Patch Released to Fix Actively Targeted Microsoft .Net Framework Vulnerability

Microsoft has addressed 27 critical flaws this Patch Tuesday, including a Microsoft .Net Framework flaw that is being actively exploited to download Finspy surveillance software on devices running Windows 10.

Finspy is genuine software created by the UK-based Gamma Group, which is used by governments globally for cyber-surveillance. The software has been downloaded in at least two attacks in the past few months according to FireEye experts, the most recent attack leveraged the Microsoft .Net Framework flaw.

The attack begins with a spam email including a malicious RTF file. The document uses the CVE-2017-8759 vulnerability to create arbitrary code, which installs and executes a VB script including PowerShell commands, which in turn installs the malicious payload, which includes Finspy.

FireEye suggests at least one attack was completed by a nation-state against a Russian target; however, FireEye experts also believe other actors may also be using the vulnerability to conduct attacks.

According to a blog post last Tuesday, the Microsoft .Net Framework flaw has been detected and mitigated. Microsoft strongly recommends downloading the latest update promptly to minimize exposure. Microsoft says the flaw could permit a malicious actor to take full control of an impacted system.

Many Several Bluetooth flaws were discovered and shared on Tuesday by security company Aramis. The flaws impact billions of Bluetooth-enabled devices around the globe. The eight flaws, referred to as BlueBorne, could be used to carry out man-in-the-middle attacks on devices via Bluetooth, sending traffic to the attacker’s computer. The bugs exist in Windows, iOS, Android and Linux.

In order to target the flaws, Bluetooth would need to be turned for the targeted device, although it would not be necessary for the device to be in discoverable mode. A hacker could use the flaws to connect to a device – a TV or speaker for example – and start a connection to a computer without the user’s knowledge. In order to carry out the attack, it would be necessary to be in relatively close physically to the targeted device.

In addition to intercepting communications, a hacker could also take full management of a device and steal data, download ransomware or malware, or perform other malicious activities such as placing the device on a botnet. Microsoft addressed one of the Bluetooth driver spoofing bugs – CVE-2017-8628 – in the latest round of updates.

One of the most pressing updates is for a remote code execution vulnerability in NetBIOS (CVE-2017-0161). The vulnerability impacts both servers and work devices. While the vulnerability is not thought to be currently exploited in the wild, it is of note as it can be exploited just by sending specially crafted NetBT Session Service packets.

The Zero Day Initiative (ZDI) said the flaw “is practically wormable within a Local Area Network. This could also target many virtual clients if the guest OSes all connect to the same (virtual) LAN.”

Overall, 81 updates have been published by Microsoft this Patch Tuesday. Adobe has addressed eight flaws, including two critical memory corruption bugs (CVE-2017-11281, CVE-2017-11282) in Flash Player, a critical XML parsing flaw in ColdFusion (CVE-2017-11286) and two ColdFusion remote code execution flaws (CVE-2017-11283, CVE-2017-11284) relating to deserialization of untrusted data.

Greater Email Security Required According to Healthcare Industry Phishing Report

In the United States, healthcare industry phishing campaigns have been to blame for exposing the protected health records of well in excess of 90 million Americans over the course of the past year. That’s more than 28% of the population of the United States.

This week, another case of healthcare sector phishing has come to light following the announcement of Connecticut’s Middlesex Hospital data breach. The hospital saw that four of its employees responded to a phishing email, resulting in their email account login details being sent to a hacker’s command and control center. In this case the damage inflicted by the phishing attack was limited, and only 946 patients had their data exposed. Other healthcare groups have not been nearly so fortunate.

Industry Latest News

Our industry news section includes a wide range of news items of particular relevance to the cybersecurity sector and managed service providers (MSPs).

This section also sources details of the most recent white papers and research studies relating to malware, ransomware, phishing and data breaches. These articles allow some insight into the general state of cybersecurity, the industries currently most heavily aimed for by cybercriminals, and figures and statistics for your own reports.

Cybercriminals use massive spam campaigns designed to infect as many computers as they can. These attacks are random, using email addresses stolen in large data breaches such as the cyberattacks on LinkedIn, MySpace, Twitter and Yahoo. However, highly targeted attacks are on the up, with campaigns geared to specific sectors. These industry-specific cyberattacks and spam and malware campaigns are covered in this section, along with possible mitigations for reducing the danger of a successful attack.

This category is therefore important for organizations in the education, healthcare, and financial services sectors – the most common attacked industries according to the latest security reports.

The articles cover current campaigns, spam email identifiers and details of the social engineering tactics used to trick end users and gain access to corporate networks. By using the advice in these articles, it may be possible to stop similar attacks.

Network Security

This network security news section contains a variety of articles about safeguarding networks and blocking cyberattacks, ransomware and malware installations. This section also includes articles on recent network security breaches, alerting outfits to the latest attack trends being used by hackers.

Layered cybersecurity defenses are vital due to the increase in hacking incidents and the explosion in ransomware and malware variants over the past 24 months. Outfits can address the threat by investing in new security defenses such as next generation firewalls, end point defense systems, web filtering solutions and advanced anti-malware and antivirus defenses.

While much investment goes on proven solutions that have been highly resilient in the past, many cybersecurity solutions – antivirus software – are not as effective as they were previously. In order to keep pace with hackers and cybercriminals and get ahead of the curve, organizations should consider using a wide variety of new cybersecurity solutions to block network intrusions, stop data breaches and improve protection against the most recent malware and ransomware threats.

This category includes information and guidance on different network security solutions that can be adopted to enhance e network security and ensure networks are not focused on by hackers and infected with malicious software.

Dangerous Spora Ransomware Ransomware Threat Discovered

A new and very dangerous ransomware threat to deal called Spore has been discovered.

Locky and Samas ransomware have certainly been major headaches for IT departments. Both forms of ransomware have a host of smart features designed to prevent detection, grow infections, and inflict the most damage possible, leaving companies with little option but pay the ransom demand.

However, there is now a new ransomware threat to address, and it could well be even bigger than Locky and Samas. Luckily, the ransomware authors only seem to be targeting Russian users, but that is likely to change. While a Russian version has been used in hacking attacks so far, an English language version has now been created. Spora ransomware attacks will soon be a global issue.

A massive portion of time and effort has gone into producing this very dangerous new ransomware variant and a decryptor is unlikely to be created due to the way that the ransomware encrypts data.

As opposed to many new ransomware attacks that rely on a Command and Control server to receive instructions, Spora ransomware can encrypt files even if the user is offline. Closing down Internet access will not stop an infection. It is also not possible to restrict access to the C&C server to prevent infection.

Earlier Ransomware variants have been created that can encrypt without C&C communication, although unique decryption keys are not necessary. That means one key will unlock all infections. Spora ransomware on the other hand needs all victims to use a unique key to unlock the encryption.  A hard-coded RSA public key is used to create a unique AES key for every user. That process happens locally. The AES key is then used to encrypt the private key from a public/private RSA key pair set up with each victim, without C&C communications. The RSA key also encrypts the separate AES keys for each user. Without the key supplied by the hackers, you cannot unlock the encryption.

This complex encryption process only represents part of what makes Spora ransomware unique. Different to many other ransomware variants, the hackers have not set the ransom amount. This gives the hackers a degree of flexibility and importantly this process occurs automatically. Security experts believe the degree of automation will see the ransomware provided on an affiliate model.

The flexibility allows companies to be charged a different amount to a person. The ransom set is calculated based on the extent of the infection and types of files that have been encrypted. Since Spora ransomware gathers data on the user, when contact is made to pay the ransom, amounts could easily be changed.

When victims visit the hacker’s payment portal to pay the ransom, they must supply the key file that is set up by the ransomware. The key files contains a range of data on the user, including details of the campaign used. The hackers can therefore carefully monitor infections and campaigns. Those campaigns that are successful and result in more payments can then be repeated. Less effective campaigns can be brought to an end.

At present there are a number of different payment options, including something quite different. Victims can pay to unlock the encryption, or pay extra to avoid future attacks, essentially being given immunity.

Emisoft Internet experts who have analyzed Spora ransomware say it is far from a run of the mill variant that has been quickly thrown together. It is the work of a highly knowledgeable group. The encryption process contains no weaknesses – uncommon for a new ransomware variant – the design of the HTML ransom demand and the payment portal is highly sophisticated, and the payment portal also contains a chat option to allow communication with the hackers. This degree of professionalism only comes from a lot of investment and massive work. This threat is unlikely to disappear soon. In fact, it could prove to be one of the most serious threats in 2017 and into the future.

Infection currently takes place through spam email containing malicious attachments or links. Currently the attachments look like PDF invoices, although they are HTA files including JavaScript code. Preventing emails from being sent is the best form of defense. Since no decryptor is available for Spora, a backup will be necessary to recover for the infection or the ransom will need to be met.

 

DNS Based Web Filtering

DNS based web filtering takes advantage of cloud based technology to provide an Internet content filtering service equally as powerful as hardware or software solutions, but without the capital investment and high maintenance costs of those. As with most cloud-based technologies, DNS based web filtering software is handy and reliable, and extremely scalable.

Any Internet filtering solution has to have SSL inspection so that it can examine the content of encrypted web pages. Whereas SSL inspection can drain CPU resources and memory when included in hardware and software solutions, with DNS based web filtering the inspection process is done in the cloud – thus enhancing network operations.

How DNS Based Web Filtering Operates

In order to filter Internet content using a Domain Name Server (DNS), you need to register for a web filtering service. The service provider gives you a browser-based account you log into, submit your external IP address and set your web filtering policy. Then you just redirect your DNS system settings to the service provider´s web filtering service.

If you have a range of web filtering policies for different positions within your company, tools are available to link management tools such as LDAP and Active Directory with the web filtering service. It is also possible to put in place a DNS proxy for per user reporting and select from a variety of predefined reports. Alternatively, it is a simple process to set up your own bespoke reports.

Due to the way in which DNS based web filtering works, it can be applied with every type of network and operating system. Multiple locations and domains can be managed from one management portal, and – due to the SSL inspection process being conducted in the cloud – end users will not suffer the latency usually associated with hardware and software solutions.

Highly Granular Controls Maximize Your Security Strength

The most common given reasons given for adding an Internet content filter are to safeguard the company from web-borne dangers and to enforce acceptable use policies. DNS based web filtering achieves both these aims by deploying a three-tier mechanism for filtering Internet content. The three tiers work in tandem to maximize the company´s defenses and prevent users accessing material that could be an obstruction to productivity or cause offense.

The first tier includes SURBL and URIBL filters. These are commonly referred to as blacklists and they compare each request to view a website against IP addresses from which malware downloads, phishing attacks and spam emails are known to have been initiated. When matches are located, the request to visit the website is denied.  Blacklists are given and updated by your service provider.

Behind the blacklists, category filters and keyword filters make up the second and third lines of defense. These can be applied by system administrators to stop users visiting websites within some categories (social networking for example), or those likely to include material that would be inappropriate for an office environment. Keyword filters can also be used to prevent users accessing specific content or web applications, or downloading files with extensions most linked with malware.

Exemptions to general policies can be set up by user or user group if access to a website or web application is required by a certain department within the company. For example, you may not want your employees to engage in personal Internet banking during working hours, but it is likely crucial for your finance department has access to online banking services. Similar exemptions could be established (say) if your marketing department needed access to the company´s Facebook or Twitter accounts.

DNS Based Web Filtering Provided by SpamTitan

SpamTitan offers businesses a range of DNS based web filtering solutions – WebTitan Cloud for companies with fixed networks, and WebTitan Cloud for WiFi for companies providing a wireless service to end users. Both DNS based web filtering solutions have been created with maximum ease of use, maximum granularity and maximum security from web-borne threats.

Along with being versatile and effective DNS based web filtering solutions, both WebTitan Cloud and WebTitan Cloud for WiFi include many features to safeguard your company. Both solutions have best-in-class malicious URL detection, phishing protection and antivirus software – all of which is updated automatically. Both also update our filtering mechanisms in actual time – including the categorization of new websites as they are released.

The service grows in line with your company, so you never have to worry about registering new users or even multiple networks. WebTitan Cloud and WebTitan Cloud for WiFi are infinitely scalable, with no bandwidth limits, and no latency problems. Unless you advise them, your users will never know they are being safeguarded from web-borne threats until they try to visit an unsafe or inappropriate web pagesite.