A self-proclaimed cryptocurrency millionaire has been charged with multiple felonies for his alleged role in a scam that purported to sell a high-powered cryptomining machine called the “Bitex Blockbuster” that did not actually exist.
Read more in my article on the Hot for Security blog.
Between 5-7 October, I will be chairing the UK’s National Information Security Conference (better known as NISC), at Carden Park in Cheshire. It’s a great event – you should come along.
Oh, and we’ll do the podcast “live” there as well…
Okay, it’s an obscure threat. But people are researching it:
Our models and experimental results in a controlled lab setting show it is possible to reconstruct and recognize with over 75 percent accuracy on-screen texts that have heights as small as 10 mm with a 720p webcam.” That corresponds to 28 pt, a font size commonly used for headings and small headlines.
[…]
Being able to read reflected headline-size text isn’t quite the privacy and security problem of being able to read smaller 9 to 12 pt fonts. But this technique is expected to provide access to smaller font sizes as high-resolution webcams become more common.
“We found future 4k cameras will be able to peek at most header texts on almost all websites and some text documents,” said Long.
[…]
A variety of factors can affect the legibility of text reflected in a video conference participant’s glasses. These include reflectance based on the meeting participant’s skin color, environmental light intensity, screen brightness, the contrast of the text with the webpage or application background, and the characteristics of eyeglass lenses. Consequently, not every glasses-wearing person will necessarily provide adversaries with reflected screen sharing.
With regard to potential mitigations, the boffins say that Zoom already provides a video filter in its Background and Effects settings menu that consists of reflection-blocking opaque cartoon glasses. Skype and Google Meet lack that defense.
Research paper.
Topics that are top of mind for the week ending Sept. 23 | A digital trust disconnect between theory and practice | Don’t ignore attack surface management | An SBOM 101 | Report finds hackers targeting small businesses | And much more!
A global survey shows a disconnect between what businesses say and what they actually do regarding digital trust.
For its “State of Digital Trust 2022” report, IT governance professional association ISACA polled 2,755 business and IT professionals about their policies, practices and beliefs for digital trust, which it defines as “the confidence in the integrity of relationships, interactions and transactions among providers and consumers within an associated digital ecosystem.”
Among the findings were:
Almost all respondents (98%) acknowledge that digital trust is important but only 12% have a dedicated staffer in this role.
Only 50% said there’s sufficient collaboration at their organization among security, data integrity and privacy professionals – digital trust’s most important roles.
Eighty-two percent of respondents say digital trust will grow in importance in the next five years, but only 29% provide digital trust training to staff.
Only 66% say their organization sufficiently prioritizes digital trust.
Just 23% say their organization measures the maturity of its digital trust practices.
There’s also strong awareness among those polled about the downsides of weak digital trust, including reputational harm (cited by 62% of respondents), more privacy breaches (60%), increased cybersecurity incidents (59%) and customer loss (56%.)
(Source: ISACA’s “State of Digital Trust 2022” North America infographic, Sept. 2022)
Among the obstacles that prevent organizations from boosting digital trust are lack of skills and training and misalignment with business goals. It also doesn’t help if leadership support for digital trust initiatives is weak, and if financial and technological resources are insufficient.
Some of ISACA’s recommendations for beefing up digital trust include:
Understand how digital trust can contribute to the organization’s goals, measure the current state and compare it against industry best practices.
Outline digital trust goals, identify priorities and develop a road map.
Establish a mindset of continuous improvement in areas such as cybersecurity, quality, reliability, compliance and customer experience.
For more information:
Read the full report
Read the blog from ISACA’s CEO and the press release
View infographics tailored for different regions
With the advent of 5G, mobile network operators see a benefit in moving away from traditional, proprietary radio-access networks (RANs) and towards open RANs that can provide them with more flexibility and reliability.
To help operators ensure the security of open RANS, the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) just published the guide “Open Radio Access Network Security Considerations.”
CISA Acting Assistant Director Mona Harrington said in a statement that open RAN is “an exciting concept” that could boost innovation, network performance and competition. “However, with those benefits come the potential for additional security concerns,” she said.
For more information:
“Top 5 security risks of Open RAN” (CSO)
“How Open RAN Can Bring Security Advantages” (Open RAN Policy Coalition)
“Open RAN so easy to hack it’s ‘scary,’ says top security boffin” (Light Reading)
“Private networks gradually get to know open RAN” (FierceWireless)
“NSA and CISA Publish Open RAN Adoption and Cybersecurity Assessment” (MeriTalk)
Attack surface growth has accelerated, thanks to remote work, distributed computing, API usage, IoT deployments, cloud adoption and shadow IT – in short, anything that increases an organization’s internet-facing assets.
In a recent column, Enterprise Strategy Group (ESG) analyst Jon Oltsik cited results from an ESG survey of 376 security pros who reported these effects of an expanded attack surface:
Collaboration and communication between the software development and security teams must be tightened as organizations develop more cloud-native apps and release software continuously.
Existing security tools and processes need to be re-evaluated as organizations seek to discover and manage attack surface assets. According to the survey, trying to manually collate and analyze data from disparate systems doesn’t work:
43% of respondents said it takes them 80-plus hours to do a full attack surface management inventory
69% said they suffered a security incident due to an unknown, unmanaged or mismanaged attack surface asset
Be prepared to manage more vulnerabilities and deploy more patches.
Anticipate an increase in blind spots.
For more information:
“Finally Finding the ‘Unknown Unknowns’ Across Your Entire Attack Surface” (Tenable)
“What is attack surface management and why is it necessary?” (TechTarget)
“The Right Way to do Attack Surface Mapping” (Tenable)
“Look for attack surface management to go mainstream in 2022” (CSO)
“How to implement an attack surface management program” (TechTarget)
Cyber insurance provider Coalition has released its mid-year report, based on an analysis of claims from 160,000 of its policyholders, and salient findings include:
Small businesses – those with annual revenue below $25 million – reported a claim cost average of $139,000, up from $88,000 in the first half of 2021, which highlights their increased vulnerability to cyberattacks.
Phishing ranked first among primary triggers for cyber incidents, accounting for 58% of reported claims – up 41% in the first half of 2021 – and putting the spotlight on employee vulnerability to this form of email social-engineering attack.
Regarding ransomware incidents specifically, there was a drop in the average cost of claims; the frequency of claims; the median ransom payment; and the average ransom demand, all compared to the first half of 2021. Coalition attributes this trend to factors such as:
Companies with security controls such as offline data backups may refuse to pay ransoms because they can restore operations.
Large organizations in particular are increasingly unwilling to enter into ransom negotiations.
(Source: Coalition’s “2022 Cyber Claims Report Mid-year Update,” Sept. 2022)
For more information:
“Ransomware is (slightly) on the decline, cyberinsurance company says” (CSO)
“Cyber Insurance Premium Hikes to Support Returns Amid Rising Claims” (Fitch Ratings)
“Cyber-Insurance Firms Limit Payouts, Risk Obsolescence” (Dark Reading)
“Cyber insurance needs an industry-wide security standard” (Security Magazine)
“Advice from an expert on cyber insurance coverage” (Journal of Accountancy)
Global management consulting firm McKinsey & Co. has published a clear and comprehensive overview about the basics of software bills of materials (SBOMs), which are very much in the spotlight as a key element of software supply chain security.
In the piece, titled “Software bill of materials: Managing software cybersecurity risks,” the authors define the SBOM, explain its benefits and include the following recommendations for developing a program:
Use existing software composition analysis (SCA) tools as a foundation and either buy or develop in house the other necessary tools, ensuring they fit smoothly with software development lifecycle processes (SDLC).
Ensure that a cross-functional team is involved with the SBOM program, including participants from software development, security, procurement, legal, risk, privacy and compliance.
(Source: “Software bill of materials: Managing software cybersecurity risks,” McKinsey & Co., Sept. 2022)
Build automated SBOM generation and review capabilities throughout the SDLC.
Create a governance structure for SBOM-related tasks.
For more information:
“The State of Software Bill of Materials (SBOM) and Cybersecurity Readiness” (Linux Foundation)
“The Minimum Elements For a Software Bill of Materials (SBOM)” (U.S. National Telecommunications and Information Administration)
“Securing the Software Supply Chain: Recommended Practices for Developers” (U.S. National Security Agency)
“Software Bill of Materials (SBOM) Pros & Cons” (Enterprise Networking Planet)
“The White House wants new transparency into software components” (Protocol)
Visibility into cloud assets remains a challenge for quite a few security teams out there, as an ad-hoc poll we conducted at a recent Tenable webinar shows.
Interested in learning more about this topic? Check out these Tenable resources:
“Full IT Visibility Requires Business Risk Context” (blog)
“You’ve Migrated Business-Critical Functions to the Cloud…Now What?” (blog)
“Cloud Security Roundtable: Scaling Cloud Adoption without Sacrificing Security Standards” (On-demand webinar)
“4 Steps to Achieving Comprehensive Kubernetes Security” (white paper)
“DevOps Guide to Terraform Security” (white paper)
Australia’s second largest telecommunications provider, Optus, revealed it suffered a cyberattack where data from customers have possibly been accessed. However, the company claims the attack has not affected the platforms and services supporting wholesale, satellite and enterprise customers, and that of enterprise customers. Mobile and home internet services have also not been affected.
Suspicious activity was noticed on Wednesday with Optus issuing a media statement on Thursday afternoon, which was a nation-wide public holiday.
The 9.8 million number of “possibly” affected customers circulating is the worst-case scenario, said Optus CEO Kelly Bayer Rosmarin at a media conference on Friday. That is the equivalent to about 37% of the Australian population. In its most recent financial report, Optus revealed it had over 10 million mobile customers as of 31 March 2022.
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Deep Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
