Magento SQL Injection Flaw Puts E-Commerce Sites at Risk

Magento, an Adobe-owned company that promotes its e-commerce platform to have more than $155 billion in gross merchandise transaction volume annually, has called on online stores using its platform to install the company’s latest update as protection from a host of critical flaws.

Last March 26, Magentoannounced that it fixed 37 security vulnerabilities on its e-commerce platform. Out of the 37 vulnerabilities fixed by Magento through its security update, 4 vulnerabilities have a base score range between 9 to 9.8. Under the v3.0 standards of the Common Vulnerability Scoring System, base scores from 9 to 10 are considered as “critical.”

Out of the 37 vulnerabilities fixed by Magento through its latest security update, one vulnerability called PRODSECBUG-2198 stands out, not only because it’s one of the 4 vulnerabilities labeled as critical, but also because the exploit of this vulnerability is now out in the wild. Armed with this publicly available exploit, any day now PRODSECBUG-2198 vulnerability could be exploited by malicious actors.

PRODSECBUG-2198 bug is a SQL injection vulnerability found in Magento Open Source prior to 1.9.4.1, and Magento Commerce prior to 1.14.4.1, Magento 2.1 prior to 2.1.17, Magento 2.2 prior to 2.2.8, Magento 2.3 prior to 2.3.1. According to Magento, PRODSECBUG-2198 bug, also known as “SQL Injection vulnerability through an unauthenticated user” allows an unauthenticated user to execute arbitrary code through an SQL injection vulnerability, which causes sensitive data leakage.

According to Charles Fol of Ambionics, the one who reported the PRODSECBUG-2198 bug way back in November 2018, in a blog postsaid that the bug involves a minor mistake in the small piece of code of Magento. “This mistake, albeit minor, is very impactful …,” Fol said. “Surprisingly enough, this piece of code has been present since Magento 1.x !”

Ambionics also posted on GitHuba proof of concept on how the discovered mistake in the small piece of Magento code can be exploited. The publication of this proof of concept means that online stores using the Magento platform that haven’t installed the latest Magento update are at risk of this particular exploit.

The risk of SQL injection vulnerability through an unauthenticated user has a far-reaching effect.

What Is SQL Injection?

SQL, which stands for Structured Query Language, is a standard programming language for accessing databases. SQL injection, meanwhile, is one of the most common web hacking techniques. This form of attack was ranked by the Open Web Application Security Project (OWASP)in 2017 as the number one threat to web applications.

“Injection flaws, such as SQL … occur when untrusted data is sent to an interpreter as part of a command or query,” OWASP said. “The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.”

SQL injection was first documentedin 1998 by Jeff Forristal, also known by the alias Rain Forrest Puppy, now the CTO of mobile security vendor Bluebox Security. For years, many cyberattacks had been made possible through SQL injection. The cyberattacks on Sony in 2011 and TalkTalk in 2015 are some of the notable cyberattacks that used SQL injection as a weapon.

According to the Federal Bureau of Investigation (FBI), the cyberattack on Sony Pictures Entertainment between May 27, 2011 to June 2, 2011 in which attackers obtained confidential information from Sony Pictures’ computer systems was done using an SQL injection attack against Sony’s website.

In October 2016, UK’s Information Commissioner Office (ICO)fined TalkTalk for £400,000 (the company though settled the case for £320,000) for a cyber incident in October 2015 which led to the illegal accessed of personal data of 156,959 customers including their names, addresses, dates of birth, phone numbers, email addresses, as well as bank account details of 15,656 customers.

“The attack [October 2015 cyber incident on TalkTalk] was an SQL injection attack, a common type of cyber attack that has been well-understood … and for which known defences exist,” ICO said. “The investigation found there had been two previous SQL injection attacks on 17 July 2015 and between 2-3 September 2015 but TalkTalk did not take any action due to a lack of monitoring of the webpages.”

Prevention

Specific to Magento’s PRODSECBUG-2198 bug, online stores using the Magento platform, specifically Magento Open Source prior to 1.9.4.1, and Magento Commerce prior to 1.14.4.1, Magento 2.1 prior to 2.1.17, Magento 2.2 prior to 2.2.8, Magento 2.3 prior to 2.3.1 need to install the company’s latest update to prevent SQL injection attacks.

In general, e-commerce sites, regardless of the platform used, are attractive targets to hackers due to the fact that personal and payment information is required to complete a sale. SQL injection is a common weapon used by cyber attackers to compromise these e-commerce sites. Here are some security best practices that will harden your e-commerce site against SQL injection attacks:

• Keep all software, not just Magento, up to date.

• Use two-factor authorization for admin logins.

• Restrict outgoing connections to only those that are necessary, such as for payment integration.

• Use a dedicated Web Application Firewall (WAF) to analyze traffic and uncover suspicious patterns and proactively block SQL injection attacks.

• Do not install any unknown software applications, or open suspicious emails with suspicious links or attachments.

Preventing SQL injections attacks is easy, as long as you engage application security experts that understand your cybersecurity challenges and business goals delivering the right solution that works for you.

Contact ustoday and protect your web application against common threats in minutes without the need for capital investment or IT support.

Cybersecurity Training Tips for Every Business

As a business-owner or manager, you want to believe your employees are the best at what they do.

You trust them to work hard. To take their role seriously. To follow standard policies and safeguard the security of your company.

But, sadly, employees can — and do — make serious mistakes. One tiny accident or oversight may lead to costly cyber-attacks that disrupt your operations, chase clients away to your competitors and damage your reputation for years to come.

And don’t assume being a small business means you’re not a valuable target for hackers — 43 percent of cyber attacksare aimed at enterprises like yours.

That’s why effective cybersecurity training is paramount for your workforce. Yet actually finding programs that deliver the right education in an engaging way can be difficult. You don’t want to send your employees on a course only to discover they failed to absorb anything they were taught.

We’ve put together four great cybersecurity training tips to help you protect your business from attacks.

#1. Identify Your Business’s Weakest Points

Every company or organization has its weak points, no matter how high-profile it is or how impenetrable it should be.

For example, FEMA (Federal Emergency Management Agency) recently leaked the personal and banking detailsof more than two million people affected by major hurricanes. This was due to the actions of an outside contractor, with a small program error sharing important data.

One would expect FEMA to have processes in place to safeguard against such simple-yet-devastating mistakes, yet this major breach still occurred.

Avoid the same (or similar) errors happening in your business by evaluating your current cybersecurity setup. Ask questions, such as:

• Where are you vulnerable?

• Do any of your systems require updating to offer maximum protection?

• Is your current cloud storage a potential hazard?

• Do too many people have access to sensitive data?

Determine which aspects of your employees’ work demands the most attention. This makes finding or devising the most effective training easier. You’ll also know what cybersecurity experts can do to reinforce your systems.

#2. Embrace Interactive Exercises

Simply sitting employees in a conference room and lecturing them on cybersecurity may not be enough on its own. We all know how easily the mind wanders when it’s not stimulated for long periods. But you can make training more engaging and easier to absorb by hosting interactive training exercises, simulating an actual cyber-attack.

One way to do this is to distribute a fake phishing email to your entire workforce and note how people react. Hopefully, the majority of your employees will recognize the signs and take the appropriate action (deletion, reporting it to a supervisor etc.).

But if even one person clicks on a link or downloads an attachment, they could be starting your business along a dangerous road.

Obviously, in an exercise there would be no actual hazard, but keep the scenario as realistic as possible — don’t tell employees about it until after the fact. You’ll be able to gauge which employees or departments are up to speed on external threats, making it easier to determine who training should be aimed at.

You can try other exercises too. For example, consider a ransomware attack in which workers become locked out of certain programs and see how well they follow standard procedure. Can they still perform aspects of their job without access to all their usual tools? How do they notify clients of the issue?

Knowing how your team copes in any cybersecurity crisis is vital. You don’t want to realize you’ve made serious strategic mistakes during the real thing.

#3. Make Training a Regular Part of the Job

Cultivate a cybersecurity-focused company culture. Make sure all employees at all levels understand the importance of being aware and vigilant every single day.

Small training sessions or exercises here and there can make a lasting impact with employees. They’re likely to find a quick 20-minute quiz on common signs of a phishing scam much easier to digest than a five-hour block of training in a stuffy office.

Encourage group training and collaboration too. Your workforce should focus on what they’re being told and take it onboard if they’re able to get involved with others: their minds could wander during long lectures or presentations, but not so much when they’re actively interacting with their colleagues.

#4. Create Reward Schemes and Incentivize Vigilance

Another effective way to make cybersecurity training more impactful is to implement a reward scheme.

Workers may feel more motivated to stay alert and watch out for potential cybersecurity threats if they know they’ll receive a tangible reward for extra efforts. Bringing a reward program into your business can encourage everyone to embrace a stricter cybersecurity policy.

Survey your workforce first to discover which rewards would make the best incentives, within reason. For example, if someone were to spot a malicious email and raised the alarm, they could be given a bonus in their next salary or a ticket to their favorite sports team’s next game.

This may only be a minor expense for the business but will save a huge amount of money down the line.

This program could include more than just spotting potential attacks, too. Consider rewarding employees for attending training and completing quizzes afterward, motivating them to pay close attention.

How to Protect Your Business

Cybersecurity training is paramount for all businesses in all industries. Any employees using a computer or device with internet access must be made aware of the potential risks they face, and effective training will do just that.

But investing in weak training that fails to engage your workers is a waste of everyone’s time and money. Follow the tips explored above and bring in cybersecurity experts to help you get your company protected against common threats.

Remember: your clients’ data, finances and routines could all be affected by an error on your part. Their trust is worth the cost of good training.

At The Driz Group, we can help you understand where you’re going wrong and protect your business. How? Contact us today!

Top 5 Business Benefits of Cybersecurity Services

Businesses today are more digitalized and connected than ever. Transactions using computers are now preferred over papers and pens and emails are preferred over snail mails.

Businesses have increasingly relied on this digitalized and connected ecosystem – and so does threat actors. This digitalized and interconnected ecosystem has exposed businesses to vulnerabilities, making cybersecurity services – a combination of human expertise and cutting-edge technology – more important than ever.

Here are the top 5 business benefits of cybersecurity services:

1. Predict Cyber Threats

As businesses transition from papers and pens to computers, new security challenges have opened up for businesses. An effective and sound cybersecurity service has the insight or intelligence on the threats faced by businesses such as knowing that digital documents such as personally identifiable information and intellectual properties have become attractive targets of cybercriminals.

An effective cybersecurity officerhas the foresight to separate a business network that houses sensitive staff and customer data from the network that houses non-sensitive data, predicting that in the event of a comprise in the non-sensitive data network, the sensitive or critical network won’t be affected or accessed by attackers.

2. Block Cyber Threats

An effective cybersecurity service helps block cyber threats from ever getting through your organization’s IT systems. As businesses transition from snail mails to emails, attackers have weaponized the business emails to conduct fraud.

Spoofed emails of CEOs, emails that appear that they come from legitimate CEOs though, in fact, they come from attackers, have tricked a number of finance personnel worldwide in releasing corporate funds to scammers in a cybercrime called Business E-mail Compromise (BEC). The Federal Bureau of Investigation (FBI)in June 2018 release a public alert warning businesses about BEC, which at the time of the alert already victimized over 78,000 businesses worldwide and resulted in the combined total loss of over $12 billion.

In a BEC attack, attackers may spoof email accounts, for instance, do slight variations on legitimate addresses such as from john.kelly@abc_company.com to [email protected], fooling the email receiver into thinking that the email is authentic. An effective email filtering system can prevent this form of attack from happening by blocking emails with extensions that are similar to the company email. For example, legitimate email of abc_company.com would flag spoof email of abc-company.com.

3. Detect Cyber Threats & Respond

Predictive and blocking cybersecurity measures aren’t enough defenses as cybercriminals are getting more creative and effective each day. There’s always a possibility that no matter how hardy your organization’s predictive and blocking systems are, an anomaly may happen, allowing an attacker or attackers to get inside your organization’s network.

Verizon’s 2018 Data Breach Investigations Reportfound that illegal remote point-of-sale (POS) intrusions often occur in the accommodation and food services industry and weren’t discovered for months in 96% of cases. Businesses only discovered about these intrusions after being informed by law enforcement or through Common Point of Purchase (CPP).

Even Tesla wasn’t spared when attackers used the tech giant’s computing resources to mine cryptocurrency. Tesla also knew about the illegal use of its computing resources for cryptocurrency mining when RedLockdiscovered the intrusion and informed Tesla about it.

In the case of the Tesla intrusion, an effective cybersecurity service could have detected the illegal cryptocurrency mining on Tesla’s resources by monitoring network traffic and correlating it with configuration data, RedLock found.

4. Cybersecurity Services Save Money

An effective cybersecurity service saves businesses an enormous amount of money. The 2018 Cost of Data Breach Study: Global Overviewcommissioned by IBM and conducted by Ponemon Institute found that Canada has the highest data breach direct costs at $81 per compromised record. Direct costs in the study refer to the expense outlay to accomplish a given activity such as engaging forensic experts, hiring a law firm, or offering victims identity protection services.

The study also found that Canada has the highest data breach detection and escalation costs, referring to forensic and investigative activities, assessment and audit services, crisis team management, and communications to executive management and board of directors. 

5. Enable Businesses to Gain Access to Cutting-Edge Tools and Top Security Talent

There are 3 types of managed cybersecurity services:

• traditional
• cloud solution
• outsourced

Traditional cybersecurity services refer to on-premise services, requiring in-house manpower and capitalization for cutting-edge hardware and software tools.

In a cloud solution, cybersecurity is managed through cloud-based console and tools, without the need for additional hardware.

In outsourced model, an external third-party cybersecurity service provider, also known as Managed Service Provider (MSP), takes care of everything. Each of these services has its own benefits and budgetary impacts.

In the case of traditional or on-premise cybersecurity services, budget isn’t limited to trained and skilled in-house cybersecurity staff, but also to the growing IT infrastructure complexity. The growing volume of devices, for instance, that need to be secured is a key challenge for businesses.

Cloud-based security service allows your organization to manage multiple endpoints, file servers and mobile devices remotely, from anywhere. In an outsourced or third-party cybersecurity service, your organization, regardless of its size, gains access to the best security talent with greater scalability and continuity.

Hiring and retaining top IT and cybersecurity talent puts a pressure on your organization. Get expert advice when you need it most.

Connect with ustoday to get started.

POS Malware Continues to Target Small and Medium-Sized Businesses

Two organizations, Flashpoint and Cisco Talos, recently revealed that point-of-sale (POS) malware continues to be a threat to small and medium-sized businesses.

What Is a Point-of-Sale (POS) Malware? 

A point-of-sale (POS) malware is a malicious software that particularly targets POS, a system used for credit card transaction for payment of goods or services. Attackers may install a POS malware physically by tampering the PIN entry device pads or swapping out devices, an attack known as payment card skimming.

Another way of installing the POS malware is through remote installation, that is, the installation of a malware on environments where card-present retail transactions are conducted using a different computer stationed in another location. This present blog post covers the remote POS intrusion.

The goal of a POS malware is to obtain credit card details from customers. Stolen credit card details are typically sold by cyber criminals on the dark web. Buyers use these stolen credit card details to commit credit card fraud – unauthorized charges on someone else’s credit card.

Prevalence

On the same day of March 13, 2019, Flashpointand Cisco Taloseach published a report about the ongoing threat of POS malware on small and medium-sized businesses.

Flashpoint researchers reported that the POS malware called DMSniff has been actively used by cyber criminals since at least 2016 against small and medium-sized businesses in the restaurant and entertainment industries. Similar to other POS malware, DMSniff harvests credit card details. Flashpoint researchers said the DMSniff malware was previously only sold privately.

One feature of DMSniff that’s rarely seen in POS malware, Flashpoint researchers noted is the use of domain generation algorithm (DGA), a feature that creates lists of command-and-control domains or webpages on the fly. Command-and-control domains are important to cyber criminals as malware typically receive commands and send stolen data via these domains.

To cripple the effectiveness of a malware, that is, preventing the malware to receive commands or share stolen data, law enforcement or hosting providers take down these malware command-and-control domains. With domain generation algorithm, attackers can create lists of command-and-control domains on the fly in case one domain is taken down. In addition, domain generation algorithm also bypasses weak blocking mechanisms.

Cisco Talos researchers, meanwhile, reported about the proliferation of the new POS malware called GlitchPOS. The sale of this malware opened a few weeks ago in one of the crimeware forums. This malware later turned up for sale in another crimeware forum. The author of the GlitchPOS malware even created a video, showing how this malware harvests credit card details.

Like other POS malware, the main purpose of GlitchPOS is to steal credit card details from the memory of the infected system. Unlike DMSniff, with its advanced domain generation algorithm feature, GlitchPOS contains few functions, such as connecting to the command-and-control server to do the following tasks: register the infected systems, exfiltrate credit card numbers from the memory of the infected system, update the "encryption" key and clean itself. Online services such as Dropbox and Google Drive are at times used by cyber criminals as command-and-control servers.

Verizon’s 2018 Data Breach Investigations Reportfound that the accommodation and food services industry was the hardest sector in terms of remote POS intrusion in 2018, with remote POS breaches 40 times more likely to occur on the accommodation and food services industry compared to other industries.

The 2018 Verizon report added that remote POS intrusions weren’t discovered for months in 96% of cases. They were only discovered via external sources such as detection as a Common Point of Purchase (CPP) or by law enforcement.

In February this year, North Country Business Products (NCBP), a Minnesota-based provider of point-of-sale products, disclosed that nearly 140 of its customers, mostly bars, restaurants, and coffee shops all over the US, have had POS systems infected with malware. 

Causes of Remote POS Intrusions

Here are some of the common causes of remote POS intrusions:

SSH Brute Forcing & Common Exploit Scanners

In the case of DMSniff malware, Flashpoint researchers suspected (with low confidence) that the initial infection could either be SSH brute forcing or common exploit scanners.

In SSH brute forcing, an attacker tries every possible password combination until it cracks the password of SSH, also known as Secure Shell or Secure Socket Shell, a network protocol that gives users, particularly system administrators, a means to access a computer over the internet. Common exploit scanners, meanwhile, are automated tools that are used to test applications and networks against known and new security vulnerabilities.

Supply Chain Attack

Supplier of point-of-sale products North Country Business Products revealed that POS systems of its nearly 140 business clients were infected with POS malware as cyber criminals compromised its IT system and later on planted POS malware on the network of some of its customers.

Lack of Trained Security Staff

Verizon’s 2018 Data Breach Investigations Report, meanwhile, said that businesses in the accommodation and food services industry rely almost exclusively on payment cards for their existence. Despite this reliance, this industry, in particular, restaurants are small organizations that typically don’t have trained security staff.

Good security controls and training will minimize the likelihood of a data breach for your business.

When you need help of experienced cybersecurity professionals, our team is a phone call away. Contact ustoday and protect your business.

Why is Segregation of Duties Between IT and Cybersecurity Critical for Your Business?

Neglecting your cybersecurity means neglecting your business’s future.

It’s that simple. Every company has to take effective action to minimize its risk of a data breach, leveraging the latest, most effective measures to combat hackers. Software specialists Citrix is just one of the latest brands to come under attack: it’s believed as much as 10TB may have been stolen.

Furthermore, the criminals are said to have gained access to the system through ‘password spraying’, or simply guessing weak, common passwords.

It’s paramount to ensure your business is protected and prepared to deal with any serious cyberattack sent your way. One key aspect of safeguarding your company is Segregation of Duties between IT and cybersecurity. What does that mean and how do you do it?

SoD Defined

Segregation of Duties (or SoD) revolves around keeping multiple people involved with achieving a specific goal, whatever the task at hand may be. Though it started as a process to minimize the danger of mistakes or fraudulent activities, SoD has evolved into an important security issue.

All tasks covered require authorization from two parties to prove integrity and defend against breaches. All individuals involved in undertaking a process of any size would have to be in agreement before the task can be completed.

Segregation of Duties is so important because it takes absolute power out of the hands of any one person within your company, offering greater peace of mind and caution. SoD spreads the privileges for everyone’s benefit and makes cybercriminals’ ‘work’ a little harder

Key Benefits of Segregation of Duties

Segregation of Duties offers businesses numerous compelling benefits, including the following:

Reduce the risk of inside attacks

You trust your employees to work with your system every day. You expect them to be respectful, careful and loyal. You put your faith in them to help steer your company toward success.

And yet, inside attacks are a sad reality of cybersecurity breaches. Not only can an issue caused from the inside be more difficult to detect until it’s too late, but it can be particularly devastating on an emotional level if the attack was intentional.

Dealing with a mistake is one thing. But knowing that an employee you paid and supported facilitated an attack can leave you, and their colleagues, struggling to trust others in the future.

Oversights may cause accidental inside attacks too. This may be down to an employee downloading an attachment from a suspicious email, failing to follow standard practice when making company payments or something equally minor.

Segregation of Duties takes care of all this. For example, if one worker is preparing to download a new tool but requires another’s agreement first, they may discover a security risk before any harm is done. 

This reduces the danger of genuine accidents caused by ignorance and acts as a deterrent for insiders looking to sabotage the business.

Should any attacks take place, it’s far easier to determine which party must have been responsible just by addressing those individuals with access. This is much more difficult when everyone in the company uses every aspect of the system without restraint.

Less power is up for grabs

Imagine if a hacker manages to gain access to your system by cracking an employee’s login details. Imagine if said employee has full access to every tool, every database, every service — a criminal could basically take control of your business and cause monumental damage before they’re shut down.

With Segregation of Duties, you can minimize the power any hacker would wield should they find a way into your network. Accounts are shared between a small group of people and only they have authorized entry. Any sign of unexpected activity within those accounts would indicate a potential issue.

Furthermore, all aspects of your company which require a different set of credentials to enter would be secure. This allows you to focus your attention on the problem areas rather than addressing the entire company.

Accounts and credentials are easier to manage

Businesses implementing SoD can manage access and credentials more easily in the event of a crisis.

Specifically, creating new logins for a compromised account is much easier with just two people to update. It’s a convenient, faster process with less room for error.

Segregation of Duties Between IT and Cybersecurity

Segregation of Duties between your IT department and cybersecurity specialists is vital for increasing your reinforcing business’s defense against hackers.

Your IT team may be experienced, well-trained and qualified, but they have to make sure they’re up-to-date on the latest risks, techniques and solutions in cybersecurity. Without this knowledge, they’re more likely to make mistakes when updating systems, maintaining your network or working with vendors.

Again, SoD means making sure your IT specialists are accountable and have to run their intentions by someone else. The smallest oversight could end up causing massive disruptions and effectively shut your business down on a temporary (or possibly permanent) basis.

Segregation of Duties demands a responsible approach: keep track of which individuals have access to specific accounts and which are authorized to perform certain tasks. Make sure to limit any crossover that could cause problems, such as putting the same person in two or three teams. This may lead to a conflict of interest and questionable choices.

Working with experienced cybersecurity experts is crucial for companies of all sizes, across all industries. Businesses have to take charge of their own protection and implement strategies designed to limit the damage a single attack is capable of.

All companies must stay organized and plan ahead when implementing a SoD strategy. Cybersecurity professionals can advise you on the major threats your business faces and how best to protect against them.

Cybersecurity experts will help you understand what that involves, how to implement Segregation of Duties and combat even the most creative cybercriminals.

Want to learn what The Driz Group can do for your company? Please don’t hesitate to reach out to our dedicated teamnow.

What Is Password Spray Attack and How to Prevent It

VPN provider Citrix, whose clientele includes more than 400,000 organizations including 98% of the Fortune 500 companies, recently disclosed that cybercriminals gained access and downloaded business documents from its internal network.

According to the Federal Bureau of Investigation (FBI), the one that informed Citrixabout the illegal intrusion, the attackers likely used a tactic known as password spray to gain a foothold with limited access to Citrix’ network and worked to circumvent additional layers of security.

What Is Password Spray Attack?

Password spray is a type of cyberattack that attempts to access a large number of usernames (accounts) using commonly used passwords. This type of attack is also known as low-and-slow method as an attacker or attackers at first attempt to login using a single commonly used password for a number of usernames. If the first password is incorrect for all the usernames, the attackers will then use a different password, giving sufficient time in between different password guessing so as not to trigger any time-based account lockout thresholds.

Attackers, for instance, can easily get all usernames of a certain organization using the toolMailsniperand then attempt to login using at first the commonly used password “P@$$w0rd” on all of the usernames, and if this password fails, after a sufficient time interval, use another commonly used password “Password1” and so on.

Password spray is a stealth form of cyberattack, evading most detection techniques. On the part of the legitimate user or the organization, login attempts that are part of password spray attacks are seen as isolated failed login.

On the part of the attackers, password spray attack is a numbers game. Even though commonly used passwords are used only by 0.5-1.0% of accounts, one successful attempt for every thousand accounts attacked is enough as this one successful attempt has a multiplying effect. Successful access to one account allows attackers to harvest further information.

A study conducted by the UK National Cyber Security Center (NCSC)showed that 75% of the participants’ organizations (UK-based) had accounts with passwords that featured in the top 1,000 passwords, and 87% had accounts with passwords that featured in the top 10,000.

"This data suggests that password spraying attacks are likely to have some success against these organizations, and many other organizations across the UK,” NCSC said. “Whilst account lockout policies may limit attackers to trying (for example) 10 passwords against a single account per day, the account lockout counters usually reset over time. This allows persistent attackers to try more passwords, and they can (and do) end up trying hundreds or even thousands of common passwords.”

Prevalence

The recent cyberattack on Citrix via password spray attack shows that cybercriminals are increasingly using this form of cyberattack against organizations worldwide. In March 2018, the U.S. Department of Homeland Security (DHS) and the FBI released a joint alertwarning the public against the growing threat of password spray attacks.

Passwords aren’t just used in emails. They’re also used in single sign-on (SSO) or web-based applications with federated authentication method. According to DHS and FBI, victims of password spray attacks often use SSO or web-based applications with federated authentication method. DHS and FBI added that the vast majority of known password spray victims share some of the following characteristics:

• Lack of multifactor authentication (MFA)
• Allow easy-to-guess passwords (“P@$$w0rd” or “Password1”)
• Use inbox synchronization, allowing email to be pulled from cloud environments to remote devices
• Allow email forwarding to be setup at the user level

In March 2018, theFBIannounced the hacking-related charges against nine Iranians. The FBI said the accused conducted a 4-year campaign that compromised nearly 144 U.S.-based universities and 176 foreign universities in 21 countries. In addition to the compromised universities, the FBI said 50 U.S. and foreign private companies, the states of Hawaii and Indiana and the United Nations were compromised by the accused as well.

Over 30 terabytes of academic data and intellectual property, equivalent to 3 times the amount of data contained in the print collection of the Library of Congress, were stolen by the accused, the FBI said.

According to the FBI, the accused compromised their victims through password spray attacks. “They were flying under the radar,” said the FBI agent who investigated the case, “and the magnitude of their effort was remarkable.”

How to Prevent Password Spray Attacks

While password spray attacks can go undetected by security networks, there are, however, indicators of this type of cyberattack. Indicators of password spray attacks include the rise in attempted logins against the enterprise SSO portal or web-based application, and employee logins from IP addresses resolving to locations not consistent with their normal locations.

Here are some measures aimed at deterring password spray attacks:

1. Use Multifactor Authentication (MFA)

Using MFA in all active, internet facing protocols is one way to deter password spray attacks. So long as there are passwords, attackers would forever guess them. MFA is a means to distinguish between a legitimate account owner and the attacker.

2. Ban Commonly Used Passwords

Banning commonly used passwords is another means to deter password spray attacks. Every password creation, change or reset should run through a banned password checker, containing a list of words that no one should ever have in their password.

3. Use Non-Password-Based Access Methods

Password spray attacks exist because of passwords. When passwords aren’t used at all, there would be no passwords that the attackers have to guess. Instead of passwords, use non-password-based authentication methods.

For instance, Windows Server 2016 enables completely password-free access based on strong cryptographic keys tied to both the user and the device.

Decade-Old Qbot Banking Malware Makes a Comeback 

The decade-old Qbot banking malicious software (malware) has made a comeback, this time exploiting a tool that already exists on targeted computers: BITSAdmin.

Researchers at Varonisrevealed that thousands of computers around the globe have been compromised and under active control by a new variant of the Qbot malware, this time leveraging BITSAdmin, a common administration tool. The researchers said they found 2,726 unique victim IP addresses infected with this new variant of Qbot.

The researchers added that the number of victims is likely much larger as many organizations use port address translation that hides internal IP addresses. Majority of the Qbot malware victims, Varonis researchers said were located in the U.S., but victims were also found in Canada, the U.K., France, Brazil, Germany, South Africa, Russia, China and India.

What Is Qbot?

Qbot, also known as Qakbot or Pinkslipbot, is a malware that was first observed in the wild in 2007. Through the years, this malware has morphed into various versions due in part to the fact that the source code of this malware is publicly available. The various versions of Qbot retain the primary purpose of this malware, that is, to steal online banking account information from compromised computers.

According to Microsoft, over the years, cybercriminals behind Qbot have improved the Qbot code, enabling this malware to better “evade detection, stay under the radar longer, and increase the chances of spreading to other potential victims.”

Various versions of Qbot, including the latest version observed by Varonis, steal online banking account information from compromised computers through keylogging and hooking.

In keylogging, every keystroke that the victim enters is automatically captured and sent to the Qbot attackers. Hooking, also known as code hooking, modifies the behavior of a computer program. For instance, antivirus programs use hooking once it discovers the presence of a malware. On the flip side, cyberattackers use hooking as well, for instance, altering the behavior of a computer program or a browser, which can lead to exfiltration of passwords and cookies (referring to the text file that a web browser stores on a user's computer).

Another common feature of Qbot variants is the worm-like capability or the ability to spread across an organization’s network and infect other systems without user interaction. According to Microsoft, Qbot "can drop copies in other machines in the network using Server Message Block (SMB) and then use remote execution to activate.” SMB is a Microsoft Windows protocol for sharing files over a network.

Another common feature of Qbot variants is the initial infection process. Like many other cyberattacks, Qbot initially arrives on the victim's computer through malicious email campaigns, containing a malicious attachment and/or link.

What Is BITSAdmin?

BITS in the term “BITSAdmin” stands for Background Intelligent Transfer Service (BITS). BITS is a component of Microsoft Windows operating systems which facilitates updates and other applications to operate in the background without interrupting other networked applications.

Cybercriminals have learned to abuse BITS by using this legitimate administration tool for downloading, executing and even cleaning up after running malicious code. The interface to create and manage BITS jobs or tasks is accessible through PowerShell, a tool capable of executing code from memory and providing administrative access directly to a device's core, and BITSAdmin tool, a tool that can be used to create download or upload BITS jobs and monitor their progress.

In the past, cybercriminals behind Qbot have used PowerShell to download and run the Mimikatz, another malware that steals credentials, allowing attackers to move rapidly across a network once they have established an initial foothold.

Researchers at Varonis reported that the latest Qbot, uses BITSAdmin, another common administration tool in Windows operating systems, to download Qbot’s loader – a component that executes the core malware.

The abuse of legitimate administration tools such as PowerShell and the BITSAdmin are examples of “living off the land” cyberattack techniques that exploit tools that already exist on targeted computers. Exploiting these common administration tools makes detection difficult.

One probable explanation why the cyberattackers behind the latest variant of Qbot use the administration tool BITSAdmin, instead of PowerShell, is that PowerShell is now closely monitored on enterprise systems. A recent study conducted by IBMshowed that more than half or 57% of cyberattacks exploit tools that already exist on targeted computers. The IBM study highlighted that the administration tool that’s often exploited by cyberattackers is PowerShell.

Prevention

Cyberattackers that abuse PowerShell and BITSAdmin have first to execute their malicious code on the targeted computer. The initial infection of PowerShell and BITSAdmin-based attacks is often phishing attacks, attacks that use malicious emails that contain malicious attachments and/or links. 

In the case of the latest variant of Qbot, Varonis researchers said the first infection was likely carried out via a phishing email that tricked the victim into running a malicious file. Cybersecurity best practices for mitigating phishing attacks also apply for mitigating PowerShell and BITSAdmin-based attacks. These mitigating measures include deleting any suspicious emails, especially those containing suspicious links and/or attachments, and avoiding enabling macros in Microsoft Office.

Disabling all BITS functionality, meanwhile, as a preventive measure is a tricky business as this will likely have unintentional side effects, such as preventing legitimate software patching and updating. Some of the mitigating measures that are specific to BITSAdmin-based attacks include modifying host firewall rules and other network controls to only allow legitimate BITS traffic, and monitoring usage of the BITSAdmin tool, including the command options “Transfer”, “Create”, “AddFile”, “SetNotifyFlags”, “SetNotifyCmdLine”, “SetMinRetryDelay” and “Resume”.