How do you manage password security?

More than half of IT executives surveyed rely on employees alone to monitor their own password behavior, subsequently leaving the company at risk, shining a light on the disconnect between IT policy and human behavior.

The report, for which Ovum surveyed hundreds of IT executives and corporate employees globally, found that 78 percent of IT executives lack the ability to control access to the cloud-based applications used by their employees. Most companies are aware of this lack of visibility and control, yet the majority are not doing enough, if anything at all, to address the situation.

The study also revealed that 76 percent of employees say they experience regular password usage problems and more than a third of users need password-related help desk support at least once every month. At the same time, nearly three-quarters said they would want to use a tool to help store and access passwords without needing to remember each one if their company offered a solution.

Organizations are leaving holes in their security

A lack of control puts excessive reliance on end users. 61 percent of IT executives surveyed rely exclusively on employee education to enforce strong passwords. Employees are essentially on their own, with no technology in place to enforce any password strength requirement.

Outdated manual processes still prevail. IT executives at four in ten companies surveyed still rely on entirely manual processes to manage user passwords for cloud applications.

Defense against password sharing is far too weak. When asked how they guard against unnecessary password sharing, 64 percent of IT execs surveyed had no technology in place, and only 14 percent had automated control facilities in place to know when it is happening.

Weak password systems put users and businesses at risk. More than three-quarters of employees reported that they regularly have problems with password usage or management. Password usage problems are exacerbated by the lack of single sign-on (SSO) in many organizations. In fact, 56 percent of the organizations surveyed did not have SSO available.

Close the password security gap

“This research has clearly identified an urgent need to close the password security gap,” said Andrew Kellett, Principal Analyst, Infrastructure Solutions at Ovum. “Far too many organizations are leaving the responsibility for password management to their employees and don’t have the automated password management technology in place to identify when things are going wrong.”

“In many cases, an organization’s password management practices are overly reliant on manual processes and far too often place an excessive level of trust in employees to use safe password practices,” said Matt Kaplan, GM of LastPass. “The threat posed by human behavior coupled with the absence of technology to underpin policy is leaving companies unnecessarily at risk from weak or shared passwords. Organizations need to focus on solving for both obstacles in order to significantly improve their overall security.”

Source: helpnetsecurity

The post Leaving employees to manage their own password security is a mistake appeared first on UCG Bolg.

As Stuff New Zealand reports, it was only because of the careful eye of Kathryn Walker, the general manager of Marlborough Vintners (who – notably – previously had a 12-year career in commercial banking), that something amiss was noticed in the email received from supplier Annie Giles.

You see Annie Giles is described by Walker as “quite an exuberant person”, reflecting the sunniness of wine-growing Marlborough, located in the northeast of New Zealand’s South Island.

What does Walker mean by describing Annie as “exuberant”? Well, she means that Annie typically peppers her email communications with smiley faces and jolliness.

And yet the email “Annie” had sent to Marlborough Vintners, informing them that her bank account had been “put under review” and that payment would need to be made into a different account, had none of that.

The formal language used in the message, the fact that a partner had not been copied on the email, and the lack of a smiley at the end of the email, rang alarm bells that it couldn’t have been the real Annie who had sent it.

The truth was that hackers had compromised Annie’s email account, snooped on her past business communications, and attempted to trick a company (Marlborough Vintners in this case) into paying money into a crooked account.

Police continue to investigate the case.

Many companies would not have been as lucky as Annie and Graeme Giles, and payments intended for them could have been sent to bank accounts under the control of criminals. As we have previously described, such scams can cost companies many millions of dollars.

Indeed, last year the FBI reported that companies had been stung to the tune of US $3 billion as a result of business email compromise attacks and that there had been a 1300% increase in identified losses since January 2015.

The problem, if anything, has got even worse since then.

With October being National Cyber Security Awareness Month (NCSAM) there has never been a better excuse for finally tightening your company’s email security.

As a minimum, harden your email defences by ensuring that you use unique, hard-to-crack passwords and enable multi-factor authentication on your accounts.

More advice for implementing a password security policy in the workplace can be found in this article we published last year.

Source: tripwire

The post How a missing smiley foiled a $70,000 email fraud appeared first on UCG Bolg.

In any case, it’s crucial that the content corresponds exactly to the original. After all, what good is it to fiddle with your development version if the changes don’t translate to the live site?

Of course, you can clone your WordPress site manually. Generally speaking, this usually involves the following steps:

• Copying your files and database
• Uploading both to the new location
• Updating the database references
• Editing wp-config to fit the new environment

Let’s be honest, though Migrating a site manually can be fiddly and you risk messing things up.

If you want to avoid the hassle and cut down on the amount of time it takes to move a site, there are plenty of plugin options that make migration a piece of cake. UCG Development Team recommend “DUPLICATOR” plugin.

WordPress Duplicator

There’s a lot of love for this free plugin, which allows you to duplicate, clone, backup, move and transfer an entire site from one place to another.

How Dose it Work

Duplicator creates a package that bundles all the site’s plugins, themes, content, database and WordPress files into a simple zip file called a package. This package can then be used to easily migrate a WordPress site to any location you wish. Move on the same server, across servers and pretty much any location a WordPress site can be hosted. WordPress is not required for installation since the package contains all site files.

During setup, you can configure what should and shouldn’t be included in the archive, and include all necessary information for the site’s new location in the installer file. Doing this will automatically populate the wp-config.php with the values of the new host.

After configuration, a backup of your site is created with just two clicks. You can download both files directly at the end of the process or find them inside the wp-snapshots folder in your WordPress installation.

Redeployment of the site is just as simple as creating the package was. All you need to do is upload both the installer and package files to the new location of your site, and access the installer.php file via your browser. The installation will then let you either create a new database or connect your site with an existing one.

Lastly, Duplicator will also give you a report on possible problems and point out a few other points to note, such as updating your permalinks and cleaning up temporary files.

After moving you website you can follow our WordPress Security Checklist

Price: Free

Official Site: Duplicator

The post Best Plugin to Clone/Duplicate a WordPress Website appeared first on UCG Bolg.

This includes new URLs where the user might be navigating to, but also search terms that IE automatically handles via a Bing search. Users copy-pasting URLs for Intranet pages inside IE would likely see this bug as a big issue.

The bug, spotted by security researcher Manuel Caballero, poses a privacy risk, as it could be used in reconnaissance operations in targeted attacks, but also for data harvesting by online advertisers.

Bug is easy to exploit

The bug occurs when IE loads a page with (1) a malicious HTML object tag and (2) features the compatibility meta tag in its source code. Both conditions are quite easy to meet.

Condition one: Attackers can hide malicious HTML object tags in hacked sites or load it via ads that allow advertisers to load custom HTML and/or JavaScript code.

Condition two: X-UA-Compatible is a document mode meta tag that allows web authors to choose what version of Internet Explorer the page should be rendered as. Almost all sites on the Internet have a compatibility meta tag.

Bug occurs because IE gets confused

According to Caballero, when JavaScript code runs in the malicious object HTML tag, “the location object will get confused and return the main location instead of its own.”

In layman’s terms, this means the malicious object HTML tag — which can be loaded and hidden inside a page — will have access to resources and information previously available to the main browser window.

In a technical write-up of the bug, Caballero says the malicious object can then “retrieve the location.href of the object while the user is leaving the main page,” allowing an attacker to “know what [the user] typed into the address-bar.”

Caballero has not reported the bug to Microsoft. Bleeping Computer has reached out to Microsoft for comment.

Previously, Caballero also discovered a bug in Internet Explorer that allows malicious JavaScript code to persist and keep running in the browser’s background even if the user has closed the malicious page’s tab. This bug is could be abused by malvertising campaigns to deliver cryptocurrency miners that utilize a user’s computational resources to mine Monero long after the user has visited a malicious site, causing the user’s computer to slow down and a premature wear of the user’s processor.

In addition, Caballero has also discovered lots of security bugs in Microsoft’s newest browser, Edge [1, 2, 3, 4], some of which Microsoft addressed, but others didn’t.

Source: bleepingcomputer

The post Internet Explorer Bug Leaks What Users Type in the URL Address Bar appeared first on UCG Bolg.

What has happened since? On top of many more malware families entering the landscape – something that was expected in these cases – there is one new development we forecast that unfortunately has come to pass: Attackers have started infecting ATMs with malware through the network. Five distinct incidents of network-based ATM malware attacks have already been reported in the media, and we believe this to be significant because it shows how cybercriminals have had ATMs firmly in their crosshairs.

As with physical ATM malware attacks, stealing cold, hard cash isn’t the sole objective of cybercrooks in targeting ATMs through the network. Looking to squeeze out their victims for as much as possible, these criminals could also compromise bank customer data and subsequently steal money in the form of ones and zeroes — making the malware act like a virtual skimming device.

A Stealthier Way in – Attacking Through the Network

Gaining access to banks’ networks and successfully installing ATM malware would mean that criminals don’t have to go to the machines anymore. They simply have money mules on-site and at the ready to collect the money for them and go.

However, network infections require more work and technical knowledge on the attackers’ side, compared with the more common approach of gaining physical access to ATMs. The complication lies in actually being able to access the ATM network from the main bank’s network.

In a well-planned network architecture, the ATM network and the bank’s main network should be separated. This way, having access to one would not mean gaining admission to the other network. Having access to both networks would ideally involve bypassing firewalls and other security protocols in place.

Unfortunately, not all banks implement network segmentation. Some reported incidents have even demonstrated how, despite the two networks being separated, criminals could establish a solid foothold in a bank’s main network and use it to install malware on the bank’s ATMs.

Based on our observation of the different known network-based attacks, criminals infiltrate banks’ networks through ways as simple as sending phishing emails to bank employees. Once in, they perform lateral movement to identify and access subnetworks, including the ATMs.

One of the most noteworthy network-based attacks involves Ripper, the first known ATM malware that uses the network as an infection vector. Targeting ATMs made by three of the major ATM manufacturers, the malware was responsible for the attacks against thousands of ATMs in Thailand in 2016. Ripper has jackpotting capabilities, allowing it to dispense cash from ATMs in large quantities to the point of emptying the machines. Another insidious feature of this malware is that it can self-destruct, removing any incriminating traces of its activity in the operating environment and making post-infection forensics difficult.

Source: trendmicro

The post An Elaborate ATM Threat Crops Up: Network-based ATM Malware Attacks appeared first on UCG Bolg.

The websites Showtime.com and iShowtimeAnytime.com silently injected in the visitors’ browser the code to abuse processor capabilities to mine Monero coins. The hidden code typically consumed as much as 60 percent of the overall CPU capacity on computers while visiting the sites.

The scripts were written by Code Hive, an outfit that develops legitim JavaScript codes that could be added by webmasters to their sites in order to generate revenue as an alternative to serving advertising.

The money mined by the scripts are managed by Code Hive and paid to the website owners.

The CBS case appears very strange, it is unlikely that the entertainment corporation has placed the mining code onto its websites because it already charges subscribers to watch the TV shows online.

It is possible that hackers compromised the website to deploy the mining JavaScript code and remove it before it was discovered, the script, in fact, worked during the weekend and disappeared on Monday.

I sincerely found also this hypothesis very strange, in my humble opinion an attacker that succeed in compromising a site like the CBS one could be more interested in delivering malware to its visitors and cash out its effort in another way.

The code was found between HTML comment tags used by the analytics firm New Relic, but it is unlikely the company would deliberately insert it.

New Relic told El Reg that the code was not deployed by its experts.

“We take the security of our browser agent extremely seriously and have multiple controls in place to detect malicious or unauthorized modification of its script at various points along its development and deployment pipeline,” states the company.

“Upon reviewing our products and code, the HTML comments shown in the screenshot that are referencing newrelic were not injected by New Relic’s agents. It appears they were added to the website by its developers.”

Of course, Code Hive knows who is behind the account linked to the mining code, but it doesn’t want to reveal it according to its privacy policy.

“We can’t give out any specific information about the account owner as per our privacy terms,” the outfit informed us. “We don’t know much about these keys or the user they belong to anyway.”

Source: securityaffairs

The post CBS Showtime website was spotted mining cryptocurrency in viewers’ web browsers appeared first on UCG Bolg.

On Monday, researchers from Trend Micro said the vulnerability, traced as CVE-2016-5195, has been discovered in a malware sample of ZNIU — detected as AndroidOS_ZNIU — and this is the first malware sample to contain an exploit for the flaw.

Dirty Cow was publicly disclosed back in 2016. The vulnerability has been present in the kernel and Linux distributions for years and permits attackers to escalate to root privileges through a race condition bug, gain access to read-only memory, and permit remote attacks.

“Dirty COW attacks on Android has been silent since its discovery, perhaps because it took attackers some time to build a stable exploit for major devices,” the company said.

In a blog post, Trend Micro researchers Jason Gu, Veo Zhang, and Seven Shen said ZNIU was present in at least 40 countries last month, with the majority of victims found in China and India.

Individuals in the US, Japan, Canada, and Germany, among others, have also been targeted.

Trend Micro’s analysis of the integration of Dirty Cow with ZNUI led to the discovery of over 1,200 malicious Android apps with the malicious code embedded within, alongside host websites containing rootkits that exploit Dirty Cow. Some of these apps disguised themselves as pornography or game-related software.

Over 5,000 users so far have been affected.

When left unpatched, the Dirty Cow vulnerability impacts all versions of the Android OS, while ZNIU’s Dirty Cow exploit only affects Android devices running on ARM/X86 64-bit architecture.

However, the recent exploit can also bypass SELinux and fashion backdoors.

“We monitored six ZNIU rootkits, four of which were Dirty COW exploits,” the team says. “The other two were KingoRoot, a rooting app, and the Iovyroot exploit (CVE-2015-1805). ZNIU used KingoRoot and Iovyroot because they can root ARM 32-bit CPU devices, which the rootkit for Dirty COW cannot.”

ZNIU often appears as a porn app downloaded from illegitimate websites. Once launched, the malware connects to its command-and-control center (C&C) to check for code updates, while simultaneously implementing Dirty Cow to try and utilize local privilege escalation to gain root access, bypass system restrictions and plant a backdoor.

This, in turn, could be used by attackers to infiltrate the device remotely.

The malware also harvests user information, such as the carrier in use, and will attempt to send payments through premium SMS messages to a dummy company in China.

After these messages are sent, they are deleted from the device. The operators behind the malware intentionally set each transaction as a small amount to try and avoid being spotted.

“If the carrier is outside China, there will be no possible SMS transaction with the carrier, but the malware will still exploit the system to plant a backdoor,” Trend Micro says.

In December last year, Google issued a security update to fix the security flaw, although it is up to vendors as to when to provide these security updates to their own handsets.

Google has been made aware of the malware’s latest weapon and has confirmed that Google Play Protect protects against the malware. Downloading apps from third-party sources is generally a risk and should be treated with caution.

The post Dirty Cow vulnerability discovered in Android malware campaign for the first time appeared first on UCG Bolg.

While this – now not so new – solution has made things much simpler for small and large companies alike, it has also led to new discussions and considerations about security.

If you have migrated your services and information to the cloud, or are thinking of doing so, here are a few considerations to keep in mind that could help you avoid a bad experience.

1. Know your service provider

With so many cloud computing services on the market these days, the first step is deciding who to entrust with your company’s information and systems.

To make this decision, it isn’t enough merely to consider which services and platforms the various providers offer; rather, it is also important to take into account their reputation and to carefully read the terms of their contract. Is the company responsible with the information it handles? What security measures do they apply? Do they have security certifications? Have they had any incidents? If so, how did they handle them?

A more prestigious company’s services may be more expensive than those of a smaller, less known company. However, we need to be aware that the maintenance tasks involved in keeping an infrastructure secure, requires time and energy, and this often translates into a higher cost for the customer. Remember, when it comes to security, what appears to be cheap can turn out to be very costly.

2. Understand your business and your needs

We have applied this tip to countless circumstances: Designing a security policy, certification of a standard, backup models, and the implementation of new technologies. The point is, before you make any important decision, you always have to think about how it will affect your business, and consider what your company’s goals are.

If you need a fast connection without lag or latency between your office and the cloud services, you could be in for some disappointment. Perhaps the ability to store files in the cloud and access them from anywhere is a tempting solution, but if we are talking about database queries, the response time could have an impact on your business.

If you deal with large volumes of information in real time, it may be worth considering an optimization option before taking those services to the cloud.

3. Encrypt your information

Encrypt data stored in the cloud as well as data in transit; basically, encrypt everything that can be encrypted! While this may require extra effort and increase the complexity of operations, what is certain is that doing so adds an additional layer of security to all your confidential information.

Remember that if you decide to take out services in the cloud and deposit your data there, you will also be delegating, to a large extent, the protection of this information. As secure and reliable as a provider might be, it is not a good idea to be completely dependent on one, and it is never overdoing it to encrypt critical data so that, in the event of a security breach, the data is not exposed.

4. Control access to the cloud

Although your data and applications may no longer be located physically within your organization, it does not mean you can simply wash your hands of all management tasks. Your service provider may supply you with an array of security controls, and keep the infrastructure protected, but if you leave the door open, it will all be in vain.

Restrict access to the information, just as you would if it were located within your organization. Segregate functions and restrict user connections. In fact, it is highly recommended to use extra protection measures like two-factor authentication when starting a session on a cloud-based platform.

5. Back up your information

Today, backups are one of the most basic and fundamental protective measures in any security system. While this service tends to be included in the contract and forms part of the tasks performed by the provider, we must remember that it is not only a matter of safeguarding the information — but also of being able to recover it.

For this reason, it is recommended that you regularly restore the backed-up information. This way, not only will you be able to check that the provider is fulfilling this aspect of the contract, but also that the information will be complete and available when you need it.

6. Read the terms and conditions of service carefully
Pay special attention to the sections that talk about the handling of information, and about privacy and liability with regard to the information you store on the cloud. You would not be the first to come across phrases like: “You give us the right to access, retain, use, and divulge information from your account and your files for the purpose of providing you with support and resolving technical problems” or “We do not guarantee that your files will not be subject to misappropriation, loss or damage, and we will not be held liable if this should happen.”

Also check the response times and SLA (Service Level Agreement) promised by the provider and ensure that they are within the time frames and commitments you have with your customers. Avoid having these surprises crop up when an incident occurs, or when you make a complaint.

7. Remember: The cloud can get infected too

It is a common mistake to think that malware cannot affect equipment in the cloud. In fact, we have seen a number of variants of the Crisis malware, which infects equipment running VMWare systems. Just as there is malicious code out there that is designed for attacking virtualization platforms, like Venom, we also need to take into account the known threats that continue to spread through operating systems.

Having your infrastructure in the cloud does not exempt you from the need to use a good comprehensive security solution that includes protection for servers and services, as well as for the hardware which accesses that infrastructure.

Of course, the cloud can offer great advantages for your company, and it will depend on your individual business when it comes to the type of services and information you decide to migrate to this platform. Whatever your circumstances may be, don’t forget these tips to keep your information protected and to make your migration as secure as possible.

The post Cloud services: What to consider when migrating your infrastructure appeared first on UCG Bolg.

The Kromtech Security Center recently found over half a million records belonging to SVR Tracking, a company that specializes in “vehicle recovery,” publicly accessible online. SVR provides its customers with around-the-clock surveillance of cars and trucks, just in case those vehicles are towed or stolen. To achieve “continuous” and “live” updates of a vehicle’s location, a tracking device is attached in a discreet location, somewhere an unauthorized driver isn’t likely to notice it.

According to SVR’s website, the tracking unit provides “continuous vehicle tracking, every two minutes when moving” and a “four hour heartbeat when stopped.” Basically, everywhere the car has been in the past 120 days should be accessible, so long as you have the right login credentials for SVR’s app, which is downloadable for desktops, laptops, and almost any mobile device.

Kromtech discovered SVR’s data in a publicly accessible Amazon S3 bucket. It contained information on roughly 540,000 SVR accounts, including email addresses and passwords, as well as some license plates and vehicle identification numbers (VIN). There were half a million records overall, Kromtech said, “but in some cases credentials were given for a record with several vehicles associated with it.”

The SVR passwords were stored using a cryptographic hash function (SHA-1), though one that’s 20 years old and with known weaknesses. Simple passwords stored using this function are likely to be cracked with ease. The CynoSure team, for example, recently announced having cracked all but 116 SHA-1 hashes from a batch of over 319 million passwords released in hash form by Troy Hunt, founder of the website Have I been pwned?

As usual, it’s difficult to say for how long exactly the data was actually exposed. In the case of Amazon S3 buckets, only Amazon and the bucket’s owner can say for sure, and normally that’s not information either is willing or eager to share.

“The overall number of devices could be much larger given the fact that many of the resellers or clients had large numbers of devices for tracking,” said Kromtech’s Bob Diachenko. “In the age where crime and technology go hand in hand, imagine the potential danger if cyber criminals could find out where a car is by logging in with the credentials that were publicly available online and steal that car?”

The leak further exposed 339 logs containing a wide range of vehicle records, including images and maintenance records, as well as documents detailing contracts with more than 400 car dealerships that use SVR’s services.

Kromtech said it first spotted the data online on September 18th. It took roughly a day for the researchers to determine to whom it belonged. SVR was then notified on September 20th and within a few hours the server was locked down. The company did not actually respond to Kromtech, however, nor did it respond this morning when Gizmodo asked for a comment. We’ll update if it does.

Earlier this month, Kromtech discovered about four million records containing personally identifiable information of Time Warner Cable customers. That leak was also traced back to an unsecured Amazon S3 bucket. In another breach, unrelated to Amazon, Kromtech discovered more than 88,600 credit cards, passport photos, and other forms of ID exposed online. In May, the company announced the discovery of a massive trove of more than 560 million login credentials thanks to one misconfigured database.

Source: gizmodo

The post Passwords to Over a Half Million Car Tracking Devices Leaked Online appeared first on UCG Bolg.

CoinDash Funds Returned by Hacker

In cryptocurrency, there have been plenty of incidents involving hacks and scams. In virtually every case, the stolen money is never returned to its rightful owner. That is not entirely surprising, as most hackers can successfully steal millions of dollars without too many repercussions. Converting stolen money to cash or other forms of ready-to-use money is often quite difficult, though.

Given the transparency of most cryptocurrencies, anyone can follow blockchain-based transactions in real time without dedicated software. In the case of the CoinDash ICO, the 44,000 ETH theft was tracked to a fake address pretty quickly. Unlike what most people would come to expect, the funds were apparently not converted to fiat or otherwise used.

Instead, the CoinDash team claims that an unknown assailant returned portion the money to them without any additional problems or demands. That was a very unusual resolution, considering 10,000 ETH has a value of around US$3 million right now. It does not make any sense for a hacker to part with some or all of his or her stolen money willingly and return it to the rightful owner. Nor does it appear any white hat hackers were involved in the process of recovering money. It is a very unusual situation, to say the least.

It does appear 488 ETH was converted using ShapeShift a while ago. The remaining 10,000 ETH were simply sent back to one of CoinDash’s Ethereum wallets. This is pretty unexpected and it raises a lot of questions as to why the hacker returned the money in the first place. Some people will question this “hack” in the first place, considering such a happy ending would not occur under normal circumstances. The transaction ID is there for everyone to see, though.

Converting such a large amount of Ether to any other currency will attract a lot of attention. It is not something one can just sell on an exchange and get away with. All exchanges perform thorough Know Your Customer (KYC) verification, which would allow them to link one’s identity to a theft such as this one. That is not something any hacker wants to risk, for obvious reasons. Then again, just returning the money without any official explanation is pretty gutsy regardless.

One could say the CoinDash team successfully dodged a major bullet now that a small portion of the money has been returned. After all, losing around US$3 million worth of funds could effectively cripple an ICO. Thankfully, the team can now go ahead with their project in an effort to revamp the cryptocurrency trading industry. It remains to be seen if CoinDash will be successful, though things could get very interesting over the coming months.

Source: themerkle

The post CoinDash ICO Hacker Returns 10,000 Ether Without Any Demands appeared first on UCG Bolg.