Authentication , Cybersecurity , Messaging

The news is in that the National Institute of Standards and Technology has finally stated what both security professionals and hackers alike have known for years: SMS is insecure, and is no longer suitable as a strong authentication mechanism. SMS Messages are not protected from the wrong eyes seeing them, and there is no assurance that they will actually go to the intended recipient. So everyone knew this day was coming, yet scores of applications deployed SMS as a security mechanism, and the question is, "Why?"

It's quite simple: As people began to lose trust in password-protected services, in the rush to give users a 'sense of security' (in other words, "We're secure, so keep using our service, pretty please!"), SMS texts provided a cheap, ubiquitous, and easy-to-understand process. In the best of cases, SMS was used for low-risk web-site access; in the worst of cases, misplaced trust saw it leveraged for access to highly-targeted intellectual property, "secure" networks, and even some credit card issuers and financial institutions. Oh, the SMS peddlers without suitable alternatives talked it up with various buzz-phrases, like "out-of-band" and "step-up" authentication, but the reality now is that SMS security does not deliver as a true "second factor", as some may have claimed; attacks against SMS are no longer theoretical but widespread.

What was the problem with SMS from the beginning, and what has changed? Well, SMS has always provided a "logical" link between your user's phone number and the actual device they hold in their hand. Before smartphones and must-have apps, the point of compromise was the user's wireless account; change the phone registered to an account, and voila! You are receiving the messages without actually hacking the account being attacked. Basically, you were relying upon the cellular companies to maintain your security. In some cases, the providers have increased the security of these types of device changes, and so maybe we delayed the inevitable....

Many people innocently believe the only way for someone to see their SMS messages is if they are in possession of their phone, and have a false sense of added security if they are using a passcode or fingerprint to protect their phone access. They couldn't be more wrong! What's here now is the ability to attack the phone directly. A user downloads all sorts of apps, usually granting various permissions without giving it a thought. Downloading apps from untrusted app stores, using jailbroken or rooted phones, or in general, just acting like users, clueless to the risks they face day to day.

Now consider the variety of apps available for "legitimate" use. Want to really see who your kids are socializing with by monitoring their texts? Want to help your aging parent by monitoring their SMS messages from one of the various services they might use? Simply install a hidden SMS utility on their phone and remotely see all their incoming and outgoing messages. So if these apps can do these things at your command, what makes you think a hacker can't hide these malicious tools in an app without your knowledge? Application repackaging, code injection, screen overlays, rogue keyboards.....Are you downloading the latest viral app? You might just get a few extra bells and whistles that you are not interested in, and they will most likely be stealing your login credentials.

So what now? Alternatives exist, and your application can be protected by run-time self-protection, true transaction security and device-binding technologies, allowing your mobile to still be used as a great second factor." Unfortunately, for years have we have heard "Passwords are dead!" yet most of us can't get around typing passwords all day; knowledge-based authentication is equally vulnerable. And now that we have heard "SMS Authentication is dead!" we need to go where the user and their devices are, and truly secure them! We must stop relying upon the SMS "message-in-a-bottle" approach to security, or we'll be relearning this lesson again and again and again....

CISO , Cybersecurity , Governance

Presented by Pulse Secure     60 minutes     Today's organization needs to provide its employees, partners, applications and even networks access to its data and IT environment regardless of how they access it. But challenges regarding identity management and device compliance can make it very difficult to be secure in this increasingly complex IT world - particularly if the solutions end up limiting productivity and hobble innovation and competitiveness. Identity management and device compliance are essential to today's organizations, whether users are accessing information via traditional enterprise applications or through cloud services on their personal devices. That's why centrally managed safeguarding of credentials across hybrid IT infrastructures, or "secure access," is the best method for ensuring data security and compliance for your organization. Register for this session to hear from David Goldschlag, Senior Vice President of Strategy and CTO at Pulse Secure, to learn why secure access and flexibility go hand in hand in forming a successful and secure IT network. To ensure that your employees and partners maintain data security no matter how they access your hybrid IT infrastructure, you need to have a central authentication and compliance solution in place. Leveraging a solution like Pulse Connect Secure enables organizations to deliver fast, secure, and optimized access to data center applications and cloud services while ensuring a consistent native-user experience across any device. In this informative webinar, Pulse Secure CTO David Goldschlag will discuss: The importance of having a single authentication and compliance policy for your hybrid IT infrastructure; How to improve visibility and context to filter traffic and enforce secure access policies; Real-world examples of how Pulse Secure's Secure Access architecture enables users to securely access Microsoft Office365 and SAP from iOS devices. You might also be interested in … Healthcare Hacker Attacks: No End In Sight

Anti-Malware , Technology

Four vulnerabilities relating to Qualcomm chipsets used by an estimated 900 million Android smartphones and tablets could each be exploited to seize control of devices and steal any data they store, warns Israeli cybersecurity firm Check Point.

See Also: From Authentication to Advanced Attack Vectors: Top Trends in Cybercrime in Q1 2016

Devices from numerous manufacturers - including Samsung, HTC, Motorola and LG - are reportedly at risk from the flaws, which exist in chipset-related code created by Qualcomm.

"If any one of the four vulnerabilities is exploited, an attacker can trigger privilege escalations and gain root access to a device," Check Point warns in a related research report into the flaws, which it's dubbed "Quadrooter."

Researchers from Check Point, who first detailed their findings on Aug. 7 at the Def Con conference in Las Vegas, say that an attacker could exploit the flaws by sneaking a malicious app onto a user's device, and that the vulnerabilities could be exploited without requiring users to grant them any special permissions, thus masking the attack.

Neither Google nor Qualcomm immediately responded to a request for comment about the flaws or related fixes.

Qualcomm controlled 65 percent of the world's 4G/LTE chipset market in 2015, compared with Samsung, which controlled 12 percent market share - largely due to the tech giant building its own chips for Galaxy S6, Galaxy S6 edge, and Galaxy Note5 devices - according to market researcher ABI Research.

Check Point says it alerted both Qualcomm and Google to the flaws in April, and that Qualcomm has pushed patches for its chipsets. Google, meanwhile, has said that any Android user who's downloaded the July security update for Android will be protected against three of the four flaws.

Still, many Android users may have to wait months - or longer - for their device manufacturers or cellular providers to release fixes that will work on the customized versions of Android that run their devices (see FTC, FCC Launch Mobile Security Inquiries).

"Fixes require mind-bending coordination between suppliers, manufacturers, carriers and users before patches make it from the drawing board to installation," Check Point notes in its report. "The fragmented world of Android leaves many users exposed to risk, even with out-of-the-box devices."

Qualcomm Chipset Code: Four Flaws

Check Point says the flaws it discovered involve a vulnerability in a Qualcomm-built kernel module, called ipc_router, that allows various Qualcomm components to communicate (CVE-2016-2059); a vulnerability in Ashmem - Android's propriety memory allocation subsystem (CVE-2016-5340); and two different flaws in Android's kernel graphics support layer driver (CVE-2016-2503, CVE-2016-2504).

"Preinstalled on devices at the point of manufacturing, these vulnerable drivers can only be fixed by installing a patch from the distributor or carrier," Check Point says. "Distributors and carriers can only issue patches after receiving fixed driver packs from Qualcomm."

Alex Gantman, the Qualcomm Product Security Initiative vice president of engineering, says that his company has released patches that fix the flaws. "I take pride in our collaborative relationship with security researchers and I am always appreciative of community's efforts to help us harden our products," he told Financial Times.

Now Manufacturers Must Patch

Now, it's up to affected manufacturers and mobile phone providers to create fixes for customers and subscribers. Via Check Point, here's a partial list of vulnerable devices:

Check Point has also released a free QuadRooter Scanner app via Google Play designed to scan for the presence of any of the four flaws it found.

Ongoing Threat: Malicious Apps

A Google spokesman attempted to downplay any risks relating to the four flaws, telling Financial Times that the flaw would require attackers to sneak a malicious app onto a target's smartphone or tablet. "Exploitation of these issues depends on users also downloading and installing a malicious application," Google said. "Our Verify apps and SafetyNet protections help identify, block, and remove applications that exploit vulnerabilities like these."

But app stores - from Google, Apple, or any other provider - aren't immune to attackers sneaking in malicious apps (see Apple Battles App Store Malware Outbreak). Plus, while Google says it's built strong security controls into its app store - Google Play - not all parts of the world enjoy full access to the site, thus driving users to seek less-secure alternatives. In China, for example, users reportedly can only access free apps, rather than paid apps, on Google Play. Not coincidentally, many attackers repackage legitimate, popular Android apps, oftentimes creating "free" Trojanized versions designed to sneak adware onto users' devices.

In July, Check Point reported that a single Chinese cybercrime group - associated with China-based mobile ad server company Yingmob - was earning $300,000 per month via such attacks, and controlled 10 million infected Android devices around the world (see Android Trojanized Adware 'Shedun' Infections Surge).

Fraud , Messaging , Technology

When the computer security company SecureWorks began studying email fraud schemes out of West Africa, the profiles of one particular group surprised them. Instead of young adults working out of cyber cafes, they were older, deeply religious men working at home.

See Also: From Authentication to Advanced Attack Vectors: Top Trends in Cybercrime in Q1 2016

The profiles were a departure from how many West African email scammers have presented themselves on social media, posing with bundles of cash and cars. Instead, these scammers have Bible quotes on their desktops.

"These guys are older, family men," says Joe Stewart, director of malware research at SecureWorks. "They're very low key about how they're making a living. They appear well-off in their pictures on social media, but they're never being flashy about it."

The group studied by SecureWorks is one of a number that have graduated from purely social engineering scams designed to trick people into making wire transfers, known under the Nigerian criminal code as 419 scams. Instead, the scams have evolved into something that's vastly more profitable, which law enforcement refer to as business email compromise or business email spoofing.

The attackers get inside the email systems of companies and do careful reconnaissance, looking for business-to-business transactions where they can intervene. If two companies are about to make a deal, the scammers use their inside access to email systems to modify invoice details and direct payments into accounts they control.

The U.S. FBI has repeatedly warned that the attacks are causing devastating losses to businesses. In April, the agency said at least $2.3 billion had been reported lost worldwide from October 2013 through February, comprising nearly 18,000 victims (see Business Email Compromise: How Big Is the Problem?).

Source of Insight

SecureWorks gained deep insight into one of the business email compromise groups because of a big mistake by its ringleader, Mr. X.

"The operator had infected himself with his own malware," says James Bettke, an information security research adviser at SecureWorks. "He was uploading screenshots every few minutes of his desktop, so we were able to determine he was ringleader of a BEC operation."

The malware also uploaded keystroke logs and clipboard information from Mr. X's computer to an open web server, which SecureWorks analyzed. That allowed the company to gain insight into the malware and tools the group uses.

Nicknamed Wire-Wire Group 1, SecureWorks estimates the group may have caused as much as $6 million annually in losses, making a net profit of $3 million after paying off money launderers, according to a blog post. It's an enormous sum in Nigeria, where GDP per capita is $6,100 annually, according to the CIA's Fact Book. Mr. X acted as an adviser, training others in the group for a cut of their proceeds.

The group picks targets by simply trolling the web for companies that have published email addresses for employees. Then comes what they refer to as "bombing" - sending malware or phishing emails, hoping to capture credentials for email accounts.

Not many of the attacks are successful. But even if 1 or 2 out of 1,000 targets are infected and compromised, it provides more than enough work for the next, labor-intensive stage of the attack.

After a company has been compromised, the attackers read through emails to discover the relationships between people and scan for pending high-value transactions. At the last minute, the payment details for an invoice are altered. The seller never gets the money, and the buyer never gets the product.

"Both parties are sort of confused, not really knowing that this third party has somehow managed to intercept their emails and very discretely changed those fine details," Bettke says.

Recent Arrests

Nigeria has long fought a battle against 419 scams, also referred to advanced free fraud. In 2003, Nigeria set up the Economic and Financial Crimes Commission to tackle internet-related crime and create public awareness campaigns trying to dissuade youths from becoming so-called yahoo-yahoo boys.

Nigeria recently has made some progress in the fight against the email scams. On Aug. 1, Interpol and the EFCC announced the arrest of a 40-year-old Nigerian man whom authorities believe was behind $60 million in fraud.

The man, referred to as Mike, headed a group of 40 people based in Nigeria, Malaysia and South Africa who were executing business email and romance scams. The group targeted the email accounts of small to medium-size businesses in Australia, Canada, India, Malaysia, Romania, South Africa, Thailand and the U.S. In one incident, a target paid $15.4 million, officials report.

Easy Defenses

Businesses can take some easy defensive steps to reduce their exposure. For example, SecureWorks recommends using two-factor authentication on email accounts. Another best practice is to closely examine wire transfer details, especially for large transactions. It's also good to pick up the phone with the other party to confirm the details, which would route around attackers lurking inside email accounts. Administrators should also watch out for new rules set up in email accounts that divert messages to other domains.

SecureWorks has also created a tool called pdfexpose that can detect modifications to PDFs. Scammers will often modify PDF invoices with a white opaque rectangle. The tool looks in a PDF for duplicate sets of bank account routing details that may be hidden under floating layers.

There is one day, though, when businesses don't have to worry about receiving BEC-related malware from Nigeria.

"A lot of this activity actually drops on Sunday because they're actually at church and taking the day off," Stewart says.

A report calling for the United States electoral systems to be designated as critical infrastructure to enhance information security and integrity leads this episode of the ISMG Security Report.

In the ISMG Security Report (click on player beneath image to listen), you'll also hear:

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Be sure to check out our July 29 and Aug. 2 reports, which respectively analyze what the Democratic Party platform has to say about privacy and cybersecurity and why IT security practitioners act more like "witch doctors" than scientists. The next ISMG Security Report will be posted Tuesday, Aug. 9.

Theme music for the ISMG Security Report by Ithaca Audio under the Creative Commons license.

Data Breach , Fraud , Payments Fraud

In the wake of the recent hack of the Bitfinex bitcoin exchange in Hong Kong, the Ethereum hack earlier this year and the Mt. Gox hack in 2014, the stability and security of cryptocurrency is being questioned. Cryptocurrency expert Robert Schwentker says these attacks could raise questions about whether regulatory oversight of bitcoin exchanges is needed.

See Also: How to Mitigate Credential Theft by Securing Active Directory

"The hack of the Bitfinex exchange in Hong Kong, which resulted in approximately 120,000 bitcoins being stolen ... was not, again, a hack of bitcoin protocol itself," Schwentker says in this video interview with Information Security Media Group. "It's similar to the Mt. Gox hack, where an exchange got hacked. Certain security protocols apparently might not have been followed, and the practices that they set up were not followed. Therefore, there's been this loss of people's funds. Whether the exchange will make those people who had put their bitcoins on their exchange whole again or not, we'll have to see."

In this interview at ISMG's recent New York Fraud and Breach Prevention Summit, Schwentker also discusses:

Schwentker is co-founder and president of Blockchain University, a project developed to provide education about blockchain technologies to developers, builders and startups in Silicon Valley. Previously, Schwentker held software development positions with PayPal, American Express, Mechanics Bank and others.