Summary In late 2015, Secureworks® Counter Threat Unit™ (CTU) researchers began tracking financially motivated campaigns leveraging SamSam ransomware (also known as Samas and SamsamCrypt). CTU™ researchers associate this activity with the GOLD LOWELL threat group. GOLD LOWELL typically scans for and exploits known vulnerabilities in Internet-facing systems to gain an initial foothold in a victim’s
admin
Summary During 2017, the cryptocurrency market grew nearly 20-fold, reportedly increasing from approximately $18 billion to more than $600 billion (USD). Those gains amplified threat actors’ interest in accessing the computing resources of compromised systems to mine cryptocurrency. Secureworks® incident response (IR) analysts responded to multiple incidents of unauthorized cryptocurrency mining in 2017, and network
In an effort to deliver more robust application and data security solutions that protect enterprises against attacks from cyber-criminals, California-based Imperva Inc. announced that it will acquire the Los Angeles-based application security company Prevoty. The deal, which is expected to close in Q3 2018, has an estimated value of $140m. The Prevoty office will become an Imperva location.
A flaw in the website design for LifeLock, a company charged with protecting the identity of its online customers, resulted in millions of customer accounts being exposed, according to KrebsonSecurity. A vulnerability in the site, which reportedly lacked authentication and security, has been fixed, but the breach highlights the larger security concerns inherent in web application security. Of
Android users have been warned about another Exobot banking malware source code (v. 2.5) that was leaked online. It was first detected in May 2018 and has been dubbed “Trump Edition.” The leak is expected to result in a surge of malicious Android apps given that the malware source code is now available in dark
by John E Dunn When does a pop-up blocker stop being a pop-up blocker and turn into something altogether different? According to AdGuard researcher Andrey Meshkov, the answer might be when the pop-up blocking function appears to obscure an ulterior motive – spying on a user’s web traffic as a way of profiling them. The
by Paul Ducklin Every time we write about HTTP versus HTTPS there’s quite a kerfuffle, with questions and comments flying around… …Do I need it? Why should I bother? How does this affect me? Won’t it cost me money? I don’t have any secrets, so what’s the deal? Well, following Tuesday’s news that the latest
by Naked Security writer Happy SysAdmin Day! If you’re a System Administrator at work, then you’re definitely IT support at home as well. In fact, if you’re reading an article on Naked Security then you’re almost certainly the least non-technical user in your family, and that means you’re IT support at home too. And that
by Lisa Vaas Come the end of 2020, it will be time to stick a fork in Adobe Flash. That’s when, if you’ll forgive the mixed metaphor, the malware petri dish will officially be toast. Unfortunately, that doesn’t mean that government agencies are going to toss Flash into the compost pile After all, the government
by John E Dunn It’s an attack that will make many in the shipping industry feel very nervous for the second time in a year – the US network of one of the world’s largest shipping companies, COSCO (China Ocean Shipping Company), has been hit by a disruptive ransomware attack. So far, the company has
by Paul Ducklin As you know by now – or can just pretend to know if you didn’t – it’s #SysAdminDay. More precisely, it’s System Administrator Appreciation Day 2018 – the day when you are expected to appreciate your sysadmins, in word and in deed. The sys in sysadmin, of course, means “the computer systems
by Paul Ducklin A few years ago – make that quite a few, actually – Sophos was a lot smaller than it is now. Recruitment was different too – back then we weren’t so much writing cybersecurity software as helping to invent the entire field of anti-malware research. One of the paradoxical things that’s important
by Danny Bradbury Google took its efforts to protect online accounts up a notch this week, announcing its own hardware-based security key. Announced at Google’s Cloud Next conference, the Titan keys are a two-factor authentication (2FA) solution, designed to combat one of the most prevalent forms of online attack: account hijacking. Without 2FA, attackers who
by Mark Stockley So you’re a sysadmin – blue team, red pill, grey hat. Your brain works at the speed of a hyperloop inside a rocket ship slingshotting around a black hole that’s slingshotting around another black hole. You make the impossible possible, you make the improbable into the everyday and for everything else there’s
by Lisa Vaas A few weeks ago, a headline popped up on the BBC that caught the eye of security researchers: “Swann home security camera sends video to wrong user”. It was clear what happened: the camera uploaded a bunch of data on purpose, and then it sent it to the entirely wrong person. As
Summary In 2017, Secureworks® Counter Threat Unit™ (CTU) researchers continued to track GOLD SKYLINE, a financially motivated Nigerian threat group involved in business email compromise (BEC) and business email spoofing (BES) fraud. During the investigation, CTU™ researchers discovered a previously unidentified BEC group that they have named GOLD GALLEON. Unlike other BEC groups, GOLD GALLEON
Dalton and Flowsynth help create and test packet captures Thursday, November 16, 2017 By: Counter Threat Unit Research Team When crafting intrusion detection system (IDS) and intrusion prevention system (IPS) rules for engines such as Suricata and Snort, it is imperative that the rules behave and perform as expected. Validation requires testing, but capturing the
By all means patch, but take a risk-based approach Thursday, January 11, 2018 By: Barry Hensley Cybersecurity continues to make headlines in the New Year, including public disclosure on January 3rd of two new vulnerabilities that affect most modern computer processors. Spectre and Meltdown represent a new class of vulnerability that takes advantage of performance
In December 2017, Secureworks® incident response (IR) analysts responded to multiple incidents where threat actors compromised vulnerable Internet-facing Oracle WebLogic servers on Linux and Windows systems to deploy cryptocurrency software. The unauthorized activity significantly impacted the performance of business-critical and client-facing applications. The continued inquiries about this activity in January 2018 suggest that many organizations
Security services, IoT, integrated platforms, GDPR, skills shortage, detection and response, machine learning, automation and orchestration are just a few of the key themes in a vast array of industry analyst predictions about the changing security landscape for customers and vendors in 2018. Following are just a few of these predictions that highlight how cybersecurity
Threat actors continue to use opportunistic attacks to compromise networks and deploy SamSam ransomware to collect money from various types of organizations. Thursday, February 15, 2018 By: Counter Threat Unit Research Team On February 15, 2018, Secureworks® Counter Threat Unit™ (CTU) researchers published details about the tools and techniques used in a series of high-profile
The iPhone and many of the apps designed to live on the device have the ability to track our location. Whenever they set up these apps, however, users get the option to opt in or out of location tracking services. But what happens when a malicious campaign doesn’t give users the option to opt of
Screen time — how much is too much — is a red-hot issue right now and for good reasons. Now, with several decades of a technology-saturated lifestyle behind us, the research repeatedly tells us: Too much screen time can be detrimental to kids. Balance is the new black when it comes to screen time. However, if
By: Ruby, Digital Media Specialist It’s often assumed that interns are usually college undergraduates with a temporary assignment. I’m an exception to the rule in both respects. I started as a McAfee intern while I was a part-time graduate MBA student at Santa Clara University. Through my internship, I secured a full-time position on McAfee’s
By: DaWane, Sales Director Standing in front of 800 parents and fellow students to deliver the welcome address, thoughts swirled around in my head. My hands were shaky, my palms oozed with sweat and I had a death grip on the podium. They say I did well, but inside, I was so uncomfortable, I thought
It seems some malicious app developers have taken the phrase “fake it ‘til you make it” to heart, as fake apps have become a rampant problem for Android and iPhone users alike. Even legitimate sources, such as Google Play and Apple’s App Store, have been infiltrated with illegitimate applications, despite their own due diligence in
By Christie, HR Communications Intern As someone who always wanted to make an impact in the world, I thought nonprofit was the only fit for my passions in marketing and philanthropy. Because of this, I’ve worked primarily in the nonprofit sector for the last three years. But to keep my options open, I desired to
Similar to smartphones and computers, Bluetooth is one of the modern-day pieces of tech that has spread wide and far. Billions of devices of all types around the world have the technology woven into their build. So when news about the BlueBorne vulnerabilities broke back in late 2017, everyone’s ears perked up. Fast forward to
McAfee Labs has noticed a significant shift by some actors toward using trusted Windows executables, rather than external malware, to attack systems. One of the most popular techniques is a “fileless” attack. Because these attacks are launched through reputable executables, they are hard to detect. Both consumers and corporate users can fall victim to this
I walked into my niece’s room and found her busy making colourful bands. “What are these for?” I asked. “Friendship Day is coming up and this year I have decided to make my own bands to give to my friends. Got to finish making them all today.” “That’s lovely,” and then as a thought struck