Phone Fraud Soars

Phone-based fraud increased by 30% over the past year among financial and retail firms, exposing the average call center to $9m in fraud, according to a new report from industry specialist Pindrop Security.

The vendor collected phone scam complaint data from online sites, as well as running its own large scale 'telephony honeypot', using fingerprinting technology to analyze the audio content of calls in order to compile its annual State of Phone Fraud report.

It found an alarming increase in phone fraud, to the point where one in every 2,200 calls in 2014-15 was a scam – with rates roughly the same in all major economically developed countries, irrespective of their security and privacy laws.

Unsurprisingly, two-thirds (64%) of such calls originate in a different country from the victim, with spoofing technology helping to hide the true number of the caller.

Cheap or free VoIP services continue to be the preferred calling method for scammers, with financial institutions, retailers and consumers all key targets, the report claimed.

Card issuers are hit particularly hard, experiencing fraud at nearly three times the rate of regular financial institutions – one fraud call for every 900.

Phone scammers typically like to work across sectors in multi-stage attacks.

This could involve calling a consumer to phish them for bank account details and/or card numbers; then using those details to call their financial institution to pass identity checks and thus effect a complete account takeover.

These details can then be used to fraudulently buy goods over the phone with a retailer.

Financial data could also come from darknet sites, where they have been uploaded by hackers following a mass data breach of a retailer, the report claimed.

The average financial institution risks exposing $7-15m in phone fraud, the report said.

So-called 'robodialers' are making the fraudsters' job easier too – often used to voice-spam consumers with free money and prize draw offers, or else threaten them with messages claiming they owe tax.

A staggering one in six calls to the average consumer is automated, the report found.

What's more, there could be worse to come for US consumers, the report explained:

`Over the next year, as the US moves to chip-and-signature card protocols, card-present fraud will become more difficult. As such, Pindrop expects attackers to shift more attention to the phone channel, which is traditionally the least protected of the card-not-present (CNP) channels. Call centers should begin preparing now for the increasing rate of attacks.`

Read original article

iOS Major vulnerability

The security issue of the week has arrived, and, quelle surprise, it`s attracted a funky name already.

The researchers who wrote it up tried to call it XARA, not least because then they got to call their XARA detection tool by the name XAVUS.

(Geddit? Pronounce `X` in the American style, as if it were `Z`, and make the `A` into a long vowel, not short, and all will be clear.)

But the vulnerabilities they found were part of Apple`s OS X and iOS operating system, so our friends over at The Register were having none of XARA.

XARA, by the way, stands for Cross-App Resource Access, and one of the main XARA problems that the researchers found was an Elevation of Privilege (EoP) hole that lets app X get unauthorised access to app Y`s entries in the Apple Keychain.

Understanding Keychain

Keychain is the operating system component where things like passwords, security tokens, credential data and other application-specific secrets are stored.

It is deliberately designed to make it difficult for apps to read each other`s private data, even if those apps are processes running under the same user`s account.

Historically, software simply stashed its private data in private files in a private directory (or in the registry, which is a special sort of file-and-directory container on Windows), and relied on the operating system`s regular Access Control List (ACL) system to regulate access.

As a result, my apps couldn`t read data from your apps, assuming we were users with different logins on the same computer, which was a good thing.

Of course, that meant my apps could easily plunder each other`s data, on the grounds that it`s my data, so I should have access to it anyway.

But in today`s cloud-based, online world, that can make life much too easy for malware.

If I run a dodgy program and inadvertently give it permission to login to my Facebook account, the `divide-and-conquer` principle says that it is highly desirable if the malicious app can`t casually take over my Twitter, my Snapchat and my Outlook.com accounts as well.

Thus, Keychain: an operating-system level `divide-and-conquer` system for app-specific authentication data.

Keychain serves a similar purpose to the same origin policy in browsers, whereby even though I choose to visit two different sites at the same time, the browser keeps their data separate for my greater safety.

Anyway, with Keychain being the core of Apple`s credential management, and our researchers having found a way to worm their way around in this core component, The Register came up with the name CORED, allowing them to use the headline `Apple CORED.`  So, CORED it is.

How attackers think

The research paper is quite extensive – indeed, we`re still working our way through its details – but the XARA problems in Keychain are perhaps the catchiest of the bunch, and they give a fascinating insight into how attackers think when they`re probing for problems in a security protocol.

What the authors found is a way to exploit the fact that Keychain isn`t quite as simple as `one app, one password storage bucket.`

If that`s how it worked, this bug wouldn`t exist, and Keychain would be easier to test for security correctness.

But software writers would be unhappy, because it would then be impossible for complementary apps to share private data such as account names and login credentials.

So, the researchers realised that they could exploit what is effectively a race condition, where two processes go for a single resource, and if the wrong process gets there first, it can subvert the correct operation of the other.

Wining the race

Let`s say you have an app called SocialNet installed, but you have`t logged in with it yet, so it hasn`t got around to creating a Keychain entry with your login credentials in it.

When you do login for the first time, it will create a Keychain item called logincookie, and save its secret data there, where my malware can`t read it without alerting you to the subterfuge, for example by popping up an adminstrator prompt.

Or so you`d hope.

But in this case, my malware can create its own logincookie, and tell Keychain, `By the way, I trust SocialNet to access this item, too.`

And so, when you get around to logging in with SocialNet, there`s a good chance (unless the programmers of SocialNet decided to watch out out for treachery of this sort) that the app will save its login cookie in this already-created Keychain object.

Then, my malware can read it without triggering any sort of alert.

Actually, it`s worse than that, because even if SocialNet has already created its own logincookie, my malware may be able to delete that data without authentication.

Sure, if I keep deleting your login credentials and deauthenticating your app, that could cause a Denial of Service (DoS) problem by decreasing privilege.

But, at a first thought, it feels as though deleting login cookies shouldn`t ever cause an increase in privilege for an unauthorised app.

Except that once I`ve deleted your Keychain item, I open up the race condition by which I can re-create it so that both your app and mine can read it back in future.

Such are the vagaries and unexpected complexities of security protocols!

Where next?

According to the researchers, who found similar cross-app data leakage issues in other inter-app protocols on OS X and iOS, these problems are part of the operating system core itself, and we shall need an update from Apple to get rid of them for ever.

Alternatively, and additionally, apps can adopt defensive programming tactics to help defend against these XARA holes, now they are known and documented.

As it happens, according to The Register`s report, the researchers claim to have told Apple more than six months ago, and only decided to publish their research when no mitigation was received or promised out of Cupertino.

The researchers also say they created malware apps that were able to exploit the XARA holes they`d found, and then successfully got them passed by Apple`s vetting process and accepted into the App Store.

What to do?

There isn`t a lot you can do right now.

But the following points can, and should, mitigate the risk:
Apple, we hope, is now looking out for apps that use these holes, making it much less likely that malware exploiting them will make it into the App Store again.
Untrustworthy apps can already pull off credential-stealing tricks without exploiting components such as Keychain, so keep on using that anti-virus software!
Thanks to the report, threat-prevention tools can now detect and block CORED-like holes and expect to avoid controversy, even if those detections find problems in otherwise legitimate apps.

You might be surprised to find how tricky it can be, if you`re a security researcher, to add generic detection and blocking even of notoriously insecure apps if they seem to have even a shred of legitimacy.  Actually, you probably won`t be surprised.

Read original article

Watchdog sues FaceBook

Facebook is in hot water. The social media giant is being taken to court by Belgium's Privacy Commission (BPC), among accusations that it has violated privacy laws.

The BPC has slammed Mark Zuckerberg's creation for spying on non-users and the tracking system that is being utilised by the company.

The main issues are not the tracking of users whilst using the main website, the point at which the BPC feel that they are surpassing their privileged position is by continuing to track browsers once the person has left their website, by collecting information from external sites that use the popular plug ins with links to `like` or `share` on the participant's Facebook profile.

In the report released by the Belgian Privacy Commission in May 2015, Facebook were accused of processing personal data of its members, along with other Internet users in secret.

This data was then allegedly being used without justification or user content. The commission continues to reveal that the processes and practices used by the social media leviathan contradict European Union data protection laws.

They have asked Facebook to cease doing said activity, or seek user consent prior to collecting the data which they have been allegedly hoarding, especially information regarding activity which can be then used to fuel advertising campaigns.

Facebook takes the standpoint which is common amongst multinational corporations, which is that they are only answerable to Irish regulators, as that is where the European headquarters are based. Furthermore they agreed they would analyse the reports and recommendations given.

This is not the first time Facebook has been accused of abusing privacy legislation, with the Vienna court ordered Facebook to respond to a class action lawsuit regarding data privacy in Austria filed by Max Schrems, whom claimed €500 per plaintiff for privacy breaches.

The commission seems to be acting with the same mantra as privacy regulators across Europe, as targeted advertising is now used on both Instagram and Whatsapp, subsidiaries of the parent company.

The European Commission has advised EU citizens to deactivate their Facebook accounts, in order to keep personal information safe from US security services.

In April 2015, Brazilian Ministry of Culture announced it will sue Facebook for blocking the picture of an Indian woman from 1909 just because her breasts were exposed.

Read original article

Samsung Galaxy Flaw

Have a Samsung Galaxy device? Chances are it has a security flaw that lets attackers install malware on it or eavesdrop on your calls, and there`s nothing you can do about it.

Chicago-based security firm NowSecure has published a report claiming that a bug in the Swift keyboard software, preinstalled on more than 600 million Samsung devices, can allow a remote attacker, which is capable of controlling a user`s network traffic to execute arbitrary code on the user`s phone

To make things worse, if your phone has the Swift keyboard software, it`s impossible to uninstall it, and the flaw can be exploited even when you don`t use it.

Swift runs in a privileged context on the phone, meaning it can access most of its functions. By exploiting the vulnerability, an attacker can secretly install malware on a user`s device, access the device`s camera, microphone and GPS, eavesdrop on calls and messages, change the way other apps behave and even steal photos and text messages.

NowSecure claims it notified Samsung of the vulnerability in December 2014, and the U.S. Computer Emergency Readiness Team (CERT) and Google`s Android team were also notified. The good news is, Samsung started providing a patch to network operators in `early 2015,` but it`s not known how many of them actually provided it to their users.

The list of potentially vulnerable devices is a scary one, including Samsung Galaxy S6, S5, S4 and S4 mini on major U.S. carriers, including Verizon, AT&T, Sprint and T-Mobile. The status of some devices with regards to this vulnerability is unknown, but some — like Galaxy S6 on Verizon and Sprint, and Galaxy S5 and T-Mobile — are vulnerable.

Since the Swift software cannot be uninstalled, the best course of action, according to NowSecure, is to avoid unsecured Wi-Fi networks and/or use a different mobile device. NowSecure also points out that SwiftKey, the keyboard app available on Google Play and based on the same software development kit, has no relation to the preinstalled Swift keyboard, and installing or removing it does not fix the vulnerability.

SwiftKey CMO Joe Braidwood confirmed to Mashable that the vulnerability is unrelated to the SwiftKey consumer app.

`We supply Samsung with the core technology that powers the word predictions in their keyboard. It appears that the way this technology was integrated on Samsung devices introduced the security vulnerability,` he said in a statement.

Braidwood points out that the vulnerability is a `low risk` one. `A user must be connected to a compromised network (...), where a hacker with the right tools has specifically intended to gain access to their device. This access is then only possible if the user's keyboard is conducting a language update at that specific time,` he argues.

Read original article

Security and privacy

Privacy and security are the two biggest challenges to monetizing internet of things (IoT) applications, according to a new global survey of developers, which claims that many feel they don't have the skills or resources to deliver on expectations.

Harbor Research polled over 670 app developers from the US, UK, Germany, France, Sweden, Netherlands and India on behalf of software company Progress.

It found the two biggest challenges they face in making money out of IoT apps are data privacy and protection from attack (18%) and security and personal privacy (18%).

However, few had faith in the government (8%) or industry bodies (7%) to help them overcome these challenges.

Instead, most believed that commercial vendors (31%) and the open source community (21%) offered the best chance of success going forward.

This is despite deep seated concerns in the information security industry that, on the commercial side at least, products are usually rushed out into the market with little heed for potential security flaws.

Still, the developer community was almost split 50:50 over whether the regulation would positively (39%) or negatively (34%) affect IoT app development.

It's also clear from the report that many don't feel they have the right blend of tech or skills.

Half of respondents said they 'don't have' or are 'unsure' if they have the right technology to deliver on expectations, while 51% felt the same way about having the necessary skills and resources.

In addition, 45% said they didn't think they had the skills to gather, analyze and use contextual data from IoT sensors.

Several reports have already highlighted the security vulnerabilities that already exist in many IoT products.

HP reported last year that 10 of the most common IoT technologies contained a staggering 25 flaws per device, for example.

A month later, Eurecom research revealed zero days, backdoors and other holes in over 140,000 devices which could lead to them being compromised.

Read original article

Security Metrics

What a haircut taught me about communicating the value of security to executives and non-security professionals.

The other day, I learned a great lesson about security metrics while getting a haircut. Initially, this may sound like a bit of an odd statement, but I promise it will make sense in the end. The woman cutting my hair asked me: `Should I cut off one-half inch?` Putting aside my preference for the metric system and dislike of the imperial system, I found this question to be quite fascinating.

To the woman cutting my hair, the question was a scientific one. Depending on how I answered, she would choose the appropriate scissors and clippers and proceed accordingly. From my perspective, however, the question was meaningless, or at the very least, difficult to parse. I didn't know how to answer because I have no idea what length I like my hair -- at least not in absolute terms like inches or centimeters.

What does this have to do with security metrics? Let's begin to answer that question by examining the definition of the word `metrics.` A metric is defined as `a method of measuring something, or the results obtained from this.` In order for me to understand and subsequently answer the question, I had to translate into a method of measurement that I could understand. After a small amount of research, I learned that hair generally grows one-quarter inch per month. In the context of this example, the question translated into relative terms I could understand would be: `Should I cut off two months of growth?`

As security professionals, we tend to get used to a certain way of thinking, speaking, measuring, and communicating. What we sometimes forget is that to many people (most notably leaders such as our executives and boards), the value we bring is not always easy to understand. It's not that we aren't working hard, doing more with less, adding value to the organizations we serve, and sometimes working small miracles. Rather, it's that we struggle to translate those efforts into a meaningful context. What's missing is a way for us to communicate our value in terms that non-security professionals can understand and evaluate.

To illustrate this point, let's work through some examples. Many security organizations regularly report a familiar set of metrics to their leadership. These metrics tend to be absolute in nature. What do I mean by that? Absolute metrics are metrics that involve quantitative measures that are not relative to or dependent on anything else. For example, absolute metrics that some of us might be familiar with include:
•Number of infected endpoints during a specific time window
•Number of brute force attempts during a specific time window
•Average length of time a ticket remains in the `open` or `unresolved` state

Although these metrics may seem familiar, they represent a critical disconnect with the prioritized list of risks and threats security-aware leaders are most concerned with. Preventing damage to the organization from those very risks and threats is likely a top priority for these individuals on a daily basis. It is against those priorities that the security-aware leader will likely evaluate the successes of his or her security organization, along with determining areas for improvement.

When we look at the subject of metrics from this perspective, it becomes a bit easier to see why traditional, absolute metrics do not fit the task at hand. What's missing from the discussion is a mapping between the tactical and operational work going on within the security organization and the strategic view taken by leaders. Enter relative metrics.

Relative metrics are metrics that involve quantitative measures that are `translated` or `mapped` to the priorities of leadership. Relative metrics allow the security organization to effectively measure and communicate its successes and areas for improvement in terms that leadership can internalize. Taking the three illustrative absolute metrics referenced above and converting them into relative metrics might result in the following examples:
•Amount of sensitive data exfiltrated via infected endpoints during a specific time window
•Risk and exposure as a result of critical assets successfully compromised via brute force attacks during a specific time window
•Median-time-to-remediation (MTTR)

As we can see, these relative metrics more precisely speak the language of our leaders. They do this by taking the absolute metrics and mapping them to the risks and threats that most concern our leadership. Of course, each organization will have its own unique concerns. That prioritized list should guide the development of relative metrics inside each organization.

It's hard to imagine how a conversation between two people speaking two mutually unintelligible languages could result in the productive exchange of ideas. Yet, in the security world, we often live this very experience daily. Tactically and operationally focused security teams speak metrics that are unintelligible to their strategically focused leaders. In my experience, in order for effective communication to occur, everyone needs to be speaking the same language. Metrics and measurement are no exception.

Read original article

Cybercrimes high returns

Cybercrime Can Give Attackers 1,425% Return on Investment

Going rates on the black market show ransomware and carding attack campaign managers have plenty to gain.

While security professionals often find it difficult to prove return on investment, a standard ransomware campaign could earn an attacker a 1,425 percent ROI, according to a report released today by Trustwave.

`We`re showing what the motivation for and value of a cybercrime is,` says Charles Henderson, vice president of managed security testing at Trustwave. `To my mind, if you`re going to defend against cybercrime, you need to understand` the attackers` motivation.

Trustwave`s report is based on study of the black market cybercrime economy and direct investigations of 574 data breaches across 15 countries in 2014.

Trustwave calculated the ransomware ROI based on the following:
•Costs of a ransomware payload (CTB Locker in this example), infection vector (RIG exploit kit, which was most common), camouflaging services (encryption), and traffic (20,000 visitors) totaled $5,900 per month.
•Earnings for a 30-day campaign, assuming a 10 percent infection rate, a payout rate of 0.5 percent, and a $300 ransom, would total $90,000.
•That`s a profit of $84,100 and a ROI of 1,425 percent.

`The black market is very transparent,` says Henderson. `You can look for a good deal ... just as any mercantile or purveyer of goods.`

Poorly secured point-of-sale systems, the high black market value of track data, and the quick turnaround on stolen cardholder data have also made the carding business very popular -- particularly against targets in North America, where EMV adoption is so low.

Overall, 42 percent of the incidents Trustwave investigated were on e-commerce assets, 40 percent on PoS system, and 18 percent on internal networks. In North America, 18 percent were e-commerce, 65 percent PoS, and 17 percent internal networks.

Although 49 percent of breaches did involve theft of PII, track data was targeted even more often, in 63 percent of attacks.

This demand for cardholder data and the ease of getting it has affected the industries that hackers are honing in on. The top three industries targeted in 2014 were retail (43 percent), food and beverage (13 percent), and hospitality (12 percent). Ninety-five percent of the attacks in the food and beverage industry and 65 percent in the hospitality industry were from PoS systems.

Nearly all of the PoS breaches were the result of weak passwords (50 percent) and weak remote access controls (44 percent).

E-commerce compromises, on the other hand, were quite different. While only 8 percent come from weak passwords and 17 percent from weak remote access security, 42 percent result from weak or non-existent input validation and 33 percent from unpatched vulnerabilities. The web server vulnerabilities most popular with opportunistic attackers were the WordPress pingback DDoS (30 percent), cross-site scripting (25 percent), and the ShellShock Bash bug.

Trustwave also examined how different types of financially motivated threat actors make money on cybercrime, distinguishing between targeted attackers and opportunistic attackers.

Targeted attackers choose a specific set of targets, and then find out where the potential victim is vulnerable and how to compromise it. Opportunistic attackers approach things from the opposite direction; they learn about a vulnerability, then look for targets that are vulnerable to it.

Trustwave found that both categories of attackers may go after e-commerce sites, for example, but they`ll have different post-exploit purposes.

`I see the opportunistic attackers as the serial entrepreneurs,` says Henderson. `Someone who`s looking to build any business` as opposed to just an auto shop or technology firm or clothing line. `Very nimble, but not very particular.`

Opportunistic attackers tended to monetize their efforts by installing webshells and backdoors and redirecting users for search-engine optimization or installing IRC clients for botnet recruitment, according to the report. In addition to being cybercriminals they are also cybercrime service providers.

Targeted attackers, rather, have a methodology and a business plan that they`re committed to, says Henderson.

Targeted attackers tend to go after specific high-value sites and steal payment card data. (Service providers for travel booking sites have become a popular target for this reaon, according to the report.) Attackers then monetize it by selling cardholder data, selling goods purchased with that data, or using money mules to transfer money out of compromised accounts to attacker-owned accounts.

Other findings

Trustwave`s scanners also found that 98 percent of applications had vulnerabilities.

`It`s both surprising and unsurprising,` says Henderon. `Surprising in the sense, that there`s a difference in knowing application security isn`t where it needs to be and seeing a hard number like that.`

Plus, `Password1` was the most common password.

`You would think it would be blacklisted,` says Henderson. `Not the case.`

Most breaches were detected by third parties -- 58 percent by regularory bodies, card brands and merchant banks, 12 percent by law enforcement, 4 percent by consumers, and 7 percent by other parties.

However, that slim 19 percent of organizations that self-detected breaches discovered and contained them far more quickly than third parties did. The median time from instrusion to containment for externally detected compromises was 154 days; for self-detected compromises just two weeks (14.5 days to be exact).

`The ongoing security programs that include managed security providers, extensive teams in-house, and regular proactive security testing, these are the companies that detect their own intrusion,` says Henderson. But those are also the types of companies that tend to prevent intrusions, he says.

Read original article