Basic Pen Tests support rapid, basic vulnerability discovery, while Standard Pen Tests provide compliance-driven testing to meet requirements for Web apps, APIs, and networks.

SAN FRANCISCO, June 6, 2022 /PRNewswire/ -- Bugcrowd, the leader in crowdsourced security, today announced a significant expansion of its Penetration Testing as a Service (PTaaS) product line to include new offerings—Basic Pen Test and Standard Pen Test—purpose built for today's digital business where continuous testing must keep pace with continuous and agile development. These strategic additions expand the use cases covered by Bugcrowd's PTaaS suite to cover the gamut of customer needs, from basic assurance for simple web apps and networks to continuous, crowd-powered testing of complex apps, cloud services, mobile apps, APIs, and IoT devices for maximum risk reduction.

Most pen test providers today offer cumbersome, ad hoc consulting offerings that do not identify all risks and are hard to execute at scale in a consistent and configurable way for buyers as well as pentesters themselves. PTaaS solutions have emerged to address these issues, but most don't go far enough—only Bugcrowd delivers a modern, platform-powered approach, enabling organizations to keep innovating without compromising security.

With Bugcrowd's expanded PTaaS product line, pen test buyers now have an option for meeting every requirement, and for every asset type:

*   **Basic Pen Tests** for rapid, basic vulnerability discovery and reporting
*   **Standard Pen Tests** for easy-to-launch, compliance-driven testing packaged to meet most customer requirements for common use cases for simple web apps, APIs and networks
*   **Plus Pen Tests** for meeting special needs around targets, testing times, geographic requirements, etc.
*   **Max Pen Tests** for continuous, maximum risk reduction

"We have a diverse set of use cases for pen testing, ranging from basic vulnerability discovery for very simple web apps to intensive and continuous risk reduction for business-critical ones," said Jason Frost, Manager, Security Assessment, Paychex. "These new additions to the Bugcrowd PTaaS product line fulfill all our needs in one platform."

The Bugcrowd Security Knowledge Platform™ enables pen tests to run alongside Bugcrowd's managed bug bounty, vulnerability disclosure programs, and other solutions as a fully integrated and orchestrated experience blending data, technology, and human intelligence, with all findings flowing directly into the software development lifecycle. Bugcrowd's PTaaS suite allows customers to:

*   Activate precisely the right crowd at the right time leveraging the platform's CrowdMatch ML technology, delivering a 2x increase in high-impact findings versus manual matching methods
*   Launch tests in days instead of weeks and continually get fresh eyes-on-target from Bugcrowd's broad and diverse crowd
*   Utilize historical information to create standardized tests that reduce the need for contracted SOW discussions, while getting the intelligence of the aggregated experience of the platform, customer needs, and researchers to conduct the most relevant pen test scope
*   Get high-impact results that go beyond compliance checkboxes
*   See prioritized results and methodology progress in real-time via a rich PTaaS Dashboard experience

"Traditional penetration testing often delivers noisy, low-impact results, often takes weeks or even months to produce results, and offers no visibility into test progress," said Ashish Gupta, CEO, Bugcrowd. "We provide real-time visibility into pen testing results and vulnerabilities being found that allow our customers to continuously reduce risk and secure their environments, helping them stay ahead of a breach with solutions tailored to meet their needs."

Click here to learn more about these additions to Bugcrowd's PTaaS.

Click here to learn more about the Bugcrowd Security Knowledge Platform.

"Bugcrowd", "CrowdMatch", and "Bugcrowd Security Knowledge Platform" are trademarks of Bugcrowd Inc. and its subsidiaries. All other trademarks, trade names, service marks and logos referenced herein belong to their respective companies.

**About Bugcrowd  
**Bugcrowd is the leading provider of crowdsourced cybersecurity solutions purpose-built to secure the digitally connected world. Today's enterprise demands an offensive approach to cybersecurity—and Bugcrowd offers the only solution that orchestrates data, technology, and human intelligence to expose blind spots. The Bugcrowd Security Knowledge Platform™ enables businesses to do everything proactively possible to protect their organization, reputation, and customers with products like Bug Bounty, Penetration Testing-as-a-Service, and more. Trusted by organizations across the globe, Bugcrowd uncovers and remediates vulnerabilities before they interrupt business by leveraging expert ingenuity and the knowledge of world-class security researchers. Based in San Francisco, Bugcrowd is backed by Blackbird Ventures, Costanoa Ventures, Industry Ventures, Paladin Capital Group, Rally Ventures, Salesforce Ventures and Triangle Peak Partners. Learn more at www.bugcrowd.com.

Bugcrowd Expands Pen Testing Solutions with New Platform Services

MongoDB claims its new “Queryable Encryption” lets users search their databases while sensitive data stays encrypted. Oh, and its cryptography is open source.

After years of data breaches, leaks, and hacks leaving the world desperate for tools to stem the illicit flow of sensitive personal data, a key advance has appeared on the horizon.

On Tuesday, MongoDB is announcing “Queryable Encryption,” a feature that will allow database users to search their data while it remains encrypted. The tool, which is debuting in preview as part of MongoDB 6.0, attempts to bridge academic cryptography findings and real-world environments so users can adopt the feature without needing advanced theoretical expertise. Crucially, Queryable Encryption is built to work with existing databases rather than requiring users to re-architect their systems before they can take advantage of it.

Institutions from businesses to governments, health care facilities, and critical infrastructure already lean on encryption to render data unintelligible (and therefore not worth stealing) when it's traveling across networks or sitting in storage. But none of that protects data when it's actively being used for legitimate reasons—looking up a patient's medical records, say, or setting up a car rental reservation. That means an attacker—including a rogue employee—could potentially gain access to data the same way a doctor or customer service agent does. This is a nut everyone wants to crack, and the database maker MongoDB has been working on possible solutions for years. Now, the company says, it has one.

“This is exactly the kind of thing that customers are wanting. We work with the biggest banks, pension systems, treasury exchanges, payment networks, pizza chains—and everyone wants better assurances,” says Kenn White, MongoDB's security principal. “And because of some practical engineering breakthroughs, it went from an academic kind of thing to something that actually could work on big databases.”

Queryable Encryption could let a bank agent investigate your account for possible fraud on a range of dates without knowing which dates specifically flagged the system. Or it could allow a customer service rep to type the first few letters of a name and start a claims process while leaving the name encrypted and indecipherable. 

Many of these breakthroughs came from Brown University cryptographer Seny Kamara and his longtime collaborator Tarik Moataz. Several years ago, the pair cofounded a searchable encrypted database startup known as Aroki Systems along with entrepreneur John Partridge. Aroki collaborated with MongoDB on a database security feature, announced in 2019, and Kamara and Moataz continued working on a prototype of a truly searchable encrypted database. In 2021, MongoDB acquired Aroki.

The Queryable Encryption system is built with a combination of established cryptographic protocols and conceptual advances Kamara and Moataz have been working on for years in an area of cryptography known as structured encryption. The approach involves encrypting data with a specific architecture so it can be searched with special tokens specific to each query without data ever being decrypted. Other techniques such as homomorphic encryption allow users to do computations on encrypted data, like adding two columns in an encrypted spreadsheet. But structured encryption is specifically focused on organizing encrypted data so it can be found without exposing the data itself.

“What we focus on is not how to do arithmetic operations on encrypted data, but how to find information fast—like really, really fast,” says Kamara, who is currently on leave from his associate professor role at Brown.

Speed is a challenge in encrypted operations, where every extra key check and computation add complications to basic operations. But MongoDB claims that searches performed with Queryable Encryption are impressively fast and won't cause unreasonable performance losses—a claim that customers will be able to test for themselves with the new preview. MongoDB is also open-sourcing much of the Queryable Encryption system, so users and other researchers can vet its underlying cryptography.

“A lot of the work is very theoretical in nature, algorithms, crypto security definitions, but for me at the end of the day I want to see something come out of it,” Kamara says. “There is a social imperative behind the work that scientists do. Working with a company at the scale of Mongo, this will be available to a huge number of people, a huge number of work loads.”

Moataz and Kamara say the big breakthrough that allowed them to move their concept from the academic world toward the real world was emulation, which enabled them to use the properties of structured encryption with existing databases that have different architectures. Like emulating Super Nintendo games on your PC or emulating Windows on a Mac, the approach creates a liminal space in which structured encryption can run on top of traditional databases.

Still, Kamara and Moataz emphasize that it's been a challenge and a learning process to collaborate with MongoDB engineers and turn the Aroki Systems prototype into something that can actually be deployed at scale around the world.

“Seny and I have been learning a lot about the constraints of real-world deployments that academics know nothing about,” Moataz says. “Models in academia are less restrictive. So we are enjoying being exposed to that and improving our models and our designs with respect to these constraints.”

Though Tuesday's release will be the first time that the public can vet Queryable Encryption in the wild, Aroki Systems had cryptographer JP Aumasson conduct technical due diligence on the cryptographic underpinning of their prototype system. And MongoDB invited University of Chicago cryptographer and searchable encryption researcher David Cash to take an early look as well. Both told WIRED that while they haven't audited the entire system deployment, the underlying cryptography appears sound. And they both emphasize that it's exciting to see a real-world searchable encryption scheme take shape after so long.

“A lot of crypto research since the 1980s has sort of been centered on how do we do this stuff, so this is a long time coming," Cash says. “Everything in cryptography is about trade-offs, and the world is complicated, so it's important to be careful about absolute statements, but that this vision is realized in some form is very exciting. And this is not at all snake oil or security theater. They're going deep on this and thinking about the important stuff carefully.”

Aumasson says that many others have claimed to offer searchable encryption without the technical depth or capability. “There have been other products advertising encrypted search, but academics would really laugh at those,” he says. “What Mongo is doing is something that is academic-compliant, and I’m very happy to see it.”

A Long-Awaited Defense Against Data Leaks May Have Just Arrived

The tool underpins cybersecurity capabilities including SIEM, SOAR, compliance automation, and vulnerability management.

Cybersecurity teams can now use Snowflake as their data platform for a range of critical use cases, making it possible for security teams to deploy a security data lake and unify their security data in one place.

Snowflake's Cybersecurity workload offers customers access to cybersecurity capabilities including security information and event management (SIEM), security orchestration, automation, and response (SOAR), compliance automation, and vulnerability management through connected applications that run on top of their existing Snowflake environmentx.

Snowflake serves as the security data lake, providing scalable storage, while analytics enable security metrics for live insights into an organization's security posture.

Partners including Hunters, Panther Labs, and Securonix offer security capabilities on top of Snowflake accounts through connected applications, removing the need for the homegrown tools security teams used to rely on to build for scale.

**Context Is Key**

"Whether it's spotting risky configurations or catching threat actors in the act, security insights depend on available data," explains Omer Singer, Snowflake's head of cybersecurity strategy. "Less obvious is the need for context and cross-source correlation."

He says many risks and attacks cannot be identified just by looking at a single finding or event log, with unified visibility the key to fewer false positives and false negatives.

For example, a vulnerability may have a CVSS score of 8.0 and be not so concerning if it's affecting a test system without Internet access. "The same issue may be super critical, on the other hand, if it affects a publicly facing Web server that handles customer financial transactions," he adds.

Another example is around user deprovisioning, which Singer calls "a real scourge" for many security compliance teams.

"Has access been revoked from all systems for all terminated employees? If not, has a terminated employee taken advantage of their access?" he asks. "It takes unified visibility to answer these questions."

**Consolidated Data Shows the Whole Picture**

Singer explains that Snowflake is enabling an alternative to typical security tools that operate in a silo and place the burden of connecting the dots on overstretched security teams.

"Our customers kept telling us that their traditional SIEM solutions didn't consolidate security logs — the legacy SIEMs actually create silos since their cost for comprehensive ingest and retention is prohibitively high," he says. "The result has been that security teams struggle to achieve necessary prevention, detection, and response outcomes."

Prabhath Karanth, senior director of security, compliance, and trust at TripActions, says that Snowflake has helped the company with log aggregation, better triaging, removing noisy alerts, faster threat detection and response, applying new threat intelligence to data, and continuous compliance.

"All of this ultimately results in better security assurance and building customer trust," Karanth says. He adds that the adoption of Cybersecurity workload is central to most of the company's data and strategic security initiatives.

"The platform allows us to leverage one single source of truth for multiple use cases," Karanth explained. "It helps us collect all data sources in a centralized location and run analytics on top, both for our business and security use cases."

In addition, integrations with Snowflake partner tools like the autonomous threat monitor Hunters and the compliance program Anecdotes on top of the Snowflake security data lake has helped TripActions further enhance some security use cases.

**The Importance of Compliance**

On the security compliance side, Karanth says TripActions is looking to achieve near-real-time controls automation using Snowflake's Cybersecurity workload and continuous compliance.

"We push all security tooling data into Snowflake data lake," he says. "This includes tools like cloud security posture management, application security posture management, and endpoint security tooling. Most of the compliance controls belong to one of these domains."

He adds that the company can get a unified view of the controls posture to meet compliance requirements like SOC2, ISO, PCI, and others by integrating with Anecdotes.

"This helps us identify control effectiveness from an audit perspective, quicker metrics reporting to leadership, and remediation activities," he says. "From a threat detection and response standpoint, again security tooling is the basis for all of this."

Karanth explains that the deviation from the desired state of assets can be identified from the data the platform collects, and integrations with autonomous tools like Hunters help his company respond with corrective action in a timely manner using custom-built and prebuilt alerts.

"Our ultimate goal as a security team is to enable our business and protect our customers' data," he says. "The need of the hour is to enable our business and at the same time reduce risk. We need to protect our customers' travel data both from a security and privacy perspective. We take customer trust very seriously. It's the foundation for how we do business."

Snowflake Debuts Cybersecurity Workload to Aid Visibility, Automation

FortiRecon combines machine learning, automation, and human intelligence to continually monitor an organization’s external attack surface.

**SAN FRANCISCO, Calif., – RSAC 2022 - Jun 6, 2022**

**John Maddison, EVP of Products and CMO at Fortinet**

“The sooner in the attack cycle you identify and stop an adversary, the less costly and damaging their actions. Employing a powerful combination of human and artificial intelligence, FortiRecon provides organizations with a view of what adversaries are seeing, doing and planning. FortiRecon’s vendor agnostic SaaS delivery model combined with an intuitive interface and easily digestible reports enable executives across the organization to quickly understand the risks posed to their company, data, and brand reputation, while our team of FortiGuard Labs cybersecurity experts enhance the offering with takedown services, guidance on prioritization of remediation efforts, and targeted threat research and intelligence.”

**News Summary**

Fortinet® (NASDAQ: FTNT), a global leader in broad, integrated, and automated cybersecurity solutions, today announced FortiRecon, a complete Digital Risk Protection Service (DRPS) offering that uses a powerful combination of machine learning, automation capabilities, and FortiGuard Labs cybersecurity experts to manage a company’s risk posture and advise meaningful action to protect their brand reputation, enterprise assets, and data. FortiRecon uniquely delivers a triple offering of outside-in coverage across External Attack Surface Management (EASM), Brand Protection (BP), and Adversary-Centric Intelligence (ACI) to counter attacks at the reconnaissance phase – the first stage of a cyberattack – to significantly reduce the risk, time, and cost of later stage threat mitigation.

**Organizations are Overwhelmed in the Fight to Protect their Network, Data, and Reputation and Mitigate Risk Early**

Before attacking an organization, a cybercriminal’s primary objective is to gather as much intelligence about their target as possible. This phase of early reconnaissance arms the adversary with everything they need to determine if and how they would exploit an organization. They will test a company’s defense and response tactics, look for unpatched systems, use social media to learn more about its employees and their normal behavior, and go as far as researching business partners, recent acquisitions, and any other third-party affiliation that could lead to a successful compromise. As organizations digitally accelerate their businesses and deploy hybrid IT architectures that expand the attack surface, identifying and mitigating these threats has become increasingly more difficult. In response to the velocity of threats, cybersecurity best practices have evolved from point-in-time evaluations to continual monitoring, ongoing reviews, and continuous enhancements to an organization’s security posture.

**Taking a Page Out of the Adversary Playbook to Mitigate Risk**

With the introduction of FortiRecon, Fortinet provides enterprise organizations with a powerful tool to understand how the adversary views an organization from the outside to help inform cybersecurity teams, the C-Level, and risk and compliance management on how to prioritize risk and improve the company's overall security posture. FortiRecon offers companies consistent and comprehensive coverage across three areas:

*   **External Attack Surface Monitoring:** Empowers organizations to understand their risk profile and mitigate risks early. Provides an outside-in view of an organization and its subsidiaries to identify exposed known and unknown enterprise assets and associated vulnerabilities, and prioritize the remediation of critical issues. EASM identifies servers, credentials, public cloud service misconfigurations, and even third-party partner software code vulnerabilities that could be exploited by malicious actors.
*   **Brand Protection:** Enables organizations to protect their brand and identify risks to their customers. Proprietary algorithms detect web-based typo-squatting, defacements, and phishing impersonations, as well as rogue mobile apps, credential leaks, and brand impersonation on social media, all common techniques used by cyber threat actors. The early detection of malicious activity allows teams to quickly take action (such as website or application takedown) to stop and prevent damage.
*   **Adversary-Centric Intelligence:** Increases the security awareness of an organization’s SOC team with industry and geography specific coverage to better understand their attackers and protect assets. FortiGuard Labs cybersecurity experts assess the underground and imminent threat risks posed by active cybercriminals to an individual company by proactively monitoring public and private forums, open-source, dark web, and other cybercriminal domains. By engaging in human intelligence collection, FortiGuard Labs experts assess and curate custom threat intelligence, providing recommendations specific to the company, industry, and geography.

For partners, FortiRecon can be sold on top of the Fortinet Security Fabric or as a stand-alone, vendor-agnostic solution that delivers easily digestible reports and enables their customers to quickly understand the risks posed to their company, data, and brand reputation. FortiRecon also extends the categories of risk for which partners can provide insight to customers and increases the opportunity to land new customers that have only invested in more traditional security solutions.

**Enhancing Fortinet’s Early Detection and Response Portfolio and Industry Leading Security Services**

FortiRecon complements Fortinet’s robust portfolio of early detection and advanced response products, including FortiNDR, FortiXDR, FortiDeceptor, in-line sandboxing, as well as advanced automation with FortiAnalyzer, FortiSIEM and FortiSOAR.

Fortinet is firmly committed to the success of SOC teams and the protection of organziations and offers an extensive portfolio of outsource services ranging from cybersecurity assessments and readiness, playbook development, tabletop training, Incident Response, MDR and SOC-as-a-service. This combined offering, alongside the many enhancements across the Fortinet Security Fabric and extended ecosystem deliver simplification and automation to help SOC teams regain focus, control, and speed by strengthening an organization’s SOC with FortiGuard Labs cybersecurity tools and experts.

**Get a demo of FortiRecon in the Fortinet booth at RSAC 2022**

Fortinet will be a Platinum Sponsor at this year’s RSA Conference and will feature product demos, a live theater, and a Fortinet Expert Bar at booth #5855 in the Moscone Center North Hall. Stop by the booth to get a demo of FortiRecon and other recent product, solution, and services innovations from Fortinet. Learn more about Fortinet at RSA and presentations featuring Fortinet executives in the media alert.

**Additional Resources**

*   Read our blog to learn more about the value security services can bring to any organization and find out more about Fortinet’s robust portfolio of AI-powered Security Services.
*   Learn more about Fortinet’s advanced detection offerings for the SOC: FortiNDR, FortiDeceptor, FortiXDR, and FortiGuard In-line Sandbox Service
*   Learn more about Fortinet SOC-as-a-Service.
*   Learn more about how the Fortinet Security Fabric delivers broad, integrated, and automated protection across an organization’s entire digital infrastructure.
*   Learn more about FortiGuard Labs threat intelligence and research or Fortinet’s AI-powered FortiGuard Security Services portfolio.
*   Learn more about Fortinet’s free cybersecurity training which includes broad cyber awareness and product training. As part of the Fortinet Training Advancement Agenda (TAA), the Fortinet Training Institute also provides training and certification through the Network Security Expert (NSE) Certification, Academic Partner, and Education Outreach programs.
*   Read more about how Fortinet customers are securing their organizations.
*   Engage in the Fortinet User Community (Fuse). Share ideas and feedback, learn more about our products and technology, and connect with peers.
*   Follow Fortinet on Twitter, LinkedIn, Facebook, and Instagram. Subscribe to Fortinet on YouTube.

**About Fortinet**

Fortinet (NASDAQ: FTNT) makes possible a digital world that we can always trust through its mission to protect people, devices, and data everywhere. This is why the world’s largest enterprises, service providers, and government organizations choose Fortinet to securely accelerate their digital journey. The Fortinet Security Fabric platform delivers broad, integrated, and automated protections across the entire digital attack surface, securing critical devices, data, applications, and connections from the data center to the cloud to the home office. Ranking #1 in the most security appliances shipped worldwide, more than 580,000 customers trust Fortinet to protect their businesses. And the Fortinet NSE Training Institute, an initiative of Fortinet’s Training Advancement Agenda (TAA), provides one of the largest and broadest training programs in the industry to make cyber training and new career opportunities available to everyone. Learn more at https://www.fortinet.com, the Fortinet Blog, or FortiGuard Labs.

Fortinet Unveils New Digital Risk Protection Offering

The threat cluster dubbed UNC2165, which shares numerous overlaps with a Russia-based cybercrime group known as Evil Corp, has been linked to multiple LockBit ransomware intrusions in an attempt to get around sanctions imposed by the U.S. Treasury in December 2019.
"These actors have shifted away from using exclusive ransomware variants to LockBit — a well-known ransomware as a service (RaaS) —

The threat cluster dubbed UNC2165, which shares numerous overlaps with a Russia-based cybercrime group known as Evil Corp, has been linked to multiple LockBit ransomware intrusions in an attempt to get around sanctions imposed by the U.S. Treasury in December 2019.

"These actors have shifted away from using exclusive ransomware variants to LockBit — a well-known ransomware as a service (RaaS) — in their operations, likely to hinder attribution efforts in order to evade sanctions," threat intelligence firm Mandiant noted in an analysis last week.

Active since 2019, UNC2165 is known to obtain initial access to victim networks via stolen credentials and a JavaScript-based downloader malware called FakeUpdates (aka SocGholish), leveraging it to previously deploy Hades ransomware.

Hades is the work of a financially motivated hacking group named Evil Corp, which is also called by the monikers Gold Drake and Indrik Spider and has been attributed to the infamous Dridex (aka Bugat) trojan as well as other ransomware strains such as BitPaymer, DoppelPaymer, and WastedLocker over the past five years.

UNC2165's pivot from Hades to LockBit as a sanctions-dodging tactic is said to have occurred in early 2021.

Interestingly, FakeUpdates has also, in the past, served as the initial infection vector for distributing Dridex that then was used as a conduit to drop BitPaymer and DoppelPaymer onto compromised systems.

Mandiant said it noted further similarities between UNC2165 and an Evil Corp-connected cyber espionage activity tracked by Swiss cybersecurity firm PRODAFT under the name SilverFish aimed at government entities and Fortune 500 companies in the E.U and the U.S.

A successful initial compromise is followed by a string of actions as part of the attack lifecycle, including privilege escalation, internal reconnaissance, lateral movement, and maintaining long-term remote access, before delivering the ransomware payloads.

With sanctions used as a means to rein in ransomware attacks, in turn barring victims from negotiating with the threat actors, adding a ransomware group to a sanctions list — without naming the individuals behind it — has also been complicated by the fact that cybercriminal syndicates often tend to shutter, regroup, and rebrand under a different name to circumvent law enforcement.

"The adoption of an existing ransomware is a natural evolution for UNC2165 to attempt to obscure their affiliation with Evil Corp," Mandiant said, while also ensuring that sanctions are "not a limiting factor to receiving payments from victims."

"Using this RaaS would allow UNC2165 to blend in with other affiliates, the company added, stating, "it is plausible that the actors behind UNC2165 operations will continue to take additional steps to distance themselves from the Evil Corp name."

The findings from Mandiant, which is in the process of being acquired by Google, are particularly significant as the LockBit ransomware gang has since alleged that it had breached into the company's network and stole sensitive data.

The group, beyond threatening to release "all available data" on its data leak portal, didn't specify the exact nature of the contents in those files. However, Mandiant said there is no evidence to support the claim.

"Mandiant has reviewed the data disclosed in the initial LockBit release," the company told The Hacker News. "Based on the data that has been released, there are no indications that Mandiant data has been disclosed but rather the actor appears to be trying to disprove Mandiant's June 2, 2022 research on UNC2165 and LockBit."

Found this article interesting? Follow THN on Facebook, Twitter __ and LinkedIn to read more exclusive content we post.

Evil Corp Cybercrime Group Shifts to LockBit Ransomware to Evade Sanctions

Prometheus ransomware contained a weak random number generator that inspired researchers to try and build a one-size-fits-all decryptor. 
The post RSA 2022: Prometheus ransomware’s flaws inspired researchers to try to build a near-universal decryption tool appeared first on Malwarebytes Labs.

Prometheus—a ransomware build based on Thanos that locked up victims’ computers in the summer of 2021—included a major “vulnerability” that led security researchers at IBM to try and build a one-size-fits-all ransomware decryptor that could work against multiple ransomware variants, including Prometheus, AtomSilo, LockFile, Bandana, Chaos, and PartyTicket.

Though the IBM researchers managed to undo the work of multiple ransomware variants, the panacea dream decryptor never materialized.

IBM global head of threat intelligence Andy Piazza said that the team’s efforts revealed that even though some ransomware families can be reverse-engineered to develop a decryption tool, no company should rely on decryption itself as a response to a ransomware attack.

“Hope is not a strategy,” Piazza said at RSA Conference 2022, held in San Francisco in person for the first time in two years.

IBM security research Aaron Gdanski, who was aided by security researcher Anne Jobman, said his interest in building a Prometheus decryption tool began after one of IBM Security’s clients was hit with the ransomware. He began by trying to understand the ransomware’s behavior: Did it persist in the environment? Did it upload files anywhere? And how, specifically, did it generate the keys that were used to encrypt files?

By using the DS-5 debugger and disassembler, Gdanski found that Prometheus’ encryption algorithm relied on both “a hardcoded initialization vector which did not change between samples” and the uptime of the computer. Gdanski also learned that Prometheus created its seeds by relying on a random number generator that, by default, used Environment.TickCount.

These discoveries revealed a key vulnerability in Prometheus, Gdanski said. If he could find when Prometheus encrypted files on the system, he could then likely generate the same seed that Prometheus used for that decryption.

“If I could obtain the seed at the time of encryption, I could use the same algorithm Prometheus did to regenerate the key it uses,” Gdanski said.

Equipped with the boot time on an affected machine and the recorded timestamp on an encrypted file, Gdanski then had a starting point to narrow down his work. After some additional calculations, Gdanski generated a seed from Prometheus and he tested it on portions of encrypted files.

With some fine-tuning, Gdanski’s work paid off.

Gdanski also learned, though, that the seed changed depending on the time when a file was encrypted. That meant that one single decryption key would not work, but by sorting the encrypted files by the last write time on the machine, he was able to slowly build a series of seeds that could be used for decryption.

The success, Gdanski said, could be applied to other ransomware families that similarly relied on flawed random number generators.

“Any time a non-cryptographically secure random number generator is used, you’re probably able to recreate a key,” Gdanski said.

But Gdanski emphasized that this flaw is rare from what he’s seen. As Piazza reiterated, the best defense to ransomware isn’t hoping that the ransomware involved in an attack has a sloppy implementation—it’s preventing a ransomware attack before it happens.

For the latest on current ransomware activity, read our May ransomware review here. You can also read about some lessons from the real-life ransomware attack on Northshore School District here.

RSA 2022: Prometheus ransomware’s flaws inspired researchers to try to build a near-universal decryption tool

Caphyon Ltd Advanced Installer 19.2 was discovered to contain a remote code execution (RCE) vulnerability via the Update Check function.

**Advanced Web Ranking**

Advanced Web Ranking is a website ranking software which helps manage your search engine rankings intelligently.

View website

**Advanced Installer**

Advanced Installer is a powerful, yet easy to use, Windows Installer authoring tool which helps you create .MSI installs in minutes.

View website

**Clang Power Tools**

Clang Power Tools is a Visual Studio extension helping C++ developers modernize and transform their code to C++11/14/17 standards by using LLVM's static analyzer and CppCoreGuidelines.

View website

**Bytes Route**

Create interactive tutorials for any web page without writing code. Bytes Route enables you to learn a web application while using it.

View website

**Wattspeed**

Wattspeed is a free tool that generates snapshots - historical captures of your web pages that include Lighthouse scores, a list of technologies, W3C HTML validator results, DOM size, mixed content info, and more.

View website

CVE-2022-27438: We make great software products.

Crackdowns are driving down ransomware profits, and analysts see signs that operators are pivoting to business email compromise attacks, security researcher warned.

RSA CONFERENCE 2022 – San Francisco – Law enforcement crackdowns, tighter cryptocurrency regulations, and ransomware-as-a-service (RaaS) operator shutdowns are driving down the return on investment for ransomware operations across the globe. 

Abnormal Security threat researcher Crane Hassold, in a presentation at the RSA Conference, laid out his latest analysis of the ransomware threat landscape, predicting that there will be a pivot from ransomware toward renewed interest in basic business email compromise (BEC) attacks in the next 6 to 12 months. 

**RaaS Operator Crackdowns**

Ransomware attacks grab headlines and have been supercharged by a few prolific RaaS operators, Hassold explained. But crackdowns on just one group can make an enormous dent. 

"Ransomware is a centralized ecosystem with small numbers of operators responsible for the majority of attacks," Hassold said. 

He pointed to the recent disappearance of Pysa, leaving just two groups, Conti and Lockbit, with more than 50% of the share of the total ransomware attacks in the first half of 2022. BEC groups, on the other hand, are diffuse and scattered, making them much harder to eradicate, Hassold added. 

Although they're not as quick to make the headlines, BEC attacks have cost business more than $43 billion since 2016, according to the FBI, and make up $1 out of every $3 lost to cyberattacks, far outpacing ransomware losses, Hassold said. 

**Cryptocurrency Supercharged Ransomware**

Ransomware has had a moment over the past couple of years, Hassold explained, in part because once threat actors were able to abandon arcane wire transfers to collect ransoms and rely on cryptocurrency, caps on transactions were lifted and it became simple to collect much larger amounts. But new crypto regulations are chilling the ability of these cybercriminals to rely on its infrastructure to do business, adding what Hassold called "friction" to the transactions. 

BEC attacks, by comparison, rely on social engineering to corrupt a business's financial supply chain to get employees to willingly part with the cash, making them exponentially harder to track and stop.  

**Social Engineering Works**

By far, the most-used BEC tactic is the standard gift-card swindle, tricking employees to buy bogus gift cards, meaning the tried-and-true grift is still working. But Hassold said the BEC landscape is shifting from impersonating internal employees to posing as external business contacts. 

Once inside a business email account, attackers will wait and gather intelligence that can help them impersonate a trusted source. Today's BEC attacks are aimed at a company's financial supply chain, and once threat actors are inside, they will look for opportunities to spoof vendor emails to send payments to controlled accounts, change direct deposit information of executives to steal their paychecks, and even order aging reports showing which vendors owe the company. Once they have an aging report, an attacker will simply try to reach out to partners and collect any outstanding balances. 

In short, social engineering works. 

"BEC, in my opinion, is the clear threat to enterprises everywhere," Hassold warned. "These attacks disproportionately impact business." 

He added there is already evidence that ransomware operators and West African BEC attackers have already started comparing notes. 

"They're not collaborating, but interacting," Hassold said. "Those relationships might harden in the future."

Ransomware's ROI Retreat Will Drive More BEC Attacks

Fraudulent donation sites using our sympathy for Ukraine seem to be on the rise. Know how to protect yourself!
The post FBI warns of scammers soliciting donations for Ukraine appeared first on Malwarebytes Labs.

The FBI recently issued an announcement about a fraudulent scheme that proves there is no low that’s too low for scammers.

“Criminal actors are taking advantage of the crisis in Ukraine by posing as Ukrainian entities needing humanitarian aid or developing fundraising efforts, including monetary and cryptocurrency donations,” the FBI said.

Scammers have always followed where the money is, even if that money is for aiding those most in need. In this case, fraudsters have banked on the widespread sympathy for Ukraine as a way to make a buck.

Malwarebytes Labs had seen its fair share of Ukraine charity-centric scam sites popping up.

Days after Russia invaded Ukraine, we spotted a spam campaign titled “Donate to Help Children in Ukraine.” Apart from a stretched Ukrainian flag as the email header, there is almost nothing you can criticize about the email itself, as the usual red flags are missing.

A month after, fundraising scams were all over the place. We weren’t surprised to see phishers and scammers leading the pack when it comes to registering domains with “Ukraine” in them, as reported by Tessian. The company noted a 210 percent increase in registered domains with this pattern compared to last year, with 77 percent of them appearing suspicious based on early indicators.

Days before May, our Threat Intelligence team spotted a fake USA for UNHCR (United Nations High Commission for Refugees) website, which was part of a phishing campaign that started as a spam email using a spoofed address, calling on recipients to donate to Ukraine. The fake site asks for a potential donor’s full name, email address, and country of residence. Unlike its legitimate counterpart, this fake site also wants you to donate bitcoins.

The FBI listed some tips so users can protect themselves against such scams:

*   Be suspicious of emails, SMS messages, and social media posts from organisations encouraging you to donate. (You can check them against a database of legitimate charities, with their actual URLs.)
*   If a donation site asks you to donate in cryptocurrency, double-check the wallet address against official cryptocurrency wallets before donating.
*   Never reply to correspondences from someone purporting to be Ukrainian entities asking for humanitarian aid.

Lastly, if you think you have been a scam victim, file a report with the FBI’s Internet Crime Complaint Center (ICCC).

Stay safe!

Tag

#intel