Read Time:1 Second
Post Content
Monthly Archives: February 2022
Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
Read Time:31 Second
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser. Depending on the privileges associated with the application, an attacker could view, change, or delete data. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.
Me on App Store Monopolies and Security
Read Time:56 Second
There are two bills working their way through Congress that would force companies like Apple to allow competitive app stores. Apple hates this, since it would break its monopoly, and it’s making a variety of security arguments to bolster its argument. I have written a rebuttal:
I would like to address some of the unfounded security concerns raised about these bills. It’s simply not true that this legislation puts user privacy and security at risk. In fact, it’s fairer to say that this legislation puts those companies’ extractive business-models at risk. Their claims about risks to privacy and security are both false and disingenuous, and motivated by their own self-interest and not the public interest. App store monopolies cannot protect users from every risk, and they frequently prevent the distribution of important tools that actually enhance security. Furthermore, the alleged risks of third-party app stores and “side-loading” apps pale in comparison to their benefits. These bills will encourage competition, prevent monopolist extortion, and guarantee users a new right to digital self-determination.
Matt Stoller has also written about this.
Cyber-Attack on Oil Firms
Read Time:1 Minute, 50 Second
Cyber-Attack on Oil Firms
A cyber-attack has disrupted operations at two oil storage and logistics firms in Germany.
Oiltanking GmbH Group and Mabanaft Group said on Tuesday that they had launched an investigation into a cyber-incident on Saturday.
IT systems at both companies were affected, though the full extent of the attack is still being determined. In a statement to the Associated Press, the companies said they had hired external computer forensic specialists to discover the “full scope” of the incident.
No information has been shared yet by either company regarding the nature of the attack or its perpetrators. The companies said work is being undertaken to enable them “to restore operations to normal in all our terminals as soon as possible.”
Oiltanking GmbH Group is still operating storage tank terminals for oil, gas and chemicals in all global markets. However, the attack has forced separate entity Oiltanking Deutschland GmbH, part of Mabanaft, into “operating with limited capacity” its terminals in Germany.
The statement said that Mabanaft’s German arm had “declared force majeure for the majority of its inland supply activities in Germany.”
Speaking at a conference on Tuesday, the head of Germany’s IT security agency, Arne Schoenbohm, said that while the incident was severe, it was “not grave.”
Schoenbohm said that 1.7% of the country’s total gas stations had been impacted by the incident, making it impossible for prices to be changed or for customers to pay for gas using a credit card. Cash payments were being accepted at some of the 233 affected facilities, most of which are in northern Germany.
German news agency dpa reported that industry officials had said that the cyber-attack on the two companies did not pose a threat to the country’s overall fuel supplies.
“The timing of this coincidentally aligns with Russia having threatened to shut off its pipelines into Europe as the crisis in Ukraine continues to be tense for all involved,” observed Lookout’s senior manager of security solutions, Hank Schless.
He added: “This is the perfect example of using a high-pressure situation to create opportunity for malicious cyber-activity, which attackers do as often as they can.”
California Passes FLASH Act
Read Time:1 Minute, 55 Second
California Passes FLASH Act
The California State Senate has passed legislation to ban the transmission of unsolicited sexually explicit images and videos without the recipient’s consent – a practice called ‘cyber flashing.’
Senate Bill 53, also known as the FLASH (Forbid Lewd Activity and Sexual Harassment) Act, was passed on Monday with bipartisan support.
Introduced in February 2020 by senators Connie Leyva and Lena Gonzalez, the legislation would establish legal protections for users of technology who receive explicit sexual consent, which they have not requested.
SB 53 would give victims of cyber flashing a private right of action against any person who knows or reasonably should know that a lewd image they sent was unsolicited. The bill would entitle the plaintiff to recover economic and non-economic damages or statutory damages between $1500 and $30,000, as well as punitive damages, reasonable attorney’s fees and costs and other available relief, including injunctive relief.
“I appreciate the Senate’s support of SB 53 as we are now one step closer to finally holding perpetrators of cyber flashing accountable for their abusive behavior and actions,” Senator Leyva said.
“This form of technology-based sexual harassment is far more pervasive than many Californians realize, so it is important that we empower survivors that receive these unwanted images or videos.”
According to the Pew Research Center, 53% of young American women and 37% of young American men have been sent unsolicited explicit material while online. Most women who received uncalled for X-rated content reported being sent this material through social media platforms, including Snapchat, Instagram, LinkedIn, Twitter and Facebook.
Cyber flashing also occurs via dating platforms, text messages, email and through the ‘AirDropping’ of content in public spaces.
The FLASH Act has the support of the dating app Bumble, whose CEO Whitney Wolfe Herd sees a need for stronger laws to protect internet users.
“An overwhelming majority of our time is spent online and there are simply not enough laws and deterrents in place to protect us, and women and children in particular,” said Wolfe Herd.
“It falls upon us in the technology and social media space to work hand in hand with local government and legislators to isolate the problems and develop solutions just like the FLASH Act being introduced by Senator Leyva.”
Social Security Numbers Most Targeted Sensitive Data
Read Time:1 Minute, 51 Second
Social Security Numbers Most Targeted Sensitive Data
Social Security Numbers (SSN) are the type of sensitive data most commonly targeted in data breaches in the United States, according to new research published today by Spirion.
Analysis conducted against the Identity Theft Resource Center (ITRC) database of publicly reported data breaches in the United States revealed that 65% of all sensitive data incidents in 2021 involved SSN.
The finding was included in the data protection and privacy company’s Definitive Guide to Sensitive Data Breaches: America’s Top Leaks, Attacks and Insider Hacks. Spirion’s guide is based on the analysis of more than 1,500 data breaches involving sensitive data in the United States last year.
A total of 1,862 data compromises were reported by US organizations last year, representing a 68% increase over 2020 and making 2021 steal 2017’s title of the most prolific year on record for data breaches. ITRC data showed that 83% of the year’s incidents impacted more than 150 million individuals by exposing 889 million sensitive data records.
Personal Health Information (PHI) was the second most targeted form of sensitive data and was the focus of 41% of data incidents. The third most predated forms of sensitive data were bank account information and driver’s licenses, which were each involved in 23% of incidents.
The majority of individuals affected by sensitive data breaches in 2021 (84%) were victims of incidents in the professional and business services, telecommunications and healthcare industries. The 157 reported data breaches in the professional and business services sector impacted 52 million individuals (or 35% of total individuals). Just eight incidents in the telecommunications industry impacted 47.8 million individuals (or 32% of total individuals).
Trends identified in the guide included the emergence of supply chain and third-party attacks as a leading contributor to sensitive data compromises.
“A total of 93 third-party attacks impacted 559 organizations, exposing more than 1.1 billion data records,” said a Spirion spokesperson.
“Of these incidents, 83% contained sensitive data, revealing PII [personally identifiable information] for 7.2 million people.”
Another trend was experiencing multiple data breaches in one year – a fate suffered by more than two dozen US organizations in 2021.
A Vulnerability in Samba Could Allow for Arbitrary Code Execution
Read Time:22 Second
A vulnerability has been discovered in Samba which could allow for arbitrary code execution. Samba is the standard Windows interoperability suite of programs for Linux and Unix. Successful exploitation of this vulnerability could result in arbitrary code execution as root on affected Samba installations that use the VFS module vfs_fruit. Depending on the permission associated with the application running the exploit, an attacker could then install programs; view, change, or delete data.
British Council Students’ Data Exposed in Major Breach
Read Time:2 Minute, 10 Second
British Council Students’ Data Exposed in Major Breach
Hundreds of thousands of British Council students had their personal and login details exposed in a worrying data breach, according to an investigation by Clario researchers.
The team discovered an open Microsoft Azure blob repository indexed by a public search engine that held 144K+ of xmal, json and xls/xlsx files, with no authentication in place. These contained sensitive information about hundreds of thousands of students that had enrolled on British Council courses across the world. This included students’ full names, email addresses, student IDs, notes, student status, enrollment dates and study duration. It is not known how long this information was available online in public.
The breach was discovered on December 5 2021, and Clario informed the British Council as soon as they had confirmed their findings. However, they received no response. After 48 hours, contact was made via Twitter, and Clario engaged in regular communication with the organization via direct messages on the platform.
Two weeks later, on December 21, the British Council issued the following statement: “The British Council takes its responsibilities under the Data Protection Act 2018 and General Data Protection Regulations (GDPR) very seriously. The privacy and security of personal information is paramount.
“Upon becoming aware of this incident, where the data was held by a third-party supplier, the records in question were immediately secured, and we continue to look into the incident in order to ensure that all necessary measures are and remain in place.
“We have reported the incident to the appropriate regulatory authorities and will fully cooperate with any investigation or further actions required.”
Clario stated: “Although they were not responsible for the data breach, errors made by the data provider they decided to work with have exposed these student details. This suggests that they need to be more rigorous in terms of how they select and work with third parties.”
British Council students have been warned that the breach may put them at risk of various scams, such as phishing and identity theft.
The British Council is a non-departmental public organization that aims to connect people in the UK and other countries through culture, education and the English language. In 2019-20, it connected with 80 million people directly and 791 million overall, including online and through broadcasts and publications.
At the end of last year, official data obtained from a Freedom of Information request revealed that the council had fallen victim to two successful ransomware attacks over the past five years, suffering a total of 12 days of downtime as a result.
What Is IaC and Why Does It Matter to the CISO?
Read Time:6 Minute, 44 Second
Many vendors and security companies are buying or building Infrastructure as Code (IaC) security into their portfolios, and this trend is only expected to continue. Here’s what you need to know.
Infrastructure as code (IaC) is a relatively new phenomenon that is revolutionizing the way organizations manage their infrastructure.
IaC offers many benefits to security leaders, including speed, consistency, accountability, scalability, reduced costs and more, which is why it is emerging as such an integral part of building on the modern cloud.
It’s important for CISOs and DevOps teams to see IaC as the connected link between cloud computing and DevOps success, as it enables businesses to innovate with confidence and strengthens infrastructure management processes.
Understanding how IaC works, its best practices and benefits are all crucial to leveling up your security programs and boosting agile software development. By leveraging IaC as both a strategy and a solution, CISOs and DevOps teams can align security with business goals.
Investing in an IaC strategy boosts the overall productivity of a business while maintaining security posture. This prevents misconfigurations, non-compliance policy violations and other cloud security risks, giving development teams more time to develop, deploy and scale with greater speed, visibility and flexibility. As a vital DevOps practice, IaC is still emerging and evolving within the cloud security realm.
What is Infrastructure as Code (IaC)?
According to Tech Target, infrastructure as code is “an IT practice that codifies and manages underlying IT infrastructure.”
Infrastructure as code emerged as a strategic approach for development teams looking to manage and maintain their infrastructure without the hassle of manually provisioning.
How does IaC work and what problems does it solve?
Managing IT infrastructure is an arduous process. It requires people to physically put the servers in place, configure them and then deploy the application. This time-consuming manual process often results in numerous discrepancies, impedes agility and, ultimately, proves costly for businesses. Corporations are forced to spend a fortune annually on building and maintaining huge data centers and hiring a plethora of engineers and other employees to manually provision the infrastructure.
To combat this, cloud computing was introduced, providing enterprises with a new approach that offered flexibility and scalability. Today, cloud computing is a booming industry, helping organizations accelerate innovation and scale at large.
Given the shift to remote work in light of the COVID-19 pandemic, more and more businesses have chosen to adopt the cloud. Currently, more than 90% of businesses use cloud computing. As a critical solution, it has rapidly changed the way people do business. Infrastructures can now be managed over networks, offering more flexibility and faster deployment for businesses. Additionally, with cloud systems, development teams can improve security, speed and software testing, increase productivity and efficiency, reduce costs and improve delivery.
Providing a myriad of benefits for businesses and cloud users alike, cloud computing continues to be an essential pillar of digital transformation. However, it does pose some serious security risks.
Cybercriminals looking to steal sensitive data and other pertinent information could potentially breach the cloud server, wreaking havoc on businesses and their customers. In 2021, more than 40 billion records were exposed, as a result of cloud-based data breaches. Just last year, social media giant Facebook had 533 million records exposed from users in 106 countries, according to Business Insider.
Additionally, infrastructure misconfigurations caused by human error can provide pathways for cybercriminals to launch attacks. Misconfigurations can expose networks and cause configuration drifts.
Therefore, a solution is needed which allows developers to manage their infrastructure through automation, while minimizing potential new security risks. This is where infrastructure as code comes in.
IaC involves using software tools to automate specific tasks through a version control system. This means that your infrastructure can be written and described in code, and this code can be executed to make changes to your infrastructure. In IaC, there are two approaches to writing the code:
Declarative approach. This is often the preferred approach of the two because of the flexibility it offers, this approach involves users only defining the end or “desired” state. Meanwhile, the tool or platform being used takes care of the steps needed to achieve the end result.
Imperative approach. This approach involves users specifying the specific commands needed to achieve the end or “desired” state. In this approach, the platform or tools do not deviate from those specific commands.
By adopting an IaC approach, organizations can accelerate innovation and build products that efficiently meet their customers’ needs in a timely and seamless manner. However, the speed at which development teams are rapidly pushing out new products and features is outpacing security. Therefore, it is critical that the security pace keeps up. More specifically, CISOs, who are responsible for the security of an enterprise, need a security solution that enables DevOps teams to continue production while applying security practices to reduce cyber risks and misconfigurations. And IaC provides the mechanism to do it.
Five benefits of IaC
Leveraging IaC as both a strategy and solution can help you achieve your security goals, as it provides several benefits for your business, including speed, scalability, consistency, accountability and reduced costs.
Speed. The most important benefit of IaC is speed. One of the CISO’s primary responsibilities is to protect the enterprise while simultaneously driving growth. By adopting an IaC security solution, productivity can get a boost, allowing for quick turnarounds, enabling businesses to meet customer’s requests and needs. Instead of spending time manually provisioning and increasing the likelihood of misconfigurations due to human error, development teams can quickly provision and configure infrastructure, speeding up the entire software development lifecycle, all while minimizing security risks by adopting IaC security.
Scalability. When demand for products or services increases, businesses need to be able to scale quickly and efficiently. The same applies to security. As businesses continue to grow and evolve, so, too, must their security processes evolve. New security tools and technologies will be used to accelerate innovation and CISOs are responsible for evaluating and consolidating these tools. By employing IaC tools, development teams can build environments to test new applications and get products or new features to the market faster with security embedded throughout the entire process.
Consistency. Generally, CISOs are responsible for ensuring security policies are being met. Therefore, they must ensure that documentation is up to date as outlined in the policies. By adopting IaC, CISOs can eliminate the documentation process because all the infrastructure is defined as code. IaC increases consistency and significantly reduces errors that often happen because of manual misconfigurations. It minimizes the potential for configuration drift and reduces the risk of cyberattacks that might occur because of manual provisioning.
Accountability. IaC enables CISOs to track any changes that have been made to any source code file. You no longer have to guess which person made a change and when they made that change throughout the software development lifecycle. Thus, making it easier for CISOs and security leaders to hold DevOps teams accountable for changes.
Reduced costs. IaC significantly reduces the cost of infrastructure management. Businesses can save money on hardware and equipment and the costs of hiring people to operate the hardware and equipment and building or renting the physical space to store it. Additionally, by employing cloud computing with IaC, businesses can reduce security risks, which, in turn, can save a fortune on “recovery costs” from a data breach or other form of cyberattack.
Conclusion
At Tenable, we recognize the value of embracing IaC as a way for organizations to innovate in the cloud with confidence. We deliver an integrated, end-to-end security solution to help organizations better protect their cloud environments. It provides a complete picture of cyber risks across the modern attack surface, with unified visibility into code, configurations, assets and workloads. Learn more about Tenable.cs and how our platform enables DevSecOps with integrated controls for development and runtime workflows, focused on IaC.
Learn More
Read the blog: Introducing Tenable.cs: Full Lifecycle, Cloud Native Security
Download the whitepaper: Using Auto Remediation to Achieve DevSecOps
UK/US data protection claim highlights ambiguity of GDPR’s geographic scope
Read Time:29 Second
A decision by the UK Court of Appeal to allow a claim for contravention of the European Union’s General Data Protection Regulation (GDPR) to be served against US defendants has raised questions over the territorial limits of the regulations. The case emphasizes the broad geographic applicability of both the EU GDPR and the UK GDPR and the interpretations that exist. The UK Court of Appeal suggested that the UK’s independent information rights authority, the Information Commissioner’s Office (ICO), should assist in the case.