Log inRegister

Security News

Breach Notification , Breach Response , Data Breach

The Breach That Supposedly Isn't a Breach California Company's Bungled Response Risks the 'Streisand Effect' Jeremy Kirk (jeremy_kirk) • September 16, 2016     The Breach That Supposedly Isn't a Breach

Most companies don't ever want to be contacted by Troy Hunt, the Australian data breach researcher who created Have I Been Pwned, a popular service for figuring out if your data has been leaked. Hunt, an amiable guy, often brings bad news.

See Also: API vs. Proxy: Understanding How to Get the Best Protection from Your CASB

He works closely with some journalists, including me, to navigate the choppy waters that can come with notifying companies. It's not an easy game: You don't want to publish a story that wrongly identifies a company as being a victim of a breach. But at the same time, people should be notified as soon as possible if their data has gone walkabout.

Regpack is essentially risking the "Streisand effect," the term for trying to obfuscate or hide an issue, inadvertently making it more prominent. 

The handling of a recent data breach - the details of which are still unfolding - by Oakland, Calif.-based web services company Regpack provides a look into how the discovery and disclosure of a breach can turn into a real train wreck.

Tweet Leak

In mid-July, Hunt came across a now-deleted tweet from a known trader of leaked data with a link to a 1.6GB file. The file contained more than 100,000 names, email and postal addresses, last four digits of payment card numbers, three-digit card verification values, expiration dates and amounts paid for services. The tweet claimed the data came from BlueSnap, a payment services provider founded in Israel.

But Hunt says a close analysis of the data showed that Regpack might be responsible. Regpack develops web-based registration forms that can be integrated into websites. The forms also accommodate credit card data, which Regpack passes on to BlueSnap for payment processing. It initially looked like BlueSnap was breached. But information in the leaked files, as well as full invoices available online, showed strong indications Regpack may be the source, according to Hunt.

In late August, I queried both companies, and neither said they were breached. Meanwhile, Hunt had reached out to verified subscribers of Have I Been Pwned whose email addresses appeared in the leaked file. Verified subscribers are those who have confirmed their email addresses and are good sources that Hunt uses to try to confirm the veracity of a breach. It's a sensitive query, but many people confirmed their details to Hunt, including CVV2s and elements of the last four digits of their payment cards. Clearly, this was a breach.

But the situation then stalled. I was reluctant to write a story without firm confirmation from either company, but Hunt was concerned that the victims were never going to be contacted. Hunt decided to go public on Sept. 13 with his research on his blog. The tree had been shaken and information trickled out. But rather than clarity, Regpack is making the situation more confusing, and it's not clear when the more than 100,000 victims may be notified.

Exposed, Not Compromised

Regpack has stopped answering my queries, but in a statement supplied to Hunt, the company acknowledges it was the source of the leaked information. Its explanation, though, is lacking - the company says the leak was the result of a developer's error.

Log files revealed that a Regpack employee had decrypted some of its payments data for analysis, a practice that likely clashes with PCI-DSS compliance, the hefty set of security requirements merchants are supposed to follow. The company maintains its servers are secure.

"We identified that a human error caused those decrypted files to be exposed to a public-facing server, and this was the source of the data loss," the statement says.

It also contends there wasn't a breach: "Neither Regpack nor BlueSnap had our systems breached." The phrasing is confusing, and what Regpack probably meant to say is that its systems were not subject to a cyberattack. Even if the cause was an internal error, it's still a breach.

"I think they're doing a lot of damage and missing language that could both inform people properly and mitigate damage to their organization," Hunt says. Regpack is essentially risking the "Streisand effect," the term for trying to obfuscate or hide an issue, inadvertently making it more prominent, he says. (The Streisand effect is named after singer Barbra Streisand, who in 2003 attempted to suppress photographs of her private residence, but only succeeded in attracting additional attention to the matter.)

Regpack has started notifying its customers, and I obtained one of the emails the company is sending out. Similar to its public statement, Regpack says it wasn't breached, arguing that a breach "is a situation where someone gains access to our servers and databases and steals information."

Hmmm. Isn't that what happened? The notification then tries even harder to advance Regpack's argument.

"A good analogy would be that the office containing your data is totally safe and impenetrable and is guarded 24/7 by multiple systems and security guards," writes Edgar Carrasco, vice president of business development. "Unfortunately, while leaving work, someone dropped a file out of their bag and someone passing by took it. Hence, the office (our servers), were not compromised but information was exposed."

Carrasco's notice also contains a suggested email that Regpack customers should send to their customers whose personal data was exposed. Notably, it neglects to spell out all the data elements that were exposed.

"They're still missing really vital elements of the incident in their communication," Hunt says.

One Victim's Tale

One of the victims whose data was exposed is Thomas Bacon, an Austin, Texas-based web designer and developer. He used a Regpack-powered website to register his son for summer camp. Bacon contacted the summer camp to let them know of the breach. He claims that the camp wasn't happy because Regpack initially downplayed the impact of the leak. The camp, however, has now received the email notice from Carrasco.

Bacon, who has an interest in computer security, has already taken action. "I've cancelled my card," he says in a phone interview.

Although the leak doesn't contain full card numbers, Hunt argues that the last four digits are still critical information that could be used by attackers. Companies often ask consumers for the last four digits of their card as part of oral authentication questions over the phone. Another problem is that Regpack should not have been storing the CVV2 numbers, a practice prohibited by PCI-DSS.

"That may get them in a lot of trouble," Hunt says.

Notification could be messy. Regpack will have to let its website customers know which of their clients are affected by the breach, meaning it will have to carefully parse 1.6GB of data to make sure no one is left out. At least 899 services that used Regpack are affected by the breach, Hunt contends.

"The sites that use Regpack really haven't done anything wrong," Hunt says. "Regpack has clearly done multiple things wrong. When you're dealing with payments, the trust in the brand is really paramount. This is inevitably why they're being really cautious in their communications. They don't want to erode trust."

But it may already be gone.

The Regpack data has been in Have I Been Pwned since Sept. 13, so it's easy to figure out if you're affected. If so, it's probably wise to cancel your card.

Cybersecurity , Network & Perimeter , Technology

While NSA Hacks, US-CERT Frets "Sophisticated Hackers and Advanced Threat Actors" Target Networking Gear Mathew J. Schwartz (euroinfosec) • September 15, 2016     While NSA Hacks, US-CERT FretsPhoto: Jon 'ShakataGaNai' Davis (Creative Commons)

In the wake of the leak of firewall attack tools from the Equation Group, by a group calling itself the Shadow Brokers, the U.S. Computer Emergency Readiness Team has issued a warning to all organizations, telling them that they must do more to lock down their networking equipment.

See Also: From Authentication to Advanced Attack Vectors: Top Trends in Cybercrime in Q1 2016

"For several years now, vulnerable network devices have been the attack-vector of choice and one of the most effective techniques for sophisticated hackers and advanced threat actors," it reads.

"For several years now, vulnerable network devices have been the attack-vector of choice." 

But many security experts have tied the Equation Group exploits to the National Security Agency's in-house hacking squad.

Security expert Bruce Schneier, CTO of IBM's Resilient, says in a blog post that the leaked attack tools show that "the agency is hoarding information about security vulnerabilities in the products you use, because it wants to use it to hack others' computers." He adds that "those vulnerabilities aren't being reported, and aren't getting fixed, making your computers and networks unsafe."

In other words, the "sophisticated attacker" alert from US-CERT, which is part of the Department of Homeland Security, was triggered by attack capabilities that apparently trace to the same government's signals intelligence agency, some of which include custom-built exploits for networking equipment developed and sold by U.S. manufacturers.

Does this feel like a family affair, or what?

We'll Always Have Puns

The Shadow Brokers dump includes Equation Group attacks sporting names such as PIXPOCKET, which exploits vulnerabilities in Cisco PIX devices, and which Cisco stopped supporting a few years ago. Other attacks include EGREGIOUSBLUNDER, targeting Fortinet devices; ESCALATEPLOWMAN, targeting WatchGuard devices; and ELIGIBLEBOMBSHELL, targeting Topsec devices.

Meanwhile, an attack called EXTRABACON can be used to hack into any Cisco ASA device unless it's been recently patched using Cisco's related updates.

Exploits Leaked by Shadow Brokers imageSource: US-CERT6 Network Admin Essentials

Whatever the identity of the Equation Group, security experts have long told me that any nation-state that can muster a hacking team will do so. China, France, Israel, Russia and the United Kingdom often feature on hacking experts' lists of "the best of the best."

Thus US-CERT's recommendations, while released in the shadow of the Equation Group tool dump, count as a "must do" for any organization that manages its own networking equipment.

Here's a brief overview:

Segregate networks and functions: Network segregation can "contain malicious occurrences" and block attackers from gaining access to other parts of the network. Limit unnecessary lateral communications: Restricting and filtering communications, including using vLANs with access control lists, helps battle backdoors. Harden network devices: Use secure configurations, restrict physical access to devices, employ strong passwords and encryption, disable all unnecessary services and never allow unencrypted remote access to admin protocols, for starters. Secure access to infrastructure devices: Use multifactor authentication, maintain privileged access controls and keep admin credentials locked down. Perform out-of-band management: Separate user traffic from network management traffic, locking down all admin-level access to devices. Validate integrity of hardware and software: Know your supply chain, validate all equipment and firmware and keep a close eye on network configurations for unauthorized changes.

Still Falling For SYNful Knock

What US-CERT is recommending, however, is what organizations should already have been doing. But it's clear that many haven't been paying sufficient attention to the security of their networking equipment.

In the same alert, for example, US-CERT calls out an attack known as SYNful Knock - so named by U.S. cybersecurity firm FireEye - that came to light in September 2015, which can be used to change a router's operating system to give attackers persistent access to the device. "The initial infection vector does not leverage a zero-day vulnerability," US-CERT says. "Attackers either use the default credentials to log into the device or obtain weak credentials from other insecure devices or communications."

Who needs potentially sophisticated, NSA-built exploits to hack, if network administrators have rolled out equipment with default passwords or otherwise failed to secure other parts of the network?

Anti-Fraud , Fraud , Risk Management

'Daily Validation Reports' Will Provide Out-of-Band View of Messages Mathew J. Schwartz (euroinfosec) • September 20, 2016     SWIFT Announces Fraud Pattern Detection Controls

To help financial institutions better spot attempted fraud, the SWIFT interbank messaging network plans to begin offering voluntary "daily validation reports" to customers in December.

See Also: How to Mitigate Credential Theft by Securing Active Directory

The move is designed to provide an "out of band" view of an institution's messages to help anti-fraud teams better spot unauthorized attempts to move money via SWIFT, the organization says in a statement.

"A key step in the modus operandi in recent wire fraud cases at customer firms involves the attackers concealing their fraudulent messaging activity on customers' local systems," says Stephen Gilderdale, who heads SWIFT's customer security program, in a statement. "Daily validation reports will provide a reliable and independent source of information, providing such institutions with an activity lens to help them quickly detect fraud - whether perpetrated by external attackers or by malicious insiders."

Formally known as the Society for Worldwide Interbank Financial Telecommunication, SWIFT is a member-owned, Brussels-based collective. About 11,000 institutions in more than 200 countries use SWIFT's interbank messaging software and network.

The pending anti-fraud feature follows the February theft of $81 million from the central bank of Bangladesh's account at the Federal Reserve Bank of New York via fraudulent SWIFT messages. As part of the Bangladesh theft, attackers employed malware that prevented details of the transactions from being printed out on the bank's printer, thus delaying the bank's discovery of the fraud.

Research conducted by British defense and security firm BAE Systems found that as part of the attack, hackers gained access to a Bangladesh Bank PC that connected to the SWIFT network. BAE Systems security researchers Sergei Shevchenko and Adrian Nish reported that attackers then injected fraudulent money-moving messages into the SWIFT network and replaced the bank's PDF reader with a Trojanized version that removed traces of the fraudulent messages.

SWIFT has warned customers that the Bangladesh Bank hack was part of a wider attack campaign that has targeted multiple banks, including Vietnam's Tien Phong Bank in late 2015. Some security researchers say that the malware used in the attacks ties to the attack code used against Sony Pictures Entertainment in 2014, and that the attack campaign appears to have been carried out at the behest of North Korea.

Following the Bangladesh Bank hack, and facing criticism that SWIFT should be doing more to help customers stay secure, SWIFT CEO Gottfried Leibbrandt in May announced the launch of a new customer security program. In July, SWIFT also announced that it had assembled an internal intelligence team and tapped BAE Systems and cybersecurity firm Fox-IT to serve as a digital forensics investigation team for assisting any customers whose systems get hacked. SWIFT has not publicly disclosed pricing for that service.

Daily Out-of-Band Validation

SWIFT says the new daily validation reports are part of a new "transaction pattern detection stream" launched as part of the customer security program. The reports, it says, will comprise two parts:

Activity reports: Financial institutions can see "aggregate daily activity across currencies, countries and counterparties" and review it for unusual patterns. Risk Reports: These will flag "large or unusual payment flows and new combinations of payment parties" to help anti-fraud teams more quickly identify "unusual senders, destinations and patterns."

Smaller financial firms should especially benefit from the new reports, SWIFT says. "Smaller institutions, in particular, are currently dependent on the accuracy of the data on their own systems, but in the event of a security breach, their locally stored payment and reconciliation data may be altered or unavailable," Gilderdale says.

Of course, savvy attackers could also target the PCs receiving these daily validation reports in an attempt to suppress them.

Voluntary Program

Signing up for the daily validation reports will be voluntary, and SWIFT has yet to finalize pricing, spokeswoman Natasha de Teran tells The Wall Street Journal. "Our focus is to improve security, not to derive profit," she said.

The introduction of the reports is good news for banks and shows SWIFT reacting to the Bangladesh Bank hack. It follows SWIFT launching an awareness campaign relating to its relationship management application, which it describes as a filter that customers can use "to select and limit the correspondents from whom they wish to receive messages, as well as to restrict the type of messages that they receive." SWIFT portrays it as a first line of defense against fraudulent messages.

But if previous cybercrime campaigns are any measure, then attackers will have also been continuing to refine their efforts - and with a head start.

Independent financial fraud consultant William Murray - who says that banks, not SWIFT, are responsible for ensuring the authenticity of SWIFT messages they send or receive - warns that whoever hacked Bangladesh Bank likely remains active. "The more we learn, the more resourceful these attacks appear to be," Murray said. "[Attackers] are now well funded and we must expect them to be active until we hear of arrests."

Forensics , Mobility , Technology

Researcher Demonstrates Technique, Acknowledges It Could Have Destroyed Device's Data Jeremy Kirk (jeremy_kirk) • September 20, 2016     Could FBI Have Cracked Shooter's iPhone for Less Than $100?Sergei Skorobogatov demonstrates his "chip off" procedure. (Source: Youtube)

A U.K.-based security researcher has taken the FBI to task after demonstrating how the law enforcement agency could have cracked the San Bernardino terrorist's iPhone using a delicate, $100 operation that enables unlimited passcode guesses.

See Also: Creating a User-Centric Authentication and Identity Platform for the Healthcare Industry

Sergei Skorobogatov, a senior research associate in the security group at the University of Cambridge's computer laboratory, released an academic paper and video showing how he accomplished what's called NAND mirroring. The technique, also referred to as "chip off," allows all four-digit passcodes to be guessed in around 40 hours.

The procedure can be used against older iPhones that have enabled a security feature that erases the device's data after 10 incorrect passcode guesses. But it's a technically difficult operation, and one that could easily destroy a device's data if not flawlessly executed.

FBI vs. Apple

In March, FBI Director James Comey contended that such a procedure would not work to unlock an iPhone 5c belonging to Syed Rizwan Farook, who with his wife shot and killed 14 people in San Bernardino, Calif., in December 2015. Skorobogatov's work, the first public demonstration of such a technique, shows that while Comey's contention is not true technically, there are plenty of reasons why the FBI likely brushed it off.

NAND mirroring had been suggested as a possibility after the FBI in February launched a controversial legal battle against Apple. The agency sought to force Apple to create a special version of its iOS mobile software to circumvent security controls on Farook's iPhone. Apple argued that such software - essentially a government-ordered backdoor - would put millions of users at risk (see The Crypto Debate: Apple vs. the FBI).

While many experts said that NAND mirroring would be an option, they also advised that it was risky. The FBI eventually paid less than $1 million to a contractor for a technique - which presumably exploited a chain of software vulnerabilities in iOS - to unlock the device. At the same time, it dropped the related challenge against Apple.

Skorobogatov, who says his research required less than $100 worth of off-the-shelf components, generally agrees that his technique is risky. "Although it does not require expensive equipment there were several unexpected traps, pitfalls and obstacles on the way to full success," his paper reads.

Heat It Up

Skorobogatov's paper and YouTube video show why the FBI probably decided not to go the NAND mirroring route: It involves a lot of heat, delicate iPhone surgery and perseverance in the face of numerous other software glitches.

Video from Sergei Skorobogatov demonstrating an Apple iPhone 5c hardware NAND mirroring as well as a successful attack on the limit for passcode retry counter.

The encryption key that scrambles data on the iPhone is stored on a NAND flash chip. If the security feature is enabled, that key is erased after 10 incorrect passcode guesses. The way around the problem is to copy the data, including the key, and restore it once 10 guesses have expired.

To copy it, the NAND flash chip has to be removed from the phone. The chip is soldered into the main printed circuit board (PCB) and also held in place with a strong epoxy. It's a tight space to work: There's only a .05mm (0.02 inch) gap between the bottom of the NAND chip and the PCB.

"Unless properly planned and supported by special thin blade knife tools, this could damage both the NAND and the main PCB," Skorobogatov writes.

Softening the epoxy requires a temperature of more than 572 degrees Fahrenheit. But if the whole area is heated to that temperature, the epoxy sticks to other small circuit board components, risking damage. Skorobogatov says he used a Nichrome wire heated with an electric current to 1,292 degrees to carefully weaken the epoxy. Then, he heated the printed circuit board to 302 degrees before further heating up the NAND flash chip. Once at the right temperature, he used a thin-blade knife to remove it.

Some Potential for Memory Damage

Even if the chip is successfully removed, repeatedly restoring its data could cause damage to the flash chip. Skorobogatov notes that NAND chips can be rewritten a few thousand times, but there's no way of knowing how many times the chip may have already be rewritten before starting a NAND mirroring operation.

That's where a longer passcode offers a better defense. A four-digit passcode would only require a maximum of 1,667 rewrites of the chip. But for a six-digit passcode, guessing could require as many as 160,000 rewrites, which would "very likely damage the flash memory storage," the paper states.

How qualified is law enforcement to investigate today's cybercrimes? While many big-city police departments have all the necessary skills, those in smaller markets often do not, according to a panel of experts.

That's why companies that have been attacked must provide as much technical and forensic information as possible to authorities to help ensure that investigations lead to arrests and prosecutions.

In an audio interview with Information Security Media Group at the recent Fraud and Breach Prevention Summit in Toronto, four cybercrime experts review the skills law enforcement officers must have to effectively investigate evolving cyberattacks and offer tips on working with authorities.

"Because you're dealing in an area of technology that's changing weekly and daily almost, it's a challenge to stay ahead of the curve," says panelist Kenrick Bagnall, who works on the computer cybercrime intelligence services team at the Toronto Police Service.

Imran Ahmad, a Toronto-based attorney with the law firm Miller Thomson, says organizations conducting investigations of cyberattacks should "prepare the materials and the evidence in a way that would be helpful to law enforcement, because they may not necessarily have either the resources or the detailed technical know-how."

When it comes to investigating financial crimes, information sharing is even more critical, say panelists John Buzzard, a fraud expert at payments provider CO-OP Financial Services, and John Walp, managing director of forensics technology at consultancy KPMG.

While it's becoming more common for law enforcement officers to have some understanding of how financial transactions work, banking institutions and other financial services firms need to educate local authorities, they say.

"If you would have picked up a telephone in 2002 and called [local police] and said, 'Hi. I'd like to speak with somebody who specializes in financial crime,' you probably would have had some blank hold time on the telephone," Buzzard says. "Not quite so much now."

Buzzard says criminal investigations focused on identity theft also have helped get law enforcement up to speed about cybercrime and fraud, which often involves the compromise of personal financial data.

"Specifically around the financial-services space, there's a lot of learning about how the banking and payments systems work," Walp adds.

During this interview (see audio player below photo), the panel also discusses:

The FBI's focus on cybercrime; How law enforcement is working with the private sector to develop relationships in advance of a breach or incident; and Why companies should involve law enforcement in their tabletop incident response exercises.

Bagnall, detective constable at the Toronto Police Service, formerly spent 20 years working in the IT industry, primarily within financial services.

Toronto-based attorney Ahmad serves on the Canadian Advanced Technologies Alliance's cybersecurity council and is a member of the executive committee of the Ontario Bar Association's privacy and access to information law section.

At CO-OP Financial Services, the largest credit union service organization in the U.S., Buzzard provides educational and directional fraud, risk and security information to institutions in the EFT/banking industry, and works with law enforcement agencies to share information about fraud trends.

Walp of KPMG formerly was the CISO of M&T Bank, where he was responsible for IT security, data protection and privacy strategies.

Network & Perimeter , Risk Management , Technology

Active Attacks Target Numerous Products, Technology Giant Warns Jeremy Kirk (jeremy_kirk) • September 20, 2016     After Equation Group Dump, Cisco Finds New Zero-Day FlawPhoto: Diesmer Ponstein (Flickr/CC)

The fallout from the leak of the Equation Group's attack tools and exploits continues. Cisco has issued patches for several versions of its latest network operating systems that the company says attackers have been exploiting.

See Also: Protecting Your Assets Across Applications, Services and Tiers

The latest vulnerability was uncovered by Cisco as it investigated deeper a set of attack tools released in mid-August by a mysterious group calling itself the Shadow Brokers. The tools came from the Equation Group, the nickname for a group of hackers that experts believe may be part of the NSA's Tailored Access Operations group (see Mystery Surrounds Breach of NSA-Like Spying Toolset).

Cisco's products were hit hard by the Equation Group leak, as it contained effective attack tools for a range of Cisco's firewall and networking products. Following the attack-tool dump, Cisco began taking a closer look at the code that runs its devices, leading to the discovery of this new zero-day vulnerability. The bug involves a flaw that is closely related to one found in its PIX firewall line, which was targeted by an Equation Group exploit called BENIGNCERTAIN.

The latest vulnerability affects many of Cisco's current networking operating systems, including IOS, IOS XE and IOS XR. Those systems run on everything from home office routers to carrier-grade equipment.

The finding shows that the Equation Group leak is still packing quite a punch. Cisco's latest disclosure means that just before the data dump in mid-August, the Equation Group likely knew of flaws in many of the company's products dating from 2002 through this month, which would have facilitated a powerful global spying arsenal.

Security researcher Mustafa Al-Bassam, a doctoral student at University College London who has been extensively analyzing the dump, made this claim on Twitter: "The NSA has been sitting on a zero day exploit to remotely grab VPN keys from Cisco firewalls for fourteen years."

Bug in Internet Key Exchange

The latest flaw to be identified lies in Internet Key Exchange version 1, or IKEv1. The problem is an insufficient condition check in code that deals with IKEv1 security negotiation requests, the company says.

"An attacker could exploit this vulnerability by sending a crafted IKEv1 packet to an affected device configured to accept IKEv1 security negotiation requests," the Cisco advisory says. "A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information."

Cisco is still figuring out exactly which versions of its IOS, IOS XE and IOS XR product lines are affected. "As the investigation progresses, Cisco will update this advisory with information about affected products, including the ID of the Cisco bug for each affected product," it says.

The flaw is similar to one targeted by BENIGNCERTAIN, which allows attackers to extract private VPN keys by triggering a PIX firewall to dump its memory. Cisco hasn't issued a patch for PIX because it stopped selling the devices in 2008 and halted support three years ago. Nonetheless, thousands of PIX firewalls are still in use.

Plenty of Patches

Cisco wasn't the only firewall and networking vendor affected by the data dump, which also contained tools and exploits targeting products made by Fortinet, Topsec and WatchGuard. But Cisco's widely used products arguably received the most attention after the leak.

In late August, Cisco patched a zero-day buffer overflow vulnerability that affected versions of its Adaptive Security Appliances. The flaw was targeted by an exploit that was code-named EXTRABACON (see NSA Pwned Cisco VPNs for 11 Years).

ASA devices were also targeted by another exploit called EPICBANANA, but that vulnerability was patched by Cisco in 2011.

The Shadow Brokers have been quiet since their first release. It's unclear how they were able to get the Equation Group's tools. One theory is that the tools were placed on a proxy server used to stage attacks and mistakenly left on it, as it's unlikely that the NSA was directly hacked.

In follow-up research, Kaspersky Lab found a strong connection between the code released by the Shadow Brokers and that of the Equation Group. The implementation of cryptography algorithms was nearly the same, Kaspersky's researchers say (see Confirmed: Leaked Equation Group Hacking Tools Are Real).

While many experts weren't exactly impressed by the coding skills displayed by the Equation Group, many found that the tools, implants and exploits worked as presented. Al-Bassam has published a guide to the tools on his website.

In light of the Equation Group leaks and other attacks, the U.S. Computer Emergency Readiness Team earlier this month issued a broad warning to administrators to be vigilant in defending crucial networking equipment such as firewalls, routers and switches (see While NSA Hacks, US-CERT Frets).

A report on a new self-assessment tool that's intended to show whether an enterprise's cyber-risk initiative aligns with its goals and strategy leads the latest edition of the ISMG Security Report.

In this episode, you'll also hear:

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Be sure to check out our Sept. 13 and Sept. 16 reports, which respectively analyze U.S. Sen. Elizabeth Warren's push to get Congress to investigate Wells Fargo for violating the privacy of bank customers and the ISMG Fraud and Breach Prevention Summit in Toronto. The next ISMG Security Report will be Friday, Sept. 23.

Theme music for the ISMG Security Report is by Ithaca Audio under the Creative Commons license.

Ransomware attacks are surging because attackers have perfected their techniques while enterprises in all sectors have failed to address critical security shortcomings, says Raimund Genes, CTO at Trend Micro.

"It's the rise of anonymous money transfer services using TOR, bitcoin and other means that the bad guys have perfected," Genes says in part two of an interview with Information Security Media Group. "Anonymous stuff today like Ukash, Bitcoin, iTunes gift cards and the dark web make it very difficult to trace the attacker."

In addition, cybercriminals can turn to ransomware-as-a-service to easily launch their campaigns, which Genes predicts will continue as long as enterprises pay ransoms.

Security Shortcomings

So many enterprises are vulnerable to the attacks because they've failed to take the necessary security precautions, including offline backups, he says. "Everyone moved away from offline backups with three copies in two independent places. This was the golden rule a few years ago. It seems that with cloud and online backups, people have totally forgotten about it."

Other essential security steps that are often skipped, Genes says, include network segregation and segmentation as well as a comprehensive risk management plan. This could be because they are too focused on protecting themselves against so-called "APT" attacks, he argues (see: Moving Beyond the Buzzwords).

"Companies spent so much time and effort on silver bullets against APT that ransomware seems to have caught them by surprise," he says. "Ransomware is a reminder that basic security should not be forgotten."

In this interview (see audio player below image), Genes also shares his perspective on the controversy over VirusTotal, the malware database service from Alphabet's Google. New rules set by VirusTotal will exclude security vendors for not sharing data. Genes spelled out key concerns in a recent blog (see: VirusTotal Move Stirs Conflict in Anti-Virus Market). He also addresses:

The ransomware ecosystem and its persistent nature; How defenders have fallen short (see: Targeted Attacks Becoming the Norm); Action that enterprises should be taking to battle the ransomware threat.

In part one of this interview, Genes spoke about the latest trends in the security marketplace.

Genes has more than 30 years of computer and network security experience. As CTO at Trend Micro, he is responsible for working with a team of researchers to introduce new methods to detect and eradicate threats and to predict movements in the digital underground.

  1. FBI to Ransomware Victims: Please Come Forward
  2. Dropbox 'Hacks' Macs, Researcher Warns
  3. Tesla Patches Cars Against Wi-Fi 'Braking' Attack
  4. Ideas for Filling the Cybersecurity Skills Gap

Page 2187 of 2215