Log inRegister

Fraud News

Cybercrime , Data Breach , DDoS

Hector Monsegur Seeks Redemption by Offering Advice to Security Executives• March 20, 2019    Former Hacktivist: Why Persistence Is KeyHector Monsegur keynotes ISMG's Fraud Summit

For as long as Hector Monesgur has been online, he's broken the rules.

See Also: Live Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

There's the teenage curiosity that got him interested in computers, progressing from Windows 95 and AOL dial-up to Unix systems and learning Perl, which eventually led to his first hacks. There's his ability to become a highly-paid system admin without a college degree or a certification.

Then there's the hacktivism and association with the Anonymous collective and LulzSec, which trained their sights on governments and corporations around the world, including distributed denial of service attacks that targeted among others PBS, Sony Pictures, Fox, Visa, MasterCard, PayPal and numerous others. In his role, Monesgur served as one of the lead hackers who stole and publicized confidential information, defaced websites, and helped shut down the internet in Tunisia during the Arab Spring.

Monesgur also broke the rules hackers had created themselves, including avoiding publicity. Eventually, he broke the ultimate rule: He cooperated with the FBI and turned on Anonymous and others.

"It was kind of against the ideas of the hackers and e-zines and the literature that was passed down from the 1980s to the 1990s, when I first got online. One of the first things I would read was that you should never attack the U.S. government - that's one. The second was never let anyone know what you are doing. And I kind of violated both of those," Monesgur told the Information Security Media's Group New York City Fraud Summit on March 19, as the event's keynote speaker.

Following his arrest and incarceration in federal prison several years ago, Monesgur has been on a redemption tour. He's spoken about his past experiences and how he lived with the consequences of his decision. As the chief researcher at Rhino Security Labs, the hacker once known as "Sabu" is now offering better security for corporate clients.

"But I do want to put out a disclaimer. I'm not here to glorify the past. I'm not proud of it and I'm actually very glad that I have made it this far and I have been able to get back to the industry and get working for my family," Monesgur said.

Persistence Is Key

During his talk on Tuesday, Monesgur used examples from his past hacking activities to illustrate a point: Attackers don't give up once a target is picked. It's a rule that Monesgur followed and it shows why persistence is key to understanding better cybersecurity practices.

"Attackers will get you regardless. You can have all the vendors and software you need ... The attacker is not going away, especially if they are focused on you. It's good to have insight and a perspective on this to move forward," Monesgur said.

In an interview with ISMG, Monesgur explained that many of the problems he sees with clients now center around asset management and not knowing what's on the network. As a hacker, Monesgur would spend weeks gathering intelligence about targets, noting what assets were sitting on these networks and what misconfigurations could be exploited.

"Not only do companies have problems with the external side of their security posture but also the internal side of their security posture," Monesgur said. "In many cases, they don't really know what they are running online. We're not even taking about shadow IT or something similar where you have employees coming in with different devices and are running devices that are not vetted or authenticated or given permission to access the network."

Another developing issue he sees: Insider threats.

"You also have things like insider threats, which is going to be a bigger problem going forward because there's no way to really stop that. Even if you were able to implement a DLP or data loss prevention software, there are still ways to circumvent those technologies," Monesgur said.

More recently, Monesgur and his colleagues have started to see the effects that new issues, such as DevOps, can have on enterprise security.

" What we do, when we start auditing a network for asset management, we are falling right into the whole DevOps slash security problem," Monesgur told ISMG. "It's a whole different beast. A lot of organizations that are bringing in-house developers, they are really opening the doors without really putting emphasis on security policies. Believe it or not, you can have a really secure infrastructure elsewhere, but then the DevOps team or the developers department starts bashing holes with ... weak passwords, public GitHub repositories, access to S3 buckets everywhere and permissions are a problem."

Why Trust A Hacker?

The one question that follows Monesgur around is of trust.

In conversation with ISMG's Senior Vice President for Editorial Tom Field, Monesgur was asked if he could be trusted. He did serve almost a year in federal prison and could have faced a maximum sentence of 124 years under sentencing guidelines if found guilty on all counts, although, in reality, he faced between five to 10 years.

His cooperation helped, but that meant turning on his former Anonymous collaborators, a decision that continues to impact him, as hackers occasionally disrupt his public appearances. However, reflecting on the possible loss of his family and a desire for redemption shows that anyone can change.

"It's all about the person's merit ... not everyone is a lifelong career criminal. Sometimes people make mistakes and they deviate and they make decisions without thinking about consequences and I was one of those individuals. Once I was in prison and I lost my family temporarily, I had made the revelation at the end of the day that this is not worth it and there's more to life," Monesgur said.

At the same time, his story holds lessons for CISOs and other security executives looking to protect against cyberattacks now.

"We do have a skill and a talent shortage. Former hackers have the skills and a talent. I'm not saying you have to hire them, but I am saying you should entertain the interview," Monesgur said. "At the end of the day, it's becoming harder to find workers who can follow your policy, enforce your policy and even understand your policies, including implementation and asset management, and developing documentation for your employees and educating employees that are not that technically savvy. It's a broad industry that is still in its infancy and we don't have enough workers."

Cybersecurity , Endpoint Security

Agency Receives Critique on Draft of Premarket Medical Device Cyber Guidance Update(HealthInfoSec) • March 20, 2019    Groups Ask FDA to Rethink Some Medical Device Cyber Proposals

The Food and Drug Administration is generally on the right track in updating guidance for the cybersecurity of premarket medical devices. But various changes are needed, according to some of the three dozen-plus healthcare sector companies and groups recently submitting feedback to the agency.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

Some of the associations submitting comments on FDA's draft guidance suggested modifications to the agency's call for a "cybersecurity bill of materials," or CBOM, that medical device makers would need to submit to the FDA for premarket review. Some also critiqued FDA's proposal to define two tiers of medical devices based on their cybersecurity risk (see FDA Calls for Cybersecurity Bill of Materials).

The FDA had requested comment by March 18 on its "Content of Premarket Submissions for Management of Cybersecurity in Medical Devices," which was issued last October. That draft premarket guidance is a significant refresh of FDA's 2014 guidance, the agency noted last fall.

Nearly 40 groups and companies submitted comments on the draft guidance by the FDA's March 18 deadline, according to the Regulations.gov website. FDA will review the comments before issuing a final version of the guidance.

Cybersecurity Bill of Materials

Under the FDA's proposals, medical device makers would submit to the agency before devices are marketed a CBOM that would include a list of commercial, open source and off-the-shelf software and hardware components that are or could become susceptible to vulnerabilities, the draft guidance says.

Many of the associations representing healthcare provider organizations were generally supportive of the CBOM proposal. "Our members have a significant need for this information, which is crucial to evaluating threats and risks, as well as undertaking mitigation," wrote the Greater New York Hospital Association in its comments.

Kaiser Permanente, the largest private integrated healthcare delivery system in the U.S., with 12.2 million members in eight states and the District of Columbia, noted that "the introduction of a Cybersecurity Bill of Materials as part of the risk management methodology will significantly improve medical device purchasing and maintenance decisions."

However, some commenters - including some associations representing medical device makers - suggested that the FDA's definition of a CBOM that includes hardware components would be too challenging to implement.

"FDA should reference a 'software bill of materials,' instead of a CBOM, and define SBOM as 'a list of commercial off-the-shelf software or open source software components that are included in the medical device software, limited to version and build," wrote the Advanced Medical Technology Association, or AdvaMed, which represents medical technology companies.

"Providing and maintaining a bill of materials that includes hardware presents unique challenges compared to software-only bill of materials, some of which are outside the immediate control of the manufacturer," AdvaMed wrote.

For example, if components are sourced from a supplier, it may not be possible to obtain a list of all hardware subcomponents, as suppliers may be unwilling or unable to provide such information, AdvaMed contends. "If the BOM were to include all software and all hardware down to the lowest component level, the sheer amount of data provided will very likely work against the shared goal to prioritize, prevent and react to cybersecurity risks to protect patient health."

Medical device maker GE Healthcare offered a similar assessment, and also suggested that FDA focus its bill of materials proposal on software, not hardware components.

"We note that vulnerabilities such as Spectre and Meltdown occurred at the level of CPU," GE Healthcare wrote.

"At this level the bill of materials would include hundreds of programmable chipsets embedded in motherboards, peripherals, and power distribution units within a single general-purpose workstation-class computer. We do not see value for healthcare delivery organizations in proactive customer disclosure and purchasing control at this level, even in the event of another vulnerability such as Spectre."

Tiers of Risk

In the draft guidance, the FDA proposes defining two tiers of devices based on their cybersecurity risk.

Tier 1, or "higher cybersecurity risk" products include devices capable of connecting - wired or wirelessly - to another medical or non-medical product, or to a network or the Internet. In addition, a cybersecurity incident affecting these devices could directly result in patient harm to multiple patients, FDA writes in the draft guidance.

Some examples of Tier 1 devices are implantable cardiac devices, such as defibrillators and pacemakers; infusion and insulin pumps; and the supporting connected systems that interact with these devices, such as home monitors and those with command and control functionality such as programmers, the FDA proposes.

"Many of our members continue to be confronted with some manufacturers who refuse to take action on known vulnerabilities."
—CHIME

Tier 2, or "standard cybersecurity risk" medical devices are those that don't meet the criteria for tier 1.

Some of the commenters were critical of FDA's cyber risk tier proposals.

"We find this proposed two-tier framework confusing and unnecessary given its superficial similarity to FDA's risk classification scheme for medical devices," AdvaMed wrote.

"There are significant differences between device types that could fit within the proposed tiers. For example, small implanted medical devices, such as ICDs and pacemakers, have significantly more engineering constraints limiting their hardware and software capabilities when compared to larger medical devices used, for example, in a hospital setting," the group wrote.

"We believe FDA should remove the two-tiered approach in favor of a single risk-based approach that addresses the agency's cybersecurity expectations based on the exploitability of a device vulnerability and the severity of patient harm - if exploited."

While AdvaMed argued against FDA's draft two-tier risk approach, GE Healthcare proposed FDA add a third tier.

"We suggest that the addition of an explicit criteria for an additional Tier 3 for 'low cybersecurity risk' [that] may make the entire tiering system more usable," GE Healthcare wrote.

"For example, a device whose security threats are limited to impact only one device at a time by requiring physical access to exploit could be an example of a Tier 3 low cybersecurity risk."

But it wasn't only medical device makers that found the FDA's draft cybersecurity risk tier proposals lacking.

"We recommend FDA expand the discussion of device tiers to address the responsibility of all stakeholders to ensure security of and risk mitigation of medical devices exploiting network vulnerabilities," Kaiser Permanente wrote.

"Devices can be risk vectors for the enterprise and patients without causing direct harm. For example, a network security vulnerability in a device could allow exposure and/or modification of patient data in the electronic medical record resulting in patient harm indirectly," the organization wrote.

Other Concerns

Some groups submitting comments also offered up other suggestions about actions FDA should consider taking for improving medical device cybersecurity.

The College of Healthcare Information Management Executive suggests FDA rethink its definition of medical device in the context of cybersecurity. "The definition should recognize that medical devices are part of an overall ecosystem which includes but is not limited to networks, switches, firewalls, applications and other components that come with 'medical devices'," CHIME - an association of healthcare CIOs and CISOs - wrote.

"Many of our members continue to be confronted with some manufacturers who refuse to take action on known vulnerabilities choosing either to categorize them as 'controlled risks' or saying they will wait until the FDA recalls a device," CHIME complained.

"For example, many of our members still report that patch MS17-010 - the patch that protects against WannaCry - has still not been deployed to certain medical devices due to the manufacturers classifying that vulnerability as a controlled risk," CHIME wrote.

This situation continues two years after the global ransomware attacks involving WannaCry and NotPetya CHIME adds.

"From our perspective both of these scenarios are unacceptable. Importantly, we believe that the FDA must be as explicit as possible with manufacturers around their expectations. Without clear direction to the manufacturers about what is required, the burden of proof for demonstrating a standard has been met and devices are secure will be shouldered by providers."

2018: The year of the banking Trojan Kaspersky Labs detected 900,000 attacks against users in 2018 alone.

Banking Trojans are popular in cybercriminal schemes given the valuable data and financial service credentials they can steal in successful cyberattacks.

Banks find themselves a constant target for relentless attacks against their apps and infrastructure. Their names, too, are abused by threat actors which use them in phishing campaigns and through copycat malicious domains designed to dupe customers into handing over their account credentials.

Banking Trojans are considered one of the top threats to the enterprise today. In 2018 alone, Kaspersky Lab recorded roughly 900,000 financial malware-based attacks against users in 2018 -- an increase of 16 percent in comparison to 767,000 attacks in the previous year.

The names of such malware may be familiar. Zeus, Redaman, BackSwap, Emotet, Gozi, and Ramnit are only some of the Trojan families which have gained prominence in the cybercriminal world, however, the operators of campaigns using banking Trojans are constantly cajoling for space and territory.

At least, this used to be the case. According to IBM's Global Executive Security Advisor Limor Kessem and the IBM X-Force cybersecurity team, the top banking malware operators are now working together to distribute their malware.

On Wednesday, Kessem revealed new research on the cooperative trend, which builds upon the financial malware trends discussed in the latest IBM X-Force Threat Intelligence Index.

Trickbot, Gozi, Ramnit, and IcedID were the most active banking Trojans in 2018, and while other forms of malware have grown in popularity, it is the most active -- and prevalent -- forms of financial malware which are now being spread through cybercriminal partnerships.

screenshot-2019-03-20-at-08-33-25.png

The cybersecurity researchers say that the list is "populated by organized cybercrime gangs that have ties to yet other cybercrime gangs, each doing its part to feed the perpetual supply chain of a digital financial crime economy."

"The banking Trojan arena is dominated by groups from the same part of the world and by people who know each other and collaborate to continue orchestrating high-volume wire fraud," Kessem added.

Trickbot is one of the major players in the financial Trojan space. The Russian cybercriminals behind the malware, who target banks and wealth firms managing high-value accounts, have recently diversified into ransomware as part of a wider botnet strategy and are now working with gang members from IcedID.

First discovered in 2017, IcedID uses web injection attacks to compromise online payment portals and also indulges in the typical bait-and-switch method for redirecting banking customers to malicious domains.

While this malware isn't particularly memorable as a banking Trojan, a recent shift in its deployment is. IcedID used to be dropped by the Emotet Trojan, but this changed to TrickBot in May 2018.

Three months later, it became clear that IcedID had also received a number of upgrades to perform more like TrickBot, including the reduction in the size of its binary file and plugins being fetched and loaded on demand, rather than being an intrinsic part of the Trojan's modules.

"Although malware authors do sometimes copy from one another, our research indicates these modifications were not coincidental," IBM says. "Even if we only looked at the fact that TrickBot and IcedID fetch one another into infected devices, that would be indication enough that these Trojans are operated by teams that work together."

See also: Facebook debuts AI tool to tackle revenge porn

IBM also speculates that a vague partnership between the two groups may have begun years ago, and potentially during the years when Dyre and Neverquest malware samples were making the rounds pre-2015. Trickbot is considered the protege of Dyre, whilst Neverquest vanished following the arrest of a member of the group behind it. IcedID came onto the scene soon after.

Gozi, too, is another key player in the banking malware industry and has been active for over a decade. First spotted in 2007, Gozi is constantly evolving and the leak of its source code in 2010 gave rise to a number of Trojans that are active today.

The malware is now in two major forms, v.2, and v.3, of which the former variant targets global players and the latter focuses on banks in Australia and New Zealand through macro-based malicious attachments sent via phishing campaigns.

In some countries, such as Japan, the operators of Gozi are collaborating with URLZone. This form of malware specializes in process hollowing and disguises itself as legitimate computing processes to lurk undetected on a victim's machine. 

In a 2018 campaign, URLZone dropped both the Cutwail botnet and Gozi, which together are able to enslave devices, create persistent backdoors, and steal data.

TechRepublic: How to prevent spear phishing attacks: 8 tips for your business

The operators of Ramnit, too, appear to find value in collaboration. Active since 2010, Ramnit started out using worm-like techniques to infect PCs, networks, and removable drives before evolving into a modular banking Trojan which is now spread through exploit kids including Angler and RIG.

Ramnit tends to focus on victims in the UK, Canada, and Japan, and in 2018, re-emerged after a law enforcement botnet takedown with a new partner in tow: Ngioweb, a multifunctional proxy server which uses multiple layers of encryption.

CNET: Facial recognition overkill: How deputies cracked a $12 shoplifting case

A 2018 campaign between the pair was able to infect approximately 100,000 devices in only two months. During the scheme, Ramnit went back to its worm-like roots and acted as a first-stage infection platform to create a proxy botnet for Ngioweb. 

IBM believes this partnership -- albeit a short-lived one -- was designed in the hopes of creating a botnet of a size comparable to the old Gameover Zeus botnet.

"While previous years saw gangs operate as adversaries, occupying different turfs, or even attack one another's malware, 2018 connects the major cybercrime gangs together in explicit collaboration," IBM says. "This trend is a negative sign to the joining of forces between botnet operators, revealing the resilience factor in these nefarious operations over time."

Previous and related coverage

JERUSALEM (Reuters) - Israeli Prime Minister Benjamin Netanyahu alleged on Wednesday that Iran could blackmail his main election rival, Benny Gantz, after hacking the former armed forces chief’s phone, even as Tehran denied doing so.

image

FILE PHOTO: Benny Gantz, head of Blue and White party speaks to the media in Kibbutz Nir-Am, Israel March 15, 2019 REUTERS/Amir Cohen/File Photo

Without providing any evidence or details, Netanyahu said Iran had gleaned “sensitive information”. His comments, in a brief speech broadcast online from his official residence, brought a new level of vitriol to the election race.

Polls put Netanyahu’s right-wing Likud and Gantz’s centrist Blue and White party neck-and-neck, with election day three weeks away.

Gantz has confirmed an Israeli TV report last week that the Shin Bet domestic intelligence service had detected that his cellphone had been hacked, though the agency itself has not commented.

But he has not confirmed that the hackers are believed to be Iranian, as reported, and has said the phone contained no data that might compromise national security or his ability to carry out his duties if he were elected prime minister.

Iran denied that its intelligence services had hacked Gantz’s phone.

“The (Israeli) regime’s officials are long used to spreading lies,” Foreign Ministry spokesman Bahram Qasemi said, according to the state news agency IRNA.

Gantz, for his part, has sought to focus public attention on the state’s decision not to deem Netanyahu a suspect in a graft scandal over a German submarine deal. Netanyahu, who denies wrongdoing, faces possible indictment in three other corruption cases.

Netanyahu said there was more to be revealed about the contents of the ex-general’s mobile phone.

“What do the Iranians know about you that you are hiding from us?” Netanyahu said. “And above all else, how would you, as prime minister, face up to Iran, our number one enemy, when Iran has sensitive information about you? This is not a matter of gossip. This is a matter of national security.”

Netanyahu called on Gantz to come clean as “the only way not to be vulnerable to blackmail”.

Speaking to the Israeli News Company TV station on Tuesday, Gantz said the Shin Bet had informed him six months ago that “there was a small problem - and I am taking care of it”.

“I have a wonderful family. I have wonderful children. My wife supports me from here until further notice,” he said.

Asked if there was anything on the phone that could be used for blackmail, Gantz said: “Nothing can have an influence over my performance.”

Additional reporting by Bozorgmehr Sharafedin in London; Editing by Jeffrey Heller and Kevin Liffey

Our Standards:The Thomson Reuters Trust Principles.

Kaspersky Lab Logo: Kaspersky Lab // Composition: ZDNet

Russian cyber-security firm Kaspersky Lab filed today an antitrust complaint against Apple with Russian authorities in regards to the OS maker's monopolistic grip over its official App Store.

Kaspersky claims that Apple used its power over the App Store and the entire iOS app ecosystem to force its engineers into removing two features from the Kaspersky Safe Kids iOS app --namely app control and Safari browser blocking.

The company argues that Apple did so to eliminate competition for the "Screen Time" feature that the OS maker added in iOS 12 in September last year.

Apple is sabotaging "Screen Time" competitors

In a blog post published today, Kaspersky said that other app makers like AdGuard and Kidslox also lost their abilities to restrict access to apps after interventions from Apple.

Furthermore, the Russian firm claims that Apple has embarked on what appears to be a concerted effort to crack down, remove, or reject any third-party screen time apps that may compete with built-in iOS features.

"By setting its own rules for that channel, [Apple] extends its power in the market over other, adjacent markets: for example, the parental control software market, where it has only just become a player," Kaspersky Lab said.

"It is precisely in this extension of its leverage through possession of so-called 'key capacity' over other segments, leading to restriction and elimination of competition, that we see the essential elements of antitrust law violation, which consist of erecting barriers and discriminating against our software," the antivirus maker added. "We have repeatedly tried to contact Apple to resolve this situation, but no meaningful negotiations have ensued."

Kaspersky lodged its complaint with the Federal Antimonopoly Service of Russia (FAS), and only in Russia, but not in the European Union.

The antivirus maker recognized Spotify's similar effort in the EU.

Last week, the music streaming service filed a similar antitrust complaint against Apple because of its strict control over the App Store. Spotify claimed that Apple had used unfair App Store taxes to suppress the growth of Spotify and other competitors for Apple's own music service --Apple Music.

Apple posted a blog post answering the Spotify complaint in the EU, but an Apple spokesperson did not return a request for comment in regards to Kaspersky's complaint today.

Kaspersky took on Microsoft and won

This is not the first time that Kaspersky Lab files antitrust complaints against a Silicon Valley tech giant. The company filed an antitrust complaint against Microsoft in Russia and the EU in November 2016.

The antivirus maker argued that Microsoft made it unfairly difficult for antivirus providers to compete following a major Windows 10 update.

Kaspersky dropped its complaints in August 2017 after reaching a common ground with Microsoft after the Redmond-based OS maker revised its antivirus and update policies.

More tech & cybersecurity coverage:

President Vladimir Putin has tightened his grip on the Russian Internet Monday, signing two censorship bills into law. One bans "fake news" while the other makes it illegal to insult public officials.

Russia has never really been a liberal democracy. It lacks an independent judiciary, and the government has found a variety of techniques to harass and intimidate independent media in the country.

But the new legislation gives the Russian government more direct tools to censor online speech. Analyst Maria Snegovaya told The Washington Post that the legislation "significantly expands the repressive power of Russia’s repressive apparatus."

Under one bill, individuals can face fines and jail time if they publish material online that shows a "clear disrespect for society, the state, the official state symbols of the Russian Federation, the Constitution of the Russian Federation, and bodies exercising state power."

Insults against Putin himself can be punished under the law, The Moscow Times reports. Punishments can be as high as 300,000 rubles ($4,700) and 15 days in jail.

A second bill subjects sites publishing "unreliable socially significant information" to fines as high as 1.5 million rubles ($23,000).

"Russia has not historically had major constraints on Internet freedom," analyst Matthew Rojansky told the Post. "The Internet has thus been one realm in which full diversity of opinion and free expression, even on the most sensitive political topics, were generally permitted."

Now, however, the Russian government has "essentially unconstrained authority to determine that any speech is unacceptable. One consequence may be to make it nearly impossible for individuals or groups to call for public protest activity against any action taken by the state."

The Russian government has steadily tightened its grip over the Russian Internet, The Moscow Times notes. "Tougher Internet laws introduced over the past five years require search engines to delete some search results, messaging services to share encryption keys with security services, and social networks to store users' personal data on servers within the country."

  1. Huge Aluminium Plants Hit By Cyber Attack
  2. EU Government Websites Infested With Third Party Adtech Scripts
  3. PuTTY SSH Client Gets Patched After RSA Key Exchange Memory Vuln Spotted
  4. Can Machine Learning Systems 'Overlearn'?

Page 262 of 355