Report: Security pros losing confidence

Security professionals were less confident in their security infrastructure in 2015 than in 2014, according to a report released by Cisco.

In 2014, 64 percent of security pros said that their infrastructure was up to date, while only 59 percent felt the same way about 2015. In addition, in 2015, 54 percent said they strongly believe that they do a good job of building security into procedures for acquiring, developing, and maintaining systems, compared with 58 percent in 2014.

"Despite all the hard efforts, there is concern that both the speed at which the technology and capabilities being deployed, and the number of people, qualified individuals to be hired, and the overall approach in the face of an overwhelming number of attacks," said John N. Stewart, chief security and trust officer and senior vice president at Cisco Systems. "This is causing confidence to go down."

Aging infrastructure was another issue raised in the report.

An analysis of more than 115,000 Cisco devices showed that 92 percent were running software with known vulnerabilities, 31 percent were no longer on the market, and 8 percent were "end of life."

The financial services industry has the highest percentage of devices that had passed their last day of support, at 20 percent.

Jason Brvenik, a principal engineer at Cisco, said that the likely explanation for this is that the financial sector has long been an early adopter of technology.

"They have more devices deployed in more places, and would have aging infrastructure," he said.

On an unrelated note, the Cisco report also uncovered browser extensions as a dangerous attack vector often overlooked by security teams.

According to Cisco, adware and browser injections were among the most difficult threats to detect, taking up to 200 hours. By comparison, downloaders that target Microsoft Word users are typically detected in less than 20 hours.

Security teams often spend less time on adware and browser injections, classifying them as lower priority.

"It's seemingly benign, it seems to offer value to the user, they like to use it," said Brvenik.

But they create invasive paths that attackers can use to install more dangerous applications, he said -- and more than 85 percent of organization were affected by malicious browser extensions.

The main problem, he said, is that many users are running out-of-date browsers that allow these malicious extensions to slip through.

"We know organizations have legacy applications that require them to legacy versions of browsers," he said. "But I advocate that, if you could, you should restrict them from accessing the Internet. They need to deploy a firewall to decide whether a version of a browser is allowed to access the Internet or not. They will significantly reduce their exposure if they enforce that policy."

Attackers use SQL injections to manipulate search engine rankings

Akamai Technologies, Inc. has issued a new Web security threat advisory from the company’s Threat Research Division. Threat Research has identified a sophisticated search engine optimization (SEO) campaign that uses SQL injections to attack targeted websites.

Affected websites will distribute hidden Hypertext Markup Language (HTML) links that confuse search engine bots and erroneously impact page rankings.

Over the course of a two week period in Q3 2015, Threat Research analyzed data gathered from the Akamai Intelligent Platform and observed attacks on more than 3,800 websites and 348 unique IP addresses participating in the various campaigns, revealing the following key findings:

• Evidence of mass defacement – when searching the Internet for the HTML links that were used as part of this campaign, Threat Research identified hundreds of web applications containing these malicious links.
• Attacks manipulated search engine results – when searching for a combination of common words such as “cheat” and “story”, it was apparent that the “cheating stories” application appeared on the first page of the leading search engines.
• Analytics showcased impact of attacks – Threat Research looked at Alexa analytics and the ranking of the “cheating stories” application dramatically increased during the three month span.

Search engines use specific algorithms to determine page rankings and indexing for sites on the web, and the number and reputation of links that redirect to the web application influence these rankings. The SEO attackers created a chain of external links that direct to stories of cheating and infidelity on the web to mimic normal web content and impact search engine algorithms.

“The ability to manipulate page rankings is an enticing proposition and business for attackers,” said Stuart Scholly, Senior Vice President and General Manager, Security Business Unit, Akamai. “If successful, attacks can impact revenue and, most importantly, the reputation of many organizations and companies using the Internet.”

Mitigation
Attacks in the campaign have demonstrated a unique understanding of search engine operations, and accordingly, Threat Research recommends the following defense techniques:

• For Web Application Developers
• Ensure that you have implemented proper input validation checks for all user-supplied data that will be used within a back-end database query. Reference: https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet
• Only use prepared statements with parameterized queries when constructing SQL queries based on user-supplied data. Reference: https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

• For Web Application Defenders
• Deploy a Web Application Firewall (WAF) that is configured in a blocking mode for SQL Injection attacks.
• Consider profiling and monitoring the HTML response body format to help identify if there are significant changes such as an increase in the number of web links.

Cyber criminals using email scam to spread virus via WhatsApp

MILLIONS of WhatsApp users are being warned to watch out for a fake email that will install a dangerous virus on their phones.

Clever cybercriminals have created the malware which is specifically designed to trick WhatsApp users on either iPhones or Android devices.

The virus is being circulated via email and is designed to look like it’s been sent by a legitimate source, researchers at Comodo Labs say. Fraudsters hope users will open the scam email and download the attached virus, which then infiltrates their phone.

Emails from the criminals contain sneaky subject lines including, “new voice message” or “an audio memo was missed” followed by a play button.

Others have received messages including “a brief audio recording has been delivered”, “a short vocal recording was obtained” and a fake notification about a video note.

Although none of the emails come from a WhatsApp address they are “disguised with an umbrella branding”, Comodo confirmed.

WhatsAppers should be aware that all voice memos, audio memos, recordings and notifications will be received in the app only.

Every scam email contains a compressed ZIP file which unleashes the secret malware into your phone when downloaded. The virus then duplicates in multiple system folders and adds itself into an auto-run in the computer’s registry.

“Cybercriminals are becoming more and more like marketers, trying to use creative subject lines to have unsuspecting emails be clicked and opened to spread malware,” said Fatih Orhan, a director of Comodo Antispam Labs.

“As a company, Comodo is working diligently in creating innovative technology solutions that stay a step ahead of the cybercriminals, protect and secure endpoints, and keep enterprises and IT environments safe.”

From Today Onwards, Don't You Even Dare to Use Microsoft Internet Explorer

Yes, from today, Microsoft is ending the support for versions 8, 9 and 10 of its home-built browser Internet Explorer, thereby encouraging Windows users to switch on to Internet Explorer version 11 or its newest Edge browser.

Microsoft is going to release one last patch update for IE8, IE9 and IE10 today, but this time along with an "End of Life" notice, meaning Microsoft will no longer support the older versions.

So, if you want to receive continuous updates for your web browser and avoid being exposed to potential security risks after 12 January, you are advised to upgrade your browser to Internet Explorer 11, or its new Edge browser.

End of Life of Internet Explorer 8, 9 and 10 
"Internet Explorer 11 is the last version of Internet Explorer, and will continue to receive security updates, compatibility fixes, and technical support on Windows 7, Windows 8.1, and Windows 10," Microsoft says.

This move could be part of Microsoft's bigger plan to move its users to the new Edge browser, which is currently available only on Windows 10 PCs.

With the launch of Microsoft Edge last April, the company attempted to encourage Windows 10 users to switch to Edge if they are using its rival browser, such as Google Chrome or Mozilla Firefox, as the default web browser.

Edge has been designed completely separate to Internet Explorer, and promises speed and usability, with support for Cortana -- Microsoft's virtual assistant.

Around 340 Million Users Run Internet Explorer
For higher adoption of Edge, Microsoft is finally ending support for Internet Explorer 8, 9 and 10. However, an estimated 340 Million Windows users are still running Internet Explorer, and nearly half of those are believed to be using one of the expired IE versions.

Therefore, the older versions of the browser will receive KB3123303 patch today that will feature "nag box" asking users to upgrade their browser.

If you have "Automatic Updates" turned ON, you most likely upgraded to IE11 already. However, users with older IE browsers can turn "Automatic Updates" ON by clicking on "Check for Updates" in the "Windows Update" section of the Control Panel.

Daily new malware count plunges as cybercriminals look to save money

The year 2015 marked the moment when demand for new malicious programmes reached saturation point, as the number of new malware files detected every day by its products fell by 15,000, from 325,000 in 2014 to 310,000, according to Kaspersky Lab.

Kaspersky Lab’s experts believe this is mainly due to the fact that coding new malware is expensive and cybercriminals have realised that they can get equally good results using intrusive advertising programmes or legitimate digital signatures in their attacks. This approach appears to be working, as results show that despite the cost-cutting in malware creation in 2015, the number of users attacked by cybercriminals increased by 5%.

Between 2012 and 2013, there was a rapid increase in the number of new malicious files detected by Kaspersky Lab, from 200,000 new files every day in 2012 to 315,000 in 2013. Thereafter, things started to slow down. In 2014, the total increased by just 10,000 files a day and in 2015 the overall number has declined from 325,000 to 310,000.

Cybercriminals in search of a quick return appear to have decided that complex coding tools such as rootkits, bootkits or replicating viruses may bring results at a cost, reducing their overall margins and revenue. Moreover, these complex malicious programmes, that can cost tens of thousands of dollars to develop, do not protect the malicious programme from increasingly sophisticated antivirus software accustomed to detecting and analysing far more complicated malware.

For this reason, 2015 saw adware, essentially harmless but often intrusive, become more prominent among overall anti-virus detections. This marks an evolution in cybercriminal tactics, with many now acting almost as businesses, engaged in selling quasi-legitimate commercial software, activity and other “essentials.”

Another trend is for cybercriminals and even advanced, state-sponsored threat actors to make greater use of legal certificates for digital products. With the help of bought or stolen certificates, attackers deceive security software, which trusts an officially-signed file more than a regular one. The value of the certificate may be only a few tens of dollars.

"Cybercrime has lost the last touch of romance. Today, malware is created, bought and resold for specific tasks. The commercial malware market has settled and is evolving towards simplification. I think will we no longer see malicious “code for the code”. This trend is also observed among the operators of targeted attacks," says Vyacheslav.

Cyberspy group repurposes 12-year-old Bifrose backdoor

A group of hackers that primarily targets companies from key industries in Asia is using heavily modified versions of a backdoor program called Bifrose that dates back to 2004.

The group, which researchers from antivirus vendor Trend Micro call Shrouded Crossbow, has been targeting privatized government organizations, government contractors and companies from the consumer electronics, computer, healthcare, and financial industries since 2010.

The group's activities are evidence that engaging in cyberespionage doesn't always require huge budgets, stockpiles of zero-day vulnerabilities and never-before-seen malware programs. Old cybercrime tools can be repurposed and improved for efficient attacks.

This toolset used by the group includes backdoors such as Kivar and Xbow, which are based on or inspired by Bifrose and which in the past have been sold on underground markets for about $10,000.

"What we think happened is that the group purchased the source code of BIFROSE, and after improving its functions, the group then designed a new installation flow, developed a new builder to create unique loader-backdoor pairs, and made more simple and concise backdoor capabilities," the Trend Micro researchers said in a blog post.

This allowed them to remain effective in their operations, despite Bifrose being a very well known and understood threat in the antivirus industry as well as one that is easily detectable.

One interesting aspect about the group is that it is organized in at least two, but possibly three or more teams, according to the Trend Micro researchers. One is the development team, which has at least 10 people who develop new builds of the backdoor. The number of people involved was determined from version strings customized with unique developer IDs.

A second team is responsible for target selection, configuring the malware parameters for each intended victim and building the spear-phishing emails that are used as delivery mechanism. The rogue emails have malicious attachments and masquerade as news reports, resumes, government data or meeting requests.

A third team might be in charge of maintaining the group's extensive command-and-control infrastructure, which includes over 100 servers whose IP addresses and domains are updated in an organized fashion. New domains are being registered all the time, the Trend Micro researchers said.