Sep 30 2021

Apple Pay with Visa Hacked to Make Payments via Unlocked iPhones

Category: Information Security,Mobile Security — DISC @ 9:08 am

Researchers have demonstrated that someone could use a stolen, unlocked iPhone to pay for thousands of dollars of goods or services, no authentication needed.

An attacker who steals a locked iPhone can use a stored Visa card to make contactless payments worth up to thousands of dollars without unlocking the phone, researchers are warning.

The problem is due to unpatched vulnerabilities in both the Apple Pay and Visa systems, according to an academic team from the Universities of Birmingham and Surrey, backed by the U.K.’s National Cyber Security Centre (NCSC). But Visa, for its part, said that Apple Pay payments are secure and that any real-world attacks would be difficult to carry out.

The team explained that fraudulent tap-and-go payments at card readers can be made using any iPhone that has a Visa card set up in “Express Transit” mode. Express Transit allows commuters around the world, including those riding the New York City subway, the Chicago El and the London Underground, to tap their phones on a reader to pay their fares without unlocking their devices.

“An attacker only needs a stolen, powered-on iPhone,” according to a writeup (PDF) published this week. “The transactions could also be relayed from an iPhone inside someone’s bag, without their knowledge. The attacker needs no assistance from the merchant.”

In a proof-of-concept video, the researchers showed a ÂŁ1,000 payment being sent from a locked iPhone to a standard, non-transit Europay, Mastercard and Visa (EMV) credit-card reader.

Exploiting Apple Pay Express Transit Mode

The attack is an active man-in-the-middle replay and relay attack, according to the paper. It requires an iPhone to have a Visa card (credit or debit) set up as a transit card in Apple Pay.

The attackers would need to set up a terminal that emulates a legitimate ticket barrier for transit. This can be done using a cheap, commercially available piece of radio equipment, researchers said. This tricks the iPhone into believing it’s connecting to a legitimate Express Transit option, and so, therefore, it doesn’t need to be unlocked.

“If a non-standard sequence of bytes (Magic Bytes) precedes the standard ISO 14443-A WakeUp command, Apple Pay will consider this [to be] a transaction with a transport EMV reader,” the team explained.

Apple Pay with Visa Hacked to Make Payments via Unlocked iPhones

Tags: apple pay, unlocked iphones, visa hacked

Sep 29 2021

Expert discloses new iPhone lock screen vulnerability in iOS 15

Category: Security vulnerabilities,Smart Phone — DISC @ 2:12 pm
Expert discloses new iPhone lock screen vulnerability in iOS 15

The security researcher Jose Rodriguez discovered a new lock screen vulnerability for iOS 15 (& iOS 14.8) that has yet to be fixed.

The security researcher Jose Rodriguez (@VBarraquito) discovered a new lock screen vulnerability for iOS 15 (& iOS 14.8) that has yet to be addressed by Apple. A threat actor with physical access to a vulnerable device can access Notes via Siri/Voice Over.

Rodriguez explained that in real incidents, unattended or stolen devices with a lock screen bypass vulnerability are exposed to attacks that could leverage a lock screen vulnerability to access sensitive information.

This specific type of vulnerability represents a serious threat to individuals and organizations, for this reason, the expert suggests including their research when conducting a mobile pen-testing assessment.

The expert disclosed details about the lock screen bypass vulnerability after Apple downplayed similar flaws, tracked as CVE-2021-1835 and CVE-2021-30699, reported by the researcher earlier this year.

The flaws allowed an attacker to access instant messaging apps like WhatsApp or Telegram even while the mobile device was locked.

Rodriguez explained that Apple partially fixed the issue and did not involve him in the test of the released patch.

Then the expert proposed a variant of the same bypass issue that leverages Apple Siri and VoiceOver services to access the Notes app.

The expert also published a video PoC for the latest screen bypass vulnerability:

Let me suggest reading a post published by the expert that includes a long list of similar vulnerabilities:

https://blog.dinosec.com/2014/09/bypassing-ios-lock-screens.html

The iPhone Manual – Tips and Hacks

Tags: ios 15, iPhone Hacks, iPhone lock screen vulnerability, iPhone manual, iPhone tips

Sep 29 2021

How to Mitigate the Top 4 Ransomware Vectors

Category: Ransomware — DISC @ 9:44 am
How to Mitigate the Top 4 Ransomware Vectors

The ransomware economy is booming. Ransomware gangs are so successful that if cybercriminals were companies, some would be considered “unicorns.” Organized crime syndicates have taken over this highly lucrative extortion racket and are now running the ransomware economy at an industrial scale. The U.S. is reportedly hit by seven ransomware attacks every hour, with ransomware demands expected to hit $20 billion this year and $265 billion in ten years.

Top Infection Vectors of a Ransomware Attack

Cybercriminals need a delivery system that drops the ransomware payload on the target machine. Once this malware infiltrates your network, it takes over and can perform several damaging actions such as file encryption, credential hijacking, data exfiltration and even deletion or corruption of your backups. Recognizing and fortifying defenses against such infection vectors is key for a proactive ransomware defense. Cybercriminals continue to evolve their vectors in line to changes in internet and technology however, here are the top four infection vectors:

How to Mitigate the Top 4 Ransomware Vectors

Ransomware Protection Playbook

Tags: Ransomware Protection Playbook

Sep 28 2021

Check What Information Your Browser Leaks

Category: Web Security — DISC @ 11:58 am
Check What Information Your Browser Leaks

These two sites tell you what sorts of information you’re leaking from your browser.

The Browser Hacker’s Handbook

Tags: Browser Hacker's Handbook, Browser Leaks

Sep 27 2021

Port of Houston was hit by an alleged state-sponsored attack

Category: Cyber Attack — DISC @ 9:45 pm
Port of Houston was hit by an alleged state-sponsored attack

One of the major US ports, the Port of Houston, revealed that it was hit by a cyber attack in August that had no impact on its systems.

“The Port of Houston Authority (Port Houston) successfully defended itself against a cybersecurity attack in August. Port Houston followed its Facilities Security Plan in doing so, as guided under the Maritime Transportation Security Act (MTSA), and no operational data or systems were impacted as a result.” reads a statement issued on Thursday by Port officials.

Cybersecurity and Infrastructure Security Agency Director Jen Easterly disclosed the attack at a Senate committee hearing Thursday morning. She believed the attack was conducted by a “nation-state actor” that exploited a zero-day flaw in a Zoho user authentication device.

“We are working very closely with our interagency partners and the intelligence community to better understand this threat actor so that we can ensure that we are not only able to protect systems, but ultimately to be able to hold these actors accountable,” Easterly added.

Tags: state-sponsored attack

Sep 27 2021

Ways to Improve Internet Speed

Category: Network security — DISC @ 2:31 pm
Ways to Improve Internet Speed

A slow-speed internet that makes you wait for ages before you can finally access a webpage is surely quite a pain! It tests your patience to the last limits and doesn’t allow you to complete your work on time. It is equally frustrating for game lovers, who always need an active internet connection to play the games. Alongside this, the slow internet hinders with user’s efficiency to a great deal.

If you are sick and tired of your slow-poke internet, here are a few ways through which you can augment the speed of your internet, easily.

  • Restart the Router

This is surely an age-old formula to repair things and works quite well most of the time. If your internet connectivity is getting blocked or the connection gets interrupted quite a lot, you need to try this method for sure. All you need to do is to turn off the switch giving power to the router. Once you turn it on again, it will work well and deliver you with the speed you always wanted

  • Use a Cable

Going back to the old typical cable connectivity might help you with your internet speed this time. Yes, you read that right! You may need to take that dangling wire out of your storage box and put it back to work. The speed it delivers will amaze you. This happens because there is no distraction, distortion, or blockade anymore, which might affect the signal strength of the Wi-Fi.

Tags: Boost internet speed, Improve Internet Speed

Sep 27 2021

Proper password security falling short despite increase in online presence

Category: Information Security,Password Security — DISC @ 9:32 am
Proper password security falling short despite increase in online presence

While 92 percent of people know that using the same password or a variation is a risk, 65 percent still re-use passwords across accounts, drastically increasing the risks to their sensitive information, a LastPass report revealed.

proper password security

While consumers have a solid understanding of proper password security and the actions necessary to minimize risk, they still pick and choose which information they apply that knowledge to, according to the report.

Spending more time online, yet lacking proper password security

Strong cybersecurity habits are more important than ever this year, given the sheer volume of time individuals have spent online in the last 18 months and the corresponding spike in cyber-attacks. Yet the survey revealed that despite 71 percent of people working wholly or partly remote and 70 percent spending more time online for personal entertainment during the pandemic, people were still exhibiting poor password behavior.

Password Authentication for Web and Mobile Apps

Tags: password security

Sep 26 2021

STILL ALIVE! iOS 12 gets 3 zero-day security patches – update now

Category: Mobile Security,Zero day — DISC @ 11:20 am
STILL ALIVE! iOS 12 gets 3 zero-day security patches – update now

If you’ve already listened to this week’s Naked Security Podcast you’ll know that we had finally concluded that iOS 12, the version before the version before the latest-and-greatest iOS 15, which arrived this Monday



had been dumped forever by Apple.

Apple notoriously won’t tell you anything about the security situation in its products unless and until it has a patch out.

So when iOS 14 got updated in the last couple of patch cycles, but iOS 12 didn’t, we couldn’t tell whether it was still safe and didn’t need the patches, whether it needed the patches but they’d be a bit late, or whether it needed the patches but would never get them.

And with iOS 15 arriving as the new kid on the block this week, we assumed the worst, following the “one-in-one-out” principle.

We haven’t finished because we haven’t even started

iOS Application Security

Tags: iOS 12, iOS Application Security

Sep 24 2021

Treasury Sanctions SUEX Exchange for Laundering Ransoms

Category: Ransomware — DISC @ 11:46 am
Treasury Sanctions SUEX Exchange for Laundering Ransoms

The Biden administration fired another shot in its battle against ransomware Tuesday as the U.S. Treasury Department took steps to disrupt the financial infrastructure behind ransoms, designating for sanctions the SUEX OTC, S.R.O. virtual currency exchange for laundering ransom payments.

By designating SUEX, the Treasury Department’s Office of Foreign Assets Control (OFAC) is blocking the exchange’s property (and interests in property) that are under U.S. jurisdiction. In addition, if a designated person owns 50% or more of an entity, they also can be blocked; those involved in some transactions or activities – whether individuals or financial institutions – could be exposed to sanctions or some other penalty.

While the actions taken against SUEX aren’t attached to a particular ransomware-as-a-service (RaaS) or ransomware variant, the agency said an analysis of the exchange’s activities found transactions made for at least eight ransomware variants.

“This advisory is really a final warning for companies to get their security operations in order,” said Jake Williams, co-founder and CTO at BreachQuest. “The vast majority of ransomware incidents we respond to were trivially preventable.”

The government, he said, “sees companies facilitating ransomware payments as encouraging future ransomware attacks.”

The new advisory may prevent organizations from paying attackers to recover their data, “making it even more critical that they do what they can now to ensure they don’t suffer a ransomware attack in the first place,” said Williams.

Praising the Biden administration for doing “more for cybersecurity awareness and direction than we’ve seen in the past,” Bill O’Neill, vice president of public sector at ThycoticCentrify, added that, “The idea of disincentivizing organizations from paying out a ransom to attackers will likely only end up backfiring and having an adverse effect economically.” While the average company most often folds to ransomware demands “because they lack the proper knowledge, resources and technology to wrest [back] control of the data that was stolen from them to begin with,” O’Neill said, “Penalizing business owners for complying will only hurt them twofold while doing nothing to ultimately stop attacks from happening.”

If attackers can’t get ransom, then they’ll turn to the black market to make money by selling the data they pilfered. “Their victims, however, will be exponentially worse off and possibly open to further attacks,” said O’Neill. “The better approach would be to continue introducing policies and programs to raise awareness and educate organizations about the best ways to stay safe and prevent attacks, as well as providing resources surrounding key technologies to implement to help further minimize risks.”

The sanctions might be a good first step, but John Bambenek, principal threat hunter at Netenrich, said, “What is more important in stopping ransomware is finding those involved and getting them brought to justice; these kinds of actions could also impair intelligence collection on those bad actors.”

sanctions currency exchange

Treasury Sanctions SUEX Exchange for Laundering Ransoms

Bitcoin Investigation Manual: Hunting Bitcoin in the AML-Money Laundering World

Tags: Laundering Ransoms, money laundering, SUEX Exchange

Sep 24 2021

OWASP Top 10 2021: The most serious web application security risks

Category: App Security,Web Security — DISC @ 9:49 am
OWASP Top 10 2021: The most serious web application security risks

How is the list compiled?

“We get data from organizations that are testing vendors by trade, bug bounty vendors, and organizations that contribute internal testing data. Once we have the data, we load it together and run a fundamental analysis of what CWEs map to risk categories,” the Open Web Application Security Project (OWASP) explains.

“This installment of the Top 10 is more data-driven than ever but not blindly data-driven. We selected eight of the ten categories from contributed data and two categories from the Top 10 community survey at a high level.”

The reason for leaving space for direct input from application security and development experts on the front lines is the fact that it takes time to find ways to test new vulnerabilities, and they can offer knowledge on essential weaknesses that the contributed data may not show yet.

The list is then published so that it can be reviewed by practitioners, who may offer comments and suggestions for improvements.

OWASP Top 10 2021

OWASP Top 10 2021: What has changed in the last 4 years?

Tags: OWASP Top 10

Sep 23 2021

FBI Had the REvil Decryption Key

Category: Cryptograghy — DISC @ 3:03 pm
FBI Had the REvil Decryption Key

Real-World Cryptography

Tags: Decryption Key, FBI, Real-World Cryptography, Revil

Sep 23 2021

How to protect the corporate network from spyware

Category: Cyber Spy,Spyware — DISC @ 1:55 pm
How to protect the corporate network from spyware

There are a range of security policies for dealing with users’ smartphones, from the most restrictive approach – no smartphone access allowed – to an open approach that allows personal phones to connect to the internal corporate network. We suggest that the right solution is somewhere in between.

You may have read about the Pegasus spyware in the news; the NSO Group’s software exploits flaws in iOS (iPhones) to gain access to data on an unsuspecting target’s phone. NSO sells Pegasus to governments, ostensibly to track criminals, but it’s often used by repressive regimes to spy on their opponents, political figures, and activists.

In the past, Pegasus infections were primarily achieved by sending a link to the victim’s phone; when the target clicked on it, they would trigger an exploit that would allow attackers to gain root access to the phone. Once the spyware obtains root access, it can read messages on apps like iMessage, WhatsApp, Telegram, Gmail and others. A sophisticated command and control network can report back to the operator and control the phone as well.

Reducing the risk

What Is Pegasus? All About the Infamous Software (Infographic)

anti-spyware A Complete Guide

How To Protect Yourself From Adware Or Spyware

Tags: anti-spyware, Pegasus spyware, Spyware and Adware

Sep 22 2021

VMware patch bulletin warns: “This needs your immediate attention.”

Category: Virtualization — DISC @ 11:02 am
VMware patch bulletin warns: “This needs your immediate attention.”

VMware’s latest security update includes patches for 19 different CVE-numbered vulnerabilities affecting the company’s vCenter Server and Cloud Foundation products.

All of the bugs can be considered serious – they wouldn’t be enumerated in an official security advisory if they weren’t – but VMware has identified one of them, dubbed CVE-2021-22005, as more critical than the rest.

Indeed, VMware’s official FAQ for Security Advisory VMSA-2021-0020 urges that:

The ramifications of this vulnerability are serious and it is a matter of time – likely minutes after the disclosure – before working exploits are publicly available.

In particular, the company explains:

The most urgent [patch] addresses CVE-2021-22005, a file upload vulnerability that can be used to execute commands and software on the vCenter Server Appliance. This vulnerability can be used by anyone who can reach vCenter Server over the network to gain access, regardless of the configuration settings of vCenter Server.

VMware unabashedly says that “this needs your immediate attention,”, and we think it’s a good thing to see a software vendor talking about cybersecurity response in plain English instead of mincing its words.

VMware vSphere and Virtual Infrastructure Security

Tags: VMware

Sep 21 2021

Alaska’s Department of Health and Social Services Hack

Category: Cyber Espionage,Data Breach,Security Breach — DISC @ 1:38 pm
Alaska’s Department of Health and Social Services Hack

Alaska Department of Health and Social Services

Alaskan health department still struggling to recover after ‘nation-state sponsored’ cyberattack

Tags: cyberespionage, Hacking, healthcare, leaks

Sep 21 2021

Hackers Are Going ‘Deep-Sea Phishing,’ So What Can You Do About It?

Category: Phishing — DISC @ 11:23 am

Nick Kael, CTO at Ericom, discusses how phishing is gaining sophistication and what it means for businesses.

Hackers are upping their game, using an approach I call “Deep Sea Phishing,” which is the use of a combination of the techniques described below to become more aggressive. To keep pace, cybersecurity innovators have been working diligently to develop tools, techniques and resources to improve defenses. But how can organizations fight against evolving threats that have yet to be launched—or even conceived of?

For example, in February, 10,000 Microsoft users were targeted in a phishing campaign which sent emails purporting to be from FedEx, DHL Express and other couriers which contained links to phishing pages hosted on legitimate domains, with the goal of obtaining recipients’ work email credentials. Use of legitimate domains allowed the emails to evade security filters, and people’s pandemic-related reliance on delivery services and habituation to similar messages boosted success rates.

And in May, attackers launched a massive, sophisticated payment-themed phishing campaign. The phishing emails urged users to open an attached “payment advice” – which was, in fact, not an attachment at all but rather an image containing a link to a malicious domain. When opened, Java-based STRRAT malware was downloaded onto the endpoint and via a command-and-control (C2) server connection, ran backdoor functions such as collecting passwords from browsers, running remote commands and PowerShell, logging keystrokes and other criminal activity.

Phishing is no longer the basement-brewed, small-scale nuisance of cyber lore, either. Today, nearly 70 percent of cyberattacks – like like those cited above – are orchestrated by organized crime or nation-state affiliated actors. With many recovery tabs running into the millions, organizations need a solution that can safeguard them from attacks that have not yet been engineered — i.e., zero-day attacks that can cause the most damage.

But before we tackle the issue of defense, let’s first take a look at just what we’re defending against. The types of phishing tactics noted below are listed in ascending order of sophistication.

Types of Phishing

Tags: Deep-Sea Phishing

Sep 20 2021

How to retain the best talent in a competitive cybersecurity market

Category: Cyber career,InfoSec jobs — DISC @ 11:48 am
How to retain the best talent in a competitive cybersecurity market

hiring and retaining the best talent has quickly become a top priority for most organizations today. In the cybersecurity industry, which faces an immense skills shortage, this is especially true. In fact, according to CompTIA and Cyber Seek, a job-tracking database from the U.S. Commerce Department, there are nearly 500,000 open positions in cybersecurity nationwide as of Q2 2021, which makes hiring the right candidate for a technical role in IT security like finding a needle in a haystack. As a result, it’s never been more important to attract and develop employees in cybersecurity – and here are a few best practices for doing so.

Retention is not a one-size-fits-all initiative

Every employee and organization are different. Even in an industry with a talent deficit, employee/employer culture needs to be symbiotic. What an employee and an employer are looking for must be aligned and when it is, the opportunities are endless.

identity theft

Cybersecurity Career Master Plan

Tags: Cyber career, InfoSec jobs

Sep 20 2021

“Back to basics” as courier scammers skip fake fees and missed deliveries

Category: Cyber Threats,Cybercrime,Information Security — DISC @ 9:24 am
“Back to basics” as courier scammers skip fake fees and missed deliveries

These scams can take many different forms, including:

  • A fake gift sent by an online “friend” is delayed by customs charges. This is a common ruse used by romance scammers, who sucker you into an online friendship, for example by stealing other people’s profile data from online data sites, courting you online, and then “sending” you a “gift”, often jewellery or something they know you would appreciate if it were real. The scammer then pretends to be the courier company handling the “delivery”, correctly identifying the item, its value and its made-up shipping code. Finally, there’s a customs or tax payment to make before the item can be released in your country (something that often happens with genuine deliveries via geniune courier companies). Some unfortunate victims pay out this fee, in cash, in good faith. In this sort of scam, the crooks are directly after your money.
  • A fake order will be delivered once you have confirmed the purchase. These fake orders range from low-value subscriptions that have auto-renewed, all the way to expensive new mobile phones or gaming consoles that will ship imminently. Given that it’s easier to guess what you haven’t just bought than what you have, these crooks are banking that you will click the link or phone the “customer support” number they’ve helpfully provided in order to cancel or dispute the charge. Once they have you on the hook, skilled social scammers in a call centre operated by the crooks offer to “help” you to cancel the bogus order or subscription (something that can be annoyingly hard for legitimate goods and services). In this sort of scam, the crooks are after as much personal information as they can persuade you to hand over, notably including full credit card data, phone number and home address.
  • A fake delivery failed and the item was returned to the depot. These fake delivery notices typically offer to help you reschedule the missed delivery (something that is occasionally necessary for legitimate deliveries of geniune online orders), but before you can choose a new date you usually need to login to a fake “courier company” website, hand over credit card data, or both. The credit card transactions are almost always for very small amounts, such as $1 or $2.99, and some crooks helpfully advise that your card “won’t be charged until the delivery is complete”, as a way of making you feel more comfortable about committing to the payment. In this sort of scam, the crooks won’t bill you $2.99 now, but they will almost certainly sell your credit card details on to someone else to rack up charges later on.

KISS – Keep It Simple and Straightforward

Tags: Cyber Scam, Scam Me If You Can, scammers

Sep 19 2021

The digital identity imperative

Category: Digital cold war,Information Privacy — DISC @ 2:24 pm
The digital identity imperative

But creating an identity layer wasn’t imperative for the creators of the internet as they didn’t predict the emergence of online platforms that facilitate people-to-people interaction.

The digital presences most of us have are based on browsing or consumer habits and are siloed within various accounts and social networks. Indeed, they don’t present an accurate picture of our unique identifiers and who we are.

Building an identity layer is complex

Establishing a verified digital identity is a complex process. Authenticating that a person performing an action online is who they say they are, and then validating that they exist is tedious for two major reasons.

The digital identity imperative

Self-Sovereign Identity

Tags: Digital Identity, Self-Sovereign Identity

Sep 18 2021

‘OMIGOD’ Azure Critical Bugfix? Do It Yourself—Because Microsoft Won’t

Category: Security Operations Center,Windows Security — DISC @ 10:47 pm
‘OMIGOD’ Azure Critical Bugfix? Do It Yourself—Because Microsoft Won’t

Using OMI on Microsoft Azure? Drop everything and patch this critical vulnerability, snappily named OMIGOD. But wait! You probably don’t know whether you’re using OMI or not.

Y’see, Open Management Infrastructure (OMI) is often silently installed on Azure—as a prerequisite. And, to make matters worse, Microsoft hasn’t rolled out the patch for you—despite publishing the code a month ago. So much for the promise of ‘The Cloud.’

What a mess. In today’s SB Blogwatch, we put the “mess” into message.

Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: Difficult Hollywood.

OMI? DIY PDQ

What’s the craic? Simon Sharwood says—“Microsoft makes fixing deadly OMIGOD flaws on Azure your job”:

Your next step”
Microsoft Azure users running Linux VMs in the 
 Azure cloud need to take action to protect themselves against the four “OMIGOD” bugs in the 
 OMI framework, because Microsoft hasn’t. 
 The worst is rated critical at 9.8/10 
 on the Common Vulnerability Scoring System.


Complicating matters is that running OMI is not something Azure users actively choose. 
 Understandably, Microsoft’s actions – or lack thereof – have not gone down well. [And it] has kept deploying known bad versions of OMI. 
 The Windows giant publicly fixed the holes in its OMI source in mid-August 
 and only now is advising customers.


Your next step is therefore obvious: patch ASAP.

‘OMIGOD’ Azure Critical Bugfix? Do It Yourself—Because Microsoft Won’t

Tags: Azure Critical Bugfix

Sep 17 2021

PenTest as a Service

Category: Information Security,Pen Test — DISC @ 3:34 pm

Download Modern Pentesting for security and development team

Find out how Cobalt service protect your Apps: Cobalt’s Pentest as a Service (PtaaS) platform coupled with an exclusive community of testers delivers the real-time insights you need to remediate risk quickly and innovate securely.

Find out how Cobalt service protect your Apps: Cobalt’s Pentest as a Service (PtaaS) platform coupled with an exclusive community of testers delivers the real-time insights you need to remediate risk quickly and innovate securely.

Please email with the subject “Beginner’s Guide to Compliance-Driven Pentesting” if interested to read this guide: Info@deurainfosec.com

Tags: Pentest as a service, Pentesting as a service, PtaaS

« Previous Page — Next Page »