Tag Archives: ‘Risk

Okiru malware puts billions of connected devices at risk

A new variant of the Mirai malware puts ARC processors at risk of being exploited.

The Mirai variant, known as Okiru, is the first malware that is able to infect Argonaut RISC Core (ARC) processors, according to a researcher known as unixfreaxjp at the malware security group MalwareMustDie.

ARC processors are used in a wide range of internet-of-things (IoT) devices, such as cellphones, televisions, cameras and cars.

It’s thought that there are approximately 1.5 billion devices worldwide with ARC processors in them that could be vulnerable to Okiru.

In 2016, Mirai malware was used to create a botnet of 100,000 IoT devices that caused a series of problems, such as shutting down domain name system (DNS) provider Dyn.

However, in a tweet, security researcher Odisseus warned that Okiru could have a bigger impact than Mirai.

“The landscape of Linux IoT infection will change,” Odisseus said.

A Mirai malware variant called Satori, which was uncovered in December 2017, took down hundreds of thousands of Huawei routers. Satori was also sometimes called Okiru, but the two have significant differences, according to Security Affairs’ Pierluigi Paganini.

Okiru’s configuration is different because it “is encrypted in two parts,” but Satori’s is not, Paganini wrote in a blog post. “Also Okiru’s telnet attack login information is a bit longer,” Paganini explained, noting that the login information can be up to 114 credentials, but Satori has a “different and shorter database.”

At the time of this writing, the detection ratio on VirusTotal was 29-58. When Odisseus tweeted about the botnet threat earlier this week, it was only at 5-60.

In other news:

  • Google launched a new tool for enterprise security called G Suite Security Center. The tool will be available to G Suite Enterprise users and is automatically accessible in the admin console. In a blog post, Google stated the three objectives of the security center are to show a “snapshot” of security metrics, to help enterprises stay ahead of security threats and to recommend ways for enterprises to improve their security posture. “We want to make it easy for you to manage your organization’s data security,” Google product managers Chad Tyler and Reena Nadkarni wrote in a blog post. “A big part of this is making sure you and your admins can access a bird’s eye view of your security — and, more importantly, that you can take action based on timely insights.” The security center will consist of a dashboard that shows the security metrics and the “security health” recommendations.
  • A team of researchers discovered a way to hack the Android Pixel phone. The exploit involves combining two separate vulnerabilities. The first, which Google patched in September 2017, is a type confusion flaw in the V8 open source JavaScript engine. The second vulnerability is a privilege escalation flaw in Android’s libgralloc module. Google patched that one in December 2017. However, security researchers were able to exploit both vulnerabilities to inject arbitrary code into the system_server process. All they had to do to make the exploit successful was get the targeted user to click on a malicious link in Chrome. The research team received a total of $100,000 from Google for the find, through both the Android Security Rewards program and the Chrome bug bounty program.
  • The Internet Systems Consortium (ISC) put out a security advisory warning of a vulnerability in the Berkeley Internet Name Domain (BIND) DNS software. The vulnerability, with severity ranked “high,” was remotely exploitable and reportedly caused some DNS servers to crash. “BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts, leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named,” ISC said in its advisory. The vulnerability was found in BIND versions 9 and later, but not in earlier versions, so the ISC advised users to upgrade to the latest version. There have been no known active exploits, but the advisory stated that “crashes due to this bug have been reported by multiple parties.”

The Bitcoin boom and its infosec effects

Listen to this podcast

In this week’s Risk & Repeat podcast, SearchSecurity editors discuss the recent bitcoin boom and how the cryptocurrency’s rising value could affect the cybersecurity landscape.

The bitcoin boom that saw a dramatic rise in the cryptocurrency’s value in recent weeks could have big implications for information security.

In the last month, the price of a single bitcoin tripled, jumping from approximately $5,700 to more than $17,000. A number of factors, including interest in the opening of the first regulated bitcoin futures exchanges and a hard fork in the cryptocurrency, could be contributing to the bitcoin boom beyond a general increase in buying and selling volumes.

But the surge also comes at a time of rampant global ransomware attacks, many of which demand payment from victims in bitcoin. While some enterprises have disclosed ransomware attacks, experts generally believe that many more attacks are kept quiet.

Could cybercriminals and ransomware attacks be contributing to the bitcoin boom? What will the rising price of the cryptocurrency mean for the cybercrime economy? Will the high value of bitcoin lead to more cyberattacks on bitcoin owners and exchanges, like NiceHash, which recently lost approximately $80 million in bitcoin following a massive data breach?

SearchSecurity editors Rob Wright and Peter Loshin discuss those questions and more on the bitcoin boom in this episode of the Risk & Repeat podcast.

Analyzing the accidental data breach

Listen to this podcast

In this week’s Risk & Repeat podcast, SearchSecurity editors discuss the rise of accidental data breaches following a series of enterprise exposures of user data online.

Data breaches are so common these days that some of them don’t even include threat actors or malware of any kind.

Troy Hunt, security researcher and creator of the website HaveIbeenpwned.com, recently testified before Congress in a hearing titled “Identity Verification in a Post-Breach World,” in which he discussed how organizations are often committing accidental data breaches. Such incidents typically involve enterprises mistakenly making corporate or user data public on the internet through cloud services, web services and other technologies.

Hunt’s testimony comes on the heels of a number of accidental data breaches via Amazon Web Services (AWS); several organizations, including the NSA and U.S. Army, have exposed sensitive data through misconfigured instances of AWS’ Simple Storage Service. More recently, Kromtech Security Center revealed that mobile app developer Ai.type exposed more than 370 million personal records of users, including, in some cases, users’ contact lists, through a misconfigured MongoDB database.

During the congressional hearing last week, Rep. Morgan Griffith (R-Va.) asked Hunt why these accidental breaches keep happening. “Is it really that easy to accidentally share your cloud services with the world?” Griffith asked.

“The simple answer to the last question is, yes, it is that easy,” Hunt said. “It’s very often just a simple misconfiguration.”

Why are enterprises committing so many accidental breaches? Do these incidents reflect a lack of security competency? Should cloud providers and software developers do more to protect customers from making these types of errors? SearchSecurity editors Rob Wright and Peter Loshin discuss those questions and more in this episode of the Risk & Repeat podcast.

Sale of Symantec Website Security completed

Listen to this podcast

In this week’s Risk & Repeat podcast, SearchSecurity editors discuss the sale of Symantec Website Security to DigiCert and what it means for Symantec’s troubled certificate business.

DigiCert Inc.’s acquisition of Symantec Website Security was completed last week, but concerns in the browser community still remain about Symantec’s SSL certificates.

DigiCert agreed to acquire the Symantec Website Security division, which includes the vendor’s public key infrastructure (PKI) business, in August, following months of negotiations between Symantec and web browser giants Google and Mozilla regarding widespread issues with the security vendor’s certificate authority. Those issues included certificate mis-issuance and a lack of proper auditing, which led Google and Mozilla to propose a removal of trust for certificates issued by Symantec Website Security.

After tense negotiations and delays, Symantec ultimately agreed to a remediation plan that would turn over its SSL certificate operations to another trusted certificate authority that would oversee issuance and validation. Instead of choosing a third-party partner, Symantec agreed to sell its PKI business to DigiCert.

However, Mozilla expressed concerns that Symantec’s old PKI operations, as well as its culture and processes, would continue to operate despite DigiCert assuming ownership of the business — DigiCert has said that all Symantec certificates will be issued and validated by DigiCert’s PKI by Dec. 1.

Questions still remain about how DigiCert will address the systemic problems within the Symantec Website Security division and when they will be resolved. SearchSecurity editors Rob Wright and Peter Loshin discuss those questions and more in this episode of the Risk & Repeat podcast.

Risk & Repeat: Is vulnerability marketing problematic?

Listen to this podcast

In this week’s Risk & Repeat podcast, SearchSecurity editors discuss vulnerability marketing and compare how the recent KRACK attack and ROCA flaw were publicized and promoted.

Should security vulnerabilities be marketed like products? That was the question after two major security flaws brought to light last week — the KRACK attack and the ROCA flaw — offered a contrast in the practice of vulnerability marketing.

While the KRACK attack, which exploits a vulnerability in the WPA2 protocol, received more marketing and media attention, some infosec experts argued the ROCA flaw, which affects RSA encryption in Infineon Technologies chips, was equally, if not more serious than KRACK.

Both vulnerabilities were discovered primarily by security researchers at universities, not by vendors. Yet, ROCA appeared to have taken a backseat to the KRACK attack; the latter discovery benefited from vulnerability marketing efforts, which included a dedicated website and promotional efforts to raise awareness of the WPA2 flaw.

What are the potential drawbacks of vulnerability marketing? Should the researchers that discovered the ROCA flaw have done more to promote their findings, or is the infosec community treating vulnerabilities too much like products? SearchSecurity editors Rob Wright and Peter Loshin discuss those questions and more in this episode of the Risk & Repeat podcast.

Risk & Repeat: Kaspersky ban turns ugly

Listen to this podcast

In this week’s ‘Risk & Repeat’ podcast, SearchSecurity editors discuss the U.S. government’s Kaspersky ban and how competitors like McAfee are trying to capitalize on it.

The ongoing controversy surrounding the U.S. government’s ban on antivirus vendor Kaspersky Lab took another ugly turn, thanks to a competitor.

Last week, it was revealed that McAfee, formerly Intel Security, was using the Kaspersky ban to promote its McAfee Total Protection software. Specifically, the promotion highlighted the fact that McAfee is headquartered in the U.S., while Kaspersky is based in Russia. It also included an inflammatory headline, which claimed, “FBI advises removal of Kaspersky for suspected ties to Russia spies.” McAfee has since changed the promotion page, but not before Kaspersky Lab CEO Eugene Kaspersky criticized the vendor’s actions on Twitter.

The Kaspersky ban came amid investigations regarding the Russian government’s alleged interference in the 2016 presidential election. While there’s no evidence of wrongdoing, the Department of Homeland Security this month ordered every federal agency to remove Kaspersky products from their systems within 90 days.

Should antivirus competitors try to capitalize on the Kaspersky ban? Was McAfee’s approach out of line? Is Kaspersky being treated unfairly by the U.S. government? SearchSecurity editors Rob Wright and Peter Loshin discuss those questions and more in this episode of the Risk & Repeat podcast.