMG and Sonatype visited San Francisco for an engaging discussion on how to mitigate risks introduced by open source software. Sonatype CMO Matt Howard discusses the relevance and value of this application security conversation.

The reason why this topic resonates so well across sectors and regions? "Because software is the last path for differentiation in every industry," Howard says, "and whether you know it or not, every business in the world today is largely a software company."

In an interview following the SF event, Howard discusses:

Why the open source topic resonates so well; The maturity of the SF crowd; The value of these roundtable discussions for attendees and sponsors alike.

A proven executive and entrepreneur with over 20 years experience developing high-growth software companies, Howard leads Sonatype's corporate marketing, strategic partnering and demand generation initiatives. Prior to Sonatype, he co-founded, developed and successfully sold two software companies. Earlier in his career he led sales and marketing at USinternetworking (acquired by AT&T) and Groove Networks (acquired by Microsoft) where his teams distributed workgroup collaboration products to enterprise customers.

Infections Started in 2015 and Ran Through April(jeremy_kirk) • May 31, 2019    Checkers, Rally's Burger Joints Hit By POS MalwareA Rally's drive-through in Louisiana (Photo: Vrlobo888 via Wikimedia Commons/CC)

Checkers Drive-In Restaurants, which also runs Rally's, says 102 of its 900 U.S. locations were hit with point-of-sale malware, with one California restaurant infected over a more than two-year period starting in December 2015.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

Checkers, which was acquired by private equity firm Oak Hill Capital Partners in 2017, says it "recently" became aware of the malware and is taking steps to remove it.

"After discovering the issue, we quickly engaged leading data security experts to conduct an extensive investigation and coordinated with affected restaurants and federal law enforcement authorities to address the matter," according to a statement from Adam Noyes, who is chief administrative officer and executive vice president of Checkers.

Retailers, restaurant chains and hotels have been frequent victims of POS malware, which seeks to collect card details during payment processing. POS systems are attractive targets due to the large volumes of card data that are processed.

Mag Stripe Data Stolen

Checkers has published a list of the affected restaurants, which spanned 20 states. It listed a date range for each location affected, but it said not all customers who visited those locations during those ranges had their card details stolen.

The malware harvested data stored on a payment card's magnetic stripe, including name, card number, card verification code and expiry data.

The length of time data was exposed varied significantly for affected locales, and it's unclear why.

For example, the earliest infection appeared at a Rally's in Los Angeles starting in December 2015 and ended in March of 2018. The exposure period for many infection periods, however, end in April, which suggests that's when Checkers discovered it had a large-scale problem.

Efforts to reach a Checkers spokesperson for clarification were not immediately successful.

Soft Targets

Despite big POS malware strikes against retailers such as Target and Home Depot in 2013 and 2014 and many incidents since, retailers remain attractive targets for cybercriminals. The stolen card details are typically sold in underground forums based on the projected return on a card and its credit limit.

Even though more than half a decade has passed since Target and Home Depot were hit, the opportunities for hackers clearly haven't been closed. Cisco's Talos intelligence unit highlighted yet another type of new POS malware in March, pointing out why it's a continuing problem (see: Fresh POS Malware Strikes Small and Midsize Companies).

"Point-of-sale terminals are often forgotten about in terms of segregation and can represent a soft target for attackers," Cisco wrote in a blog post.

Last year, several large organizations reported payment card breaches, including Applebee's, Saks Fifth Avenue and Chili's. The incidents can be costly for retailers and restaurants because banks may take legal action to recover costs, such as issuing new cards. Class action lawsuits on behalf of consumers also are frequently filed.

In February, Wendy's announced it had entered into a settlement agreement related to a class-action lawsuit filed by banks. The suit related to a 2015 and 2016 breach in which 18 million card details were stolen from the POS systems of 1,025 restaurants (see: Wendy's Reaches $50 Million Breach Settlement With Banks).

Just hours after Checkers issued its advisory, the law firm Federman & Sherwood, which has offices in Oklahoma and Texas, announced it was launching an investigation of the Checkers breach that could lead to a consumer class action lawsuit.

In March, Federman & Sherwood reached a consumer settlement with Sonic Drive-In, another burger-and-fries chain, regarding a POS malware card breach that affected 325 restaurants (see: Fast-Food Chain Sonic Investigates Potential Card Breach).

Application Security , General Data Protection Regulation (GDPR) , Governance

Cybersecurity Conference Addresses AppSec, Incident Response, Top Threats and More(euroinfosec) • May 31, 2019    11 Hot Sessions: Infosecurity Europe 2019Data breach expert Troy Hunt is among the keynote speakers at this year's Infosecurity Europe. (Photo: Mathew Schwartz)

Come June in London, it's time for the return of the annual Infosecurity Europe conference.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

Running from Tuesday, June 4, through Thursday, June 6, this year's cybersecurity conference is set to feature more than 230 sessions. Across keynotes, a Cyber Innovation Showcase, an "immersive zone" called Geek Street and more, these sessions will cover a broad range of topics, including application security, automation, data protection, risk management, incident response and threat analysis.

Here's a preview of 11 hot sessions:

Wednesday, June 5

image

Discovering the Digital Underworld: Privacy, the Dark Web, Tech & Democracy (10:15 - 11:05): Keynote: Jamie Bartlett, author of "The People vs. Tech: How the Internet is Killing Democracy" and "The Dark Net", will look at how the digital revolution is destabilizing our already fragile democracies as part of a wider-ranging look at the impact of cybercrime and surveillance.

View from the Board: Managing Organizational Complexity & Risk (11:25 - 12:05): Keynote: Inga Beale, former CEO of Lloyds of London, promises to describe the challenge of changing business culture during a digital transformation program as well as touch on strategies for addressing cyber risk board-level communications.

imageKen Munro of Pen Test Partners speaks at Infosecurity Europe 2017.

Regulating the IoT. A Dream Too Far? (11:45 - 12:30): Geek Street: Ken Munro, a partner at Pen Test Partners who's hacked hotel keycards, keyless cars, internet of things devices and children's toys, will address IoT security challenges (see: Don't Hug These Internet-Connected Stuffed Toys).

imageBrian Honan moderates a panel on GDPR at Infosecurity Europe 2018.

Navigating Complex Regulatory Oversight to Ensure Privacy, Security & Compliance (16:40 - 17:30): Keynote: Cybersecurity expert Brian Honan will moderate a session featuring panelists from the Bank of England, the Information Commissioner's Office, News UK and Penguin Random House, reviewing not just managing privacy risk from the EU's General Data Protection Regulation, but also Europe's proposed ePrivacy Regulation.

Thursday, June 6

imageCiaran Martin, CEO, National Cyber Security Center, speaking at CyberUK 2019 in April in Glasgow, Scotland

Defending the U.K.: The NCSC Vision For a More Secure UK (10:15 - 11:05): Keynote: A representative from Britain's National Cyber Security Center - the public-facing arm of GCHQ - will take to the stage to talk about the agency's efforts (see Cybersecurity Drives Intelligence Agencies in From the Cold).

imageTroy Hunt

Rise of the Breaches (11:20 - 12:10): Keynote: Troy Hunt, founder of the free breach-notification service Have I Been Pwned, will describe the rise of data breaches. He's this year's inductee into the Infosecurity Europe Hall of Fame (see: Credential Stuffing Attacks: How to Combat Reused Passwords).

imageRobert McArdle speaking at the IRISSCERT conference in Dublin in 2015

Feel the Flow: Where Water & Energy Industries are Most Vulnerable (11:45 - 12:30): Geek Street: Always engaging and never averse to translating security into digestible Star Wars metaphors, Robert McArdle, director of Trend Micro's Forward Looking Threat Research team, promises to go beyond the overly sensationalized tales of industrial control system hacking and talk about how organizations can learn from previous incidents about how to safeguard their potentially exposed critical systems.

image The bow of container ship Majestic Maersk (Photo: Teralaser, via Flickr/CC)

Case Study: Lessons Learned from the NotPetya Cyber-Attack (12:25 - 13:15): Keynote: Shipping giant A.P. Møller-Maersk got hit hard by the 2017 NotPetya ransomware outbreak, but then earned plaudits for its crisis communications as it recovered. The company's CIO and CTO, Adam Banks, will detail how Maersk responded to the attack and share crisis management and communications lessons learned (see: Maersk Previews NotPetya Impact: Up to $300 Million).

image

Black Mirrors: The Dark Web, The Enterprise & Platform Criminality (13:00 - 13:45): Geek Street: Criminologist Mike McGuire of the University of Surrey will offer a deep dive into the dark web world of "platform criminality."

Strengthening Collaboration Between Law Enforcement & Business (13:30 - 14:10): Keynote: Peter Goodman, chief constable of Derbyshire Constabulary and also the cyber lead for the National Police Chiefs' Council, will talk about how businesses and law enforcement agencies can better work together.

Building an Intelligent Incident Response Plan: Lessons from the Front Line (14:25 - 15:35): Keynote: Panelists from Aldermore Bank, Domino's, Pinsent Masons and Vocalink will discuss best practices for translating IR strategy into tactical implementation in this session moderated by Amar Singh, CEO of Cyber Management Alliance.

Exhibitors Galore

Of course the conference features far more than just sessions (see: Visual Journal: Infosecurity Europe 2018).

Given the number of information security professionals in attendance, the conference also serves as a great place for networking as well as to check out the latest technologies.

More than 400 exhibitors will have displays, making this the U.K.'s biggest annual information security event. Exhibitors on hand will include 13 small companies selected by the British government as part of its "Most Innovative Small Cybersecurity Company of the Year" competition, including Hack the Box - the winner - as well as Human Firewall, Padlock, Tricerion and others.

imageFlashback: Assembly in progress on the 2018 Infosecurity Europe 2018 conference

As in years past, I'll be conducting interviews at the Information Security Media Group stand in the exhibition hall, talking to a number of leading information security practitioners. Stay tuned for numerous video interviews from the event.

imageInfosecurity 2018 flashback: Talking GDPR and breach notification with IBM Resilient's Allen Rogers (Photo: ISMG)

I hope to catch you at Infosecurity 2019 in London.

All photos by Mathew Schwartz unless otherwise indicated.

  1. Irish Supreme Court Rejects Facebook Bid To Block ECJ Data Case
  2. 2.3B Files Exposed In A Year: A New Record For Misconfigs
  3. Just Over 100 Checkers And Rally's Hit With POS Malware
  4. Linux Backdoor Found In The Wild Escaped AV Detection

Page 245 of 354