Most Small UK Businesses Have No Security Oversight

Smaller UK businesses typically don’t assign an employee to be responsible for information security education and implementation—and are becoming fraud victims as a result.

As detailed in its State of the Industry report, appropriately-named information destruction expert Shred-it has found that nearly half (46%) of small business owners have no employee responsible for managing data security issues internally. Even more concerning, more than a quarter (27%) of small businesses do not have information security policies and procedures in place at all.

And, a third of those who do have policies in place admit to never training their employees on their protocols.

If data security is not made a priority, businesses are left exposed to data breaches, fraud, heavy legal fines from the Information Commissioner’s Office (ICO) and other regulatory bodies, and loss of customers and business partners—all of which can cause irreversible damage.

Since April 2010, the ICO has issued over £7 million worth of fines to organizations that have experienced a data breach. Despite such high figures and the irreversible damage to a company’s reputation as a result of a breach, businesses are still not doing enough when it comes to data security, the report concluded.

In addition to appointing a data protection officer, companies can reduce the risk of workplace fraud by implementing a few best practices. For instance, surprise audits: Conduct unscheduled workplace audits to assess how employees process, store and destroy confidential information.

Frequent training on the risks of fraud and how to prevent it is also important, along with education about vulnerable areas in which to avoid leaving confidential information in the office and off-site.

Shred-it is also calling on the UK government to implement legislation to ensure all businesses have a dedicated employee responsible for raising awareness of the importance of data security, understanding changes to legislation and enforcing data security procedures in the workplace.

“There is a strong correlation between data security practices and data breaches. Introducing legislation which mandates an employee specifically responsible for raising awareness of data security in the workplace and implementing a ‘culture of security’, will help protect businesses  against fraud and help them avoid financial or legal penalties,” said Robert Guice, SVP, EMEA, Shred-it.

To ensure all companies in the UK follow similar standards in data protection compliance, Shred-it has also urged the government to introduce legislation which ensures organizations have dedicated employees responsible for managing and monitoring data security issues on a day-to-day basis.

The longest continuous attack recorded by Kaspersky Lab lasted almost two weeks

The longest continuous attack recorded by Kaspersky Lab in the third quarter of 2015 lasted for 320 hours, or almost two weeks. This is one of the findings of the new quarterly DDoS report, based on constant monitoring of botnets and observing new techniques utilised by cybercriminals.

The Q3 report shows that DDoS attacks remain highly localised. 91.6% of victims’ resources are located in only 10 countries around the world, although we have recorded DDoS attacks targeting servers in 79 countries total. What is even more significant is that DDoS attacks are most likely to originate from the same countries.The longest continuous attack recorded by Kaspersky Lab in the third quarter of 2015 lasted for 320 hours, or almost two weeks. This is one of the findings of the new quarterly DDoS report, based on constant monitoring of botnets and observing new techniques utilised by cybercriminals.

The Q3 report shows that DDoS attacks remain highly localised. 91.6% of victims’ resources are located in only 10 countries around the world, although we have recorded DDoS attacks targeting servers in 79 countries total. What is even more significant is that DDoS attacks are most likely to originate from the same countries.

China, the United States of America and South Korea occupied top positions in both ratings of the most frequent attack sources and targets. Although other cybercrime syndicates, focusing on things like credit card theft, may operate far from their country of residence, this is not the case for DDoS.

More than 90% of attacks lasted less than 24 hours but the number of attacks lasting over 150 hours grows significantly. The highest number of attacks on the same victim was 22, on a server located in The Netherlands.

The report also showed that Linux-based botnets are significant, accounting for up to 45.6% of all attacks recorded by Kaspersky Lab. Main reasons include poor protection and higher bandwidth capacity.

“Based on our observations and direct measurements, we cannot pinpoint one exact direction in which the underground business of DDoS attacks is moving," commented Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab.

"Instead, the threat appears to be growing everywhere. We have recorded highly complex attacks on banks, demanding a ransom, but have also observed new, low-cost methods designed to put a company’s operations down for a significant amount of time. Attacks are growing in volume with most of them aiming to attack, disrupt and disappear, but the number of lengthy attacks, capable of bankrupting a large, unprotected business is also on the rise. These significant developments make it imperative for companies to take measures to prevent the very real threat and increased risk posed by DDoS attacks.”

The study also found that cybercriminals go on vacation too, just like regular people, with August the quietest month of the quarter for attacks. Meanwhile, banks are frequent targets of complex attacks and ransom demands.

China, the United States of America and South Korea occupied top positions in both ratings of the most frequent attack sources and targets. Although other cybercrime syndicates, focusing on things like credit card theft, may operate far from their country of residence, this is not the case for DDoS.

More than 90% of attacks lasted less than 24 hours but the number of attacks lasting over 150 hours grows significantly. The highest number of attacks on the same victim was 22, on a server located in The Netherlands.

The report also showed that Linux-based botnets are significant, accounting for up to 45.6% of all attacks recorded by Kaspersky Lab. Main reasons include poor protection and higher bandwidth capacity.

“Based on our observations and direct measurements, we cannot pinpoint one exact direction in which the underground business of DDoS attacks is moving," commented Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab.

"Instead, the threat appears to be growing everywhere. We have recorded highly complex attacks on banks, demanding a ransom, but have also observed new, low-cost methods designed to put a company’s operations down for a significant amount of time. Attacks are growing in volume with most of them aiming to attack, disrupt and disappear, but the number of lengthy attacks, capable of bankrupting a large, unprotected business is also on the rise. These significant developments make it imperative for companies to take measures to prevent the very real threat and increased risk posed by DDoS attacks.”

The study also found that cybercriminals go on vacation too, just like regular people, with August the quietest month of the quarter for attacks. Meanwhile, banks are frequent targets of complex attacks and ransom demands.

Backdoor in Baidu Android SDK Puts 100 Million Devices at Risk

The China's Google-like Search Engine Baidu is offering a software development kit (SDK) that contains functionality that can be abused to give backdoor-like access to a user's device, potentially exposing around 100 Million Android users to malicious hackers.

The SDK in question is Moplus, which may not be directly available to the public but has already made its way into more than 14,000 Android apps, of which around 4,000 are actually created by Baidu.

Overall, more than 100 Million Android users, who have downloaded these apps on their smartphones, are in danger.

Security researchers from Trend Micro have discovered a vulnerability in the Moplus SDK, called Wormhole, that allows attackers to launch an unsecured and unauthenticated HTTP server connection on affected devices, which works silently in the background, without the user's knowledge.

This unsecured server does not use authentication and can accept requests from anyone on the Internet. Though the server is controlled by the attacker, who can send requests to a particular port of this hidden HTTP server to execute malicious commands.

Malicious Functionalities of Wormhole
Currently, the researchers have identified that the SDK is using the port 6259 or 40310 to perform malicious activities on affected Android devices, which includes:

•     Send SMS messages
•     Make phone calls
•     Get mobile phone details
•     Add new contacts
•     Get a list of local apps
•     Download files on the device
•     Upload files from the device
•     Silently install other apps (if the phone is rooted)
•     Push Web pages
•     Get phone's geo-location, and many more

Since the SDK automatically installs the Web server when a Moplus SDK app is opened, hackers just need to scan a mobile network for port 6259 or 40310, thereby finding vulnerable devices they can abuse.

Wormhole is More Dangerous than Stagefright 
The vulnerability, according to researchers, is potentially easier to exploit than the Stagefright flaw, as Wormhole doesn't require social engineering to infect an unsuspecting user.

Trend Micro has also found at least one malware strain (detected as ANDROIDOS_WORMHOLE.HRXA) in the wild that takes advantage of Wormhole in Moplus SDK.

Researchers informed both Baidu as well as Google of the vulnerability.

As a result, Baidu has just pushed a partial fix for the problem by releasing a new version of the SDK that removed some of the SDK's functionality, but not all. The HTTP server remains online and active; however, Baidu assured its users that no backdoor exists now.

This isn't the first time a Chinese company has caught distributing malicious SDK. Just a few days ago, the Taomike SDK – one of the biggest mobile ad solutions in China – was caught secretly spying on users' SMS messages and uploading them to a server in China.

The same malicious functionality was also discovered two weeks back in another SDK developed by Youmi; that affected 256 iOS apps, which were caught using private APIs to collect users private data. However, Apple eventually banned those apps from its App Store.

Akamai warns of 3 new reflection DDoS attacks

Akamai Technologies, Inc. says it has observed three new reflection distributed denial of service (DDoS) attacks in recent months. An advisory from Akamai details the DDoS threat posed by NetBIOS name server reflection, RPC portmap reflection, and Sentinel reflection in full, including payload analysis, a Snort rule, and system hardening best practices

What is DDoS reflection?
In a reflection DDoS attack, also called a DrDoS attack, there are three types of participants: the attacker, victim servers that act as unwitting accomplices, and the attacker’s target. The attacker sends a simple query to a service on a victim host. The attacker falsifies (spoofs) the query, so it appears to originate from the target. The victim responds to the spoofed address, sending unwanted network traffic to the attacker’s target. Attackers choose reflection DDoS attacks where the victim’s response is much larger than the attacker’s query, thus amplifying the attacker’s capabilities. The attacker sends hundreds or thousands of queries at high rates to a large list of victims by automated the process with an attack tool, thus causing them to unleash a flood of unwanted traffic and a denial of service outage at the target.

“Although reflection DDoS attacks are common, these three attack vectors abuse different services than we’ve seen before, and as such they demonstrate that attackers are probing the Internet relentlessly to discover new resources to leverage,” said Stuart Scholly, senior vice president and general manager, Security Business Unit, Akamai. “It looks like no UDP service is safe from abuse by DDoS attackers, so server admins need to shut down unnecessary services or protect them from malicious reflection. The sheer volume of UDP services open to the Internet for reflection DDoS attacks is staggering.”

The attack tools for each of the new reflection attacks are related – they are all modifications of the same C code. Each attack vector requires the same basic recipe – a script that sends a spoofed request to a list of victim reflectors. The command-line options are similar.

NetBIOS name server reflection DDoS attack
The NetBIOS reflection DDoS attack – specifically NetBIOS Name Service (NBNS) reflection – was observed by Akamai as occurring sporadically from March to July 2015. The primary purpose of NetBIOS is to allow applications on separate computers to communicate and establish sessions to access shared resources and to find each other over a local area network.

This attack generates 2.56 to 3.85 times more response traffic sent to the target than the initial queries sent by the attacker. Akamai observed four NetBIOS names server reflection attacks, with the largest recorded at 15.7 Gbps. Although legitimate and malicious NetBIOS name server queries are a common occurrence, a response flood was first detected in March 2015 during a DDoS attack mitigated for an Akamai customer.

RPC portmap reflection DDoS attack 
The first RPC portmap reflection DDoS attack observed and mitigated by Akamai occurred in August 2015 in a multi-vector DDoS attack campaign. RPC portmap, also known as port mapper, tells a client how to call a particular version of an Open Network Computing Remote Procedure Call (ONC RPC) service.

The largest responses had an amplification factor of 50.53. A more common amplification factor was 9.65. Of the four RPC reflection attack campaigns mitigated by Akamai, one exceeded 100 Gbps, making it an extremely powerful attack. Active malicious reflection requests were observed by Akamai almost daily against various targets in September 2015.

Asian companies are in biggest danger of cyber attacks

Attackers are advancing zero day exploits into ‘zero-day-plus-one’ attacks at record speed, warns a new report from Nexusguard. Attacks are outpacing even those IT teams working at their most efficient pace, and teams could not possibly be expected to keep up with the rate of attack.

Add to this the falling cost of botnet-for-hire schemes that threaten to attack unsuspecting businesses for as little as twenty-dollars per attack and teams are overwhelmed in their efforts to stay ahead of swiftly evolving threats.

“The Asia Pacific region not only produces the most amount of DDoS scans to the Internet, but is also the biggest target of DDoS attacks than anywhere else in the world,” says Terrence Gareau, Chief Scientist at Nexusguard. “With the highest rate of software piracy globally, it should come as no surprise that the large botnets are able to operate freely in this region simply because there are so many vulnerable systems.”

Industry and analyst research reviewed in the latest Cybersecurity Asia Pacific report sponsored by Nexusguard point further to the serious cybersecurity threat that companies in the region are facing.

The report notes that organizations in the Asia-Pacific region were forecast to spend $230 billion to deal with cybersecurity breaches in 2014 — the highest amount for any region in the world, according to International Data Corporation (IDC) and the National University of Singapore survey, as reported in Marsh’s “Cybercrime in Asia” 2014 report.

The Asia Pacific Cyber Security Market contributes 17.21 percent of the global market and will grow to 21.16 percent by 2019, according to MicroMarketMonitor.

The private sector – highly developed, economically lucrative, and a prime target for the theft of intellectual property, blackmail, phishing, and identity theft – is investing in cybersecurity in nations such as China, Japan, Korea, Australia, New Zealand, Hong Kong, and Singapore”, according to ABI Research.

Research and Markets states that demand for cloud-based security solutions is one  key trend emerging in the cybersecurity market. End-users prefer cloud-based  security solutions because they are cost-effective and can be easily managed. Therefore, both large enterprises and SMEs in the Asia-Pacific region are increasingly adopting cloud-based cyber security solutions.

According to the Asia Cloud Computing Association, China leads Asia-Pacific nations with a total addressable cloud computing market totaling $141.9 billion. Japan is the number two nation in the region at $101.4 billion. Indonesia is number three at $76.8 billion.

More importantly, Gartner predicts that by 2018, more than half of organisations will use security services firms that specialize in data protection, security risk management and security infrastructure management to enhance their security postures. The expected increase in spending to deal with cybersecurity threats and the lack of preparedness of Asian companies thus represents an opportunity for global firms and regional or local service providers to invest in the right partnerships and technologies to beef up their security offerings.

“Cyber threats including DDoS attacks are a serious meance facing CIOs and their teams, and extending across the organization, especially with the growing integration of personal mobile devices into the corporate network, and increasing mobility of the workforce spread across multiple locations, with all of these disparate areas linked through the cloud,” said Jolene Lee, CEO, Nexusguard.

“Combined with the rate and speed of cyber-attacks and the increasing intelligence behind them, companies outsourcing their cybersecurity needs would be well advised to consider not just innovative technology and global reach, but also the depth of experience and expertise in predicting and mitigating threats.”

2015 Most Dangerous Celebrity

Who doesn’t love to search for celebrities online? From red carpet photos, to clips of the latest fashion faux pas, Hollywood gossip on the Web has a lot of us hooked. But sometimes, our interest in the stars can lead us into the digital danger zone.

Intel Security has dubbed electronic dance music DJ Armin van Buuren as the Most Dangerous Cyber Celebrity of 2015.

The company found that when Web users search for his name combined with the terms "free MP4," "HD downloads," or "torrent" they have almost a one in five chance of landing on a malicious site when they click on the search results.

A number of other musicians also generate dangerous search results, according to Intel Security's Most Dangerous Celebrities study.

"With today's busy culture and a desire for real time information, consumers often click on sites that will quickly provide them with news and entertainment, without considering safety and security implications," said Stacey Conner, online safety expert at Intel Security. "Cybercriminals leverage this need for immediacy by encouraging people to visit unsafe sites that can steal private data."

Indeed, it's worth reminding employees to access content directly from official websites of content providers, to only download videos from legitimate sites, and to use caution when searching for "HD downloads," which is by far the highest virus-prone search term

Cybercriminals will continue to innovate, looking for new ways to take advantage of our interest in pop culture to steal personal information.  Luckily, there are a few things you can do to keep yourself safe:

• Only download from verified sites. Don’t download anything from a website you don’t trust. If it looks suspicious, your hunch about its legitimacy is probably right. Access content directly from reputable sources, such as Apple Music and Google Play Music.
• Be strict when sharing your personal information. If you receive a message from an unknown website asking for your log-in, or requesting other personal information, about face. Cybercriminals often pose as legitimate companies to scoop up your sensitive information via email, text, or other methods of communication. Be wary of these phishing tactics to avoid becoming a victim of identity theft.
• Let an online safety advisor be your guide. When it’s hard to tell if a site is legitimate, a web advisor can help. 
• Use comprehensive security. Whether you follow celebrity gossip or not, it’s always a good idea to protect your devices from potential infection.