My Take

BEST PRACTICES: How to protect yourself from the enduring scourge of malvertising

By Byron V. Acohido

Malvertising is rearing its ugly head – yet again. Malicious online ads have surged and retreated in cycles since the earliest days of the Internet. Remember when infectious banner ads and viral toolbars cluttered early browsers?

Historically, with each iteration of malicious ads, the online advertising industry, led by Google, has fought back, and kept this scourge at a publicly acceptable level.

However, malvertising has never been as dynamic, stealthy and persistent as it is today. Here’s what you should know about this enduring online threat:

Gaming the ecosystem

Malvertising has become enmeshed in the highly dynamic online advertising, shopping and banking ecosystem we’ve come to rely on. It has accomplished this by leveraging the openness of the browsers on our go-to computing devices, namely our smartphones and PCs.

Malvertising code often circulates in tiny iframes, the HTML element that enables objects to appear on a webpage without changing the page. This bad code comes and goes, circulating to even well-known, high-traffic websites as part of the flow of web ads being placed dynamically by the online advertising networks, of which Google is the largest.

Malvertisers game this ecosystem in several ways. There are endless ways for them to hack into websites and ad networks directly. Doors and windows are left wide open in the software applications being rapidly developed to support a swelling army of third-party contractors who supply shopping cart services, data management platforms, retargeting enablement systems, and the like.

“The bad guys are insinuating their malicious code as part of the code that renders on the victim’s device during fulfillment,” says Chris Olson, CEO of the Media Trust, a McLean, VA-based website security vendor. “If you visit a large retail website, you may encounter 100 or 150 third party companies that get access to your computing device. For the most part, no one is really thinking about the security of all of these third-party apps. It’s only lightly monitored.”

Another gambit favored by threat actors is to set up shop as an independent ad network, and then patiently behave as a model citizen in order to gain trust. Once good-standing is achieved, the attacker begins to slip malicious ads into the daily flow of the ecosystem.

…more

Comment | Read | March 22nd, 2019 | My Take | Top Stories

Web application exposures continue to bedevil companies as digital transformation accelerates

By Byron V. Acohido

As sure as the sun will rise in the morning, hackers will poke and prod at the web applications companies rely on – and find fresh weaknesses they can exploit.

Companies are scaling up their use of web apps as they strive to integrate digital technology into every aspect of daily business operation. As this ‘digital transformation’ of commerce accelerates, the attack surface available to threat actors likewise is expanding.

I had a lively discussion recently with a couple of experts from WhiteHat Security. The San Jose, CA-based security vendor has been helping companies protect their web applications since the company was founded in 2001 by world-renowned ethical hacker Jeremiah Grossman, who also happens to be a black belt in Brazilian Jiu-Jitsu, as well as a native of my home state, Hawaii.

I spoke with WhiteHat Security researchers Bryan Becker and Mark Rogan at RSA 2019. They supplied clarifying context as to why web application vulnerabilities continue bedevil companies of all sizes and in all sectors. For a full drill down, give a listen to the accompanying podcast. Key takeaways:

Myriad vault doors

Thanks to digital transformation, the attack surface available to threat actors, via web interfaces, is larger than many companies realize – and this exposure continues to steadily expand.

“Moving to the cloud, terms like agile development and container-based infrastructure — all of these are different ways to break a large process down into many smaller components which is easier for a management team and a development team to manage and to update quicker,” said Becker.

But what happens is that instead of having one giant application, you end up with a hundred mini applications, and in the long run, that means it is harder to monitor for vulnerabilities in the code. …more

MY TAKE: Get ready to future-proof cybersecurity; the race is on to deliver ‘post-quantum crypto’

By Byron V. Acohido

Y2Q. Years-to-quantum. We’re 10 to 15 years from the arrival of quantum computers capable of solving complex problems far beyond the capacity of classical computers to solve.

PQC. Post-quantum-cryptography. Right now, the race is on to revamp classical encryption in preparation for the coming of quantum computers. Our smart homes, smart workplaces and smart transportation systems must be able to withstand the threat of quantum computers.

Put another way, future-proofing encryption is crucial to avoiding chaos. Imagine waiting for a quantum computer or two to wreak havoc before companies commence a mad scramble to strengthen encryption that protects sensitive systems and data, the longer we wait, the bigger the threat gets.

Related: The case for ‘zero-trust’

The tech security community gets this. One recent report estimates that the nascent market for PQC technology will climb from around $200 million today to $3.8 billion by 2028 as the quantum threat takes center stage.

I had the chance to visit at RSA 2019 with Avesta Hojjati, head of research and development at DigiCert. The world’s leading provider of digital certificates is working alongside other leading companies, including Microsoft Research and ISARA, to gain endorsement from the National Institute of Standards for breakthrough PQC algorithms, including Microsoft’s “Picnic” and ISARA’s qTESLA.

Hojjati outlined the challenge of perfecting an algorithm that can make classical computers resistant to quantum hacking — without requiring enterprises to rip-and-replace their classical encryption infrastructure. For a full drill down of our discussion, give a listen to the accompanying podcast. Below are excerpts edited for clarity and length.

LW: What makes quantum computing so different than what we have today? …more

NEW TECH: Exabeam retools SIEMs; applies credit card fraud detection tactics to network logs

By Byron V. Acohido

Security information and event management, or SIEM, could yet turn out to be the cornerstone technology for securing enterprise networks as digital transformation unfolds.

Exabeam is a bold upstart in the SIEM space. The path this San Mateo, CA-based vendor is trodding tells us a lot about the unfolding renaissance of SIEMs – and where it could take digital commerce.

Launched in 2013 by Nir Polak, a former top exec at web application firewall vendor Imperva, Exabeam in just half a decade has raised an eye-popping $115 million in venture capital, grown to almost 350 employees and reaped over 100 percent revenue growth in each of the last three years.

I had the chance to visit with Trevor Daughney, Exabeam’s vice president of product marketing at RSA 2019. He explained how Exabeam has taken some of the same data analytics techniques that banks have long used to staunch credit card fraud and applied them to filtering network data logs. For a full drill down on our conversation, please listen to the accompanying podcast. Here are a few takeaways:

Very Big Data

The earliest SIEMs cropped up around 2005 or so. Led by the likes of Splunk, LogRhythm, IBM and Exabeam, the global SIEM market is expected to grow to over $5 billion annually in 2022.

Fundamentally, SIEMs collect event log data from internet traffic, as well as corporate hardware and software assets. The starting idea was for a security analyst to then sift meaningful security intelligence from a massive volume of potential security events and keep intruders out. Yet, SIEMs never quite lived up to their initial promise.

And now, Big Data is about to become Very Big Data. Consider that 90 percent of the data that exists in the world today was generated in just the past couple of years. That includes everything moving across the internet: email, texting, online searches, social media posts, entertainment streaming, global finance, scientific research and cyber warfare. And on the horizon loom a full blown Internet of Things (IoT) and 5G networks, which will drive data generation to new heights. …more

NEW TECH: Votiro takes ‘white-listing’ approach to defusing weaponized documents

By Byron V. Acohido

It’s hard to believe this month marks the 20th anniversary of the release of the devastating Melissa email virus which spread around the globe in March 1999.

Melissa was hidden in a weaponized Word document that arrived as an email attachment. When the recipient clicked on the Word doc, a macro silently executed instructions to send a copy of the email, including the infected attachment, to the first 50 people listed as Outlook contacts.

Unfortunately, despite steady advances in malware detection and intrusion prevention systems, and much effort put into training employees to be wary of suspicious email, weaponized email and document-based malware remain as virulent as pervasive as it was two decades ago.

The Defense Department, for instance, detects 36 million malware-infested emails arriving from hackers, terrorists and foreign adversaries every 24 hours. That translates into an onslaught of some 13 billion weaponized emails raining down on Pentagon on an annual basis. This gives you an idea of the steady flow of weaponized email attacks against companies of all sizes and in all sectors, with certain verticals, namely financial services, healthcare companies and tech firms bearing the brunt.

I had a revelatory discussion about this with Aviv Grafi, CEO of Votiro, at RSA 2019 in San Francisco last week. Votiro is a Tel Aviv-based security startup that is pioneering a new white-listing approach to help companies mitigate their exposure to weaponized email and document-distributed malware. For a full drill down, please listen to the accompanying podcast. The key takeaways:

Productivity vs. security

Threat actors fully grasp that humans will forever remain the weak link in any business network. And they’re accomplished at sidestepping the latest perimeter and near-perimeter defenses. Meanwhile, they’ve also become adept at manipulating widely-used, legitimate workplace tools, for instance, …more

MY TAKE: What the Ethiopian 737 Max 8 crash should tell us about the safety of ‘smart’ jetliners

By Byron V. Acohido

When news broke about the crash of a Ethiopian Airlines Boeing 737, the first question that popped into my head was whether an older 737 model, still using the flawed rudder actuator, might have been involved.

Of course it was actually the newest iteration of the 737, the Max 8. I’m no longer covering aviation. But having chronicled the saga of the 737 flawed rudder design, which Boeing ultimately replaced, here is what I’m wondering:

•I wonder if this will turn out to be yet another in a long …more

Comment | Read | March 12th, 2019 | My Take | Top Stories

MY TAKE: Memory hacking arises as a go-to tactic to carry out deep, persistent incursions

By Byron V. Acohido

A common thread runs through the cyber attacks that continue to defeat the best layered defenses money can buy.

Peel back the layers of just about any sophisticated, multi-staged network breach and you’ll invariably find memory hacking at the core. In fact, memory attacks have quietly emerged as a powerful and versatile new class of hacking technique that threat actors in the vanguard are utilizing to subvert conventional IT security systems.

In a sense, memory attacks are a reflection of what has been left out of the $216 billion companies spent over the past two years on security products and services. That’s Gartner’s estimate of global spending on cybersecurity in 2017 and 2018. Memory hacking is being carried out across paths that have been left comparatively wide open to threat actors who are happy to take full advantage of the rather fragile framework of processes that execute deep inside the kernel of computer operating systems.

Last Watchdog recently sat down with Satya Gupta, founder and CTO of Virsec, a San Jose-based supplier of advanced data protection systems. Virsec is a leading innovator of memory protection technologies. Gupta put memory attacks in context of the complexity that has overtaken modern business networks. Here’s what I took away from our discussion:

Transient hacks

Memory hacking has become a go-to technique used both by common cybercriminals, as well as nation-state backed hacking specialists. Threat actors are crafting memory attacks designed to help them gain footholds, move laterally and achieve persistence deep inside well-defended enterprise networks.

Microsoft, supplier of the Windows operating system used ubiquitously in enterprise networks, recently disclosed that fully 70% of all security bugs pivot off what the software giant refers to as “memory safety issues.”

These are issues that are coming into play in all other major OSs, as well as at the processing chip level of computer hardware.

For instance, major vulnerability was discovered lurking in the GNU C Library, or GLIBC, an open source component that runs deep inside of Linux operating systems used widely in enterprise settings. GLIBC keeps common code in one place, thus making it easier for multiple programs to connect to the company network and to the Internet. Turns out it was possible for a threat actor to flood GLIBC with data, take control of it, and then use it as a launch point for stealing passwords, spying on users and attempting to usurp control of other computers. …more

Older Articles »

The Last Watchdog

My Take

BEST PRACTICES: How to protect yourself from the enduring scourge of malvertising

By Byron V. Acohido

Web application exposures continue to bedevil companies as digital transformation accelerates

By Byron V. Acohido

MY TAKE: Get ready to future-proof cybersecurity; the race is on to deliver ‘post-quantum crypto’

By Byron V. Acohido

NEW TECH: Exabeam retools SIEMs; applies credit card fraud detection tactics to network logs

By Byron V. Acohido

NEW TECH: Votiro takes ‘white-listing’ approach to defusing weaponized documents

By Byron V. Acohido

MY TAKE: What the Ethiopian 737 Max 8 crash should tell us about the safety of ‘smart’ jetliners

By Byron V. Acohido

MY TAKE: Memory hacking arises as a go-to tactic to carry out deep, persistent incursions

By Byron V. Acohido