Finance minister Philip Hammond on Tuesday warned Britain will "strike back" against states hacking into strategic networks in order to avoid a military showdown, as part of a new cyber-defense plan.

Unveiling the £1.9 billion ($2.3 billion, 2.1 billion euro) National Cyber Security Strategy, Hammond said hackers were trying to capitalize on the increasing connectivity of devices to target homes, cars, air traffic control networks and power grids.

"A small number of hostile foreign actors have developed and deployed offensive cyber-capabilities. These capabilities threaten the security of the UK's critical national infrastructure," he said at the London launch.

"If we do not have the ability to respond in cyber-space... we would be left with the impossible choice of turning the other cheek and ignoring the devastating consequences or resorting to a military response.

"We will not only defend ourselves in cyber-space, we will strike back in kind when we are attacked," he added.

The finance ministry earlier called on businesses to "up their game" in the fight against cyber-crime, with Hammond adding that "government can't deliver innovation -- that's something that only businesses and entrepreneurs can do".

However, he promised that the government would take "a more active cyber-defence role" to "block, disrupt an neutralize malicious activity... and make Britain to be the best place in the world to be a tech business".

The funding will try to reduce the impact of cyber-attacks and stop viruses and spam emails reaching strategic targets.

Hammond said the government would strength law enforcement capabilities in a bid to deter would-be hackers and announced a new Cyber Security Research Institute to improve the security of smartphones, tablets and laptops.

"We must now keep up with the scale and pace of the threats we face," said Hammond.

"Our new strategy, underpinned by £1.9 billion of support over five years and excellent partnerships with industry and academia, will allow us to take even greater steps to defend ourselves in cyber-space and to strike back when we are attacked."

© AFP 2016

Tags:

The Windows zero-day vulnerability disclosed this week by Google has been exploited by the Russia-linked cyberespionage group known as Strontium. Microsoft has been working on a patch and expects to release it on November 8.

Google informed Adobe and Microsoft on October 21 that malicious actors had been actively exploiting previously unknown vulnerabilities in Flash Player (CVE-2016-7855) and the Windows kernel. The companies were given 7 days to patch the flaws or publish workarounds that would help users protect themselves against attacks.

Adobe released a patch for Flash Player on October 26, but since Microsoft had not come up with a fix or a workaround, Google decided that it would be in the best interest of users to disclose the Windows flaw. Microsoft does not agree and accused Google of putting its customers at risk.

In a blog post published on Tuesday, Microsoft revealed that the Windows vulnerability has been exploited by the group tracked by the company as Strontium. The threat actor is also known as Pawn Storm, APT28, Fancy Bear, Sednit, Sofacy and Tsar Team.

The group, which many believe is sponsored by the Russian government, has been linked to numerous high-profile attacks, including ones aimed at the U.S. Democratic Party, the World Anti-Doping Agency (WADA), investigators of the flight MH17 crash, and government organizations in Germany and Turkey.

According to Microsoft, the Windows flaw exploited by the group in a low-volume spear-phishing campaign affects Windows Vista through Windows 10 Anniversary Update, but the exploit does not work against the latter due to new mitigations implemented recently by Microsoft.

The attackers have been leveraging the Flash Player vulnerability to gain control of the victim’s browser process, after which they use the Windows kernel flaw to elevate their privileges and escape the browser sandbox. In the last phase of the attack, a backdoor that gives attackers access to the victim’s device is downloaded and executed.

While Microsoft will only release a patch next Tuesday, the company pointed out that security features in Edge, and Device Guard for Internet Explorer and other browsers, should block the final stages of the attack. Furthermore, the company says its Windows Defender Advanced Threat Protection (ATP) system also detects and blocks these attacks.

Related: Russian Cyberspies Use "Komplex" Trojan to Target OS X Systems

Related: U.S. Officially Accuses Russia of Election Hacks

Previous Columns by Eduard Kovacs:

Tags:

A recently detailed 0-day SAP vulnerability that was patched in September impacts over 900 SAP systems that are exposed to the Internet.

The bug could be exploited by an external attacker to remotely obtain the list of SAP users from the system, Quenta Solutions’ Sergiu Popa, who SAP acknowledged to have reported the vulnerability, says. 

“This service is actually an example of application to create a time-off request. This service should not be activated in production systems, however, it’s installed by default and, in reality, few SAP customers disable the component,” ERPScan founder Alexander Polyakov explains.

By exploiting this vulnerability, an attacker could obtain information such as usernames, user IDs and even emails (provided that the user offered this piece of information). An actor obtaining the username and email can use them to launch phishing attacks or to spam users with malware.

The information disclosure vulnerability was patched by SAP in September, which means that it isn’t technically a 0-day. However, with over 15% of all SAP systems exposed to the Internet vulnerable to this bug and with patches usually slow to roll-out, many users might still be affected by this, ERPScan, which specializes in securing SAP applications, notes.

According to the company, the vulnerability impacts at least 941 SAP Systems exposed to the Internet, but this is not the first bug of the kind to have been resolved by SAP. In fact, the company recently patched 2 similar flaws in other applications.

“To make matters worse, an SAP system has 1000+ of such applications enabled by default. Thus, there is a need for detailed analysis of all exposed web services,” Polyakov says.

He also notes that ERPScan reported the very same vulnerability on July 12, but decided not to reveal details on it for three months, to comply with SAP’s policy on publicly disclosing information on vulnerabilities (the company asks researchers to hold details for three months, so that customers could apply patches). In the case of this 0-day, however, only 1.5 months passed between the release of the patch and the publication of details.

In October, SAP issued patches for 48 vulnerabilities in its products, including 25 Implementation Flaws and 12 Missing Authorization checks. As of June 2016, SAP had released over 3,660 Security Notes, but the number of resolved security flaws is much higher, because one security note can patch multiple vulnerabilities.

Related: Vulnerabilities in SAP HANA Impact Over 10,000 Customers

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

A cybersecurity startup has disclosed a couple of unpatched denial-of-service (DoS) vulnerabilities affecting a human-machine interface (HMI) product from Schneider Electric.

CRITIFENCE, a company that specializes in security solutions for industrial control systems (ICS), reported on Tuesday that Eran Goldstein, its CTO and founder, in April discovered two serious flaws in Schneider Electric Magelis HMI panels.

The affected devices allow operators and process engineers to monitor and manage industrial facilities. Users can configure the products with the Vijeo Designer software.

The security holes, dubbed “PanelShock” and tracked as CVE-2016-8367 and CVE-2016-8374, allow attackers to cause the devices to enter a DoS condition by sending specially crafted HTTP requests. According to the security firm, the issues are caused by improper implementation of HTTP request methods and resource consumption management mechanisms.

“The use cases identified demonstrate the ability to generate a freeze condition on the HMI, that can lead to a denial of service due to incomplete error management of HTTP requests in the Web Gate Server,” Schneider Electric said in an advisory. “While under attack via a malicious HTTP request, the HMI may be rendered unable to manage communications due to high resource consumption. This can lead to a loss of communication s with devices such as Programmable Logic Controllers (PLCs), and require reboot of the HMI in order to recover.”

The PanelShock vulnerabilities affect Magelis GTO, GTU, STO, STU and XBT panels. Schneider Electric has yet to release patches, but it has provided recommendations on how to mitigate possible attacks. The energy management giant has classified the flaws as high severity, but pointed out that the attacks described by CRITIFENCE only work if the Web Gate Server, which is disabled by default, is active.

The vendor has informed users of Magelis GTO Advanced Optimum and GTU Universal panels that a new version of the Vijeo Designer software, one that will not include these vulnerabilities, will be released in March 2017.

The flaws can be exploited remotely even by an attacker with low skill and the publicly available information is sufficient for developing an exploit. CRITIFENCE has published a free tool that allows users to check their devices for these types of vulnerabilities and a video that shows how an attack works:

Last week, at SecurityWeek’s 2016 ICS Cyber Security Conference, researchers from Indegy and CyberX reported finding some serious vulnerabilities in Schneider’s Unity Pro software platform and its ConneXium industrial firewalls.

Related: ICS-CERT Issues Alerts After Expert Discloses Power Meter Flaws

Related: U.S. Has Most Internet Connected Industrial Control Systems

Previous Columns by Eduard Kovacs:

Tags:

Symantec Unveils Symantec Endpoint Protection 14 With Multi-Layered Protection

In the battle for the endpoint, the new generation security products have been making the most noise. Their claim that machine learning is more effective than signature detection in finding zero-day malware is doubly effective: firstly it is true, but secondly it implies that first generation vendors do nothing more than signature detection. This bit is false - and we can expect a serious fightback from the 1st gen vendors.

The fightback has already started. A few weeks ago, Sophos launched a new product called Intercept X. And today, Symantec announced the single largest upgrade to its flagship Symantec Endpoint Protection: SEP14. It is an extensive evolutionary upgrade that verges on a new product. We can expect more announcements from other 1st gen vendors in the coming months.

In a conversation with SecurityWeek, Symantec's Global VP of Endpoint Products Javed Hasan explained that SEP14 is built to three requirements: "superior protection, higher performance, and an orchestrated response." This is achieved by overlaying multiple technologies in an innovative fashion; something he noted that 'single technology' vendors could not achieve.

'Single technology' is likely to emerge as the marketing epithet levied by 1st gen vendors against the new machine learning based new gen vendors, in the same way as some new gen vendors dismiss 1st gen vendors as simply 'signature detection engines'. ESET senior research fellow David Harley recently did very similar. "If there is a generational difference, it's that the fossils [his term for first gen vendors] don't rely on a single algorithmic approach, any more than they rely on static signatures; whereas the new boys tend - in their marketing, at any rate - to promote an either/or view, claiming to be signatureless while promoting ML (for instance) as a technology so obviously perfect that malware just fades away."

This multi-technology capability of the 'fossils' lies at the heart of SEP14. It is easy to maximize malware detection by simply calling everything malware; but the high volume of false positives would make this unworkable in a business environment. The real problem is to maintain high detection while minimizing false positives. "We have always held SEP to a standard of very low false positives," Hassan told SecurityWeek. "Internally we measure it at 0.1% of falsing." This false rate is achievable with a system using signature detections, but less achievable with machine-learning detection (machine learning delivers probabilities rather than binary yes/no results). Conversely, machine learning probabilities are more likely to detect unknown malware that doesn't yet have a signature.

SEP14 now seeks to maximize the best of both approaches without limiting performance. Put very simply, SEP14 comprises a machine learning agent on the endpoint with signatures removed to the cloud. "We still use signatures," said Hassan, "but we have put the majority of them in the cloud. The big use of signatures is now around lower falsing rather than higher detection." Now machine learning on the endpoint detects a dubious file which is then checked against what Hassan describes as the world's largest civilian blacklist and whitelist databases.

Interestingly, he claims that a cloud hash look-up is actually faster than checking the hash against a locally stored database of signatures. "The cloud lookups are so small that the speed of detection actually increases -- either we scan on disk, or we look it up," he explained. "Scanning on disk takes longer than the cloud lookup. Not everything detected by ML requires a cloud lookup -- it's only to confirm those detections where the ML probability level leaves room for doubt."

It is this double-checking against machine learning algorithms and a signature database that keeps the SEP14 false positive rate very low -- around 2% at the most compared to 15% at the least for some of the machine learning new gen competitors (Hasan noted that all of the figures he quoted would be verified by third party testing already undertaken and due to be published in the coming weeks).

But this approach still has a security weakness that SEP14 seeks to avoid. For machine learning to detect a dubious file, that file has already landed on the disk. In effect, the infection has already occurred; which is what endpoint security should really seek to prevent. "What we have added in this release," explained Hasan, "is exploit mitigation technology which detects the methods of targeting vulnerabilities used by attackers. There are relatively few techniques used in exploits. What this technology does is stop them."

Sophos introduced a similar approach last month, and suggested that there are only about 24 separate basic exploit methodologies. This gets more complicated by multiplying different approaches for different platforms (Word, PDF, etcetera) but is nevertheless tiny compared to the size of a general malware signature database.

It is the combination of machine learning and exploit mitigation on the endpoint that provides maximum protection, while signature corroboration in the cloud minimizes false positives. This arrangement has two further advantages: zero-day malware detected by ML on the endpoint is immediately sent to the cloud to provide protection for all customers, while daily updates to the endpoint are reduced. "The number of updates drops by about 70% with SEP14 compared with SEP12," said Hasan. "Updates don't fully go away, but they're reduced to something about the size of a large email per day."

Hasan had one final rabbit to pull from the hat -- orchestration. "We've opened it up," he said, "so the customer can orchestrate SEP14 with other products or through the use of scripts. You can pull out data from SEP14 and use scripted controls, so you can respond to events happening elsewhere if you want to change the security posture of an endpoint."

Related: Inside The Competitive Testing Battlefield of Endpoint Security

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

After a seemingly endless barrage of cyberattacks, debate is heating up on hitting back at hackers where it hurts.

Amid calls for ways to punish and deter hackers without sparking a so-called "cyber war," a panel of experts assembled by the George Washington University Center for Cyber and Homeland Security said in a report Monday that US policies should be eased to allow "active defense" measures by both the government and private sector.

However, it stopped short of endorsing the idea of "hacking back" to disable systems used by attackers.

The panel envisioned measures such as taking down "botnets" that disrupt cyberspace, freeing data from "ransomware" hackers and "rescue missions" to recover stolen data.

The report follows a wave of high-profile attacks against US companies and government databases, and after Washington accused Russia of using cyberattacks to attempt to disrupt next week's presidential election.

It comes after President Barack Obama called for a "proportional" response to Russia, while leaving unanswered whether this would mean a cyber attack or measures such as diplomatic or economic sanctions.

'Shooting behind the rabbit'

Former national intelligence director and GWU task force co-chair Dennis Blair said the US has been moving too slowly in its response to cyberattacks.

"We are shooting so far behind the rabbit that we will only hit it if the rabbit makes another lap and comes back to where it was," he told a conference presenting the report.

Some analysts argue that hackers and states responsible for attacks should get a taste of their own medicine, and that US laws should be amended to allow for hacking back at the cyber criminals.

Some proposals call for private security firms to be "deputized" to carry out legally sanctioned hack-back operations when private firms are victimized.

"Department stores hire private investigators to catch shoplifters rather than relying only on the police. So too private companies should be able to hire their own security services," said a Hoover Institution paper written by scholars Jeremy Rabkin and Ariel Rabkin.

"There should be a list of approved hack-back vendors from which victims are free to choose."

Juan Zarate, a former White House national security advisor who now works with the Foundation for Defense of Democracies, said such a model for action could be based on the early days of the republic when Congress issued "letters of marque and reprisal" for private merchant ships to bring in maritime pirates.

In an essay last year, Zarate called for a "cyber-privateering regime that rewards, enables, and empowers the private sector to help defend itself in concert with government."

Others warn of the dangers of empowering private actors to engage in reprisals.

Nuala O'Connor, president of the Center for Democracy and Technology and co-chair of the GWU panel, argued of unintended consequences of authorizing companies to break into outside computer networks.

"I believe these types of measures should remain unlawful," she wrote, adding that it remains difficult to be sure of cyberattacks' sources.

"The risks of collateral damage to innocent internet users, to data security, and to national security that can result from overly aggressive defensive efforts needs to be better accounted for."

'Cyber shooting war'

Steve Grobman, chief technical officer at Intel Security, also questioned whether private entities should be allowed to take counter-measures.

Because hackers can easily disguise their attacks, Grobman said a questionable retaliation could create an ugly situation.

"What I worry about is a terrorist entity creating an attack that appears to come from a nation state that creates a public push for some hack back and that leads to a live shooting cyber war," he said.

James Lewis, senior fellow at the Center for Strategic and International Studies, said the United States has pledged to its international partners to steer clear of these kinds of acts in cyberspace.

"We've told people the internet should be based on the rule of law, and (hacking back) would undercut that," he said.

"The question you always want to ask is whether this would make cyberspace more or less stable. This would make it less stable."

Patrick Lin, who led a study this year for California Polytechnic State University on the ethics of hacking back, said there is "a moral case for hacking back, but an under-developed case for its legality and effectiveness."

In the report, Lin wrote that while it is difficult to know whether hacking back has deterrent value, "doing nothing, as seems to be the case now, certainly offers no deterrence and likely encourages cyber-attackers to continue preying on others."

Related: Hacking Back: Industry Reactions to Offensive Security Research

© AFP 2016

Tags: