Malware Devil

Enterprise Database Strategies for 2020

More Insights

Webcasts

Why Performance Testing is More Critical Today

White Papers

A Guide to the Iranian Threat Landscape

The Threat from the Internet–and What Your Organization Can Do About It

Reports

The State of IT Operations and Cybersecurity Operations 2020

https://www.malwaredevil.com/2020/08/03/11-hot-startups-to-watch-at-black-hat-usa-2/?utm_source=rss&utm_medium=rss&utm_campaign=11-hot-startups-to-watch-at-black-hat-usa-2

🔴 LIVE: SWVHSC: Application Security Weekly #117

This week, on our special Security Weekly Virtual Hacker Summer Camp edition of Application Security Weekly, we welcome Mike Rothman from DisruptOps, and we round the show out with the Application Security News

→Full Show Notes & Schedule: https://securityweekly.com/asw117

→Join the Security Weekly Discord Server: https://discord.gg/pqSwWm4
→Visit our website: https://www.securityweekly.com
→Follow us on Twitter: https://www.twitter.com/securityweekly

https://www.malwaredevil.com/2020/08/03/%f0%9f%94%b4-live-swvhsc-application-security-weekly-117/?utm_source=rss&utm_medium=rss&utm_campaign=%25f0%259f%2594%25b4-live-swvhsc-application-security-weekly-117

11 Hot Startups to Watch at Black Hat USA

A sneak peek at the up-and-coming organizations to check out on the Black Hat USA virtual show floor.

1 of 12

(Image:

Rawpixel.com — stock.adobe.com)

1 of 12

DevOps: Innovating with Speed, Security, and Quality

More Insights

Webcasts

White Papers

CyberSecurity Trends 2020

The Threat from the Internet–and What Your Organization Can Do About It

Reports

2019 Threat Hunting Report

Expert led sessions and real networking – Join us at Data Center World 2020: A Virtual Experience
Collaborate With IT Industry Leaders at Interop Digital, Oct. 5-8

https://www.malwaredevil.com/2020/08/03/11-hot-startups-to-watch-at-black-hat-usa/?utm_source=rss&utm_medium=rss&utm_campaign=11-hot-startups-to-watch-at-black-hat-usa

Robocall Legal Advocate Leaks Customer Data

A California company that helps telemarketing firms avoid getting sued for violating a federal law that seeks to curb robocalls has leaked the phone numbers, email addresses and passwords of all its customers, as well as the mobile phone numbers and other data on people who have hired lawyers to go after telemarketers.

The Blacklist Alliance provides technologies and services to marketing firms concerned about lawsuits under the Telephone Consumer Protection Act (TCPA), a 1991 law that restricts the making of telemarketing calls through the use of automatic telephone dialing systems and artificial or prerecorded voice messages. The TCPA prohibits contact with consumers — even via text messages — unless the company has “prior express consent” to contact the consumer.

With statutory damages of $500 to $1,500 per call, the TCPA has prompted a flood of lawsuits over the years. From the telemarketer’s perspective, the TCPA can present something of a legal minefield in certain situations, such as when a phone number belonging to someone who’d previously given consent gets reassigned to another subscriber.

Enter The Blacklist Alliance, which promises to help marketers avoid TCPA legal snares set by “professional plaintiffs and class action attorneys seeking to cash in on the TCPA.” According to the Blacklist, one of the “dirty tricks” used by TCPA “frequent filers” includes “phone flipping,” or registering multiple prepaid cell phone numbers to receive calls intended for the person to whom a number was previously registered.

Lawyers representing TCPA claimants typically redact their clients’ personal information from legal filings to protect them from retaliation and to keep their contact information private. The Blacklist Alliance researches TCPA cases to uncover the phone numbers of plaintiffs and sells this data in the form of list-scrubbing services to telemarketers.

“TCPA predators operate like malware,” The Blacklist explains on its website. “Our Litigation Firewall isolates the infection and protects you from harm. Scrub against active plaintiffs, pre litigation complainers, active attorneys, attorney associates, and more. Use our robust API to seamlessly scrub these high-risk numbers from your outbound campaigns and inbound calls, or adjust your suppression settings to fit your individual requirements and appetite for risk.”

Unfortunately for the Blacklist paying customers and for people represented by attorneys filing TCPA lawsuits, the Blacklist’s own Web site until late last week leaked reams of data to anyone with a Web browser. Thousands of documents, emails, spreadsheets, images and the names tied to countless mobile phone numbers all could be viewed or downloaded without authentication from the domain theblacklist.click.

The directory also included all 388 Blacklist customer API keys, as well as each customer’s phone number, employer, username and password (scrambled with the relatively weak MD5 password hashing algorithm).

The leaked Blacklist customer database points to various companies you might expect to see using automated calling systems to generate business, including real estate and life insurance providers, credit repair companies and a long list of online advertising firms and individual digital marketing specialists.

The very first account in the leaked Blacklist user database corresponds to its CEO Seth Heyman, an attorney southern California. Mr. Heyman did not respond to multiple requests for comment, although The Blacklist stopped leaking its database not long after that contact request.

Two other accounts marked as administrators were among the third and sixth registered users in the database; those correspond to two individuals at Riip Digital, a California-based email marketing concern that serves a diverse range of clients in the lead generation business, from debt relief and timeshare companies, to real estate firms and CBD vendors.

Riip Digital did not respond to requests for comment. But According to Spamhaus, an anti-spam group relied upon by many Internet service providers (ISPs) to block unsolicited junk email, the company has a storied history of so-called “snowshoe spamming,” which involves junk email purveyors who try to avoid spam filters and blacklists by spreading their spam-sending systems across a broad swath of domains and Internet addresses.

The irony of this data leak is that marketers who constantly scrape the Web for consumer contact data may not realize the source of the information, and end up feeding it into automated systems that peddle dubious wares and services via automated phone calls and text messages. To the extent this data is used to generate sales leads that are then sold to others, such a leak could end up causing more legal problems for The Blacklist’s customers.

The Blacklist and their clients talk a lot about technologies that they say separate automated telephonic communications from dime-a-dozen robocalls, such as software that delivers recorded statements that are manually selected by a live agent. But for your average person, this is likely a distinction without a difference.

Robocalls are permitted for political candidates, but beyond that if the recording is a sales message and you haven’t given your written permission to get calls from the company on the other end, the call is illegal. According to the Federal Trade Commission (FTC), companies are using auto-dialers to send out thousands of phone calls every minute for an incredibly low cost.

In fiscal year 2019, the FTC received 3.78 million complaints about robocalls. Readers may be able to avoid some marketing calls by registering their mobile number with the Do Not Call registry, but the list appears to do little to deter all automated calls — particularly scam calls that spoof their real number. If and when you do receive robocalls, consider reporting them to the FTC.

Some wireless providers now offer additional services and features to help block automated calls. For example, AT&T offers wireless customers its free Call Protect app, which screens incoming calls and flags those that are likely spam calls. See the FCC’s robocall resource page for links to resources at your mobile provider. In addition, there are a number of third-party mobile apps designed to block spammy calls, such as Nomorobo and TrueCaller.

Obviously, not all telemarketing is spammy or scammy. I have friends and relatives who’ve worked at non-profits that rely a great deal on fundraising over the phone. Nevertheless, readers who are fed up with telemarketing calls may find some catharsis in the Jolly Roger Telephone Company, which offers subscribers a choice of automated bots that keep telemarketers engaged for several minutes. The service lets subscribers choose which callers should get the bot treatment, and then records the result.

For my part, the volume of automated calls hitting my mobile number got so bad that I recently enabled a setting on my smart phone to simply send to voicemail all calls from numbers that aren’t already in my contacts list. This may not be a solution for everyone, but since then I haven’t received a single spammy jingle.

https://www.malwaredevil.com/2020/08/03/robocall-legal-advocate-leaks-customer-data/?utm_source=rss&utm_medium=rss&utm_campaign=robocall-legal-advocate-leaks-customer-data

How Did The Twitter Hackers Get Caught? – BH20 #1

The FBI tracked down the Twitter hackers, but how? What mistake did they make? Doug White and Matt Alderman discuss the latest news on the Twitter hack.
Visit https://securityweekly.com/summercamp2020 to view the Live Stream and previously recorded micro-interviews.

Chat live with the Security Weekly Staff, Hosts, and Guests in our Discord Server: https://discord.gg/pqSwWm4
Show Notes: https://securityweekly.com/bh201

https://www.malwaredevil.com/2020/08/03/how-did-the-twitter-hackers-get-caught-bh20-1/?utm_source=rss&utm_medium=rss&utm_campaign=how-did-the-twitter-hackers-get-caught-bh20-1

FBI Warns on New E-Commerce Fraud

Subscribe to Newsletters

More Informa Tech Live Events

White Papers

CyberSecurity Trends 2020

A Guide to the Iranian Threat Landscape

Database Performance Monitor Datasheet

2020 Gartner Market Guide for Network Detection & Response

State of Endpoint Security: How Enterprises Are Managing Endpoint Security Threats

Video

All Videos

Cartoon Contest

Write a Caption, Win a Starbucks Card! Click Here

Latest Comment: Sandboxing? Ppphhht! I’ve moved beyond sandboxes to sandcastles.

Cartoon Archive

Current Issue

Special Report: Computing’s New Normal, a Dark Reading PerspectiveThis special report examines how IT security organizations have adapted to the “new normal” of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.

Back Issues | Must Reads

Flash Poll

All Polls

The Threat from the Internet–and What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!

Download Now!

0 comments

State of Cybersecurity Incident Response

0 comments

Developing and Maintaining Secure Applications

0 comments

Twitter Feed

Bug Report

Enterprise Vulnerabilities
From DHS/US-CERT’s National Vulnerability Database
CVE-2020-11583
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-11584
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-5770
PUBLISHED: 2020-08-03
Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5771
PUBLISHED: 2020-08-03
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious backup archive.
CVE-2020-5772
PUBLISHED: 2020-08-03
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file.

https://www.malwaredevil.com/2020/08/03/fbi-warns-on-new-e-commerce-fraud/?utm_source=rss&utm_medium=rss&utm_campaign=fbi-warns-on-new-e-commerce-fraud

What’s Going On With TikTok? – BH2020

What’s the latest with TikTok? Will the application be banned? Can you actually ban it? Doug White and Matt Alderman discuss the latest news on TikTok.

Visit https://securityweekly.com/summercamp2020 to view the Live Stream and previously recorded micro-interviews.

Chat live with the Security Weekly Staff, Hosts, and Guests in our Discord Server: https://discord.gg/pqSwWm4

Show Notes: https://securityweekly.com/bh201

https://www.malwaredevil.com/2020/08/03/whats-going-on-with-tiktok-bh2020/?utm_source=rss&utm_medium=rss&utm_campaign=whats-going-on-with-tiktok-bh2020

DHS Urges ‘Highest Priority’ Attention on Old Chinese Malware Threat

“Taidoor” is a remote access tool that has been used in numerous cyber espionage campaigns since at least 2008.

The US government Monday urged enterprise organizations to pay the “highest priority” attention to malicious activity involving “Taidoor,” a Chinese remote access Trojan that has been used in various cyber-espionage campaigns since at least 2008.

In a Malware Analysis Report (MAR) dated August 3, the US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) said that security researchers from multiple federal agencies had observed Chinese government actors using a variant of the malware in recent attacks.

An analysis of the activity shows that the attackers are using Taidoor variants in conjunction with proxy servers to maintain persistence on compromised networks and to enable further exploitation, according to the CISA. The CISA report included a complete list of indicators of compromise and suggested mitigation and response measures organizations can take to protect against the newly resurfaced threat.

“Users or administrators should flag activity associated with the malware and report the activity to the Cybersecurity and Infrastructure Security Agency (CISA) or the FBI Cyber Watch (CyWatch),” the advisory noted. “Give the activity the highest priority for enhanced mitigation.”

The CISA alert is the latest involving heighted threat activity from China-based actors. Just last month, the US government indicted two Chinese nationals on charges connected to the theft of intellectual property and business secrets, including COVID-19 research from organizations in the US and elsewhere. Earlier this year, the US government indicted four members of China’s military for allegedly being involved in the Equifax hack of May 2017. The indictments follow years of US accusations about China-based actors conducting systematic and widespread espionage campaigns against US corporations, government agencies, military and defense entities, and academic institutions.

Taidoor is a malware tool that multiple security vendors — including FireEye, Trend Micro and Symantec — have reported on over the years. Researchers have observed the malware being used in cyber-espionage campaigns targeting corporate organizations, think tanks, and government agencies in Taiwan and other countries with interests in Taiwan, including the US.

Substantial Threat
A detailed Trend Micro technical analysis of the malware in 2012 described Taidoor at the time as exploiting a wide variety of old and new vulnerabilities — including zero-days in multiple products including Adobe Reader, Acrobat, Flash Player, Microsoft Word, PowerPoint, and Excel. One zero-day-vulnerability that Taidoor exploited was “Sandworm,” a remote code execution flaw in Windows that was disclosed in 2014

In initial campaigns the China-based government actors behind Taidoor have used phishing emails with malicious attachments to distribute the malware. One of their tricks involved the use of a decoy document that would behave as a recipient might expect it to, while executing a malicious payload in the background. In later campaigns, the operators of Taidoor stopped using emails to drop the malware directly on a victim’s system. Instead, they used the rogue emails to drop a downloader on a system that later would go out and grab the malware from a remote command and control servers. A September 2013 FireEye report described a further evolution in tactics where instead of hosting the malware in a remote command-and-control servers, the attackers began hosting it as encrypted text in Yahoo blog posts.

It is not entirely clear what specific malicious activity involving Taidoor triggered the new warning from CISA this week. So far, at least, none of the vendors that have previously tracked the malware have reported a resurgence in Taidoor activity.

A FireEye spokeswoman says researchers at the company are still looking into what might be going on.

“We’ve seen Taidoor used extensively over the last 10+ years, while it has become less common recently, we expect it is still in use,” adds Ben Read, senior manager of analysis at FireEye’s Mandiant Threat Intelligence group. According to Read, FireEye has observed the malware being used in attacks against law firms, nuclear power suppliers, airlines, East Asian governments, engineering firms, and organizations within the defense industrial sector.

Symantec did not immediately respond to a Dark Reading inquiry. Trend Micro says it is working on getting comments from its researchers in Asia and Europe.

Related Content:

Register now for this year’s fully virtual Black Hat USA, scheduled to take place August 1-6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full BioRecommended Reading:

Why Performance Testing is More Critical Today

More Insights

Webcasts

White Papers

A Guide to the Iranian Threat Landscape

The Threat from the Internet–and What Your Organization Can Do About It

Reports

State of Endpoint Security: How Enterprises Are Managing Endpoint Security Threats

https://www.malwaredevil.com/2020/08/03/dhs-urges-highest-priority-attention-on-old-chinese-malware-threat/?utm_source=rss&utm_medium=rss&utm_campaign=dhs-urges-highest-priority-attention-on-old-chinese-malware-threat

Satellite Broadband Security – James Pavur – BH2020

In my upcoming Blackhat and DEFCON briefings, I will be presenting the result of several experiments looking at real-world security and privacy in satellite broadband communications. We find that it is possible for attackers using cheap home-television equipment to eavesdrop on the internet traffic of people who are thousands of miles away. In the briefing, we show how this effects individuals and organizations ranging from home internet customers, to oil companies, to airlines.

Visit https://securityweekly.com/summercamp2020 to view the Live Stream and previously recorded micro-interviews.

Chat live with the Security Weekly Staff, Hosts, and Guests in our Discord Server: https://discord.gg/pqSwWm4

Show Notes: https://securityweekly.com/bh201

https://www.malwaredevil.com/2020/08/03/satellite-broadband-security-james-pavur-bh2020/?utm_source=rss&utm_medium=rss&utm_campaign=satellite-broadband-security-james-pavur-bh2020

New ‘Nanodegree’ Program Provides Hands-On Cybersecurity Training

Emerging streamlined curriculum programs aim to help narrow the skills gap.

Estimates show that by 2021, there will be 3.5 million unfilled jobs in cybersecurity. That’s worrisome news for a field under more pressure than ever to protect enterprises adjusting to a new and unsecure world of remote work.

With an eye toward that skills shortage, the online learning platform Udacity recently launched what it calls an Introduction to Cybersecurity Nanodegree program. The course, taught by security pros, is intended for those just starting out or transitioning fields, to get a leg up on a career. The course is made up of four sections: Cybersecurity Foundations; Defending and Securing Systems; Threats, Vulnerabilities, and Incident Response; and Governance, Risk, and Compliance.

Christine Izuakor, founder and CEO of Cyber Pop-up, and instructor for the Threats, Vulnerabilities, and Incident Response portion, says one of the program’s benefits is its project-based nature. “It’s an opportunity for students to go through some real-world projects,” she says. In one vulnerability management module, for example, students use a vulnerability scanner to search the server for flaws.

“As we’re trying to build the next-generation talent pipeline, it’s very important we not only give them the fundamentals but also that we’re giving them hands-on experience,” she says. Overall her segment will examine threat assessments, threat actors, threat motivations, finding and fixing vulnerabilities, and what to do when a hacker inevitably gets in, despite your best efforts.

A Black woman in a white-male dominated field, Izuakor also hopes that this type of course offering will help more underrepresented people get involved. “The industry is missing such a huge opportunity by not embracing the full scope of potential talent out there,” she says.

Izuakor, meanwhile, recently published the Ultimate Guide to a Career in Cybersecurity for individuals interested in learning how to break into the industry.

The next-generation talent pipeline will be key to closing the skills gap, particularly because, as Izuakor notes, the harder roles to fill tend to be in cloud security, AI, and other emerging areas of security.

There are other programs that aim to fill those gaps: The SANS Institute runs the CyberStart program in the US, which creates an onramp for students in community college to simultaneously learn cybersecurity skills and emerge from school in two years ready to enter the workforce.

But of course at the same time that new security skillsets are in dire need, companies are also bogged down by hiring constraints brought on by the COVID-19 crisis. According to a recent SANS survey, 40% of organizations don’t know if they will hire new security staff in the next year.

John Pescatore, director of emerging security trends at SANS, says that number is usually around 15-20%, and the sharp rise reflects widespread economic uncertainty and discomfort with hiring new security employees to work remotely.

Indeed, the survey shows that 30% of organizations are considering bringing on consultants. The implication being, for example, that a company that was considering hiring a penetration tester may now opt for a consultant to perform a pen test instead, Pescatore says.

Post-Pandemic Hiring

Security pros say when organizations do start making new hires, they need to broaden their parameters in order to address the growing skills gap.

“Recession aside, we are still looking at a skills shortage when it comes to cybersecurity professionals and such a situation is only set to become more challenging with demand set to outstrip supply over the coming 18-24 months,” says Steve Durbin, managing director of the Information Security Forum, a London-based authority on cyber, information security and risk management. “But when we say there is a skills shortage, what do we actually mean? Yes, there will be a shortage of individuals skilled in the practical aspects of cybersecurity good practice, but a more imaginative approach to providing the necessary skills is needed.”

Some security experts, like Megan Bradley, vice president of operations at application security provider nVisium, think security teams could consider overlooking a college degree requirement in favor of those who take cybersecurity courses including Udacity’s that provide hands-on experience.

“I can’t speak for the entire industry, but we would certainly consider a candidate who participates in an immersive, hands-on cybersecurity program, with or without a college degree,” she says, adding that college curriculum tends to be “antiquated” anyway, teaching older technologies and cyber security practices.

Terence Jackson, CISO at Thycotic, argues that while cybersecurity degrees serve an important purpose in providing soft skills, they’re not “a great predictor of success in cybersecurity.”

“I do believe training and continuous learning are beneficial in our field, but nothing beats hands-on experience, a curious mindset, and the inner will to push through,” he says.

Dr. Casey Marks, chief product officer and vice president at (ISC)2, says it’s important for hiring practices to be realistic. “Make sure experience requirements, responsibilities, salary, and titles all align. Avoid a ‘kitchen sink’ mentality in terms of job skills,” he says. “We’d be the first organization to agree with the statement that holding a CISSP certification isn’t necessary for an entry-level position.”

And according to Thomas Hatch, CTO and co-founder at SaltStack, a provider of intelligent IT automation software, while he values a formal degree, candidates who complete special courses like Udacity’s Nanodegree program should also be considered if they can demonstrate their abilities. “This is all about looking beyond the degree and understanding the many ways that people can gain an education,” he says.

Registration for Udacity’s training program runs through August 11 and costs $1,436 (with discounts for those students suffering hardships). The self-paced program takes about four months to complete at about 10 hours per week.

Related Content:
Nicole Ferraro is a freelance writer, editor and storyteller based in New York City. She has worked across b2b and consumer tech media for over a decade, formerly as editor-in-chief of Internet Evolution and UBM’s Future Cities; and as editorial director at The Webby Awards. … View Full BioRecommended Reading:

Why Performance Testing is More Critical Today

More Insights

Webcasts

White Papers

CyberSecurity Trends 2020

The Threat from the Internet–and What Your Organization Can Do About It

Reports

The State of IT Operations and Cybersecurity Operations 2020