The attacks showcase broader security concerns as phishing grows in volume and sophistication, especially given that Windows Defender's Safe Links feature for identifying malicious links in emails completely failed in the campaign.

Thousands of Microsoft 365 credentials have been discovered stored in plaintext on phishing servers, as part of an unusual, targeted credential-harvesting campaign against real estate professionals. The attacks showcase the growing, evolving risk that traditional username-password combinations present, researchers say, especially as phishing continues to grow in sophistication, evading basic email security.   

Researchers from Ironscales discovered the offensive, in which cyberattackers had compromised email account credentials for employees at two well-known financial-services vendors in the realty space: First American Financial Corp., and United Wholesale Mortgage. The cybercrooks are using the accounts to send out phishing emails to realtors, real estate lawyers, title agents, and buyers and sellers, analysts said, in an attempt to steer them to spoofed Microsoft 365 login pages for capturing credentials.

The emails alert targets that attached documents needed to be reviewed or that they have new messages hosted on a secure server, according to a Sept. 15 posting on the campaign from Ironscales. In both cases, embedded links direct recipients to the fake login pages asking them to sign into Microsoft 365.

Once on the malicious page, researchers observed an unusual twist in the proceedings: The attackers tried to make the most of their time with the victims by attempting to tease out multiple passwords from each phishing session.

"Each attempt to submit these 365 credentials returned an error and prompted the user to try again," according to the researchers' writeup. "Users will usually submit the same credentials at least one more time before they try variations of other passwords they might have used in the past, providing a gold mine of credentials for criminals to sell or use in brute-force or credential-stuffing attacks to access popular financial or social-media accounts."

The care taken in the targeting of victims with a well-thought-out plan is one of the most notable aspects of the campaign, Eyal Benishti, founder and CEO at Ironscales, tells Dark Reading.

"This is going after people who work in real estate (real estate agents, title agents, real estate lawyers), using an email phishing template that spoofs a very familiar brand and familiar call to action ('review these secure documents' or 'read this secure message')," he says.

It's unclear how far the campaign may sprawl, but the company's investigation showed that at least thousands have been phished so far.

"The total number people phished is unknown, we only investigated a few instances that intersected our customers," Benishti says. "But just from the small sampling we analyzed, there more than 2,000 unique sets of credentials found in more than 10,000 submission attempts (many users supplied the same or alternate credentials multiple times)."

The risk to victims is high: Real estate-related transactions are often targeted for sophisticated fraud scams, especially transactions involving real estate title companies.

"Based on trends and stats, these attackers likely want to use the credentials to enable them to intercept/direct/redirect wire transfers associated with real estate transactions," according to Benishti.

**Microsoft Safe Links Falls Down on the Job**

Also notable (and unfortunate) in this particular campaign, a basic security control apparently failed.

In the initial round of phishing, the URL that targets were asked to click didn't try to hide itself, researchers noted — when mousing over the link, a red-flag-waving URL was displayed: "https://phishingsite.com/folde...\[dot\]shtm."

However, subsequent waves hid the address behind a Safe Links URL — a feature found in Microsoft Defender that's supposed to scan URLs to pick up on malicious links. Safe Link overwrites the link with a different URL using special nomenclature, once that link is scanned and deemed safe.

In this case, the tool only made it harder to visually inspect the actual in-your-face "this is a phish!" link, and also allowed the messages to more easily get past email filters. Microsoft did not respond to a request for comment.

"Safe Links has a several known weaknesses and generating a false sense of security is the significant weakness in this situation," Benishti says. "Safe Links didn’t detect any risks or deception associated with the original link, but rewrote the link as if it had. Users and many security professionals gain a false sense of security because a security control in place, but this control is largely ineffective."

Also of note: In the United Wholesale Mortgage emails, the message was also flagged as a "Secure Email Notification," included a confidentiality disclaimer, and sported a fake "Secured by Proofpoint Encryption" banner.

Ryan Kalember, executive vice president of cybersecurity strategy at Proofpoint, said that his company is no stranger to being brand-hijacked, adding that fake use of its name is in fact a known cyberattack technique that the company's products scan for.

It's a good reminder that users can't rely on branding to determine the veracity of a message, he notes: "Threat actors often pretend to be well-known brands to entice their targets into divulging information," he says. "They also often impersonate known security vendors to add legitimacy to their phishing emails."

**Even Bad Guys Make Mistakes**

Meanwhile, it might not be just the OG phishers that are benefiting from the stolen credentials.

During the analysis of the campaign, researchers picked up on a URL in the emails that shouldn't have been there: a path that points to a computer file directory. Inside that directory were the cybercriminals' ill-gotten gains, i.e., every single email and password combo submitted to that particular phishing site, kept in a cleartext file that anyone could have accessed.

"This was totally an accident," Benishti says. "The result of sloppy work, or more likely ignorance if they are using a phishing kit developed by someone else — there are tons of which available for purchase on black market."

The fake webpage servers (and cleartext files) were quickly shut down or removed, but as Benishti noted, it's likely that the phishing kit the attackers are using is responsible for the cleartext glitch — which means they "will continue to make their stolen credentials available to the world."

**Stolen Credentials, More Sophistication Fuels Phish Frenzy**

The campaign more broadly puts into perspective the epidemic of phishing and credential harvesting — and what it means for authentication going forward, researchers note.

Darren Guccione, CEO and co-founder at Keeper Security, says that phishing continues to evolve in terms of its sophistication level, which should act as a clarion warning to enterprises, given the elevated level of risk.

"Bad actors at all levels are tailoring phishing scams using aesthetic-based tactics such as realistic-looking email templates and malicious websites to lure in their victims, then take over their account by changing the credentials, which prevents access by the valid owner," he tells Dark Reading. "In a vendor impersonation attack \[like this one\], when cybercriminals use stolen credentials to send phishing emails from a legitimate email address, this dangerous tactic is even more convincing because the email originates from a familiar source."

Most modern phishes can also bypass secure email gateways and even spoof or subvert two-factor authentication (2FA) vendors, adds Monnia Deng, director of product marketing at Bolster, while social engineering in general is extraordinarily effective in a time of cloud, mobility, and remote work.

"When everyone expects their online experience to be fast and easy, human error is inevitable, and these phishing campaigns are getting more clever," she says. She adds that three macro-trends are responsible for the record numbers of phishing-related attacks: "The pandemic-fueled move to digital platforms for business continuity, the growing army of script kiddies who can easily purchase phishing kits or even buy phishing as a subscription service, and the interdependency of technology platforms that could create a supply chain attack from a phishing email."

Thus, the reality is that the Dark Web hosts large caches of stolen usernames and passwords; big data dumps are not uncommon, and are in turn spurring not only credential-stuffing and brute-force attacks, but also additional phishing efforts.

For instance, it's possible that threat actors used information from a recent First American Financial breach to compromise the email account they used to send out the phishes; that incident exposed 800 million documents containing personal information.

"Data breaches or leaks have a longer half-life than people think," Benishti says. "The First American Financial breach happened in May 2019, but the personal data exposed can be weaponized used years afterwards."

To thwart this bustling market and the profiteers that operate within it, it's time to look beyond the password, he adds.

"Passwords require ever increasing complexity and rotation frequency, leading to security burnout," Benishti says. "Many users accept the risk of being insecure over the effort to create complex passwords because doing the right thing is made so complex. Multifactor authentication helps, but it is not a bulletproof solution. Fundamental change is needed to verify you are who you say you are in a digital world and gain access to the resources you need."

**How to Fight the Phishing Tsunami**

With widespread passwordless approaches still a ways off, Proofpoint's Kalember says that the basic user-awareness tenets are the place to start when fighting phishing.

"People should approach all unsolicited communications with caution, especially those that request the user to act, such as downloading or opening an attachment, clicking a link, or disclosing credentials such as personal or financial information," he says.

Also, it’s critical that everyone learn and practice good password hygiene across every service they use, Benishti adds: "And if you are ever notified that your information may have been involved in a breach, go reset all of your passwords for every service you use. If not, motivated attackers have cleaver ways of correlating all sorts of data and accounts to get what they want."

In addition, Ironscales recommends regular phishing simulation testing for all employees, and called out a rule-of-thumb set of red flags to look for:

*   Users could have identified this phishing attack by closely looking at the sender
*   Make sure the sending address matches the return address and the address is from a domain (URL) that usually matches the business they deal with.
*   Look for bad spelling and grammar.
*   Mouse over links and look at the full URL/address of the destination, see if it looks unusual.
*   Always be very cautious about sites that ask you for credentials not associated with them, like Microsoft 365 or Google Workspace login.

Real Estate Phish Swallows 1,000s of Microsoft 365 Credentials

Building quantum resilience requires C-suite commitment, but it doesn't have to mean tearing out existing infrastructure.

You may feel that encrypting data with current technology will offer robust protection. Even if there is a data breach, you may presume the information is secure. But if your organization works with data with a "long tail" — that is, its value lasts years — you'd be wrong.

Fast forward five to 10 years from now. Quantum computers — which use quantum mechanics to run operations millions of times faster than today's supercomputers can — will arrive and will be able to decrypt today's encryption in minutes. At that point, nation-state actors simply have to upload the encrypted data that they've been collecting for years into a quantum computer, and in a few minutes, they will be able to access any part of the stolen data in plaintext. This type of "harvest now, decrypt later" (HNDL) attack is one of the reasons why adversaries are targeting encrypted data now. They know they can't decrypt the data today but will be able to tomorrow.

Even though the threat of quantum computing is some years away, the risk exists today. It is for this reason that US President Joe Biden signed a National Security Memorandum requiring federal agencies, defense, critical infrastructure, financial systems, and supply chains to develop plans to adopt quantum-resilient encryption. President Biden setting the tone for federal agencies serves as an apt metaphor — quantum risk should be discussed, and risk mitigation plans developed, at the leadership (CEO and board) level.

**Take the Long-Term View**

Research analyst data suggests the typical CISO spends two to three years at a company. This leads to potential misalignment with a risk that is likely to materialize in five to 10 years. And yet, as we see with government agencies and a host of other organizations, the data you generate _today_ can provide adversaries with tremendous value in the future once they can access it. This existential problem will likely not be tackled solely by the person in charge of security. It must be addressed at the highest business leadership levels owing to its critical nature.

For this reason, savvy CISOs, CEOs, and boards should address the quantum computing risk problem together, _now_. Once the decision to embrace quantum-resistant encryption is made, the questions invariably become, "Where do we start, and how much will it cost?"

The good news is it doesn't have to be a painful or costly process. In fact, existing quantum-resilient encryption solutions can run on existing cybersecurity infrastructure. But it is a transformational journey — the learning curve, internal strategy and project planning decisions, technology validation and planning, and implementation all take time — so it is imperative that business leaders begin preparing today.

**Focus on Randomizing and Key Management**

The road to quantum resilience requires commitment from key stakeholders, but it is practical and does not usually require ripping-and-replacing existing encryption infrastructure. One of the first steps is to understand where all of your critical data resides, who has access to it, and what protection measures are currently in place. Next, it is important to identify which data is most sensitive and what its sensitivity lifetime is. Once you have these data points, you can develop a plan to prioritize the migration of the data sets to quantum-resilient encryption.

Organizations must give thought to two key points when considering quantum-resilient encryption: the quality of the random numbers used to encrypt and decrypt data and the key distribution. One of the vectors quantum computers could use to crack current encryption standards is to exploit encryption/decryption keys that are derived from numbers that are not truly random. Quantum-resistant cryptography uses longer encryption keys and, most importantly, ones that are based on truly random numbers so they can't be cracked.

Second, the typical company has several encryption technologies and key-distribution products, and management is complex. Consequently, to reduce the reliance on keys, often only large files are encrypted, or, worse yet, lost keys leave batches of data inaccessible. It is imperative that organizations deploy high-availability, enterprise-scale encryption key management to enable a virtually unlimited number of smaller files and records to be encrypted. This results in a significantly more secure enterprise.

Quantum-resistant encryption is no longer a "nice to have." With every passing day, risk is mounting as encrypted data is stolen for future cracking. Happily, unlike quantum computing, it does not require a huge investment, and the resulting risk reduction is almost immediate. Getting started is the hardest part.

Keep Today's Encrypted Data From Becoming Tomorrow's Treasure

The target has been under relentless DDoS attack, which ultimately set a new packets-per-second record for Europe.

Researchers at Akamai are reporting a distributed denial-of-service (DDoS) attack in Eastern Europe, which set records by peaking at 704.8 Mpps as the cyberattackers tried to cripple the organization's business operations.  

The attackers began by targeting the victim's primary data center, before expanding unexpectedly and hitting six different global locations, from Europe to North America.

This isn't the first record-breaking DDoS attack this unidentified Eastern European victim has weathered. In July, it was on the receiving end of 14-hour attack that set the previous European packets-per-second record of 659.6 Mpps.

The notable set of attacks is part of an emerging trend toward more complex, powerful, and persistent DDoS attacks, according to Akamai. 

"Adversaries are constantly evolving their techniques, tactics, and procedures to evade detection and maximize disruption, as demonstrated by this ongoing attack campaign," the Akamai report on the European DDoS attack said. "These events reflect a growing trend in which adversaries are increasingly hitting deep-reconnaissance targets," 

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

DDoS Attack Against Eastern Europe Target Sets New Record

A teen hacker reportedly social-engineered an Uber employee to hand over an MFA code to unlock the corporate VPN, before burrowing deep into Uber's cloud and code repositories.

**_This post was updated at 2:15 ET on Sept. 16, 2022 to reflect additional initial compromise information._**

Ride-sharing giant Uber took some of its operations offline late Thursday after it discovered that its internal systems have been compromised. The attacker was able to social-engineer his way into an employee's VPN account before pivoting deeper into the network, the company said.

While the full extent of the breach has yet to come to light, the person claiming responsibility for the attack (reportedly a teenager) claimed to have troves of emails, data pilfered from Google Cloud storage, and Uber's proprietary source code, "proof" of which he sent out to some cybersecurity researchers and media outlets, including The New York Times.

"They pretty much have full access to Uber," Sam Curry, security engineer at Yuga Labs, told the Times. "This is a total compromise, from what it looks like."

**Compromise Dominoes**

The Slack collaboration platform was the first system taken offline, but other internal systems quickly followed, according to reports. Just before the disablement, the attacker sent off a Slack message to Uber employees (some of whom shared it on Twitter): "I announce I am a hacker and Uber has suffered a data breach."

The perp also told researchers and media that the breach began with a text message to an Uber employee, purporting to be from corporate IT. More specifically, according to independent cybersecurity analyst Graham Cluley, the hacker mounted what's known as an "MFA fatigue attack." 

To wit: The attacker had already determined a valid username and password for Uber's VPN, but needed a text-based multifactor authentication (MFA) one-time code to get into the account. So, he bombarded the worker with MFA push notifications for more than an hour before contacting the target via WhatsApp, where he again posed as Uber IT staff. If the person wanted the irritation to stop, he said, they needed to accept the MFA request. The target complied.

"While no official explanation has been provided yet, \[apparently\] the intruder was able to connect to the corporate VPN to gain access to the wider Uber network, and then seems to have stumbled on gold in the form of admin credentials stored in plain text on a network share," Ian McShane, vice president of strategy at Arctic Wolf, said in a statement. "This is a pretty low-bar-to-entry attack and is something akin to the consumer-focused attackers calling people claiming to be Microsoft and having the end user install keyloggers or remote access tools."

The hacker also told other researchers that once in, he scanned the company’s intranet, and was lucky enough to find a PowerShell script containing hardcoded credentials for a Thycotic privileged access management (PAM) admin account, which gave him bountiful tools to unlock other internal systems, like Slack.

In a media statement to the Times, an Uber spokesperson confirmed that social engineering was the point of entry, and simply said that the company was working with law enforcement to investigate the breach. Publicly, via Twitter, the company posted, "We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available."

According to reports, the hacker said he is 18 years old and targeted the company to demonstrate its weak security; there may also be a hacktivist element, because he also declared in the Slack message to employees that Uber drivers should be paid more.

"Given the access they claim to have gained, I'm surprised the attacker didn't attempt to ransom or extort, it looks like they did it 'for the lulz,'" McShane added.

**Not Uber's First Data Breach Ride**

Uber was the subject of another massive breach, back in 2016. In that incident, cyberattackers made off with personal information for 57 million customers and drivers, demanding $100,000 in exchange for not weaponizing the data (the company paid up). A subsequent criminal investigation led to a non-prosecution settlement with the US Department of Justice this summer, which included Uber admitting that it actively covered up the full extent of the breach, which it didn't even disclose for more than a year.

Also related to that earlier hit, in 2018 Uber settled nationwide civil litigation by paying $148 million to all 50 states and the District of Columbia; and, ironically given the new developments, it agreed to "implement a corporate integrity program, specific data security safeguards, and incident response and data breach notification plans, along with biennial assessments."

Hacker Pwns Uber Via Compromised VPN Account

Since 2007, the Pwnies have celebrated the good, the bad, and the wacky in cybersecurity. Enjoy some of the best moments of this year's ceremony.

Highlights of the 2022 Pwnie Awards

Be wary of being pestered into making a bad decision. As digital applications proliferate, educating users against social engineering attempts is a key part of a strong defense.

Social engineering is hardly a new concept, even in the world of cybersecurity. Phishing scams alone have been around for nearly 30 years, with attackers consistently finding new ways to entice victims into clicking a link, downloading a file, or providing sensitive information.

Business email compromise (BEC) attacks iterated on this concept by having the attacker gain access to a legitimate email account and impersonate its owner. Attackers reason that victims won't question an email that comes from a trusted source — and all too often, they're right.

But email isn't the only effective means cybercriminals use to engage in social engineering attacks. Modern businesses rely on a range of digital applications, from cloud services and VPNs to communications tools and financial services. What's more, these applications are interconnected, so an attacker who can compromise one can compromise others, too. Organizations can't afford to focus exclusively on phishing and BEC attacks — not when business application compromise (BAC) is on the rise.

**Targeting Single Sign-on**

Businesses use digital applications because they're helpful and convenient. In the age of remote work, employees need access to critical tools and resources from a wide range of locations and devices. Applications can streamline workflows, increase access to critical information, and make it easier for employees to do their jobs. An individual department within an organization might use dozens of applications, while the average company uses more than 200. Unfortunately, security and IT departments don't always know about — let alone approve of — these applications, making oversight a problem.

Authentication is another issue. Creating (and remembering) unique username and password combinations can be a challenge for anyone who uses dozens of different apps to do their job. Using a password manager is one solution, but it can be difficult for IT to enforce. Instead, many companies streamline their authentication processes through single sign-on (SSO) solutions, which allow employees to sign into an approved account once for access to all connected applications and services. But because SSO services give users easy access to dozens (or even hundreds) of business applications, they are high-value targets for attackers. SSO providers have security features and capabilities of their own, of course — but human error remains a difficult problem to solve.

**Social Engineering, Evolved**

Many applications — and certainly most SSO solutions — have multifactor authentication (MFA). This makes it more difficult for attackers to compromise an account, but it's certainly not impossible. MFA can be annoying to users, who may have to use it to sign into accounts multiple times a day — leading to impatience and, sometimes, carelessness.

Some MFA solutions require the user to input a code or show their fingerprint. Others simply ask, "Is this you?" The latter, while easier for the user, gives attackers room to operate. An attacker who already obtained a set of user credentials might try to log in multiple times, despite knowing that the account is MFA-protected. By spamming the user's phone with MFA authentication requests, attackers increase the victim's alert fatigue. Many victims, upon receiving a deluge of requests, assume IT is attempting to access the account or click "approve" simply to stop the flood of notifications. People are easily annoyed, and attackers are using this to their advantage.

In many ways, this makes BAC easier to accomplish than BEC. Adversaries engaging in BAC just need to pester their victims into making a bad decision. And by targeting identity and SSO providers, attackers can gain access to potentially dozens of different applications, including HR and payroll services. Commonly used applications like Workday are often accessed using SSO, allowing attackers to engage in activities such as direct deposit and payroll fraud that can funnel funds directly into their own accounts.

This kind of activity can easily go unnoticed — which is why it's important to have in-network detection tools in place that can identify suspicious behavior, even from an authorized user account. In addition, businesses should prioritize the use of phish-resistant Fast Identity Online (FIDO) security keys when using MFA. If FIDO-only factors for MFA are unrealistic, the next best thing is to disable email, SMS, voice, and time-based one-time passwords (TOTPs) in favor of push notifications, then configure MFA or identity provider policies to restrict access to managed devices as an added layer of security.

**Prioritizing BAC Prevention**

Recent research indicates that BEC or BAC tactics are used in 51% of all incidents. While lesser known than BEC, successful BAC grants attackers access to a wide range of business and personal applications associated with the account. Social engineering remains a high-return tool for today's attackers — one that's evolved alongside the security technologies designed to stop it.

Modern businesses must educate their employees, teaching them how to recognize the signs of a potential scam and where to report it. With businesses using more applications each year, employees must work hand-in-hand with their security teams to help systems remain protected against increasingly devious attackers.

Business Application Compromise & the Evolving Art of Social Engineering

A stunning three-quarters of companies are looking to consolidate their security products this year, up from 29% in 2020, suggesting fiercer competition among cybersecurity vendors.

The makers of point security products may have a struggle on their hands over the next few years: Three-quarters of businesses are planning to reduce the number of security vendors on which they rely, up from 29% in 2020, according to a survey conducted by business-intelligence firm Gartner and published this week.

The massive surge in interest in vendor reduction is not driven by cost savings but a focus on making security more manageable and effective, according to Gartner's 418-person survey. Of the companies pursuing or planning to pursue security vendor consolidation, 65% stated that improving risk posture is the primary goal, while less than 30% expected that spending on products and licensing would be reduced, the analyst firm found.

The trend could fuel another round of consolidation among vendors in the industry, says John Watts, vice president analyst at Gartner.

"Gartner believes that security and risk management leasers are dissatisfied with their current operational inefficiencies and lack of integration of their existing heterogeneous security stacks," Watts says. "Many organizations are seeking more efficient and integrated solutions rather than point security products."

Consolidation of security vendors and products is a trend that has been building. In July, a survey conducted by the Information Systems Security Association and the Enterprise Strategy Group found that 46% of companies had begun consolidating, or were planning to consolidate, their number of security vendors.

In its 2020 CISO Benchmark Study, Cisco found that 86% of companies had 20 or fewer vendors, up from 79% two years earlier. In addition, 28% of firms thought that managing security in a multivendor environment had become very challenging, and another 53% considered the state of affairs to be somewhat challenging, according to Cisco's report.

"Most organizations are now in the 'finding it challenging' categories," Cisco stated in the report. "This might mean that you have fewer vendors to manage or that you have started to use tools, such as analytics engines, to improve results from multiple, disparate tools."

Two years later, Gartner's survey suggests that companies have consolidated even more, with 57% of companies having nine or fewer vendors for their security products and services, Gartner said in its announcement of the survey results.

Many companies are aiming to consolidate vendors with new contracts as they move to zero-trust technologies, such as secure access service edge (SASE) and extended detection and response (XDR). Fifty-seven percent all organizations say they are able to resolve security threats more quickly after implementing an XDR strategy, Gartner stated. Similarly, SASE projects help simplify network and security policy management.

"Security and risk management leaders must consider XDR and SASE as compelling options to start their consolidation journey," stated Dionisio Zumerle, vice president analyst at Gartner, in the survey announcement. "SASE provides secure enterprise access, while XDR focuses on detecting and responding to threats through increased visibility on networks, cloud, endpoints and other components."

While a minority of organizations are looking to consolidate to reduce costs, they will have to be willing to give up some features and shrink the number of products and licenses — or renegotiate their contracts, Gartner stated.

The cybersecurity industry has already started consolidating as vendors look to satisfy the demands of easier and more efficient security processes. In July, Google bought cybersecurity services firm Mandiant, beefing up its portfolio in its competition with other major cloud providers, such as Microsoft and Amazon.

The endpoint security market has already undergone significant consolidation, with VMware acquiring Carbon Black, HP hopping on the bandwagon with Bromium, BlackBerry cornering Cylance, and Thoma Bravo snapping up Sophos.

Companies that have not successfully consolidated vendors cite both time constraints and too-strict vendor agreements as the cause of failure, the firm said.

"Security and IT leaders should plan at least two years for consolidation as it takes time to effectively consolidate and consider incumbent vendor switching costs," Watts said in a statement announcing the results of the survey. "It is also important to anticipate vendor M&A disruption as the security market is always consolidating but never consolidated."

Note to Security Vendors: Companies Are Picking Favorites

Malware-laced ads are hauling in tens of millions of dollars in revenue for operators of pirated-content sites — posing a real risk to enterprises from remote employees.

The conventional wisdom about there being no such thing as a free lunch appears to be especially true for those visiting websites offering "free" (read: pirated) movies, TV shows, and other entertainment content.

A joint investigation by the consumer-oriented Digital Citizens Alliance, piracy and brand protection firm White Bullet, and security firm 221B found that most pirate sites generate a substantial portion of their revenues from serving malware-infused ads on the systems of users who visit them.

Many of the advertisers use fear tactics — of a malware infection, for instance — or messages conveying the need for a user to update their antivirus or other software, to try and deceive users into clicking on a malicious ad. The ads are often served as pop-ups or in so-called pop-under fashion behind a browser window. Users who click on the advertisements can often end up downloading ransomware, spyware for tracking their activities, and malware for stealing banking credentials or for bookmarking their compromised system for a future attack.

**Not Just a Consumer-Oriented Threat**

The threat might appear primarily consumer-oriented on the surface, but in an era in which many employees are working from home — often using unmanaged devices and poorly secured networks — what happens on a consumer device can easily spill over into enterprise environments as well. 

"The report's findings show that deceptive ads on piracy sites are driving the spread of malware, including ransomware attacks," says Tom Galvin, executive director of Digital Citizens Alliance. That should be a matter of concern to enterprises that have workers splitting their time between an office and home, he notes.

For such workers, the division between when they are working or playing is increasingly blurred, Galvin says.

"Given that the ads on piracy websites condition visitors to change their device settings to get access to what they want, that poses risks to enterprises," he says. "Workers visiting a piracy website could end up with their device breached, exposing the company to ransomware attacks or risk exposure to confidential information."

The collaborative investigation by Digital Citizens Alliance, White Bullet, and 221B showed that on average, 12% of the ads on websites serving pirated entertainment are malicious ads that generate a minimum of $121 million annually in revenues for the site operator. 

More than half of those revenues, or some $68 million, come from malicious advertisements served to US-based visitors to these sites. The research showed that the top websites that offer pirated and stolen content are raking in $1.08 billion in annual ad revenues.  

**Pirating & Malware: A Willing Alliance**

In many instances, the researchers found ad intermediaries actively facilitating ad placement on pirated sites even though they knew the advertisements were weaponized with different kinds of malware.

The new investigation showed that sites offering pirated content can sometimes profit from legitimate ads on their sites, but instances of ads for reputable companies landing on pirate sites are decreasing because of initiatives that the ad industry has launched in recent years. 

One of the most significant efforts to reduce revenues from legitimate ads for pirate site owners is being spearheaded by a group called the Trustworthy Accountability Group, according to the joint report: "As those efforts have succeeded in reducing revenue from legitimate advertisers, pirate operators appear to be increasingly turning to malvertising facilitated by the bottom feeders of the advertising ecosystem," the report noted.

Pop-under ads, through which malicious activity is hidden under content that a user might expect to see, are particularly lucrative for piracy site operators. These ads accounted for $88 million of the average $121 million in revenues the site operators generate. Click-to-play ads, where users are tricked into clicking on something to stream content, is another favorite tactic and accounts for $21 millions in revenues.

**Cyber-Risks With the New Normal**

The new normal of people working from home has created a target-rich environment for criminals seeking to breach computers, Galvin says. "They may be a consumer one minute and working on behalf of their organization the next," he says. Piracy and specifically many of malicious ads that appear on the sites are crafted to trick users to taking steps that lead to their devices being infected.

"Once that happens, it doesn't matter. Whatever information is on that device is the target of these illicit actors," he warns. "This should be a concern for corporations, nonprofit organizations, and governments that face the growing threat of cyberattack."

Malware on Pirated Content Sites a Major WFH Risk for Enterprises

When an organization fully embraces the cloud, traditional endpoints become disposable. Organizations must adapt their security strategy for this reality.

Traditional endpoint concepts were eroding as a result of mobile device adoption, and cloud sealed the deal. Data is an organization's most valuable asset. When an organization fully embraces the cloud, traditional endpoints become disposable. Modern applications are consumed from any device, anywhere, not just controlled workstations from the confines of a sanctioned data center. Endpoints are more likely to refer to APIs or services, not desktops, laptops, or servers. Organizations must adapt their security strategy for this reality, or they're exposing themselves to risk of incident, breach, or reputational damage.

**Cloud Attack Patterns Are Different**

Attack patterns evolved with cloud adoption and mobilization. Attack patterns that compromise endpoints for persistence are more likely to trigger security monitoring mechanisms and alert security teams. Attackers need not resort to the blunt hammer approach of ransomware infection. They can rely on numerous other methods to compromise credentials, abuse services, and exfiltrate sensitive data that are just as successful and profitable. Examples of attack patterns that never touch an endpoint include:

*   Abusing access credentials for privilege escalation or account takeover (ATO)

*   Compromising digital supply chain elements like application dependencies and repositories

*   Cryptojacking, or maliciously mining cryptocurrency at the organization's expense

*   Exploiting access to liberally permissioned cloud storage services

*   Targeting machine identities rather than user identities

*   Siphoning infrastructure data from cloud provider metadata APIs

Collection and analysis of cloud environment interactions provides context to security teams to enable threat detection and response (TDR) and support digital forensics and incident response (DFIR). Continuous analysis informs baselines for secure configurations and workload behaviors. Deviations from those baselines are environmental drift or potential indicators of compromise. When a series of seemingly interconnected events are part of a complex attack chain, that event must be quickly surfaced so security teams can prioritize an appropriate response. It's a difficult problem to solve in practice because it requires data collection and correlation across heterogeneous environments and technology stacks. Attacks may also traverse on-premises and cloud environments, depending on where targeted data exists or services run.

**Organizations Have Low Success With Traditional Tools**

Organizations implement a number of security technologies to enable SecOps in modern architectures, but they all result in security gaps. Common approaches include:

*   **Network detection and response (NDR):** Network monitoring can work well for traditional environments but not in cloud. Most business traffic flows through cloud services that are external to the organization. You don't own cloud networks fully, so it can't be your source of truth.

*   **Endpoint detection and response (EDR):** Endpoints may not exist at all and workloads only persist for short intervals. Agents, particularly those that are perceived to be heavyweight, aren't technically feasible or create availability concerns. You can't treat a container workload or cloud service like a laptop or Windows workstation.

*   **Extended detection and response (XDR):** A proverbial kitchen sink approach to TDR, XDR was intended to correlate all types of event data. In reality, the XDR tooling shares traditional endpoint roots with focuses on laptops or desktops. It's best to think of EDR as next-generation EDR (NG-EDR).

*   **Security information and event management (SIEM):** The backbone of SecOps, SIEMs unfortunately become a dumping ground for too many logs and event streams. Organizations rely on their SIEM to alert on security events like ransomware or phishing attacks. Storage costs often present an issue, not to mention time wasted by analysts parsing data that may not even be actionable. SOC modernization efforts often emphasize reduction on the number of feeds into SIEM instances to improve signal-to-noise ratio for security events.

**Cloud Detection and Response Addresses Gaps**

Modern application designs, threat evolution, and weaknesses of traditional security approaches have spotlighted the need for different capabilities to support TDR and DFIR. Organizations need augmenting capabilities to succeed in their security strategy. Some in industry have started labeling this new grouping of capabilities cloud detection and response (CDR). Traits of CDR include:

*   Unify visibility across traditional, cloud, and cloud-native environments by ingesting and analyzing host telemetry, workload telemetry, and cloud event sources.

*   Improve mean-time-to-detect (MTTD) security events with automation based on service profiling, flexible and customizable rules, and ML-based detections.

*   Improve mean-time-to-respond (MTTR) with contextualized guidance for the organization's unique environments.

*   Accelerate remediation and repair time with auto-generated "as code" formats like AWS CloudFormation, Terraform, or Kubernetes YAML.

*   Bridge work streams of development, operations, and security teams via API integrations with nonsecurity and SecOps systems.

The current state of SecOps sometimes reminds me of earlier days of application security and infrastructure security, when practitioners first wrestled with digital transformation. DevOps practices put heavy emphasis on automation. We're able to quickly tear down and redeploy secure applications, but SecOps approaches also need to evolve for this reality. CDR capabilities are a path forward for organizations that must maintain security operations in modern architectures.

**About the Author**

    

Michael Isbitski, the Director of Cybersecurity Strategy at Sysdig, has researched and advised on cybersecurity for more than five years. He's versed in cloud security, container security, Kubernetes security, API security, security testing, mobile security, application protection, and secure continuous delivery. He has guided countless organizations globally in their security initiatives and supporting their business. Prior to his research and advisory experience, Mike learned many hard lessons on the front lines of IT with more than 20 years of practitioner and leadership experience focused on application security, vulnerability management, enterprise architecture, and systems engineering.

Will the Cloud End the Endpoint?

Several models of EZVIZ cameras are open to total remote control by cyberattackers, and image exfiltration and decryption.

At least five models of EZVIZ Internet of Things (IoT) cameras are vulnerable to a handful of vulnerabilities that could lead to threat actors accessing, decrypting, and downloading the video from the devices.

EZVIZ is a smart home security brand of cloud-connected hardware used across the globe, offering dozens of IoT security camera models. 

As part of their ongoing research into IoT hardware security, analysts at Bitdefender identified vulnerabilities in at least five EZVIZ camera models, although the team added there could be other affected products as well: 

*   CS-CV248 \[20XXXXX72\] - V5.2.1 build 180403
*   CS-C6N-A0-1C2WFR \[E1XXXXX79\] - V5.3.0 build 201719
*   CS-DB1C-A0-1E2W2FR \[F1XXXXX52\] - V5.3.0 build 211208
*   CS-C6N-B0-1G2WF \[G0XXXXX66\] - v5.3.0 build 210731
*   CS-C3W-A0-3H4WFRL \[F4XXXXX93\] - V5.3.5 build 22012

First, the security researchers identified a stack-based buffer overflow bug that could lead to remote code execution (CVE-2022-2471). In addition, they found an insecure direct object reference vulnerability at several API endpoints that could allow a cyberattacker to take control of the camera, and a third remote bug that lets an attacker steal the encryption key for the video, the researchers added. 

Finally, a local vulnerability, tracked under CVE-2022-2472, lets an attacker take over the device in earnest. 

"When daisy-chained, the discovered vulnerabilities allow an attacker to remotely control the camera, download images and decrypt them," the IoT cybersecurity research team added. "Use of these vulnerabilities can bypass authentication and potentially execute code remotely, further compromising the integrity of the affected cameras." 

EZVIZ started issuing security updates for the cameras affected by the IoT bug starting in June, Bitdefender disclosed.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading