Category - DDoS Protection Specialist

1
DoJ Charges Hackers with Staging Computer Attacks
2
How traffic scrubbing can guard against DDoS attacks
3
Europol Crackdown Targets DDoS Attack Buyers
4
Cyberattacks now cost businesses an average of $1.1M
5
U.S. Tech Giant Cloudflare Provides Cybersecurity For At Least 7 Terror Groups
6
FragmentSmack: How is this denial-of-service exploited?
7
The CoAP protocol is the next big thing for DDoS attacks
8
60 Cybersecurity Predictions For 2019
9
Middle East, North Africa Cybercrime Ups Its Game
10
Players affected as online game ‘Final Fantasy XIV’ hit by ‘unprecedented’ cyberattacks

DoJ Charges Hackers with Staging Computer Attacks

Federal authorities have arrested two alleged members of a hacking group known as the Apophis Squad on charges of making false threats of violent attacks and staging attacks on multiple computer systems.

According to an announcement from the Department of Justice (DoJ), the two defendants, Timothy Dalton Vaughn, 20, of Winston-Salem, North Carolina, and George Duke-Cohan, 19, of Hertfordshire, United Kingdom, are allegedly part of a global group of hackers suspected of wreaking havoc on the internet for the better part of 2018, including launching distributed-denial-of-service (DDoS) attacks.

Duke-Cohan, who is already serving a three-year sentence in the UK for threatening an airline, which turned out to be a hoax, is believed to go by the names DigitalCrimes and 7R1D3N7 online.

The defendants face multiple charges, including conducting cyber- and swatting attacks against individuals, businesses and institutions in the US and the UK, according to the DoJ.

“Members of Apophis Squad communicated various threats – sometimes using ‘spoofed’ email addresses to make it appear the threats had been sent by innocent parties, including the mayor of London,” the announcement stated.

“They also allegedly defaced websites and launched denial-of-service attacks. In addition, Vaughn allegedly conducted a DDoS attack that took down hoonigan.com, the website of a Long Beach motorsport company, for three days, and sent extortionate emails to the company demanding a Bitcoin payment to cease the attack.”

If convicted of all charges in the 11-count indictment, Vaughn could be sentenced to a maximum of 80 years in prison. Duke-Cohen, who is facing nine charges, would be sentenced to a maximum of 65 years if found guilty.

“The Apophis Squad also took credit for hacking and defacing the website of a university in Colombia, resulting in visitors to the site seeing a picture of Adolf Hitler holding a sign saying ‘YOU ARE HACKED’ alongside the message ‘Hacked by APOPHIS SQUAD,’” the DoJ wrote.

Source: https://www.infosecurity-magazine.com/news/doj-charges-hackers-with-staging-1/

How traffic scrubbing can guard against DDoS attacks

Although most scrubbing services can help fend off distributed denial of service attacks, a more comprehensive mitigation strategy is required to remain unscathed

What was possibly the world’s biggest distributed denial of service (DDoS) attack in February 2018 was stopped in its tracks after 20 minutes because there was a DDoS protection service in place.

The attack on GitHub, a popular online code management service used by millions of developers, experienced incoming traffic of 1.3Tbps, bombarded by packets at a rate of 126.9 million per second. Within 10 minutes of the attack, GitHub had sounded the alarm and routed its traffic to its DDoS mitigation service Akamai Prolexic, which sorted out and blocked the malicious traffic.

GitHub is not alone, as DDoS attacks have grown in intensity and become more sophisticated. Since 2017, businesses in the Asia-Pacific (APAC) region started to experience DDoS attacks at almost the same rate as North American businesses, which have traditionally been the most targeted, said Shahnawaz Backer, security specialist for APAC at F5 Networks, based on F5’s data.

And ASEAN organisations are not standing still. The DDoS market in ASEAN has seen significant growth, accounting for 20% of the APAC market, according to Frost & Sullivan.

A growing number of enterprises are investing in DDoS solutions, especially cloud-based DDoS mitigation services, with a shift away from a service-provider-centric market.

A DDoS attack is one of the most complex threats that businesses can face. The goal of the individual hacker, organised criminals or state actors is to overwhelm a company’s network, website or network component, such as a router. To begin with, organisations have to determine whether a spike in traffic is legitimate or is an attack.

“Without a solid understanding of baselines and historic traffic trends, organisations are unlikely to detect an attack until it is too late,” said Sherrel Roche, senior market analyst at IDC’s Asia-Pacific business and IT services research group.

Landbank, the largest government-owned bank in the Philippines, has taken the step of implementing F5’s BIG-IP local traffic manager to understand its application traffic and performance better, as well as to gain full visibility into customer data as it enters and leaves an application. This enables the security team to inspect, manage and report fraudulent transactions as soon they are spotted.

Complementing that is an on-premise application level layer 7 DDoS mitigation service to ensure mission-critical applications are protected against application-specific attacks.

It can be relatively simple to launch a DDoS attack with readily available DDoS-for-hire services, and even people with little or no technical skills can launch a damaging attack.

One such attack, which generated over 170Gbps of traffic, was organised over chatrooms on the Steam game distribution platform and IRC (internet relay chat), with many participating members using downloaded tools. These included a YouTube tutorial by a 12-year-old developer, said Fernando Serto, head of security technology and strategy at Akamai Technologies APAC.
Part of the challenge of DDoS is the complexity of these attacks. Not only are there several categories of attack method, but each category has a host of different attacks. The same target can also be attacked using several different attack vectors.

On top of that, some attacks can be hard to detect. One notable attack involved overwhelming the target’s DNS (domain name system) server through a series of bursts that lasted several minutes, instead of a sustained attack.

“This led to defender fatigue as these bursts of traffic were coming in over a long period of time, and detection, let alone mitigation, of these types of attacks becomes very difficult,” said Serto.

DDoS attacks are unlike other cyber attacks, where patches and locally installed security appliances can block an attack altogether. The defence calculus for denial of service is different because no organisation can prevent or block all DDoS attacks on its own, said Gartner senior analyst Rajpreet Kaur.

So the decision to invest in DDoS protection is also not an easy one. DDoS mitigation is an expensive investment, which organisations do not easily choose unless they or their competitors have suffered an attack.

“While multinational and global firms will invest, the cost may deter smaller, local firms,” said Kaur.

Also, IT infrastructure is getting more complex as enterprises move their applications and infrastructure to the cloud, requiring DDoS solutions to cater to different environments, said Frost & Sullivan network security senior industry analyst Vu Anh Tien.

Scrubbing clean

What GitHub relied on to counter the massive attack in February 2018 was scrubbing services, a common DDoS mitigation technique. Using this method, the traffic destined for a particular IP address range is redirected to datacentres, where the attack traffic is “scrubbed” or cleaned. Only clean traffic is then forwarded to the target destination.

Most DDoS scrubbing providers have three to seven scrubbing centres, typically distributed globally, said Gartner’s Kaur. Each centre consists of DDoS mitigation equipment and large amounts of bandwidth, which can be over 350Gbps, that feeds traffic to it. When customers are under attack, they “push the button” to redirect all traffic to the closest scrubbing centre to be cleaned.

Enterprise customers make use of scrubbing centres in two ways – one is to route traffic via the scrubbing centres around the clock, while others prefer to route traffic on demand when an attack occurs.

Given the complexity of security attacks and IT infrastructures, organisations are increasingly adopting hybrid models of protection, in order to protect against the broadest set of potential attack vectors. They often turn to an on-premise system that is the first line of defence, with the scrubbing centre stepping in when the on-premise technology is overwhelmed, said Backer.

IDC’s Roche added: “For bad traffic to be diverted to a scrubbing centre in a seamless action to reduce any downtime, organisations need to have seamless integration between cloud and on-premise solutions, implemented in front of an infrastructure’s network to help mitigate an attack before it reaches core network assets and data.”

Source: https://www.computerweekly.com/news/252456702/How-traffic-scrubbing-can-guard-against-DDoS-attacks

Europol Crackdown Targets DDoS Attack Buyers

On Monday, Europol said it was closing in on more than 250 customers of Webstresser.org and other DDoS-for-hire services. In April, authorities took down the site for letting buyers knock websites offline.

If you were a big buyer of DDoS attacks, you may be in trouble. Police in Europe plan to go after customers of Webstresser.org, a major DDoS-for-hire website it shut down last year

On Monday, Europol said it was closing in on more than 250 customers of Webstresser.org and other DDoS-for-hire services. “Actions are currently underway worldwide to track down the users of these Distributed Denial of Service (DDoS) attacks,” the agency added.

In April, Europol shut down Webstresser.org for letting buyers knock websites offline. For as little as $18.99 a month, the site offered access to DDoS attacks, which can overwhelm an IP address or website with enough internet traffic to disrupt access to it.

Webstresser.org was believed to be the world’s largest market for DDoS-for-hire services, according to Europol. Before its shutdown, the site helped launch 4 million attacks. It had also attracted 151,000 registered users under the guise of selling “server stress testing” services.

Now all those customers are in danger of facing potential prosecution. That’s because authorities have uncovered a “trove of information” on Webstresser.org’s users.

“In the United Kingdom, a number of webstresser.org users have recently been visited by the police,” Europol said in its announcement. “UK police are also conducting a number of live operations against other DDoS criminals.”

Although police have typically focused on targeting the sellers of DDoS attacks, Europol said law enforcement is ramping up activities to crack down on buyers as well. Last month, US federal investigators also warned they were going after customers of DDoS-for-hire websites.

“Whether you launch the DDoS attack or hire a DDoS service to do it for you, the FBI considers it criminal activity,” FBI Assistant Director Matthew Gorham said in December. “Working with our industry and law enforcement partners, the FBI will identify and potentially prosecute you for this activity.”

Source: https://www.pcmag.com/news/366214/europol-crackdown-targets-ddos-attack-buyers

Cyberattacks now cost businesses an average of $1.1M

Malware and bots, phishing, and DDoS attacks are some of the top threats companies face, according to Radware.

The average estimated cost of a cyberattack on an enterprise was $1.1 million in 2018—up 52% from the year before, according to a Tuesday report from Radware. For companies with a formal cost calculation process, that estimate rises to $1.7 million, the report found, with the top impacts being operational/productivity loss (54%), negative customer experiences (43%), and brand reputation loss (37%).

The report surveyed 790 IT executives worldwide across industries. These IT leaders perceive the goals of the attacks to be service disruption (45%), data theft (35%), unknown reasons (11%), or espionage (3%).

Some 21% of businesses experience daily cyberattacks, up from 13% last year, the report found. Another 13% said they were attacked weekly, 13% said monthly, and 27% said once or twice a year. Only 7% of organizations said they have never been attacked, according to the report.

The most common types of attacks on enterprises are malware and bots (76%), socially engineered threats like phishing (65%), DDoS attacks (53%), web application attacks (42%), ransomware (38%), and cryptominers (20%).

Hackers are also increasing their usage of emerging attack vectors to bring down networks and data centers, the report found: IT leaders reporting HTTPS Floods rose from 28% in 2017 to 34% in 2018, while reports of DNS grew from 33% to 38%. Burst attacks rose from 42% to 49%, and reports of bot attacks grew from 69% to 76%.

“While threat actors only have to be successful once, organizations must be successful in their attack mitigation 100% of the time,” Anna Convery-Pelletier, chief marketing officer for Radware, said in a press release. “A cyberattack resulting in service disruption or a breach can have devastating business impacts. In either case, you are left with an erosion of trust between a brand and its constituency.”

To combat security threats in 2019, CXOs can follow these tips, and focus on training employees.

The big takeaways for tech leaders:

  • The average estimated cost of a cyberattack on an enterprise was $1.1 million in 2018, up 52% from the year before. — Radware, 2019
  • Top goals of cyberattacks are perceived to be service disruption (45%), data theft (35%), unknown reasons (11%), and espionage (3%). — Radware, 2019

Source: https://www.techrepublic.com/article/cyberattacks-now-cost-businesses-an-average-of-1-1m/

U.S. Tech Giant Cloudflare Provides Cybersecurity For At Least 7 Terror Groups

American tech firm Cloudflare is providing cybersecurity services to at least seven designated foreign terrorist organizations and militant groups, HuffPost has learned.

The San Francisco-based web giant is one of the world’s largest content delivery networks and boasts of serving more traffic than Twitter, Amazon, Apple, Instagram, Bing and Wikipedia combined. Founded in 2009, it claims to power nearly 10 percent of Internet requests globally and has been widelycriticized for refusing to regulate access to its services.

Among Cloudflare’s millions of customers are several groups that are on the State Department’s list of foreign terrorist organizations, including al-Shabab, the Popular Front for the Liberation of Palestine, al-Quds Brigades, the Kurdistan Workers’ Party (PKK), al-Aqsa Martyrs Brigade and Hamas — as well as the Taliban, which, like the other groups, is sanctioned by the Treasury Department’s Office of Foreign Assets Control (OFAC). These organizations own and operate active websites that are protected by Cloudflare, according to fournational security and counterextremism experts who reviewed the sites at HuffPost’s request.

In the United States, it’s a crime to knowingly provide tangible or intangible “material support” — including communications equipment — to a designated foreign terrorist organization or to provideservice to an OFAC-sanctioned entity without special permission. Cloudflare, which is not authorized by the OFAC to do business with such organizations, has been informed on multiple occasions, dating back to at least 2012, that it is shielding terrorist groups behind its network, and it continues to do so.

The Electronic Frontier Foundation and other free speech advocates have long been critical of material support laws. The foundation described them as tools the government has used to “chill First Amendment protected activities” such as providing “expert advice and assistance” ― including training for peacefully resolving conflicts ― to designated foreign terrorist organizations. Many of the designated groups, the EFF has argued, also provide humanitarian assistance to their constituents.

But so far, free speech advocates’ arguments haven’t carried the day — which means that Cloudflare still could be breaking the law.

‘We Try To Be Neutral’

“We try to be neutral and not insert ourselves too much as the arbiter of what’s allowed to be online,” said Cloudflare’s general counsel, Doug Kramer. However, he added, “we are very aware of our obligations under the sanctions laws. We think about this hard, and we’ve got a policy in place to stay in compliance with those laws.” He declined to comment directly on the list of websites HuffPost provided to Cloudflare, citing privacy concerns.

Cloudflare secures and optimizes websites; it is not a domain host. Although Cloudflare doesn’t host websites, its services are essential to the survival of controversial pages, which would otherwise be vulnerable to vigilante hacker campaigns known as distributed denial-of-service attacks. As the tech firm puts it, “The size and scale of the attacks that can now easily be launched online make it such that if you don’t have a network like Cloudflare in front of your content, and you upset anyone, you will be knocked offline.”

Some of the terrorist sites that HuffPost identified on its server have been used to spread anti-state propaganda, claims of responsibility for terrorist attacks, false information and messages glorifying violence against Americans and civilians. But none of that really matters: Even if al-Shabab were posting cat videos, it would still be a crime to provide material support to the group.

“This is not a content-based issue,” said Benjamin Wittes, the editor in chief of Lawfare and a senior fellow at the Brookings Institution. “[Cloudflare] can be as pure-free-speech people as they want — they have an arguable position that it’s not their job to decide what speech is worthy and what speech is not — but there is a law, a criminal statute, that says that you are not allowed to give services to designated foreign terrorist organizations. Full stop.”

Intermediary websites are shielded from liability for illicit third-party content on their platforms, thanks to the U.S. Communications Decency Act (meaning, for example, that Twitter cannot be held legally accountable for a libelous tweet). This immunity is irrelevant with regard to the material support statute of the USA Patriot Act, which pertains strictly to the provision of a service or resource, not to any offending content, explained Wittes. In this case, Cloudflare’s accountability would not be a question of whether it should be monitoring its users or their content but, in part, whether the company is aware that it is serving terrorist organizations.

“If and when you know or reasonably should know, then you’re in legal jeopardy if you continue to provide services,” said University of Texas law professor Bobby Chesney.

In its terms of use, Cloudflare reserves the right to terminate services “for any reason or no reason at all.” Yet the firm has refused to shut down even its most reprehensible customers, with very few exceptions. Its CEO, former lawyer Matthew Prince, has made it clear that he believes in total content neutrality and that Cloudflare should play no role in determining who’s allowed online. His company is reportedly preparing for an initial public offering that would value it at more than $3.5 billion.

There is a law — a criminal statute — that says that you are not allowed to give services to designated foreign terrorist organizations. Full stop.Benjamin Wittes, senior fellow at the Brookings Institution

Cloudflare’s services range in price from completely free to north of $3,000 per month for advanced cybersecurity. (Kramer declined to say if the sanctioned entities HuffPost identified are paying customers. Material support law applies to both free and paid services.) Its reverse proxy service reroutes visitors away from websites’ IP addresses, concealing their domain hosts and giving them a sense of anonymity. This feature has made Cloudflare especially appealing to neo-Nazis, white supremacists, pedophiles, conspiracy theorists — and terrorists.

Screen Shot 2018-12-14 at 15.18.33

Cloudflare Knows

Cloudflare has knowingly serviced terrorist-affiliated websites for years. In 2012, Reuters confronted Cloudflare about websites behind its network that were affiliated with al-Quds Brigades and Hamas. Prince argued that Cloudflare’s services did not constitute material support of terrorism. “We’re not sending money, or helping people arm themselves,” he said at the time. “We’re not selling bullets. We’re selling flak jackets.”

That analogy bears little relevance. “Material support,” as defined in 18 U.S.C. § 2339B, refers to “any property, tangible or intangible, or service,” excluding medicine and religious materials. Contrary to Prince’s suggestion, it applies to more than money and weapons. A New York man who provided satellite television services to Hezbollah was sentenced in 2009 to 69 months in prison for material support of terrorism. And although the definition is broad, “it really covers anything of value,” Chesney said. “It’s meant to be like a full-fledged embargo.”

In 2013, after journalist James Cook learned Cloudflare was securing a website affiliated with al Qaeda, he wrote an article arguing that the web giant was turning “a blind eye to terrorism.” Prince published his responses to Cook’s questions about serving terrorist groups in a Q&A-style blog post titled “Cloudflare and Free Speech.”

Cook asked what safeguards Cloudflare had in place to ensure it was not supporting illegal terrorist activity; Prince listed none. Cook inquired whether Cloudflare would investigate the website he had identified; Prince suggested it would not. The site is still online and is still secured by Cloudflare.

“A website is speech. It is not a bomb,” Prince wrote in his post. “We do not believe that ‘investigating’ the speech that flows through our network is appropriate. In fact, we think doing so would be creepy.”

Creepy or not, if a company receives a tip that it has customers who are sanctioned terrorists or has reason to believe that could be the case, it should absolutely investigate so as not to risk breaking the law, experts said. (Kramer noted Prince’s remarks are “from six years ago” and said Cloudflare does take such tips seriously.)

“This is a criminal statute that we’re talking about, so companies bear a risk by putting their heads in the sand,” said Georgetown Law professor Mary McCord, a former head of the Justice Department’s national security division. “A company has got to spend money, resources [and have] lawyers to make sure it’s not running afoul of the law. The risk it takes if it doesn’t is a criminal prosecution.”

President Donald Trump’s administration also urges due diligence. “We encourage service providers to follow the lead of the big social media companies, whose terms of service and community standards expressly enable them to voluntarily address terrorist content on their platforms, while exploring ways to more expeditiously tackle such content,” a White House official told HuffPost.

The international hacktivist group Anonymous accused Cloudflare of serving dozens of ISIS-affiliated websites in 2015, which Prince shrugged off as “armchair analysis” by “15-year-old kids in Guy Fawkes masks.” In media interviews, he maintained that serving a terrorist entity is not akin to an endorsement and said only a few of the sites on Anonymous’ list belonged to ISIS. Prince hinted that government authorities had ordered Cloudflare to keep certain controversial pages online. The FBI, Justice Department, State Department, Treasury Department and White House declined to comment on that assertion.

Last year, Cloudflare disclosed that the FBI subpoenaed the company to hand over information about one of its customers for national security purposes. The FBI, which also uses Cloudflare’s services, rescinded the subpoena and withdrew its request for information after Cloudflare threatened to sue. Neither Cloudflare nor the FBI would comment on this matter.

Over the past two years, the Counter Extremism Project, a nonpartisan international policy organization, has sent Cloudflare four detailed letters identifying a total of seven terrorist-operated websites on its server. HuffPost has viewed these letters, which explicitly address concerns about material support of terrorism, and Kramer acknowledged that Cloudflare received them.

“We’ve never received a response from [Cloudflare],” said Joshua Fisher-Birch, a content review specialist at the Counter Extremism Project. Five of the seven flagged websites remain online behind Cloudflare today, more than a year after they were brought to the firm’s attention.

“I think they’re doubling down on free speech absolutism at all costs,” he added. “In this case, that means they’re going to allow terrorist and extremist organizations to use their services and to possibly spread propaganda, try to recruit or even finance on their websites.”

HUFFPOST

In August 2017, Cloudflare cut off services to the Daily Stormer, a website that had allegedly been involved in a neo-Nazi rally that month in Charlottesville, Virginia, where a counterprotester was killed.

‘Assholes’ vs. Terrorists

Kramer said he was not able to comment in detail on specific cases in which outside actors such as journalists and Anonymous informed Cloudflare about possible terrorist organizations using its services, but he noted that Cloudflare works with government agencies to comply with its legal obligations.

“Our policy is that if we receive new information that raises a flag or a concern about a potentially sanctioned party, then we’ll follow up to figure out whether or not that’s something that we need to take action on,” he said. “Part of the challenge is really to determine which of those are legitimate inquiries and which of those … are trying to manipulate the complaint process to take down people with whom they disagree.”

Cloudflare was flooded with such complaints in August 2017, when activists pleaded with the firm to terminate its services for the Daily Stormer, a prominent neo-Nazi website that was harassing the family of a woman who had recently been killed in violence surrounding a neo-Nazi rally in Charlottesville, Virginia.

Prince initially refused to drop the Daily Stormer, but as public outrage intensified, he reluctantly pulled the plug. “The people behind the Daily Stormer are assholes and I’d had enough,” he later said in an email to his team. The rationale behind that decision raised questions among Cloudflare’s staff, according to Wired.

“There were a lot of people who were like, ‘I came to this company because I wanted to help build a better internet … but there are some really awful things currently on the web, and it’s because of us that they’re up there,’” one employee said. Another wondered why Cloudflare would consider shutting down Nazis but not terrorists.

Source: https://www.huffingtonpost.ca/entry/cloudflare-cybersecurity-terrorist-groups_us_5c127778e4b0835fe3277f2f

FragmentSmack: How is this denial-of-service exploited?

FragmentSmack, a DDoS vulnerability first discovered in Linux, affects Windows as well as nearly 90 Cisco products. Discover how it can be exploited with Judith Myerson.

A distributed denial-of-service vulnerability called FragmentSmack enables an unauthenticated remote attacker to disable servers with a stream of fragmented IP packets that activate the vulnerability on affected systems. First discovered in Linux, and now also found in Windows, FragmentSmack affects many products, including nearly 90 from Cisco. How can this vulnerability be exploited, and how big is the threat?
FragmentSmack is a vulnerability in the IP stack that can be used to execute a distributed denial-of-service attack. The vulnerability affects Linux kernel version 3.9 or later, and it was discovered in some Cisco products by the Vulnerability Coordination team of the National Cyber Security Centre of Finland and the CERT Coordination Center. The flaw is caused by inefficient algorithms used in IP implementations to reassemble fragmented IPv4 and IPv6 packets.

An attacker using the FragmentSmack vulnerability could exploit it remotely by continuously sending crafted packets — that appear to be fragments of larger packets that need to be reassembled — to cause the system to become unresponsive, as 100% of the CPU cores will be in use.

In one scenario, an attacker could send a stream of 8-byte sized IP fragments, each starting with randomly chosen offset values, to a server. The queue of malformed IP fragments waiting for reassembly — which will never happen because the fragments are not part of any legitimate packets — increases in size until all the CPU core resources are consumed, leaving no room for other tasks the system needs to perform.

The attacker doesn’t specify what core the malformed packets are sent to and the Linux kernel automatically distributes the reassembly to different cores. While such an attack could take a server down, once the flow of malicious fragments stops, the targeted server can resume its normal function.

Cisco’s vulnerable listed products include network and content security devices, voice and unified communications devices, and telepresence and transcending devices.

Likewise, this threat has extended to Microsoft and Red Hat, and the affected Microsoft’s Window systems include versions 7, 8.1 and 10, as well as all the Windows Server versions. Windows 10 — 64 bit — in particular, features an option for Windows Subsystem for Linux that is vulnerable. Turning off this option doesn’t prevent the attacker from exploiting the vulnerability, however.

Vulnerable Red Hat products include Virtualization 4, Enterprise MRG, Enterprise Linux Atomic Host and Enterprise Linux versions 6, 7, Real Time 7, 7 for ARM64 and 7 for Power.

Source: https://searchsecurity.techtarget.com/answer/FragmentSmack-How-is-this-denial-of-service-exploited

The CoAP protocol is the next big thing for DDoS attacks

CoAP DDoS attacks have already been detected in the wild, some clocking at 320Gbps.

RFC 7252, also known as the Constrained Application Protocol (CoAP), is about to become one of the most abused protocols in terms of DDoS attacks, security researchers have told ZDNet.

If readers don’t recognize the name of this protocol that’s because it’s new –being formally approved only recently, in 2014, and largely unused until this year.

WHAT IS COAP?

CoAP was designed as a lightweight machine-to-machine (M2M) protocol that can run on smart devices where memory and computing resources are scarce.

In a very simplistic explanation, CoAP is very similar to HTTP, but instead of working on top of TCP packets, it works on top of UDP, a lighter data transfer format created as a TCP alternative.

Just like HTTP is used to transport data and commands (GET, POST, CONNECT, etc.) between a client and a server, CoAP also allows the same multicast and command transmission features, but without needing the same amount of resources, making it ideal for today’s rising wave of Internet of Things (IoT) devices.

But just like any other UDP-based protocol, CoAP is inherently susceptible to IP address spoofing and packet amplification, the two major factors that enable the amplification of a DDoS attack.

An attacker can send a small UDP packet to a CoAP client (an IoT device), and the client would respond with a much larger packet. In the world of DDoS attacks, the size of this packet response is known as an amplification factor, and for CoAP, this can range from 10 to 50, depending on the initial packet and the resulting response (and the protocol analysis you’re reading).

Furthermore, because CoAP is vulnerable to IP spoofing, attackers can replace the “sender IP address” with the IP address of a victim they want to launch a DDoS attack against, and that victim would receive the blunt force of the amplified CoAP traffic.

The people who designed CoAP added security features to prevent these types of issues, but as Cloudflare pointed out in a blog post last year, if device makers implement these CoAP security features, the CoAP protocol isn’t so light anymore, negating all the benefits of a lightweight protocol.

That’s why most of today’s CoAP implementations forgo using hardened security modes for a “NoSec” security mode that keeps the protocol light, but also vulnerable to DDoS abuse.

THE RISE OF COAP

But because CoAP was a new protocol, a few hundreds of vulnerable devices here and there would have never been a problem, even if all were running in NoSec modes.

Unfortunately, things started to change. According to a talk that Dennis Rand, founder of eCrimeLabs, gave at the RVAsec security conference over the summer (19:40 mark), the number of CoAP devices has exploded since November 2017.

Rand says the CoAP device count jumped from a lowly 6,500 in November 2017 to over 26,000 the next month. Things got even worse in 2018 because by May that number was at 278,000 devices, a number that today is hovering at 580,000-600,000, according to Shodan, a search engine for Internet-connected devices.

coap-shodan.png

Rand suggests the reason for this explosion is CoAP’s use as part of QLC Chain (formerly known as QLink), a project that aims build a decentralized blockchain-based mobile network using WiFi nodes available across China.

But this sudden rise in readily available and poorly secured CoAP clients hasn’t gone unnoticed. Over the past few weeks, the first DDoS attacks carried out via CoAP have started to leave their mark.

A security researcher who deals with DDoS attacks but who couldn’t share his name due to employment agreements told ZDNet that CoAP attacks have happened on an occasional basis over the past months, with increasing frequency, reaching 55Gbps on average, and with the largest one clocking at 320Gbps.

The 55Gbps average is an order of magnitude superior to the average size of a normal DDoS attack, which is 4.6Gbps, according to DDoS mitigation firm Link11.

Of the 580,000 CoAP devices currently available on Shodan today, the same researcher told ZDNet that roughly 330,000 could be (ab)used to relay and amplify DDoS attacks with an amplification factor of up to 46 times.

Of the attacks the researcher has recorded, most have targeted various online services in China, but also some MMORPGs platforms outside of mainland China.

It is unclear if CoAP has been added as an attack option to DDoS-for-hire platforms, but once this happens, such attacks will intensify even more.

Furthermore, CoAP’s use in the real world has exploded this year but was mainly restricted to China. It is safe to assume that once CoAP has already become popular in China, today’s main manufacturing hub, vulnerable devices will also spread to other countries as devices made in the communist state are sold overseas.

WE’VE BEEN WARNED

Just like with the case with most protocols developed with IoT in mind, the issue doesn’t seem to reside in the protocol design, which includes some basic security features, but in how device makers are configuring and shipping CoAP in live devices.

Sadly, this isn’t something new. Many protocols are often misconfigured, by accident or intentionally, by device makers, which often choose interoperability and ease of use over security.

But the thing that will annoy some security researchers is that some predicted this would happen even before CoAP was approved as an official Internet standard, way back in 2013.

This was a totally avoidable disaster if only countries around the world had more stringent rules about IoT devices and their security features.

On a side note –and coincidentally– as CoAP DDoS attacks are now beginning to get noticed, Federico Maggi, a security researcher with Trend Micro, has also taken a look at CoAP’s DDoS amplification capabilities, research which he’s set to present at the Black Hat security conference this week in London.

The same research also looked at a fellow M2M protocol, MQTT, also known to be a mess, and in which the researcher has identified several vulnerabilities.

Source: https://www.zdnet.com/article/the-coap-protocol-is-the-next-big-thing-for-ddos-attacks/

60 Cybersecurity Predictions For 2019

I’ve always been a loner, avoiding crowds as much as possible, but last Friday I found myself in the company of 500 million people. The breach of the personal accounts of Marriott and Starwood customers forced us to join the 34% of U.S. consumers who experienced a compromise of their personal information over the last year. Viewed another way, there were 2,216 data breaches and more than 53,000 cybersecurity incidents reported in 65 countries in the 12 months ending in March 2018.

How many data breaches we will see in 2019 and how big are they going to be?

No one has a crystal ball this accurate and it’s difficult to make predictions, especially about the future. Still, I made a brilliant, contrarian, and very accurate prediction last year, stating unequivocally that “there will be more spectacular data breaches” in 2018.

Just like last year, this year’s 60 predictions reveal the state-of-mind of key participants in the cybersecurity industry (on the defense team, of course) and cover all that’s hot today. Topics include the use and misuse of data; artificial intelligence (AI) and machine learning as a double-edge sword helping both attackers and defenders; whether we are going to finally “get over privacy” or see our data finally being treated as a private and protected asset; how the cloud changes everything and how connected and moving devices add numerous security risks; the emerging global cyber war conducted by terrorists, criminals, and countries; and the changing skills and landscape of cybersecurity.

It’s the data, stupid

“While data has created an explosion of opportunities for the enterprise, the ability to collaborate on sensitive data and take full advance of artificial intelligence opportunities to generate insights is currently inhibited by privacy risks, compliance and regulation controls. The security challenge of ‘data in use’ will be overcome by applying the most universal truth of all-time—mathematics—to facilitate data collaboration without the need for trust from either side. For example, ‘zero-knowledge proof’ allows proof of a claim without revealing any other information beyond what is claimed. Software that is beyond trust and based on math will propel this trend forward”—Nadav Zafrir, CEO,Team8

“IT security in 2019 is no longer going to simply be about protecting sensitive data and keeping hackers out of our systems. In this day and age of big data and artificial intelligence—where cooperation on data can lead to enormous business opportunities and scientific and medical breakthroughs—security is also going have to focus on enabling organizations to leverage, collaborate on and monetize their data without being exposed to privacy breaches, giving up their intellectual property or having their data misused. Cybersecurity alone is not going to be enough to secure our most sensitive data or our privacy. Data must be protected and enforced by technology itself, not just by cyber or regulation. The very technology compromising our privacy must itself be leveraged to bring real privacy to this data-driven age”—Rina Shainski, Co-founder and Chairwoman, Duality Technologies

AI is a dual-use technology

AI-driven chatbots will go rogue. In 2019, cyber criminals and black hat hackers will create malicious chatbots that try to socially engineer victims into clicking links, downloading files or sharing private information. A hijacked chatbot could misdirect victims to nefarious links rather than legitimate ones. Attackers could also leverage web application flaws in legitimate websites to insert a malicious chatbot into a site that doesn’t have one. In short, next year attackers will start to experiment with malicious chatbots to socially engineer victims. They will start with basic text-based bots, but in the future, they could use human speech bots to socially engineer victims over the phone or other voice connections”—Corey Nachreiner, CTO, WatchGuard Technologies

“While next-gen technology like Artificial Intelligence (AI) and Machine Learning (ML) are transforming many enterprises for the better, they’ve also given rise to a new breed of ‘smart’ attacks. The ability to scale and carry out attacks is extremely enticing to cybercriminals, including use of intelligent malware. The rise in next-gen threats means that security professionals must be extra vigilant with detection and training against these threats, while also adopting new methods of automated prevention methods”—John Samuel, Senior Vice President and Global Chief Information Officer, CGS

“Cyber defenders have been researching and working on their machine learning/AI/deep Learning for a long time. We expect over the next 5 years that these technologies will also empower adversaries to create more powerful and elusive attacks through a new generation of tools, tactics and procedures. While AI/ML-savvy offensive cybercriminals are in their infancy, this is like any other business. They will invest in whatever provides them the greatest return. Unlike defenders, those on the offense are willing to collaborate and share innovation freely, which could increase rapid development and innovation”—David Capuano, CMO and VP Sales, BluVector

“Automation is the name of the game in security and machine learning is here to help. AI is all about automating expert systems, and security is all about experts answering some form of the question: ‘Does this matter? Does this alert matter? Is this vulnerability risky?’ Machine learning will help filter out the noise, so that the limited number of practitioners out there can use their time most efficiently”—Michael Roytman, chief data scientist, Kenna Security

“Recent updates to exploit kits, specifically natural language and artificial intelligence capabilities, has made the automation of highly convincing and unique social engineering emails a very simple process. Meaning, an attacker can upload a file with one million email addresses and can automate the creation of effective and unique phishing messages to send out to victims”—Brian Hussey, VP of Cyber Threat Detection and Response, Trustwave SpiderLabs

When it comes to using AI in cybersecurity, be wary. AI offers companies huge potential, but it is a largely untapped area. If you do plan to implement it, do a proof of concept to make sure that it integrates into your company’s environment, ensuring that you’re getting the maximum value”—Joan Pepin, CISO and VP of Operations, Auth0

“The focus on artificial intelligence in cybersecurity has led to an arms war, with vendors ratcheting up claims about the number of models or features to sensational levels. In 2019, the focus will shift from quantity to quality of features. Both vendors and their users will recognize that fewer, more precise features, can improve threat detection rates, while ensuring virtually zero false positives”—Adrien Gendre, North American CEO, Vade Secure

As AI-enabled apps continue to proliferate, companies will face a rise in accidental vulnerabilities. Expect to hear about more breaches that aren’t a result of a hack, but can be mapped back to developers leaving large data pools (which power AI-enabled applications) accidentally unprotected. Companies need to be vigilant when working with large data pools, especially customer data, that feed AI in services like Amazon, Facebook and Google, and always double check their configurations”—Alex Smith, Director of Security Products,Intermedia

“With fraud attack rates expected to continue to increase in 2019, costing e-commerce retailers billions of dollars, AI is poised to play a huge role in stopping bad actors in real-time before they strike. Artificial intelligence and machine learning, enhanced by human research, have the ability to protect online merchants from abuse at both the account level and the point of transaction.  AI-driven solutions are becoming a necessity because they instantly prevent fraud, enabling retailers to scale and keep up with the e-commerce giants without sacrificing the consumer experience. Finally, fraud prevention models that use AI can be personalized based on a nuanced understanding of each merchant’s specific pain points and historical data”—Michael Reitblat, Co-Founder and CEO, Forter

The emerging global cyber war

Terrorist-related groups will attack population centers with crimeware-as-a-service. While terrorist-related groups have been tormenting organizations and individuals for years, we anticipate more potentially destructive attacks in 2019. Instead of breaking systems with ransomware, adversaries will leverage new tools to conduct harmful assaults on targeted subjects and organizations. From attacks on data integrity that essentially kill computers to the point of mandatory hardware replacements, to leveraging new technology for physical assaults such as the recent drone attack in Venezuela, attack surfaces are growing and enemies will take advantage. To combat this, organizations must take inventory of their attack landscape to identify and mitigate potential threats before they are exploited. Malcolm Harkins, Chief Security and Trust Officer, Cylance

“We expect nation-state threats to increase significantly in 2019, particularly targeting critical infrastructure. Critical infrastructure systems are extremely vulnerable to both cybersecurity and physical security risks. State-sponsored threats and high-level hackers are constantly looking to gain access to the critical infrastructure of nations worldwide, with the intent of hitting some of our most valuable systems (national security, public health, emergency communications, and more)”—Mike McKee, CEO, ObserveIT

“The nature of cyberwarfare is changing. Russia has led the way in the use of targeted cyber actions as part of larger objectives, and now other nation states are looking to follow the same playbook. While a direct cyberwar is not on the horizon, there will continue to be smaller proxy cyber wars as part of regional conflicts where larger nation state actors provide material support to these smaller conflicts. These regional conflicts will be testing grounds for new tactics, techniques and procedures as larger nation states determine how cyber warfare integrates into their larger military objectives. Nation states will also start experimenting more this year in adding ‘disinformation’ campaigns as part of their cyber warfare efforts. These kinds of attacks will make true attribution more difficult”—Sean McNee, Senior Data Scientist, DomainTools

“As the cyber threat landscape intensifies, adversaries will continue to discover new avenues for attacks. Although satellites aren’t the most common attack surface, it is important for industry professionals to acknowledge the capabilities that threat actors hold over them. Security concerns continue to grow within the satellite industry, with execs even forming a government-backed clearinghouse to share information on cyber threats to space assets. From military satellites to GPS technology and even communication satellites, adversaries are able to conduct targeted attacks to gain access to these crucial systems—some of which are highly classified networks. As these threat actors refine their skills, we anticipate major attacks on satellite systems as a new form of nation-state warfare”—John Cassidy, CEO and Co-Founder, King & Union

The year of protected privacy, finally?

Managing privacy will be the new normal, like securing data or paying taxes. Privacy will continue on a similar path as the evolution of cybersecurity. The number of breaches and privacy-related incidents will continue to rise, up and to the right. This rise will be comprised of peaks and valleys. Like with security, a standard of constant privacy will become the new normal. For example, while many organizations treated GDPR as a project, with a finite end, compliance is a continuous exercise that requires the same focus and vigilance as security or taxes”—Chris Babel, CEO, TrustArc

Consumers will start to reclaim control and monetize their data. Ownership of customer data will transition away from businesses and back toward customers themselves, and new services will emerge that empower customers to even monetize their own personal data and rent it back to companies. Data is the fuel that powers AI, and customers will realize they have the power to drive their own AI-based experiences by reclaiming data control”—Dr. Rob Walker, vice president, decision management and analytics, Pegasystems

“GDPR was a great first step, but global regulation and governance still remain a complex web. The United States will continue to fall further and further behind in competency and international relations as our federal compliance efforts simply aren’t moving fast enough to meet worldwide requirements. Countries where privacy is prioritized and seamlessly integrated will see the most optimal growth”—Tomas Honzak, Chief Information Security Officer, GoodData

“Data protection legislation will continue to influence societal expectations on security, which will trickle down to companies and their supply chains.  Consumers have always felt protective of their data, but with new legislation redefining the data landscape, consumers have grown more confident in demanding their data be treated with respect, that its uses are kept visible and clear, and that it is used only as they agreed. The pressure these new societal expectations will exert cannot be overstated, both on public-facing companies and through them all the way down their supply chains. Make no mistake, security and data handling are seen now by all successful companies to be as critical to business and contracts as confidentiality and liability limits have always been”—Geoff Forsyth, CTO, PCI Pal

There will be a lot more focus on privacy and security of connected cars. The information from the connected car is arguably more sensitive than our credit card information – where do we go, when do we go there, when are we home, where do we shop and work, where do our kids go to school and what locations do we go to at what time. There will be breaches of this personal information and bad things that happen as a result. There will be more of the takeover scenarios where an external (bad) actor can take over the technology. This too will result in backlash and involvement of political and legal entities to begin to make laws and precedents. What can law enforcement access and discover to use for investigation purposes?”—Todd Walter, chief technologist, Teradata

“As privacy concerns grow, there will be an increasing interest in privacy-preserving machine-learning techniques that are able train accurate models without compromising privacy”—Prasad Chalasani, Chief Scientist, MediaMath

The global regulatory environment will become more challenging as regulators and governments worldwide continue to strive to implement better data privacy protection as was done with GDPR. While this is a great progress, we’re going to see these governments counter to gain more access to information”—Phil Dunkelberger, CEO, Nok Nok Labs

“As governments implement new data privacy regulations, enterprises will increasingly adopt a ‘Privacy First’ approach to data management. However, the challenges these enterprises will face as they seek to integrate data privacy best practices into their existing applications, as well as new mobile, IoT and other applications, will be significant. Enterprises will need AI-powered, automated, outcome-driven data management solutions to address these challenges if they hope to implement strong data privacy policies without sacrificing productivity or agility”—Don Foster, senior director of worldwide solutions marketing, Commvault

“In 2019, the US government will NOT adopt any new digital privacy policies despite the recent congressional hearings with Twitter, Facebook, Google, etc.”—Kevin Lee, Trust and Safety Architect, Sift Science

The Cloud changes everything and everything is connected… and vulnerable

“Your smart fridge will start scamming you. IoT-connected appliances such as refrigerators and washing machines already produce unattended payments that the user cannot personally verify. Fraudsters see this vulnerability now and will begin to take advantage of it”—Uri Rivner, Chief Cyber Officer, BioCatch

“In 2019, the two main targets for cyber-attackers will be the cloud and user devices. Operating systems on user devices provide more functionality than ever before, making them more vulnerable and an easy target for attackers. At the same time, users will expect more flexibility and the ability to work with any OS, any application, and on any device. As organizations look provide security, privacy, and productivity, they will have to shift to a new, ‘zero trust’ device architecture”—Tal Zamir, CEO, Hysolate

“IoT, in its current state, is not secure. There are secure devices out there, but they are the exception rather than the rule. Perhaps more concerning is that there are no revolutions in IoT security on the horizon. IoT will continue to be vulnerable in 2019”—Erez Yalon, Head of Security Research, Checkmarx

“A marked shift from network security towards identity-based application security will take place next year. The cloud causes traditional control planes to become obsolete. From firewalls and IPS’s to host-based security tools, current technologies cannot be implemented in an effective and constructive manner. Application identities, in a similar process that user identity underwent in the last couple of years, will conquer the main stage”—Ran Ilany, CEO, Portshift

“With Waymo, Cruise, Uber and other autonomous vehicle industry players rushing to the market and expanding previously limited pilots to wider scale public deployments, we predict that a self-driving car used ‘in production’ will be hacked. The immediate implications are unlikely to be life-threatening, however, they will only strengthen concerns about a potential nightmare scenario like car ransomware”—Nir Gaist, CTO and co-founder, Nyotron

Teams will shift to prioritizing cloud-delivered security solutions over traditional appliance-based point products. In addition, teams will shift to simplifying security architectures by prioritizing solutions that provide consolidated feature sets that would have traditionally required numerous separate point products. This will be driven by a vastly expanded attack surface and necessary operational efficiency for understaffed teams”—Gene Stevens, CTO & Co-Founder, ProtectWise

“From Windows to IoTs, Apple and Microsoft have invested colossal amounts in information security to make it very difficult for attackers to enter. In addition, due the accelerated growth in the number of IoT vendors and a severe lack of regulation, significant investments are now being made in developing breakthrough attack capabilities in this field”—Eilon Lotem, CTO, SAM Seamless Network

IoT-enabled device innovation will continue to outpace the security built into those devices and Federal government regulation will continue to inadequately define the laws and fines required to affect change. State-level regulations will be enacted to improve the situation, but will likely fall short in impact, and in many cases, only result in a false sense of consumer confidence with respect to the security of these devices”—Carolyn Crandall, Chief Deception Officer, Attivo Networks.

Cyber breaches will have increased impacts on corporate stock prices, especially in the technology and cyber security sector. The rate at which we’re seeing attacks, and the breadth of the impact is alarming but as of yet haven’t had a large impact on stock prices. However, this will soon change as organizations complete their digital transformation and move to the cloud. Once this happens, a breach is going to have a larger impact on their revenue and as a result a detrimental effect on stock price. Another impact of companies moving operations and revenue to the cloud is we’re going to see more criminal and state organizations going after cybersecurity companies to infiltrate code in their distribution base or take them offline to get to the corporations themselves”—Stan Lowe, Global CISO, Zscaler

“Consumers and legislators alike are increasingly aware of the cyber risks facing the automotive industry as vehicles become increasingly connected.Due to the growing number of susceptible entry points in today’s connected cars, it is only a matter of time before the automotive industry experiences further significant cyber-related product recalls. Moving into 2019, it is imperative that OEM and Tier 1 suppliers ensure robust cyber security protections over the course of the vehicle lifespan. A multi-layered, end-to-end security solution that enables over the air system update capabilities will become the norm. Now is the time for automakers to be proactive and take the wheel in deploying effective solutions for automotive cyber security”—Yoni Heilbronn, CMO, Argus Cyber Security

“Cloud and DevOps transformations will rapidly gain pace in 2019, increasing the risk at the web application layer for enterprises. The reason for this increase is simple: the application layer used to be mostly static assets like marketing websites, but flash forward to today, it is now often the primary way an enterprise interacts with their customers (via full featured web applications or APIs that back mobile apps). This massive shift in functionality comes an equally massive shift in risk. The number one lesson for CISOs is that the transformation to cloud and DevOps will be successful if you can shift your security program from being a blocker to an enabler and focus on making your application and DevOps teams security self-sufficient”—Zane Lackey, Co-Founder and CSO, Signal Sciences

Endpoint security will be redefined by detection and response features (EDR), plus managed detection and response (MDR) services. Endpoint prevention (EPP) has been king of the hill for years, now more than 80% of these solutions fall behind on requirements to provide a combined prevention, detection, investigation, response, system management, and security hygiene as a solution set via a single agent for Windows, macOS and Linux systems. Less than 20% of organizations have the resources and skills for mature EDR solutions which will drive the need for MDR services to the majority of companies, even more so for 24/7 coverage”—Tom Clare, Senior Product Manager, Fidelis Cybersecurity

“With IoT growth posing huge unknown risks to enterprises with the introduction of 5G, businesses will increasingly need to invest in both technology and employee training in order to prepare for the next generation threat landscape. What’s more is that 5G will not only give rise to new threats, but it will also provide cyber criminals with new opportunities to carry out attacks that we have seen grow in popularity over the years with greater force and impact. With this in mind, even an organization that ‘does everything right’ to combat threats posed by 5G could still be impacted just as easily as those that are less security savvy”—James Willett, Vice President of Technology, Neustar

“As IoT innovation continues to blossom, more and more IoT devices will continue to get involved in DDoS attacks in 2019. Routers and cameras are the major types of IoT devices involved in DDoS attacks, with routers making up 69.7% of IoT devices exploited to launch DDoS attacks, and 24.7% of cameras in 2017. This is because a great number of routers and web cameras have been introduced into production and living environments, with no sufficient security measures enforced. We have every reason to believe that attacks leveraging the IoT will become more diverse in the future”—Guy Rosefelt, Director of Product management for Threat Intelligence & Web Security, NSFOCUS

“With the number of IoT technologies in the workplace beginning to outnumber conventional IT assets, there is an ever-increasing probability that these devices will be used as entry point by malicious actors to further compromise corporations for data breaches. Expect in 2019 to see this come to reality and several breaches will be directly tied to installed IoT technology”—Deral Heiland, IoT Research Lead, Rapid7

Industrial control systems are the wild-west of cybersecurity at the moment. These systems control factories, buildings, utilities, etc.  Most systems have little-to-no protection, and best practices are still being adopted very slowly. They also represent extremely high-value targets, especially from a strategic point of view.  A few new companies have entered the landscape, but it is still an extremely young industry”—Bryan Becker, application security researcher, WhiteHat Security

“At a time where nearly every device is connected to the internet, vendors should be taking security seriously. Too many of these products, toys, and phone apps that connect to the cloud in an insecure or unencrypted fashion and are at risk. Security issues have been plaguing the IoT market from the very beginning and it will only continue to exacerbate in 2019. IoT manufacturers will continue to race to introduce new products before their competitors bypassing secure coding practices resulting in products that add risk to corporate environments”—Karl Sigler, Threat Intelligence Manager, Trustwave SpiderLabs

“It’s important to consider the role of certificates in a world of connected devices. Nations (and more U.S. states) will follow California’s lead and enact legislation requiring security for IoT networks. This is particularly important for the healthcare, transportation, energy, and manufacturing sectors, which face the highest risk. The legislation stops short of prescribing strong forms of authentication—but thankfully, consortium groups such as the Open Connectivity Foundation and AeroMACS have championed the use of strong certificate-based authentication in their best practice standards for IoT—Damon Kachur, Vice President of IoT, Sectigo

“It may not seem like a big deal for an attacker to compromise your smart-lights, but those can connect to your smart home management device (e.g., Google Home, Amazon Echo), and from there propagate throughout both your physical and notional personal networks. And those networks can be tied to even larger ones that could result in high-profile DDoS attacks. Every added device is an added attack surface, and we’re in for a very rude awakening in the near future”—Ken Underhill, Master Instructor, and Joe Perry, Director of Research, Cybrary

Cybersecurity skill set transformation

“As IT organizations embrace public cloud environments, the threat of cyber-attacks and malicious attempts is a growing phenomenon. However, a gap still exists between the industry’s needs and what can be achieved with the available workforce. As cloud increasingly becomes a part of every IT environment, 2019 will be a key year for re-skilling the workforce, educating new talent and making the right moves to face the cyber challenge”—Avishai Sharlin, General Manager, Amdocs Technology

The role of CISO will become intertwined with CTO. Security will need to integrate into the operations of a business if it is to become an enabler rather than a blocker of innovation. The same can be said for the blurred lines between the roles of the CISO and CTO. We have seen time and again the c-suite take the brunt of the fallout following high-profile security breaches – where the buck used to stop long before the CEO, the fallout from a security breach increasingly takes senior management along with the security and teaching teams. As a result, the distinction between the traditional roles of the CISO and CTO will become yet more gray next year”—Ivan Novikov, CEO, Wallarm

“Security is increasingly starting at the developer level, a trend that will only grow next year. As an industry, we’ve realized that security should lie at the heart of any digital transformation initiative and should never be an afterthought but built-in by design. The code should be secure, as well as the design and processes. DevSecOps should be applied for applications as well as the cloud, infrastructure and work with partners. Organizations will look to create more security ambassadors at the developer level next year who can advocate for employee awareness around the individual’s role in overall security”—Brent Schroeder, CTO Americas, SUSE

“In 2018, cybersecurity was more widely accepted as a board level topic and senior executives became more aware about its impact on achieving business goals and brand protection. Looking toward 2019, boards will want to see objective measurement and validation of program effectiveness, and will continue to bring on independent cybersecurity advisors or add team members with experience in cybersecurity, putting more pressure on CISOs. As a result, the effectiveness of cybersecurity programs will rely more and more on CISOs and their ability to partner with the board and communicate security needs to them. CISOs that can communicate a clear strategy and a measurable plan will have increased support, as well as funding for key initiatives”—Andrew Howard, CTO, Kudelski Security

“It’s no surprise that we are currently in a massive deficit of qualified cybersecurity talent. In 2019, we will see a more modern approach to recruiting and retention in the cybersecurity workforce to fill this void and create more diversity. We will see an uptick in apprenticeship programs, more diverse training, recruiting practices and federal funding to help bridge the enormous talent and diversity gap the industry has today“—Jason Albuquerque, CISO, Carousel Industries

The ever-evolving cybersecurity landscape

“The security industry tends to look at future trends as monumental shifts in attack methodologies, security technologies, or predictions. In reality, shifts in attack methodologies, security technologies, and observations tend to be incremental. Spending 20% of your time enhancing controls on the security essentials can easily yield 80% of your security improvements. The remaining time should be spent on exploring more advanced technologies that can help fill some of the more niche gaps in your security program. In the coming year, shifts in attacks will be incremental if the same old attacks continue to work as they have in the past”—Jason Rebholz, Senior Director at Gigamon

In 2019, we will see advances in mobile biometric sensors. The industry has dipped its toe in the water in regards to fingerprint sensors being placed underneath phone screens as a solution to eliminate the “home button,” expect to see these screen sensors cannonball into becoming the norm. We may even see Samsung extend their capability with Iris beyond phone unlock and Samsung apps. There will be a battle as to which biometric is best, face or fingerprint, with focus on usability rather than performance rates, ultimately this will come down to user preference as to which is more convenient for individuals and fits better with their use cases”—John Callahan, CTO, Veridium

The demand for affordable, managed security service providers will increase dramatically in 2019 due to a rise in attacks on small and medium sized businesses as a result of successful monetization of ransomware, crimeware and extortion by criminal organizations. With the shortage of available security professionals in the workforce, one of the only places SMB’s will be able to turn to in 2019 are MSSPs”—Sharon Reynolds, Chief Information Security Officer, Omnitracs

”In 2019, healthcare organizations will be the number one target for attackers. The evolution of attacks has made it much harder to secure the industry, creating and growing an entire ecosystem that lends itself to multiple forms of fraud that the attacker can profit off of. For example, in healthcare, when protected health information (PHI) is stolen, attackers are able to steal identities, gaining access to medical information, which the attacker either uses or sells to then obtain prescriptions to be traded or sold illegally”—Bob Adams, cybersecurity specialist, Mimecast

“New, high-profile breaches will push the security industry to finally solve the username/password problem. The ineffective username/password conundrum has plagued consumers and businesses for years. There are many solutions out there—asymmetric cryptography, biometrics, blockchain, hardware solutions, etc.—but so far, the security industry has not been able to settle on a standard to fix the problem. In 2019, we will see a more concerted effort to replace the password solution all together”—Marcin Kleczynski, Founder and CEO,Malwarebytes

“In 2019 we will see an evolution in the two-factor authentication (2FA) process that directly addresses some of the most discussed fraud attacks. It’s a documented fact that the use of 2FA to stop unauthorized account access has exponentially decreased account takeover fraud around the globe, but as fraudsters have evolved, so too must the techniques used to combat them. The increasing prevalence of SIM swap fraud and porting fraud (where attackers take over an end-user phone number so they can intercept one-time passcodes) has led to more collaboration between online businesses and mobile network operators, who can tell those businesses (in real-time) when a SIM swap or porting change has occurred. What we will see as 2019 unfolds is the use of that data to augment 2FA, which will ultimately ensure the continued growing adoption of this important security step by both businesses and their users”—Stacy Stubblefield, Co-Founder and Chief Innovation Officer, TeleSign

“Year-end cyber predictions often focus on specific threat categories and whether or not to expect an increase or decrease in their activity. 2019, however, promises a more fundamental shift in the cyberthreat landscape, for example the impact of social media as an exploding vector for malicious activities and the implications for businesses protecting their assets. Cybersecurity is not an IT problem, it is far wider than just ‘computers’ and the threats ahead in 2019 will make this painfully obvious”—Raj Samani, Chief Scientist and McAfee Fellow, McAfee

“Fraud attacks continue to rise, and we can expect to see them increase in volume up to 2-3X in the coming year. In addition to an increase number of attacks, we anticipate cyber criminals will leverage new tactics to fool retailers and consumers. We will continue to see them utilizing compromised data obtained from data breaches, but beyond that we can anticipate the use of account take over efforts like attacking small and medium-sized online merchants that don’t have proper eCommerce fraud risk technologies, and attacking online merchants with high speed velocity, identity takeover, and brute force high volume attempts”—Steven Gray, Head of Payments, Tax and Fraud, Radial

In 2019, there will be continued consolidation of companies in the security sector, especially for those that have developed technologies that relate to Digital Identities (DIs), including the on-boarding of individuals behind the DIs, the authentication of the individuals behind the DIs (MFA), and the continual management of privileges and access (IAM)”—Todd Shollenbarger, Chief Global Strategist, Veridium

“Small organizations are finally realizing that they need to be as prepared as large organizations when it comes to cybersecurity, making it no longer an IT problem but a larger business challenge within every organization. Additionally, we will see small businesses’ approach to cybersecurity impacting larger organizations through the supply chain vector. Hackers will take advantage of smaller organizations, which often fuel larger business’ supply chains, because they typically have security vulnerabilities that can be more readily exploited than larger ‘targeted’ companies”—Brian NeSmith, CEO and co-founder, Arctic Wolf Networks

“Because security has not been built into established industries like utilities, these sectors are an easy target across the globe and a prime mark for attackers looking to engage in cyber warfare. While their vulnerability has been well-documented, I believe the industry won’t take the threat seriously until something significant occurs—but by then, it will be too late. As we head into 2019, expect this threat to intensify until it finally boils over and results in action. By 2023, Threat X predicts there will be a major attack on a US utility that will finally force the industry to address these vulnerabilities”—Bret Settle, CEO, Threat X

“Risk management is going to become an extremely critical topic for both the public and private sector next year.  As a nation, we are facing complex geopolitical issues and state-sponsored attacks targeting our businesses and government on an enormous scale. Large financial institutions and Silicon Valley companies have already experienced billions of dollars in losses due to decisions being made without effective Enterprise Risk Management. Data is both an asset and a liability and next year we are going to see the regulatory environment become even more complex around data governance, which will see Enterprise Risk Management become a huge priority for the c-suite and board”—David Pigott, Chief Compliance Officer, Neustar

Source: https://www.forbes.com/sites/gilpress/2018/12/03/60-cybersecurity-predictions-for-2019/#57c3994b4352

Middle East, North Africa Cybercrime Ups Its Game

Ransomware, DDoS extortion, and encrypted communications abound as cybercriminals in the region refine their tradecraft.

Ransomware infections increased by 233% this past year in the Middle East and North Africa as part of a shift toward more savvy and aggressive cybercrime operations in a region where criminals just last year mostly were sharing malware tools, phony documents, and services for free or on the cheap.

Researchers at Trend Micro found that cybercrime in the region has matured rapidly in the past year, with hackers employing the Telegram messaging app for encrypted communications and money-laundering services to replace rudimentary cash-out transaction methods that in many cases converted stolen physical items into cash. “The increase in money-laundering services also shows the demand for monetizing ill-gotten gains has increased over time,” says Jon Clay, global threat communications director at Trend Micro. “This all shows an increase in money-motivated cybercrimes within this region.”

The shift from email, Skype, and Facebook Messenger to Telegram as well as WhatsApp for encrypted communications and money-laundering schemes is about flying under the radar as the cybercrime gangs in the region have evolved into more experienced and lucrative operations. They now offer so-called broker services or “contracts” for moving money, using European banks, PayPal, Western Union, and banks in the region. They offer commissions between 10% to upward of 50% to convert stolen funds into a different currency, preferring to cash out in stronger currencies, such as the US dollar via US banks.

SQL injection tools, keyloggers, port numbers for Internet-connected SCADA equipment, and hacking instruction manuals all had been offered for free in the region’s underground in 2017, according to previous Trend Micro research. The WannaCry ransomware sample was sold for $50. Freely shared tools still exist there today, according to Clay, but the criminals are moving to more stealthy and secure infrastructures to hide their activities.

One of the biggest changes Trend Micro saw was the move from a tool that was “open source (and likely insecure) to a private communications tool,” he says. “This tool encrypts all communications between the members and can ensure law enforcement cannot access. This has provided the underground community with a much more secure and private means of communications.”

Aside from ransomware, distributed denial-of-service (DDoS) attacks and website defacements remain a popular attack by hackers in the region. What was once the domain of hacktivists has become yet another money-making opportunity for cybercriminals to extort their victims with destructive attacks on their websites, for example.

The oil and gas industry remains one of the biggest targets in the region – half of all cyberattacks  hit that sector – due to its pervasiveness and financially lucrative status. These organizations can’t afford a ransomware or DDoS attack to disrupt sensitive operations. “These factors make it more likely that a compromised victim may pay an extortion or ransom fee,” Clay says.

Law enforcement, too, has matured in its fight against cybercrime, which, in turn, has forced attackers to better hide their tracks. So far, Trend Micro hasn’t detected any links between the cybercrime world there and nation-state operations. “In our analysis of the actors themselves, we’re seeing predominately young males with either a high school or college education. As such, they are likely very good with technology, aggressive in their work, but still need more time to build their skillsets,” Clay says.

Going Global
All of this means yet another international cybercrime region is emerging as a threat to nations such as the US. “This is a region that is increasing in their cybercriminal operations and will likely target organizations within the US,” Clay says. “With an increase in the US oil and gas industry, these actors are learning what works within their own region and can take that knowledge and apply it into attacks within the US region.”

They already are selling tools in both Arabic and English-speaking underground forums, notes Mayra Rosario Fuentes, senior threat researcher at Trend Micro. “They are no longer just targeting their own region.”

The Middle East and North Africa will become a bigger player in global cybercrime. “This should be a call for the regional law enforcement and government to improve their laws and ability to arrest and convict these criminals,” Clay says. “It is also a call for organizations to recognize this region as a threat to their operations and improve their security capabilities to thwart attacks from this region.”

Source: https://www.darkreading.com/vulnerabilities—threats/middle-east-north-africa-cybercrime-ups-its-game/d/d-id/1333354

Players affected as online game ‘Final Fantasy XIV’ hit by ‘unprecedented’ cyberattacks

Servers for Square Enix Co.’s popular online game “Final Fantasy XIV” has been hit by a series of cyberattacks since early October, preventing some users from accessing the service, its publisher said Thursday.

The distributed denial of service (DDoS) attacks, in which multiple hacked computers are used to flood the target system, were carried out to an “unprecedented extent” against data centers in Japan, North America and Europe, Square Enix said.

The identities of the attackers are not yet known, although information security experts suspect links to cheap online services that carry out so-called DDoS attacks.

Two major attacks in early October and late October prevented game players from logging in to the service or cut off their connections for up to 20 hours, according to the company.

Square Enix has taken steps against the attacks but the servers were attacked again Tuesday night, disrupting the service for some 50 minutes.

“FFXIV” had previously been subjected to DDoS attacks. A study by a U.S. internet company has showed that some 80 percent of DDoS attacks worldwide are targeted at game services.

“The attacks may have been carried out by people who commit the offense for pleasure, hold a grudge against the company or seek money,” said Nobuhiro Tsuji, an information security expert.

“The attacks have extended over a long period, and, while it is costly, there is no choice but to boost countermeasures,” the expert at SoftBank Technology Corp. said.

In 2014, a high school student in Kumamoto Prefecture was found to have used an online DDoS attack service to disrupt a different game company’s operations after he became frustrated with the way the game services were managed. He was referred to prosecutors the same year.

Source: https://www.japantimes.co.jp/news/2018/11/01/business/tech/players-affected-online-game-final-fantasy-xiv-hit-unprecedented-cyberattacks/#.W9yKTuIpCUk

Copyright © 2014. DoS Protection UK. All Rights Reserved. Website Developed by: 6folds Marketing Inc. | Demo Test