Cybersecurity is a constantly evolving field, with new threats emerging all the time. As technology advances and more and more of our personal and business lives are conducted online, it's essential to stay aware of the latest cybersecurity threats to protect ourselves and our organizations. In this blog post, we'll take a closer look at some of the most pressing cybersecurity threats to pay attention to in 2023, including ransomware attacks, phishing scams, cloud security threats, IoT security threats, AI-powered attacks, and supply chain attacks.

Ransomware

Ransomware attacks are a growing threat to organizations of all sizes. This malware encrypts a victim's data and demands payment to restore access. The problem with these attacks is that paying the ransom does not guarantee the return of the encrypted data, and it only encourages the attackers to continue their harmful actions. To safeguard against ransomware, it's crucial to implement preventive measures such as keeping software updated, regularly backing up critical information, and training your employees to exercise caution when interacting with emails or attachments from unknown sources. Please do so to avoid costly downtime and the loss of sensitive information. By being proactive and taking the necessary steps to protect against ransomware attacks, organizations can reduce the risk of falling victim to these malicious attacks.

Phishing Scams

Next, we have phishing scams. Phishing scams are a type of social engineering attack that uses fake emails or websites to trick victims into giving away personal information, such as login credentials or financial information. These scams can be challenging to spot, as the attackers go to great lengths to make their emails and websites look legitimate. To avoid falling victim to a phishing scam, it's important to be wary of emails or websites that ask for personal information and to always verify the authenticity of an email or website before entering any sensitive information.

Cloud Security

Cloud security threats are becoming an increasingly pressing concern for organizations as they shift more of their data and applications to the cloud. One of the main reasons for this is that cloud-based systems are often more vulnerable to cyberattacks than traditional on-premise systems. This is because cloud systems are frequently accessed remotely, making them more vulnerable to hackers looking to gain access to sensitive data.

To protect against cloud security threats, it's essential to use a reputable cloud service provider that has a solid track record of providing secure services. This will help to ensure that the latest security measures protect your data and applications and that your cloud provider is taking the necessary steps to protect your information from cyberattacks. Additionally, it's essential to ensure that all security settings are correctly configured to minimize the risk of a data breach.

Another important step in protecting against cloud security threats is to conduct regular monitoring and testing of your cloud systems. This will help to identify and address any vulnerabilities that may exist in your cloud environment. This can include using security tools to perform vulnerability scans, penetration testing, and other types of testing to identify and address any weaknesses in your cloud environment.

It's also important to have an incident response plan in case of a security incident. This will help minimize the impact of a security incident and ensure that your organization can respond quickly to any threats that may arise.

Overall, protecting against cloud security threats requires a multi-layered approach that involves using a reputable cloud service provider, properly configuring security settings, regularly monitoring and testing cloud systems, and having an incident response plan in place. By taking these steps, organizations can better protect their data and applications in the cloud and minimize the risk of a cyberattack.

IoT

The Internet of Things (IoT) is another area where security threats are rising. IoT devices, such as smart home devices, can be particularly vulnerable to attack, as they often have weaker security features than traditional computing devices. Hackers can target vulnerabilities in these devices to gain access to networks and steal sensitive information. To protect against IoT security threats, it's important only to use devices from reputable manufacturers, to keep all software up to date, and to use strong passwords.

AI

I-powered attacks are a relatively new but rapidly growing threat in the cyber security landscape. These types of attacks leverage the power of artificial intelligence to evade detection and carry out more sophisticated attacks. For example, hackers can use AI-powered malware to adapt to changes in a victim's network in order to avoid detection. This can make it much harder for traditional security solutions to detect and block these types of threats.

One of the key challenges with AI-powered attacks is that they can change and adapt over time. This means that security solutions that were effective at detecting these types of threats in the past may not be effective in the future. As a result, it's important to use security solutions that are specifically designed to detect and block AI-powered threats.

One way to protect against AI-powered attacks is to use security solutions that employ machine learning algorithms. These algorithms can help to identify patterns and anomalies in network traffic that may indicate the presence of an AI-powered attack. Additionally, security solutions that use behavioural analysis can effectively identify and block AI-powered attacks.

Another important step in protecting against AI-powered attacks is to use security solutions that are designed to detect and block attacks at different stages of the attack lifecycle. This can include using solutions that are designed to detect and block attacks at the endpoint, network, and cloud levels. By using a multi-layered approach to security, organizations can better protect against AI-powered attacks.

In addition, it's important to keep your security solutions up to date, which will ensure that they can detect and block the latest AI-powered threats. Also, it's crucial to have an incident response plan in place in case of a security incident. This will help to minimize the impact of a security incident and ensure that your organization is able to respond quickly to any threats that may arise.

Overall, protecting against AI-powered attacks requires a multi-layered approach that involves using security solutions specifically designed to detect and block these types of threats, using a multi-layered approach to security, and keeping your security solutions up-to-date. By taking these steps, organizations can better protect against AI-powered attacks and minimize the risk of a cyberattack.

Supply Chain

Lastly, supply chain attacks are becoming an increasingly common concern. In a supply chain attack, hackers target third-party vendors and suppliers in order to gain access to a company's network. These attacks can be challenging to detect and prevent, as the attackers may have access to the company's network for an extended period of time before being discovered. To protect against supply chain attacks, it's important to use third-party vendors and suppliers with a strong security posture and to monitor and test these systems' security regularly, using best-in-breed software and automation tools.

In conclusion, the cybersecurity landscape is constantly changing, and new threats are always emerging. By staying aware of the latest cyber threats, your organization can mitigate the risks and protect critical information and the organizational reputation.

A Lookback of the Cybersecurity Threats in 2020

The world dramatically changed in 2020. The abrupt work from home shift to anything online such as online shopping opened up a plethora of cybersecurity threats at a scale never seen before.

Most Notable Cybersecurity Threats in 2020

Here are some of the notable cybersecurity threats in 2020:

1. Threats Associated with Collaboration Apps

The work from home shift gave rise to the demand for collaboration tools such as Microsoft Teams, Slack, and Zoom. In 2020, threat actors turned their attention to these collaboration tools.

In 2020, the term “Zoombombing” was coined. This term refers to uninvited threat actors viewing Zoom meetings or sharing pornographic images and content.

Last year, threat actors leveraged association to Microsoft Teams – referring to the communication platform developed by Microsoft which features chat, videoconferencing, and file storage. In October 2020, Abnormal Security reported that up to 50,000 emails were observed spoofing employee emails and impersonating Microsoft Teams.

“The email pretends to be a Microsoft Teams notification email notifying the recipient that they have received messages and their teammates are trying to reach them,” Abnormal Security said. “The link landing page also looks convincingly like a Microsoft login page with the start of the URL containing ‘microsftteams’, lending further credence.”

2. Remote-Working Tools Exploitation

An IBM study released in June 2020 showed that 83% of employees were provided little to no ability to work from home prior to the sudden work from home shift. The IBM study further found that 53% of employees used their personal laptops and computers for business operations, while 61% also said their employer hasn't provided tools to properly secure those devices.

In 2020, threat actors actively exploited remote-working services such as virtual private network (VPN) services. In addition to masking internet protocol (IP) address so that online actions are virtually untraceable, VPN services promise secure and encrypted connections.

Security researchers, however, discovered security vulnerabilities in many VPN services. Even as VPN service vendors released patches fixing these security loopholes, many users delay the application of these patches, leading threat actors to exploit these unpatched security vulnerabilities.

In April 2020, the Canadian Centre for Cyber Security and U.S. Cybersecurity and Infrastructure Security Agency issued separate alerts warning organizations about the continued exploitation of the security vulnerability in Pulse Secure VPN, in particular, CVE-2019-11510 – a security vulnerability that allows a remote, unauthenticated attacker to compromise a vulnerable Pulse Secure VPN server, allowing an attacker to gain access to all active users and their plain-text credentials.

3. E-Commerce Threats

Among the effects of the lockdown measures in 2020 has been a huge spike in e-commerce business. Imperva reported that web traffic to retail sites spiked by as much as 28% on the weekly average. In “The State of Security within E-commerce,” Imperva reported that among the cyber threats faced by e-commerce businesses in 2020 were DDoS attacks and bad bots.

DDoS, short for distributed denial-of-service, refers to a cyberattack that attempts to disrupt the normal traffic of online resources such as websites, overwhelming the target or its surrounding infrastructure with a flood of internet traffic. DDoS attacks are launched by hijacking multiple computer systems, including Internet of Things (IoT), as sources of attack traffic.

According to Imperva, it monitored an average of eight application layer DDoS attacks a month against retail sites as lockdown measures led to an increase in demand for online shopping.

Bad bots, meanwhile, refer to software applications that run automated tasks over the internet for malicious purposes, for example, automatically scanning websites for software vulnerabilities and exploiting these vulnerabilities. According to Imperva, bad bots are the top threat to online retailers before and during the imposition of the lockdown measures.

4. Supply Chain Attack on SolarWinds

Year 2020 ends with one of the biggest cyberattacks: the supply chain attack on SolarWinds. On December 13, 2020, SolarWinds admitted that it fell victim to a supply chain attack.

In a supply chain attack, a threat actor gains access to your organization’s IT systems via an outside partner or third party that has access to your organization’s systems and data. According to SolarWinds, a threat actor gained access to its Orion Platform software source code and inserted the malicious software (malware) called “Sunburst.”

This malware ended up in the Orion Platform software update, specifically for versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1. According to SolarWinds, if present and activated, the Sunburst malware could potentially allow an attacker to compromise the server on which the Orion Platform software runs.

Open-source reports showed that the U.S. Treasury Department and other U.S. Government Departments had been compromised. Microsoft recently admitted that the SolarWinds supply chain attack also affected its own systems. Microsoft said that it found no evidence of access to production services or customer data, or its systems being used to attack others.

Microsoft, however, said that the SolarWinds attackers were able to view Microsoft's source code but had been unable to modify any code or engineering systems. “At Microsoft, we have an inner source approach – the use of open source software development best practices and an open source-like culture – to making source code viewable within Microsoft,” the company said. “This means we do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code. So viewing source code isn’t tied to elevation of risk.”

Upcoming Holiday Shopping Season Brings New Level of Cybercrime Threats to Online Retailers

Online shopping this holiday season is projected to be unprecedented, with many people staying at home and opting to shop online as a result of the COVID-19 mandatory lockdown or due to self-imposed lockdown.

The expected online shopping surge creates a perfect stage for cybercrimes.

Shift to Online Shopping

Statistics Canada reported that from February 2020 to May 2020, retail e-commerce sales soured by 99.3%. The record gain in e-commerce, however, resulted in a record decline in retail sales.

Statistics Canada reported that for the same period, the total retail sales fell by 17.9%. The impact of COVID-19, Statistics Canada said, is best highlighted using the April 2020 data, with a 26.4% decline in retail sales compared to the April 2019 data.

A survey conducted by Deloitte showed that 47% of Canadian consumers said they’ve been shopping online more often since the COVID-19 crisis began. The survey further showed that the same number of Canadian consumers (47%) will likely head online to find gifts and other items this holiday season, with the remaining 53% to head to traditional retails stores. While the number of those who intend to do their shopping in the traditional way is few points higher than those who intend to shop online this holiday season, this data is high enough as 69% of holiday shoppers shopped in the retails stores during the holiday season in 2019.

“A lot has changed since the 2019 outlook,” Deloitte said. “COVID-19 has changed how Canadians live, work, and shop, and it has turbocharged the fundamental shifts in consumer behaviour that were already underway.”

Imperva, meanwhile, reported that from March 1 to March 22, 2020, retail websites’ traffic worldwide soured by as much as 28% on a weekly average.

Holiday Season Cybercrime Threats

A new report from Imperva showed that the upcoming holiday shopping season will present online retailers with a new level of traffic, at the same time, never seen before level of cybercrime threats. According to Imperva, online retailers will face the following cybercrime threats this holiday season:

Bad Bots Attacks

According to Imperva, bad bots, as a group, is a top threat to online retailers, before and during the pandemic. A bad bot refers to a software application that runs automated tasks over the internet.

As opposed to a good bot which runs automated tasks over the internet for legitimate purposes, the purpose of a bad bot is malicious. Bad bots interact with software applications in the same way as legitimate users would, making them indistinguishable from legitimate users.

An example of a bad bot is a bot that interacts with a website’s login interface, attempting to “brute-force” its way by attempting to login using the trial and error method in guessing the correct username and password combination. Aside from brute-force attacks, bad bots are used for competitive data mining, personal and financial data harvesting, and more.

API Attacks

According to Imperva, API attacks are attractive targets due to the sensitive payment data they hold. The volume of attacks on retailers’ APIs far exceeded average levels this year, Imperva said.

API, short for An Application Programming Interface, is a software intermediary that allows other software applications to communicate with one another. A website API, for instance, connects between applications such as databases.

DDoS Attacks

According to Imperva, retail sites experienced an average of eight application layer DDoS attacks a month, with a significant spike in April 2020 as lockdowns resulted in the demand for online shopping. DDoS, short for distributed denial of service, refers to a cyberattack that attempts to make an online service, such as a website, unavailable to legitimate users.

DDoS uses bad bots. In DDoS attacks, bad bots are organized into a botnet – referring to hijacked computers that are controlled by attackers to conduct malicious activities such as DDoS attacks. Application layer DDoS, meanwhile, is a type of DDoS attack comprised of malicious requests with the end goal of crashing the web server.

Client-Side Attacks

According to Imperva, retail sites are vulnerable to client-side attacks as many of these sites are built on frameworks using a number of third-party code. Client-side refers to anything that’s displayed or takes place on the client – end user – using a browser. This includes what the user sees on the site’s online form.

The attack on Ticketmaster is an example of a client-side attack. In June 2018, Ticketmaster made public that they had been compromised and that attackers stole customer information. RiskIQ, the company that discovered the attack, reported that Ticketmaster wasn’t directly compromised but the site’s third-party supplier known as Inbenta was. According to RiskIQ, attackers either added or replaced Inbenta’s code used for Ticketmaster with a malicious one.

A client-side attack also directly compromises the website itself. Such was the case in the British Airways website client-side attack. The attack was discovered by RiskIQ.

According to RiskIQ, a malicious code was found in British Airways’ baggage claim page where customers were required to enter their personally identifiable information. The malicious code then sent the information entered to a URL that looked like it belonged to British Airways. Upon closer inspection, however, the URL wasn’t owned by British Airways.

It’s still unknown how the malicious code got into the British Airways’ site in the first place.

Worried about your website or web application and looking to better protect it? Contact us today to see how to mitigate the risks quickly and efficiently.

Combating the Most Common Cyber Security Risks

Hard as it may be to believe, government agencies have been found to have some of the worst cyber-security systems in the United States.

Agencies at federal, state, and local agencies were all ranked below other industries (retail, transportation etc.) in a study on U.S. cyber-security. Even NASA, considered one of the most technologically-innovative institutions in the country (if not the world), was flagged for its high vulnerability.

The U.S. Department of State was another weak performer, struggling to protect their systems from outside threats with an unsuitable set-up.

The point? If one of the most powerful governments in the world is failing to keep sensitive data out of criminals’ hands, they are risking the security of countless people on a daily basis. They cannot afford to be so lax.

The same is true of your own business, albeit on a smaller scale: allowing your enterprise to be vulnerable in today’s world is dangerous for your employees and clients alike.

What cyber threats are you most susceptible to, and how can you protect against them?

Malware

What is it?

We’ve all heard of malware, but do we know what it actually is?

This applies to various incarnations of dangerous software that can cause all manner of chaos in your computer, delivered as a virus or ransomware (in which you are ordered to pay in order to regain access to your system).

The malware can actually take over your computer, monitor your activities without your awareness, or even transfer critical information to another user with the utmost discretion.

How can you prevent it?

Make sure you use unique passwords and educate your employees to do the same. Only share sensitive data on a site which is clearly secure, with ‘https’ in their URL.

You should never download any files sent by a sender you don’t trust or recognize, and make sure data is backed up to disconnected hardware on a regular basis. This enables you to restore vital information in the event of a malware attack, without needing to pay or sacrificing critical data.

Phishing

What is it?

You know to never open an attachment in an email from an unknown sender, or to be wary of telltale bad grammar. These are sure signs of a phishing scam, but some cyber-criminals are more advanced.

They may pose as someone else – such as a friend, a bank etc. – and encourage you to follow a link or open an attachment. The email may look legitimate but will contain harmful malware that could pose a serious risk to your entire business.

How can you prevent it?

The most obvious technique: be sure before you click. If there is anything remotely suspicious or odd about the email, don’t follow a link or open an attachment.

If an email from a bank or other trusted organization asks for confidential information, contact them through another channel to confirm this (though they will generally never ask for sensitive data through email anyway).

Anti-phishing toolbars can be installed on your browser, which will notify you if you enter a known phishing website. Use desktop and network firewalls to protect your system from any malicious programs, and pay attention when your browser informs you that a site is ‘not secure’ (lacking the ‘https’ in its URL bar).

SQL Injection Attack

What is it?

SQL (Structured Query Language) is a language allowing for communication between databases, and countless servers use it to manage critical data. An SQL injection is an attack aimed at these types of servers, employing malicious coding to extract data from them which would otherwise remain private.

If the server under attack carries access information (usernames, passwords), financial details (credit cards etc.), or any other highly-sensitive data, the criminal responsible will be able to access some or all of it.

How can you prevent it?

All sensitive data contained within a database should be encrypted. Passwords, financial records, and anything else which could leave your business vulnerable must be protected.

Also, don’t store such sensitive information if you don’t need it currently, and are unlikely to in the future. Leaving data that carries real value to linger in your databases could lead to problems – all of which can be avoided simply by wiping useless information.

Implement Web Application Firewall as it will automatically block and prevent SQL injection attacks.

Cross-Site Scripting (XSS)

What is it?

During an XSS attack, the cyber-criminal injects malicious code right into your website with an aim to go after your visitors through their browser.

They can plant the code in comments on blogs, possibly embedding links to risky JavaScript that would attack unsuspecting users. The browser would run the infected script believing it to be part of the legitimate website, and the user is none the wiser.

These attacks can cause severe damage to your reputation, as your site would be responsible for endangering visitors’ sensitive data.

This is worsened if they are customers purchasing from you or providing their personal details. As a result, you might not even realize your site is infected until customers start tracing suspicious activity back to their activities on your domain.

How can you prevent it?

While web application firewall will block XSS attacks, you need to pay attention to the way in which your site accepts input data, to minimize malicious code passing through. This might mean using a number of filters in place, such as a web app firewall, that reduces the risk of an XSS attack significantly.

Another step, though somewhat more complex, is to use an alternative rendering format to raw HTML, to reject entries that might be malicious. Markdown or BBCode are alternatives to raw HTML that may help to protect against XSS attacks.

Cyber-security threats are constantly evolving, as criminals continue to find weaknesses in security protocols and exploit them. By keeping your security systems up to date and, staying abreast of the latest risks, you can maximize your business’s resistance to threats. 

Never be complacent about your business’s cyber-security precautions: you should always be willing to explore new systems and processes for the good of your entire enterprise.

When you have questions concerning cybersecurity threats, get in touch with our team and we will be happy to help.

Dangers of Cyberattacks as a Result of Source Code Leak

This past week, someone posted the source code of Apple iPhone operating system iOS on GitHub – a repository of open source code.

There was confusion at first as to whether the code was real or not. Apple indirectly confirmed that the code was real by filing a DMCA legal notice demanding GitHub to remove the source code. DMCA, which stands for Digital Millennium Copyright Act, is a takedown request that empowers owners of copyrighted material who believe their rights under U.S. copyright law have been infringed.

The iPhone source code called “iBoot” published on GitHub, Apple said "is responsible for ensuring trusted boot operation of Apple's iOS software." The company added, “The ‘iBoot’ source code is proprietary and it includes Apple's copyright notice. It is not open-source.”

Jonathan Levin, the author of a series of books on iOS and Mac OSX internals, told Lorenzo Franceschi-Bicchierai of Motherboard that the iBoot source code publication is the “biggest leak” in Apple's history.

A source code is a collection of computer instructions that’s written by a programmer when developing a software program. A software can either be open source or non-open source.

With an open source code, anyone can inspect or modify the code. With a non-open source code, the source code is hidden from the public and as such, only the software maker can make changes to the code.

Non-Open Source Code Leak

Apple and Microsoft are examples of companies that keep their products’ source code hidden from the public.

While most companies don’t allow outsiders to view and make modifications on their source code, they allow security researchers, also known as ethical hackers, to review their software, find security vulnerabilities and report this directly to the company to receive monetary reward, also called bounty.

Apple, through its bounty program, pays a maximum of $200,000 to someone who directly reports bugs or security vulnerabilities to the company.

Despite the takedown of the iPhone source code on GitHub, the source code has already made its way to dark web sites.

Access to non-open source code like the iBoot gives hackers a better chance of finding security vulnerabilities that could lead to cyberattacks.

EternalBlue Source Code Leak

On April 15, 2017, a hacker group calling itself the “Shadow Brokers” leaked the source of code of a number of hacking tools believed to be developed by the U.S. National Security Agency (NSA).

The source code of EternalBlue is one of those leaked by the hacker group. EternalBlue could allow remote code execution if a cyberattacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server.

WannaCry

The EternalBlue source code leak spawned devastating cyberattacks, the most notable of which was the WannaCry cyberattack. In May 2016, hundreds of thousands of computers around the world were infected with WannaCry, a malware that encrypts computer files, prevents users from accessing files and asks for ransom payment in the form of Bitcoin for the release of the decryption key to unlock the affected computer.

Adylkuzz

Adylkuzz is another malware that uses the EternalBlue source code. The purpose of Adylkuzz malware is to mine the cryptocurrency Monero. Similar to cryptocurrency Bitcoin, a Monero coin needs to be mined – a process by which a transaction is verified, added to the public ledger, known as the blockchain, and a means before a coin is released.

While cryptocurrency mining of Bitcoin can only be done on powerful computers, mining Monero can be done on regular computers and even on smartphones.

The Adylkuzz malware installs the Monero cryptocurrency miner called “cpuminer” on infected computers. Once the cpuminer is installed in a compromised computer, Monero cryptocurrency mining is conducted without the knowledge of the user. Cryptocurrency mining operation, however, will exhaust your computer CPU, resulting in slow performance.

Open Source Code Leak

With an open source code, anyone can inspect or modify the code. An open source is also known as a collaborative code. There are benefits in allowing other programmers to inspect and modify a source code. It’s a known fact that there’s not one software with a perfect source code. Allowing programmers to inspect and modify a source code can enhance and improve the code in the long run.

Linux is an example of an open source software. It’s an operating system similar to Windows and iOS. The difference between Linux and other operating systems is that it’s open source. The Linux source code is free and available to the public to view and, for users with the necessary skills, to contribute to the enhancement of the code.

While the publication of an open source code, on one hand, can be beneficial to society similar to the positive contribution of Linux, publication of an open source code with malicious intent can be detrimental to society.

Mirai Source Code Leak

The publication of the Mirai source code is an example of how a publication of a malicious open source code can be detrimental to society.

On September 30, 2016, a HackForum user by the name of “Anna-senpai” posted the source code of the malicious software called “Mirai”. The Mirai was responsible for the distributed denial of service (DDoS) attack on the website of cybersecurity journalist Brian Krebs on September 20, 2016.

On December 13, 2017, Paras Jha pleaded guilty in creating the Mirai and for conducting a series of DDoS attacks on the networks of Rutgers University between November 2014 to September 2016, which resulted in shutting down Rutgers University’s central authentication server – a gateway portal through which students, staff and faculty deliver assignments and assessments.

According to the U.S. Department of Justice, hundreds of thousands of IoT devices such as wireless cameras and routers were infected with the Mirai malware and were used "to conduct a number of powerful distributed denial-of-service, or ‘DDOS’ attacks, which occur when multiple computers, acting in unison, flood the Internet connection of a targeted computer or computers".

According to Imperva Incapsula, Mirai-infected IoT devices were spotted in 164 countries, appearing even in remote locations like Montenegro, Tajikistan and Somalia.

The publication of the Mirai spawned other DDoS attacks, the most notable of which was the attack on Dyn, a domain name service (DNS) provider which many websites rely upon. The DDoS attacks against Dyn resulted in temporarily shutting down popular websites like Amazon, Twitter, Netflix and even GitHub.

Dyn, in a statement, said, “We are able to confirm that a significant volume of attack traffic originated from Mirai-based botnets.” The company said that 100,000 IoT devices were infected with the Mirai malware to attack its DNS infrastructure.

In December 2017, the source code of the malware called “Satori”, a variant or new version of Mirai, was leaked on Pastebin. This Mirai variant particularly infects Huawei home router model HG532.

While the original Mirai malware infects IoT devices by using default usernames and passwords, Satori doesn’t need usernames and passwords. Security researchers at Qihoo 360 Netlab said, “The bot [Satori] itself now does NOT rely on loader/scanner mechanism to perform remote planting, instead, bot itself performs the scan activity. This worm-like behavior is quite significant.”

Security researchers at NewSky Security said that with the release of the full working code of the Mirai variant Satori, “we expect its usage in more cases by script kiddies and copy-paste botnet masters.”

Cybersecurity Best Practices

Here are some security best practices to protect your organization’s computers from the dangers of cyberattacks as a result of source code leak:

1. Use Supported Software

Supported software refers to a software whereby security updates are regularly issued by the software vendor.

Many fell victim to WannaCry for using Windows operating systems that Microsoft – the software vendor – no longer supports or no longer issues security updates.

2. Patch

A patch, also known as security update, is a piece of software code added to an existing source code that fixes security vulnerabilities.

WannaCry could have been prevented by simple patching or installing of the security update issued by Microsoft on March 14, 2017 – a month before the hacker group leaked the EternalBlue source code. Microsoft’s March 14, 2017 security update patches or fixes the security vulnerability exploited by EternalBlue. This security update was issued to supported Windows operating systems.

3. Use Latest Software Version

Many leaked source code are typically source code of older software version. Software vendors normally fix security vulnerabilities found in older software versions with the latest software version.

Interesting to note that Windows 10 proved to be resilient against Petya ransomware attack unleashed more than a month after the WannaCry attack. Similar to WannaCry, Petya exploited security vulnerabilities exploited by EternalBlue and EternalRomance – two hacking tools believed to be developed by the NSA and leaked by the hacker group Shadow Brokers.

4. Practice Network Segmentation

There are instances that security updates can’t be installed right away. One way to prevent or minimize the effects of a cyberattack is through network segmentation – a process of dividing computer network into subnetworks. With network segmentation, cyberattack on one subnetwork won’t affect the other subnetworks.

5. Have the Right DDoS Protection

Cybercriminals today don’t necessarily create their own attack tools. Some simply copy leaked source code. This is the case of DDoS-for-hire groups, a bunch of cybercriminals that offer DDoS service for a fee. There are available tools that effectively counter these DDoS attacks. Connect with us today and protect your business.

'Secure' Wi-Fi Standard Has Serious Security Flaws

Researchers from the University of Leuven in Belgium have discovered a series of serious wi-fi security flaws that essentially eliminate wi-fi privacy.

These series of wi-fi vulnerabilities collectively dubbed as “Krack”, short for key reinstallation attacks, can access data that was previously presumed to be safely encrypted. Krack attackers can steal wi-fi passwords, chat messages, emails, photos and other sensitive information. It’s also possible, depending on device use and the network configuration, for Krack attackers to inject malicious software like ransomware into websites.

The University of Leuven researchers, in their paper entitled “Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2” (PDF) said that “every Wi-Fi device is vulnerable” to Krack attacks.

"The weaknesses are in the Wi-Fi standard itself, and not in individual products or implementations,” lead researcher Mathy Vanhoef said.

Wi-Fi Alliance, a non-profit organization that promotes wi-fi technology and certifies wi-fi products, said, “Recently published research identified vulnerabilities in some Wi-Fi devices where those devices reinstall network encryption keys under certain conditions, disabling replay protection and significantly reducing the security of encryption.”

For its part, the International Consortium for Advancement of Cybersecurity on the Internet (ICASI), in a statement said, “Depending on the specific device configuration, successful exploitation of these vulnerabilities could allow unauthenticated attackers to perform packet replay, decrypt wireless packets, and to potentially forge or inject packets into a wireless network.”

ICASI members include Amazon, Cisco Systems, IBM, Intel Corporation, Juniper Networks, Microsoft Corporation and Oracle Corporation.

How Krack Works

For Krack to work, the attacker must be within the range of a victim. As proof-of-concept, lead researcher Vanhoef executed Krack attacks against wi-fi devices. Vanhoef was able to show that Krack not just steals login credentials – including email addresses and passwords – but all data that the victim transmits or sends was decrypted.

It’s also doable for Krack attackers, depending on the network setup and the device being used, to decrypt, not just data sent over wi-fi but also data sent towards the victim, for instance, the content of a website.

“Although websites or apps may use HTTPS as an additional layer of protection, we warn that this extra protection can (still) be bypassed in a worrying number of situations,” Vanhoef said. “For example, HTTPS was previously bypassed in non-browser software, in Apple's iOS and OS X, in Android apps, in Android apps again, in banking apps, and even in VPN apps.”

Krack is able to decrypt not just data sent over wi-fi but also data sent towards the victim by exploiting the vulnerabilities in the 4-way handshake of the Wi-Fi Protected Access 2 (WPA2) protocol.

The 4-way handshake is a 14-year-old technology that supposedly ensures wi-fi privacy by installing a fresh and unique encryption key that’ll be used to encrypt all subsequent traffic every time a device joins a protected wi-fi network.

Instead of installing a fresh and unique encryption key, Krack tricks the device into reinstalling an already-in-use encryption key. This is done by manipulating and replaying handshake messages. The researchers also found that Krack similarly exploits other wi-fi handshakes, including PeerKey handshake, the group key handshake and the Fast BSS Transition (FT) handshake.

As mentioned, Krack is a series of wi-fi vulnerabilities. This means that not just one wi-fi vulnerability is exploited by Krack. The Common Vulnerabilities and Exposures (CVE) – a dictionary of common names for publicly known cyber security vulnerabilities – list the following specific vulnerabilities related to Krack:

• CVE-2017-13077: Reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake.
• CVE-2017-13078: Reinstallation of the group key (GTK) in the 4-way handshake.
• CVE-2017-13079: Reinstallation of the integrity group key (IGTK) in the 4-way handshake.
• CVE-2017-13080: Reinstallation of the group key (GTK) in the group key handshake.
• CVE-2017-13081: Reinstallation of the integrity group key (IGTK) in the group key handshake.
• CVE-2017-13082: Accepting a retransmitted Fast BSS Transition (FT) Reassociation Request and reinstalling the pairwise encryption key (PTK-TK) while processing it.
• CVE-2017-13084: Reinstallation of the STK key in the PeerKey handshake.
• CVE-2017-13086: Reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake.
• CVE-2017-13087: Reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.
• CVE-2017-13088: Reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame.

According to Wi-Fi Alliance, there’s no evidence that Krack has been exploited maliciously in the wild.

How to Prevent Krack Attacks

To prevent Krack attacks, make sure to update your wi-fi device as soon as patch or security update becomes available. A security update ensures that an encryption key is only installed once, preventing Krack attacks.

Password change of your wi-fi network won’t stop Krack attacks. The only remedy is to apply the patch or security update of your wi-fi device as soon as it becomes available. It’s also important to update your router’s firmware. While it’s important to patch or apply the latest security updates of your wi-fi and router, it also pays to change the wi-fi password as a precaution.

According to Vanhoef, they notified wi-fi manufacturers about the Krack issue on July 14, 2017. They also notified the Computer Emergency Response Team Coordination Center (CERT/CC) – the world’s first computer emergency response team for internet security incidents. CERT/CC, in turn, issued a broad notification to wi-fi manufacturers on August 28, 2017 about this issue.

“We have released a security update to address this issue,” Microsoft spokesperson told The Verge. “Customers who apply the update, or have automatic updates enabled, will be protected. We continue to encourage customers to turn on automatic updates to help ensure they are protected.”

Windows updates released last October 10, according to Microsoft, addressed this issue. The company said it “withheld disclosure until other vendors could develop and release updates”.

“Wi-Fi Alliance now requires testing for this vulnerability within our global certification lab network and has provided a vulnerability detection tool for use by any Wi-Fi Alliance member,” the alliance said. “Wi-Fi Alliance is also broadly communicating details on this vulnerability and remedies to device vendors and encouraging them to work with their solution providers to rapidly integrate any necessary patches.”

Cryptocurrency Mining Malware: A Credible Threat

New Bluetooth Malware Puts Billions of Devices at Risk

Canadian University Loses $11.8 Million to BEC Scammers

Small and Medium-Sized Businesses Not Investing in Cyber Security