BREAKING NEWS

A10 Networks addresses corporate attitudes on cyber-security

Liken to the “Me Too” viral campaign, corporations emerge from the dark to address the rising cyber-attacks.

A10 Networks addresses corporate attitudes on cyber-security. Corporations have come out of the dark and addressed cyber-attacks that resulted on distributed denial of service (DDoS) against their businesses. Much like the “Me Too” viral campaign, many corporations have fallen victims to the cyber-attack one after another in the past year.

In some extend, some of the “victims” did not even know that their information technology (IT) system have been breached by malicious code and virus, according to Application Intelligence Report (AIR) complied by US-based computering firm, A10 Network.

Almost one in two companies hacked on average in 2017

On the all-telling reports, the US-based A10 Network surveyed over 2000 businesses and IT leaders globally on the knowledge and attitudes toward cyber-security. The survey was conducted between two targeted groups, the IT decision makers and employees of the corporations.

The findings were then rather alarming as nearly half or 44% of the companies surveyed, indicated that they have either been a victim of a DDoS attack or do not know if they have been attacked.

To be specifically, 33% of the companies polled recognized that their IT system had been breached at least once over the past 12 months, while 11% polled were still left in dark of whether at least a cyber-attack had occurred to its IT infrastructure over the past one year.

Ignorance is not bliss

On further surveys with the companies’ employees revealed nonchalant attitudes toward a DDoS attack or simply the lack of awareness in this area. As such, the AIR recorded 55% of the participating employees claimed little or no knowledge of what a DDoS attack is.

Similarly, 11% of the participants were left in the dark and unsure if they have been attack or not by DDoS over the past year. Therefore in addressing to this knowledge gap, over 90% of the IT decision makers of the corporations believed cyber-security education were needed to create the awareness among employees.

Yet to rub salt to employees’ ignorance of DDoS, almost a quarter or 23% of the IT decision makers expected the education to do little or no improvement in employees’ attitude toward corporate cyber-security best practices over the next 12 months, as opposed to 77% whom believe optimistically that improvement is nigh.

Gloom and doom for 2018

The IT decision makers’ pessimism did not stop there, as over half of the personnel polled or 60% expected the DDoS attacks to intensify in 2018. This was due to the hackers using more sophisticated approaches, where the sizes and the frequency of DDoS attacks are estimated to increase as well.

As such, only around 36% of IT decision makers are only slightly optimistic about their ability to stop threats and protect their companies. However, they cited the need for ongoing support and corporate commitment to cyber-security policy and enforcement to fend off rising attacks.

Changed attitudes with right infrastructure forms the best defense

After the publication of the report, Jonathan Tan, Regional Vice President of A10 Networks for ASEAN and Pakistan, told Hackwarenews the need to change corporate attitudes and behaviors in the ever-present threat of cyber-attacks.

“We believe that a business’ cyber defense infrastructure is critical,” said Tan.

For instance, the simple practice of changing password regularly and the two-factor or multi-factor authentication can make a difference in cyber-security. Regular email reminders for updating passwords can also help to minimize data breaches.

“The enterprises must also take on a proactive and ongoing approach towards educating the workforce on cyber security threats and precautions.” he concluded.

BREAKING NEWS

UK Fines Facebook over Cambridge Analytica Scandal

UK Fines Facebook over Cambridge Analytica Scandal. The UK has hit Facebook a fine of $645,000 for the Cambridge Analytica Scandal. It was revealed earlier this year that they had harvested the personal data of millions of profiles without the user’s consent and used it for political purposes. It is estimated that 87 million users were affected.

The fine has been enforced by the UK’s Information Commissioner’s Office (ICO) and was calculated using a pre-GDPR formula for data breach fines. Using the UK’s old Data Protection Act to fine Facebook, rather than GDPR they can only give a maximum penalty of £500,000, which is equal to what the social media giant earns every 18 minutes.

GDPR rules dictate a maximum fine of 4% of annual global turnover, which would be $1.6 billion. Unfortunately the the GDPR regulation wasn’t in place when the Cambridge Analytica story broke, coming into force in May 2018.

The UK investigation concluded that Facebook’s APIs had been allowing developers access to users information without them providing proper consent, for a long period of time between 2007 and 2014. Once they realized this loophole existed and patched it up, they did nothing to investigate the data compromised or ensure it was deleted.

[FACEBOOK] should have known better and it should have done better… We considered these contraventions to be so serious we imposed the maximum penalty under the previous legislation. The fine would inevitably have been significantly higher under the GDPR

Information Commissioner Elizabeth Denham said in a statement

Facebook has said they are reviewing the ICO’s findings and stated they “respectfully disagree” with some of the report, but admit they should have done more to protect users data. They also added that they found no evidence that British users profile information was shared with Cambridge Analytica.

BREAKING NEWS

Libssh Security Flaw leaves thousands of servers vulnerable to hijacking

Libssh Security Flaw leaves thousands of servers vulnerable to hijacking. A security flaw in libssh leaves thousands, and potentially more, servers vulnerable to an attack. Libssh is a multiplatform C library which allows users to remotely execute programs, transfer files, manage public keys and use a secure and transparent tunnel.

The security flaw, discovered by Peter Winter-Smith from NCC Group, allows a hacker to bypass the authentication process on the servers and gain access to the system without having to enter a password.

An attacker can do this by sending the SSH server “SSH2_MSG_USERAUTH_SUCCESS” message instead of the “SSH2_MSG_USERAUTH_REQUEST” message that a server usually expects and which libssh uses as a sign that an authentication procedure needs to initiate.

The libssh system will treat this message to mean the authentication has already taken place and allow the attacker access to the server. The flaw (CVE-2018-10933) was released in January 2014 in release 0.6.0.

It’s estimated that the vulnerability currently affects at least 3000 servers, however this is based on a small search and the scale of the problem is not yet known. There were concerns that the popular version control site for developers to work collaboratively on projects, GitHub, was affected but they have released a statement denying this. Github claims the way they use libssh means they are not vulnerable to this exploit.

“We use a custom version of libssh; SSH2_MSG_USERAUTH_SUCCESS with the libssh server is not relied upon for pubkey-based auth, which is what we use the library for,”

a GitHub security official said on twitter

While we use libssh, we can confirm that https://t.co/0iKPk21RVu and GitHub Enterprise are unaffected by CVE-2018-10933 due to how we use the library.

— GitHub Security (@GitHubSecurity) October 16, 2018

The security flaw is only on the server side, meaning users who have a libssh based SSH client installed on their computer will be safe from potential attackers looking to exploit this vulnerability.

While there are currently no public exploits available for the vulnerability, they are easy to put together so these are likely to pop up online in the coming days and weeks.

The team at libssh released versions 0.8.4 and 0.7.6 yesterday to handle this bug.

BREAKING NEWS

Ad Clicker Disguised as a Google Photos App has been Hosted on Microsoft Store.

Ad Clicker Disguised as a Google Photos App has been Hosted on Microsoft Store.

A malicious app called “Album by Google Photos” was found to be hosted on the Microsoft store. The app was pretending to be part of Google Photos, but was in fact an ad clicker that generates hidden adverts within the Windows 10 Operating System.

The ad clicker app seemed credible to users because of its name, and also the fact it claimed to be created by Google LLC, Google’s actual Microsoft store account is Google Inc, but it looks unsuspecting to users. Microsoft came under some criticism for not realising the app was actually malicious software since the user reviews did highlight that the app was fake, with plenty of 1* reviews. One review states “ My paid Anti-malware solution detected several attempts to download malware by this app. Watch out”. The App was first released on the Microsoft store in May.

What did the application do?

The “Album by Google Photos” app is a Progressive Web Application (PWA), which acts as the front end for Google Photos and includes a legitimate login screen. Hidden in the app bundle is also an ad clicker which runs in the background and generates income for the app developers.

The app connects to ad URLS, and the ads were very similar to what users would see from typical adware, including tech support scams, random chrome extensions, fake flash and java installs and general low-quality sites.

Microsoft haven’t commented how this app managed to pass the Microsoft review process before ending up on the store. This is somewhat concerning since it could mean other malicious apps of a similar nature have flown under the radar and are still infecting user’s computers. We are waiting for Microsoft to comment on the issue.