Malware Devil

Tuesday, February 9, 2021

Spotify Accounts Leaked, SonicWall Zero-Day, & Multiple Google Attacks! – SWN #99

This week, hundred thousand Spotify accounts leaked in credential stuffing attack, Hacker breached Florida water facility, raising chemical levels to dangerous levels, SonicWall Zero-Day in the SMA 100 Series, and Multiple Google attacks.

Time Stamps:

1:41 – Hundred thousand Spotify accounts leaked in credential stuffing attack
2:37 – Hacker Raised Chemical Settings at Water Treatment Plant to Dangerous Levels
3:24 – SonicWall Zero-Day
4:15 – Android App Infects Millions of Devices With a Single Update
5:25 – Fake Forcepoint Google Chrome Extension Hacks Windows Users
6:46 – The Great Suspender Chrome extension used by millions was malware
7:44 – Google Fixed A Chrome Zero-Day Under Active Attack

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn99

The post Spotify Accounts Leaked, SonicWall Zero-Day, & Multiple Google Attacks! – SWN #99 appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/spotify-accounts-leaked-sonicwall-zero-day-multiple-google-attacks-swn-99/?utm_source=rss&utm_medium=rss&utm_campaign=spotify-accounts-leaked-sonicwall-zero-day-multiple-google-attacks-swn-99

Microsoft Patch Tuesday February 2021 fixes 56 vulnerabilities

With cybersecurity threats on the rise thanks to the pandemic, it is essential to understand the importance of Patch Tuesday releases, and find ways to deploy them to remote endpoints efficiently.

This Patch Tuesday, Microsoft has released fixes for 56 …

The post Microsoft Patch Tuesday February 2021 fixes 56 vulnerabilities appeared first on ManageEngine Blog.

The post Microsoft Patch Tuesday February 2021 fixes 56 vulnerabilities appeared first on Security Boulevard.

The post Microsoft Patch Tuesday February 2021 fixes 56 vulnerabilities appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/microsoft-patch-tuesday-february-2021-fixes-56-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-patch-tuesday-february-2021-fixes-56-vulnerabilities

Microsoft February 2021 Patch Tuesday, (Tue, Feb 9th)

This month we got patches for 56 vulnerabilities. Of these, 11 are critical, 1 is being exploited and 6 were previously disclosed.

The exploited vulnerability is an elevation of privilege vulnerability affecting Win32k (CVE-2021-1732). This is a local vulnerability, which means that to exploit the vulnerability, an attacker would have to have local access to the machine (console or SSH for example) or rely on user interaction, like a user opening a malicious document. The CVSS v3 score for this vulnerability is 7.80.

The highest CVSS score this month (9.80) was given to 4 vulnerabilities. One of those is a critical Remote Code Execution (RCE) vulnerability in Microsoft DNS Server (CVE-2021-24078). This vulnerability would allow a remote unauthenticated attacker to execute code with the service privilege on the target host. As this vulnerability does not require user interaction, this is a potentially wormable vulnerability that requires your attention if you have Microsoft DNS Server in your network – specially exposed to the Internet.

There are also two RCEs worth mentioning this month affecting Windows TCP/IP. The first (CVE-2021-24074) affects IPV4 and involve source routing. Despite source routing being blocked by default in Windows, the system will process the request and return an ICMP message denying the request. There is a workaround for this vulnerability documented in Microsoft advisory that will cause the system to drop these requests altogether without any processing. The vulnerability affecting IPV6 (CVE-2021-24094) is related to package fragmentation. Both vulnerabilities are CVSS v3 9.80.

Amongst already disclosed vulnerabilities, there is a critical RCE affecting .Net Core 2.0, 3.1 and 5.0 (CVE-2021-26701). The CVSS v3 for this vulnerability is 8.10. There are no details.

See Renato’s dashboard for a more detailed breakout: https://patchtuesdaydashboard.com.

February 2021 Security Updates

Description
CVE	Disclosed	Exploited	Exploitability (old versions)	current version	Severity	CVSS Base (AVG)	CVSS Temporal (AVG)
.NET Core Remote Code Execution Vulnerability
%%cve:2021-24112%%	No	No	Less Likely	Less Likely	Critical	8.1	7.3
%%cve:2021-26701%%	Yes	No	Less Likely	Less Likely	Critical	8.1	7.1
.NET Core and Visual Studio Denial of Service Vulnerability
%%cve:2021-1721%%	Yes	No	Less Likely	Less Likely	Important	6.5	5.9
.NET Framework Denial of Service Vulnerability
%%cve:2021-24111%%	No	No	Less Likely	Less Likely	Important	7.5	6.5
Azure IoT CLI extension Elevation of Privilege Vulnerability
%%cve:2021-24087%%	No	No	Less Likely	Less Likely	Important	7.0	6.1
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
%%cve:2021-24109%%	No	No	Less Likely	Less Likely	Moderate	6.8	5.9
Microsoft Dataverse Information Disclosure Vulnerability
%%cve:2021-24101%%	No	No	Less Likely	Less Likely	Important	6.5	5.9
Microsoft Defender Elevation of Privilege Vulnerability
%%cve:2021-24092%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
%%cve:2021-1724%%	No	No	Less Likely	Less Likely	Important	6.1	5.5
Microsoft Edge for Android Information Disclosure Vulnerability
%%cve:2021-24100%%	No	No	Less Likely	Less Likely	Important	5.0	4.5
Microsoft Excel Remote Code Execution Vulnerability
%%cve:2021-24067%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
%%cve:2021-24068%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
%%cve:2021-24069%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
%%cve:2021-24070%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
Microsoft Exchange Server Spoofing Vulnerability
%%cve:2021-24085%%	No	No	Less Likely	Less Likely	Important	6.5	5.7
%%cve:2021-1730%%	No	No	Less Likely	Less Likely	Important	5.4	4.9
Microsoft SharePoint Information Disclosure Vulnerability
%%cve:2021-24071%%	No	No	Less Likely	Less Likely	Important	5.3	4.8
Microsoft SharePoint Remote Code Execution Vulnerability
%%cve:2021-24066%%	No	No	More Likely	More Likely	Important	8.8	7.7
Microsoft SharePoint Server Remote Code Execution Vulnerability
%%cve:2021-24072%%	No	No	More Likely	More Likely	Important	8.8	7.7
Microsoft SharePoint Spoofing Vulnerability
%%cve:2021-1726%%	No	No	Less Likely	Less Likely	Important	8.0	7.0
Microsoft Teams iOS Information Disclosure Vulnerability
%%cve:2021-24114%%	No	No	Less Likely	Less Likely	Important	5.7	5.0
Microsoft Windows Codecs Library Remote Code Execution Vulnerability
%%cve:2021-24081%%	No	No	Less Likely	Less Likely	Critical	7.8	7.0
Microsoft Windows VMSwitch Information Disclosure Vulnerability
%%cve:2021-24076%%	No	No	Less Likely	Less Likely	Important	5.5	5.0
Microsoft.PowerShell.Utility Module WDAC Security Feature Bypass Vulnerability
%%cve:2021-24082%%	No	No	Less Likely	Less Likely	Important	4.3	3.8
PFX Encryption Security Feature Bypass Vulnerability
%%cve:2021-1731%%	No	No	Less Likely	Less Likely	Important	5.5	4.8
Package Managers Configurations Remote Code Execution Vulnerability
%%cve:2021-24105%%	No	No	Less Likely	Less Likely	Important	8.4	7.6
Skype for Business and Lync Denial of Service Vulnerability
%%cve:2021-24099%%	No	No	Less Likely	Less Likely	Important	6.5	5.7
Skype for Business and Lync Spoofing Vulnerability
%%cve:2021-24073%%	No	No	Less Likely	Less Likely	Important	6.5	5.9
Sysinternals PsExec Elevation of Privilege Vulnerability
%%cve:2021-1733%%	Yes	No	Less Likely	Less Likely	Important	7.8	7.0
System Center Operations Manager Elevation of Privilege Vulnerability
%%cve:2021-1728%%	No	No	Less Likely	Less Likely	Important	8.8	7.7
Visual Studio Code Remote Code Execution Vulnerability
%%cve:2021-1639%%	No	No	Less Likely	Less Likely	Important	7.0	6.1
Visual Studio Code npm-script Extension Remote Code Execution Vulnerability
%%cve:2021-26700%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
Windows Address Book Remote Code Execution Vulnerability
%%cve:2021-24083%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
Windows Backup Engine Information Disclosure Vulnerability
%%cve:2021-24079%%	No	No	Less Likely	Less Likely	Important	5.5	4.8
Windows Camera Codec Pack Remote Code Execution Vulnerability
%%cve:2021-24091%%	No	No	Less Likely	Less Likely	Critical	7.8	6.8
Windows Console Driver Denial of Service Vulnerability
%%cve:2021-24098%%	Yes	No	Less Likely	Less Likely	Important	5.5	4.8
Windows DNS Server Remote Code Execution Vulnerability
%%cve:2021-24078%%	No	No	More Likely	More Likely	Critical	9.8	8.5
Windows DirectX Information Disclosure Vulnerability
%%cve:2021-24106%%	Yes	No	Less Likely	Less Likely	Important	5.5	4.8
Windows Event Tracing Elevation of Privilege Vulnerability
%%cve:2021-24102%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
%%cve:2021-24103%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
Windows Fax Service Remote Code Execution Vulnerability
%%cve:2021-1722%%	No	No	Less Likely	Less Likely	Critical	8.1	7.1
%%cve:2021-24077%%	No	No	Less Likely	Less Likely	Critical	9.8	8.5
Windows Graphics Component Remote Code Execution Vulnerability
%%cve:2021-24093%%	No	No	Less Likely	Less Likely	Critical	8.8	7.7
Windows Installer Elevation of Privilege Vulnerability
%%cve:2021-1727%%	Yes	No	More Likely	More Likely	Important	7.8	7.0
Windows Kernel Elevation of Privilege Vulnerability
%%cve:2021-24096%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
Windows Local Spooler Remote Code Execution Vulnerability
%%cve:2021-24088%%	No	No	Less Likely	Less Likely	Critical	8.8	7.7
Windows Mobile Device Management Information Disclosure Vulnerability
%%cve:2021-24084%%	No	No	Less Likely	Less Likely	Important	5.5	4.8
Windows Network File System Denial of Service Vulnerability
%%cve:2021-24075%%	No	No	Less Likely	Less Likely	Important	6.8	5.9
Windows PKU2U Elevation of Privilege Vulnerability
%%cve:2021-25195%%	No	No	Less Likely	Less Likely	Important	7.8	6.8
Windows Remote Procedure Call Information Disclosure Vulnerability
%%cve:2021-1734%%	No	No	Less Likely	Less Likely	Important	7.5	6.5
Windows TCP/IP Denial of Service Vulnerability
%%cve:2021-24086%%	No	No	More Likely	More Likely	Important	7.5	6.5
Windows TCP/IP Remote Code Execution Vulnerability
%%cve:2021-24074%%	No	No	More Likely	More Likely	Critical	9.8	8.5
%%cve:2021-24094%%	No	No	More Likely	More Likely	Critical	9.8	8.5
Windows Trust Verification API Denial of Service Vulnerability
%%cve:2021-24080%%	No	No	Less Likely	Less Likely	Moderate	6.5	5.7
Windows Win32k Elevation of Privilege Vulnerability
%%cve:2021-1732%%	No	Yes	Detected	Detected	Important	7.8	7.2
%%cve:2021-1698%%	No	No	More Likely	More Likely	Important	7.8	6.8

—
Renato Marinho
Morphus Labs| LinkedIn|Twitter

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Read More

The post Microsoft February 2021 Patch Tuesday, (Tue, Feb 9th) appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/microsoft-february-2021-patch-tuesday-tue-feb-9th/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-february-2021-patch-tuesday-tue-feb-9th

An Inside Look at the Collegiate Penetration Testing Competition

Curious about the Collegiate Penetration Testing Competition (CPTC)? In this podcast, Heather welcomes Tom Kopchak, Josh Neubecker, and Meredith Kasper to chat about their experiences working to bring the competition to life. Learn more about CPTC from Tom’s blog posts and by visiting the CPTC website and Twitter profile: CPTC Review Part 1: The […]

The post An Inside Look at the Collegiate Penetration Testing Competition appeared first on Hurricane Labs.

The post An Inside Look at the Collegiate Penetration Testing Competition appeared first on Security Boulevard.

The post An Inside Look at the Collegiate Penetration Testing Competition appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/an-inside-look-at-the-collegiate-penetration-testing-competition/?utm_source=rss&utm_medium=rss&utm_campaign=an-inside-look-at-the-collegiate-penetration-testing-competition

Attackers Exploit Critical Adobe Flaw to Target Windows Users

A critical vulnerability in Adobe Reader has been exploited in “limited attacks.”
Read More

The post Attackers Exploit Critical Adobe Flaw to Target Windows Users appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/attackers-exploit-critical-adobe-flaw-to-target-windows-users/?utm_source=rss&utm_medium=rss&utm_campaign=attackers-exploit-critical-adobe-flaw-to-target-windows-users

Security & Compliance Legal Highlights – SCW #61

Our co-host, Priya Chaudry will enlighten us on several other topics of interest to our community. There might be a mention of Solarwinds, Southwest Airlines, HIQ Labs, and more.

Visit https://www.securityweekly.com/scw for all the latest episodes!

Show Notes: https://securityweekly.com/scw61

The post Security & Compliance Legal Highlights – SCW #61 appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/security-compliance-legal-highlights-scw-61/?utm_source=rss&utm_medium=rss&utm_campaign=security-compliance-legal-highlights-scw-61

SentinelOne Buys Data Analytics Company Scalyr

Subscribe to Newsletters

Communications & Collaboration: 2024 (March 9-10)

More Informa Tech Live Events

White Papers

Improve MITRE ATT&CK Test Results for Endpoint Security Using Deception

Buyer’s Guide to Next-Gen Cloud Security Posture Management (CSPM)

Full Body Exposure: CybelAngel Analysis of Medical Data Leaks

How to Manage Third-Party Digital Risk

Reducing Data Breach Risk From Your Remote Workforce

More White Papers

Video

All Videos

Cartoon

How Neurodiversity Can Strengthen Cybersecurity Defense

Team members from different backgrounds, genders, ethnicities, and neurological abilities are best equipped to tackle today’s security challenges.

The cybersecurity skills shortage and workforce gap continue to be of concern to organizations. As they seek to protect digital assets by finding professionals with the right skills, demand remains higher than supply.

With recent surveys suggesting the cybersecurity workforce gap decreased in 2020 from previous years — from 4 million worldwide in 2019 to 3.1 million in 2020 — 28% of CISOs firmly believe that “serious disruptions” will occur if these roles are not filled. Around 76% of CIOs and CISOs believe the answer to this shortage lies in a more diverse skill set among those tackling cybersecurity tasks. Additionally, a third of infosec professionals agree that neurodiversity will make cybersecurity defenses stronger while also helping to eliminate bias in the industry.

Defining Diversity and Neurodiversity
Diversity is nature’s way of increasing its odds of survival. It’s a fact that genetic diversity helps maintain a healthy population and build up resistance to diseases, while allowing it to adapt to change.

Neurodiversity is considered a natural genetic variation in the population and usually refers to the range of neurological differences in brain functions and behavioral traits, typically associated with social skills, learning ability, and mood. Commonly, individuals that diverge from the dominant societal standards of “normal” neurocognitive functioning are referred to as neurodivergent.

Since first introduced as a concept in the late ’90s, neurodiversity has also become a social justice movement that seeks civil rights, equality, respect, and full societal inclusion for the neurodivergent. Regardless of the specific definition, the topic is typically associated with individuals that may be diagnosed with ADHD (attention deficit hyperactivity disorder) or on the autism spectrum and possess exceptional high pattern-recognition abilities, attention to detail, focus, and even outside-the-box thinking.

Diversity, including neurodiversity, in cybersecurity could improve an organizations’ overall resilience to cyberattacks. Cybersecurity teams combining professionals with unique skill sets from different educational and social backgrounds, genders, ethnicities, and even with exceptional neurological abilities, can build the right pool of talent to tackle a wide range of cybersecurity challenges.

How Cybercriminals Leverage Diversity and Neurodiversity
Cybercriminals may have long embraced neurodiversity. With no rules on educational background or hiring practices, the cybercriminal community often simply seeks the person who can do the job best. It’s likely that most cybercriminal gang members have different social backgrounds, are of different ethnicity or religion and possess differing levels of education, but that doesn’t stop them from breaching some of the largest companies or pulling off massive digital heists.

Consider the cybercriminals diagnosed with Asperger’s syndrome who pulled off hacks against the Federal Bureau of Investigation, the US Army, the Missile Defense Agency, and the Federal Reserve. It’s safe to speculate that diversity and neurodiversity are no strangers to cybercrime.

Although there is little to no empirical evidence to suggest the relationship between autistic individuals and cyber-driven crimes, some studies have tried to find a link between cybercrime and gifted individuals. However, due to the nature of the Internet and cybercrime, it is difficult to find and prosecute these criminals, let alone study and assess their cognitive abilities.

Strengthening Cybersecurity Efforts
Four in 10 cybersecurity professionals believe communication remains one of the biggest barriers in the cybersecurity industry. Tech jargon brought into the boardroom can significantly hamper board members’ understanding of the security risk their organization faces. This, in turn, can negatively affect security budgets because of the lack of perceived risk.

Diversity of talent on cybersecurity teams could potentially solve this communication problem. Building teams with different skill sets ranging outside technical qualifications can have a positive impact.

For example, instead of creating an all-tech team, each with their area of expertise, infosec leaders should consider adding a staff member who’s an excellent communicator. He or she could translate technical details and present them in terms non-technical board members can understand, providing clear insight on the organization’s security challenges, which in turn could lead to positive outcomes, including improved cybersecurity posture of the organization. Gaining buy-in from board members and achieving cybersecurity objectives is one goal where a non-technical member of a security team can be invaluable.

Incorporating neurodiversity into cybersecurity teams may have additional positive impacts. Employees that are uniquely skilled at finding patterns in seemingly unrelated data or relentlessly pursuing potential signs of data breaches could prove invaluable as part of companies’ efforts to detect and respond to threats. While automation currently does most of the heavy lifting in spotting these anomalies, security team members with unique skills and attention to detail may contribute additional insights and correlations that validate findings and even improve tuning of automated systems.

Of course, there’s no recipe for success in building diversity and neurodiversity into a cybersecurity team. Motivating people with different skill sets and from across the neurodivergent spectrum may prove challenging, but a growing number of CIOs and CISOs believe neurodiversity in the sector will help combat advanced persistent threats and cyberwarfare.

Striking the balance between using the best security technologies, automation, and people should be a goal for any organization when pursuing a more effective cybersecurity posture.

Liviu Arsene is a Global Cybersecurity Researcher for Bitdefender, with a strong background in security and technology. Researching global trends and developments in cybersecurity, he focuses on advanced persistent threats and security incidents while assessing their impact … View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

The Failures of Static DLP and How to Protect Against Tomorrow’s Email Breaches

More Webcasts

White Papers

Improve MITRE ATT&CK Test Results for Endpoint Security Using Deception

The State of DevSecOps Report

More White Papers

Reports

Special Report: Understanding Your Cyber Attackers

2020 State of Cybersecurity Operations and Incident Response

More Reports

The post How Neurodiversity Can Strengthen Cybersecurity Defense appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/how-neurodiversity-can-strengthen-cybersecurity-defense-2/?utm_source=rss&utm_medium=rss&utm_campaign=how-neurodiversity-can-strengthen-cybersecurity-defense-2

F5 Labs Survey Sees Decline in Credential Spill Volume

A report published by F5 Labs today finds that while the total number of credential spills involving large pairs of usernames and passwords doubled from 2016 to 2020, the volume of spilled credentials has been steadily declining during the same period. The average spill size declined from 63 million records in 2016 to 17 million..

The post F5 Labs Survey Sees Decline in Credential Spill Volume appeared first on Security Boulevard.

The post F5 Labs Survey Sees Decline in Credential Spill Volume appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/f5-labs-survey-sees-decline-in-credential-spill-volume/?utm_source=rss&utm_medium=rss&utm_campaign=f5-labs-survey-sees-decline-in-credential-spill-volume

BSidesSF 2020 – Sohini Mukherjee’s ‘Leveraging Osquery For DFIR At Scale’

Our thanks to BSidesSF and Conference Speakers for publishing their outstanding presentations; which originally appeared at the group’s BSidesSF 2020 Conference, and on the Organization’s YouTube Channel. Additionally, the BSidesSF 2021 Conference will take place on March 6 – 9, 2021 – with no cost to participate. Enjoy!

Permalink

The post BSidesSF 2020 – Sohini Mukherjee’s ‘Leveraging Osquery For DFIR At Scale’ appeared first on Security Boulevard.

The post BSidesSF 2020 – Sohini Mukherjee’s ‘Leveraging Osquery For DFIR At Scale’ appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/bsidessf-2020-sohini-mukherjees-leveraging-osquery-for-dfir-at-scale/?utm_source=rss&utm_medium=rss&utm_campaign=bsidessf-2020-sohini-mukherjees-leveraging-osquery-for-dfir-at-scale

Update on CFAA – SCW #61

We welcome our resident legal expert and co-host Priya Chaudry to catch us up on the status of the Supreme Court case concerning the Computer Fraud and Abuse Act (CFAA) and some other legal topics.

Visit https://www.securityweekly.com/scw for all the latest episodes!

Show Notes: https://securityweekly.com/scw61

The post Update on CFAA – SCW #61 appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/update-on-cfaa-scw-61/?utm_source=rss&utm_medium=rss&utm_campaign=update-on-cfaa-scw-61

Water Supply Poisoned by Hacker in Oldsmar, Fla.

A small municipal water supply was briefly tainted by a dangerous chemical: Another reminder of the risks of SCADA on the internet.

The post Water Supply Poisoned by Hacker in Oldsmar, Fla. appeared first on Security Boulevard.

The post Water Supply Poisoned by Hacker in Oldsmar, Fla. appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/water-supply-poisoned-by-hacker-in-oldsmar-fla/?utm_source=rss&utm_medium=rss&utm_campaign=water-supply-poisoned-by-hacker-in-oldsmar-fla

SentinelOne Buys Data Analytics Company Scalyr

Cloud-based big data platform boosts extended detection and response (XDR) offering.

The post SentinelOne Buys Data Analytics Company Scalyr appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/sentinelone-buys-data-analytics-company-scalyr/?utm_source=rss&utm_medium=rss&utm_campaign=sentinelone-buys-data-analytics-company-scalyr

Dependency Hijacking Software Supply Chain Attack Hits More Than 35 Organizations

Today, news broke that a security researcher managed to breach systems of over 35 tech companies in what has been described as a novel software supply chain attack.

The post Dependency Hijacking Software Supply Chain Attack Hits More Than 35 Organizations appeared first on Security Boulevard.

The post Dependency Hijacking Software Supply Chain Attack Hits More Than 35 Organizations appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/dependency-hijacking-software-supply-chain-attack-hits-more-than-35-organizations/?utm_source=rss&utm_medium=rss&utm_campaign=dependency-hijacking-software-supply-chain-attack-hits-more-than-35-organizations

How Neurodiversity Can Strengthen Cybersecurity Defense

Team members from different backgrounds, genders, ethnicities, and neurological abilities are best equipped to tackle today’s security challenges.

The post How Neurodiversity Can Strengthen Cybersecurity Defense appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/how-neurodiversity-can-strengthen-cybersecurity-defense/?utm_source=rss&utm_medium=rss&utm_campaign=how-neurodiversity-can-strengthen-cybersecurity-defense

XKCD ‘Vaccine Odering’

via the comic delivery system monikered Randall Munroe resident at XKCD ! — **via** the comic delivery system monikered **Randall Munroe** resident at **XKCD**!

Permalink

The post XKCD ‘Vaccine Odering’ appeared first on Security Boulevard.

The post XKCD ‘Vaccine Odering’ appeared first on Malware Devil.

https://malwaredevil.com/2021/02/09/xkcd-vaccine-odering/?utm_source=rss&utm_medium=rss&utm_campaign=xkcd-vaccine-odering

Monday, February 8, 2021

Malicious Code Injected via Google Chrome Extension Highlights App Risks

An open source plug-in purportedly introduced tracking and malicious download code to infect nearly 2 million users, reports say.

Google has removed a Chrome plugin used by approximately 2 million users after reports that the browser extension had been compromised and installed potentially malicious code and tracking software on users’ systems.

The Great Suspender utility for Chrome has a very simple task–reduce the memory consumed by the browser through shutting down tab processes that are old, removing their content from memory. Yet, the original maintainer of the open-source project sold the code to an unknown group, who changed the functionality of the plugin and installed updated code on users’ systems without notification and without publishing the code to the plugin’s repository on GitHub, according to some reports.

This recent Chrome plugin incident, along with SolarWinds and other software compromise, highlight how attackers are focusing on software ecosystems outside the main application stores such as the Apple Store and Google Play store, says Vinnie Liu, the CEO of Bishop Fox.

“The secure development lifecycle has for 15 years been focused on preventing the inadvertent introduction of vulnerabilities by developers, and not against identifying and preventing the purposeful insertion of malicious code or behavior into an existing application,” he says. “Developers are unprepared for this. Most enterprise security programs are unprepared for this.”

Neither Google – which removed the software on Feb. 4 – nor the original developer of the software, Dean Oemcke, had responded to requests for comment as of this posting.

Application security firms have warned that open-source components and third-party software should be vetted for vulnerabilities and, increasingly, as a supply-chain issue. The cyber espionage attack that infected customers of SolarWinds by adding code to the software, and the spread of the NotPetya worm through the compromise of a Ukrainian accounting software update, both highlight the dangers of third-party security failures.

“We should use systematic detection–like publicly verifiable software bills of material–of software, so we can check, detect, and track changes,” says Stefan Frei, security officer at SDX Security and a lecturer on application security at ETH Zurich, a large public university in Switzerland. “Unexpected, or large changes in a popular upstream app, plugin, [or] project would trigger closer investigation to understand the type of changes introduced.”

Unanswered Questions

The full story behind the changes in the Great Suspender remains unclear. In June 2020, the maintainer of the open-source project reportedly sold the project to an unidentified group. Three months later, the extension available on the Google Chrome and Microsoft Edge stores appeared to contain questionable code. Microsoft removed the Edge extension in November, but Google continued to offer the extension in its store until last Thursday.

Information on the functionality of the malicious code also is still hard to find. An analysis of the situation posted by Callum McConnell in November noted that the latest versions available in the stores appeared to load intentionally-hidden data.

“Because the malicious code loaded from a server by the extension … was heavily obfuscated, it is hard to say what may have been compromised,” the analysis stated. “However, those who did manage to conduct [a] successful analysis of the code reported no password-stealing functionality in the copies that were archived.”

Special Report: How IT Security Organizations are Attacking the Cybersecurity Problem

New From The Edge: What’s the Difference Between ‘Observability’ and ‘Visibility’ in Security?

Companies should track software bill-of-materials and ensure that software on users’ systems is analyzed for security issues – and any changes to the code is tracked. Software component analysis (SCA), which tracks the state of open-source components and other libraries, has quickly become important for software makers’ secure development lifecycle (SDL) initiatives.

A broader initiative may also be necessary, involving an industry associate or government agency to run such a service, says SDX Security’s Frei.

“Maybe we need a government or industry to run such a shop … for the common good,” he says. “Coupled with code signing (and) rules that [code] certificates get revoked if ownership is changes without proper process [or] notice.”

Users and companies should expect attackers to continue to create campaigns that focus on smaller ecosystems. With Apple, Google, and Microsoft investing more money into software security, using popular software with less-robust security measures will be more common, says Bishop Fox’s Liu.

“The attackers are going to adapt by moving into these other areas that have not gotten the same security scrutiny,” he says. “There are cheaper ways to get what they want, so we are seeing adversaries adapt to those changing economics.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

The Failures of Static DLP and How to Protect Against Tomorrow’s Email Breaches

More Webcasts

White Papers

Improve MITRE ATT&CK Test Results for Endpoint Security Using Deception

7 Experts on Implementing Microsoft Defender for Endpoint

More White Papers

Reports

The Malware Threat Landscape

Evolution of Ransomware Gangs

More Reports

The post Malicious Code Injected via Google Chrome Extension Highlights App Risks appeared first on Malware Devil.

https://malwaredevil.com/2021/02/08/malicious-code-injected-via-google-chrome-extension-highlights-app-risks/?utm_source=rss&utm_medium=rss&utm_campaign=malicious-code-injected-via-google-chrome-extension-highlights-app-risks

Evolution of the CISO Role – Ben Carr – BSW #205

Ben Carr, Global Chief Information Security Officer at Qualys, steps in last minute to talk about his transition from Aristocrat to Qualys and the evolution of the CISO role.

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw205

The post Evolution of the CISO Role – Ben Carr – BSW #205 appeared first on Malware Devil.

https://malwaredevil.com/2021/02/08/evolution-of-the-ciso-role-ben-carr-bsw-205/?utm_source=rss&utm_medium=rss&utm_campaign=evolution-of-the-ciso-role-ben-carr-bsw-205

BBPLR, API Security Trends, Memory Unsafety, & Patching 0-Days – ASW #139

Funding bounties or finding bugs, how should we invest? Talks from Enigma Conference on memory unsafety and 0-days. Coming trends in API security and a review of research from 2020.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw139

The post BBPLR, API Security Trends, Memory Unsafety, & Patching 0-Days – ASW #139 appeared first on Malware Devil.

https://malwaredevil.com/2021/02/08/bbplr-api-security-trends-memory-unsafety-patching-0-days-asw-139/?utm_source=rss&utm_medium=rss&utm_campaign=bbplr-api-security-trends-memory-unsafety-patching-0-days-asw-139

White History Month

Brilliant history/comedy by The Amber Ruffin Show explaining why Americans desperately need a White History Month: I do feel the need to point out her citation of Lincoln, while true, evades the important context of his speech. First, after being repeatedly fraudulently bashed by his political opponents as someone who would dare to marry blacks … Continue reading White History Month →

The post White History Month appeared first on Security Boulevard.

The post White History Month appeared first on Malware Devil.

https://malwaredevil.com/2021/02/08/white-history-month/?utm_source=rss&utm_medium=rss&utm_campaign=white-history-month

Malware Devil

Malware Devil

Tuesday, February 9, 2021

Spotify Accounts Leaked, SonicWall Zero-Day, & Multiple Google Attacks! – SWN #99

Microsoft Patch Tuesday February 2021 fixes 56 vulnerabilities

Microsoft February 2021 Patch Tuesday, (Tue, Feb 9th)

An Inside Look at the Collegiate Penetration Testing Competition

Attackers Exploit Critical Adobe Flaw to Target Windows Users

Security & Compliance Legal Highlights – SCW #61

SentinelOne Buys Data Analytics Company Scalyr

How Neurodiversity Can Strengthen Cybersecurity Defense

F5 Labs Survey Sees Decline in Credential Spill Volume

BSidesSF 2020 – Sohini Mukherjee’s ‘Leveraging Osquery For DFIR At Scale’

Update on CFAA – SCW #61

Water Supply Poisoned by Hacker in Oldsmar, Fla.

SentinelOne Buys Data Analytics Company Scalyr

Dependency Hijacking Software Supply Chain Attack Hits More Than 35 Organizations

How Neurodiversity Can Strengthen Cybersecurity Defense

XKCD ‘Vaccine Odering’

Monday, February 8, 2021

Malicious Code Injected via Google Chrome Extension Highlights App Risks

Evolution of the CISO Role – Ben Carr – BSW #205

BBPLR, API Security Trends, Memory Unsafety, & Patching 0-Days – ASW #139

White History Month

Barbary Pirates and Russian Cybercrime

Blog Archive

About Me