Connect with us

Cyber Security

New DazzleSpy malware targets macOS users in watering hole attack

Published

on

A new watering hole attack has been discovered targeting macOS users and visitors of a pro-democracy radio station website in Hong Kong and infecting them with the DazzleSpy malware.

As detailed by researchers at ESET who have been investigating the campaign, it’s part of the same operation that Google’s Project Zero disclosed two weeks ago, which leveraged Chrome and Windows zero-days to hack into Windows and Android devices.

ESET’s report instead focuses on the exploitation of a WebKit flaw in the Safari web browser, essentially adding the final piece in the puzzle and confirming that the campaign targeted all major platforms.

Watering hole attacks involve the infection of a legitimate website with malware, targeting the demographic of that site, and in some cases, only specific IP addresses.

Targeting activists

Based on the websites used to propagate the exploits, the campaign targets freedom of speech advocates, independence, and political activists.

The central Chinese administration has been restricting political rights and special privileges enjoyed by citizens of Hong Kong in recent years, and allegations of spying activists have been abundant.

This is not the first time the Chinese state has been accused of conducting aggressive surveillance against minorities by using malware deployed through watering hole attacks.

In this case, one of the websites that dropped exploits to unsuspecting victims is that of the D100 internet radio, a pro-democracy station that fosters anti-Beijing sentiments.

Website of D100 radio
Website of D100 radio

The other example is a fake website that attempted to lure liberation activists using the “fightforhk[.]com” domain that was only registered in October 2021.

Fake activists portal
Fake activists portal
Source: ESET

The macOS exploit chain

Both of these websites, and possibly more, feature a malicious iframe that points to a domain that checks the macOS version and redirects to the next stage, which loads the exploit JavaScript code.

Malicious iframe that triggers the beginning of the exploit
Malicious iframe that triggers the beginning of the exploit
Source: ESET

The exploit targets CVE-2021-1789, an arbitrary code execution flaw triggered when processing web content and affects Safari versions below 14.1.

“The exploit relies on a side effect caused by modifying an object property to be accessible via a “getter” function while enumerating the object’s properties in JIT-compiled code,” explains ESET’s report

“The JavaScript engine erroneously speculates that the value of the property is cached in an array and is not the result of calling the getter function.”

The exploit implements two primitives (‘addrof’ and ‘fakeobj’) to gain memory read and write access, while it also contains code that helps bypass mitigations like ‘Gigacage’ and loads the next stage.

The next step is a privilege escalation to root, taking place through a Mach-O file loaded into memory and executed.

The vulnerability exploited to achieve privilege escalation is CVE-2021-30869, which enables an app to execute arbitrary code with kernel privileges.

In summary, the executed Mach-O does the following:

  • Downloads a file from the URL supplied as an argument
  • Decrypts this file using AES-128-EBC and TEA with a custom delta
  • Writes the resulting file to $TMPDIR/airportpaird and makes it executable
  • Uses the privilege escalation exploit to remove the com.apple.quarantineattribute from the file to avoid asking the user to confirm the launch of the unsigned executable
  • Uses the same privilege escalation to launch the next stage with root privileges

DazzleSpy

The final step in the process is to drop DazzleSpy, a feature-rich backdoor that includes a wide range of malicious capabilities.

DazzleSpy establishes persistence on the compromised system by adding a new Property List file to the ‘LaunchAgents’ folder. Its executable hides in $HOME/.local/ under the misleading name ‘softwareupdate’.

New Property List entry
New Property List entry
Source: ESET

The malware features a hardcoded C2 server address and can accept several commands from it, with the most important being:

  • info – Collect system information like IP address and Wi-Fi SSID.
  • ScanFiles – Enumerate files in Desktop, Downloads, and Documents folders
  • cmd – Execute shell command
  • RDP – Start a remote screen session
  • downloadFile – Exfiltrate a file from the system
  • processInfo – Enumerate running processes
  • acceptFile – Writes a file to disk

ESET comments that the DazzleSpy contains several artifacts resulting from sloppy code writing and disregard for operational security.

There are plenty of clues that point to the backdoor’s origin, like the internal error messages, which are written in Chinese, and the conversion of the exfiltrated timestamps to the China Standard Time zone before reaching the C2.

Internal error message in Chinese
Internal error message in Chinese
Source: ESET

Finally, DazzleSpy features end-to-end encryption in its communications, and if a middle-man inserts a TLS-inspection proxy in-between, it stops sending data to the C2.

Source link

Cyber Security

In-house vs. Outsourced Security: Understanding the Differences

Published

on

Cybersecurity is not optional for businesses today. Ignoring security can result in a devastating breach or a productivity-sapping attack on the organization. But for many small- and medium-sized businesses (SMBs), the debate often revolves around whether to hire a third party or assemble an in-house security operations team.

Both options have their own pros and cons, but SMBs should weigh several factors to make the best decision for their own unique security needs. An in-house team, a managed security services provider (MSSP), or even a hybrid approach can make sense for various reasons.

Before choosing to build an in-house security team or outsource to an MSSP, businesses must first evaluate their unique needs to ensure the choice lays a foundation for future success.

Weighing control vs. costs

The obvious reason for assembling your own security team is control and immediate knowledge of what goes into your security operations.

“Handling security internally means you will sometimes have better visibility and centralized management,” says Scott Barlow, vice president of global MSP and cloud alliances at Sophos. “That said, if you outsource with the right service provider, visibility into what is going on should not be an issue.”

For many smaller organizations, the cost of running an in-house security program is prohibitive. Hiring skilled security specialists is expensive, and they are often difficult to find. They require regular training, and certifications must be kept fresh – typically at a cost to the employer.

“When you outsource to an MSSP, you will be paying a lot less than paying a senior security executive,” Barlow says. “I suggest that organizations conduct a cost analysis of outsourcing compared to paying salaries. Much of the time, it’s better to outsource.”

There are also technology and license costs to consider. Keeping software licenses up to date can consume both time and money, whereas working with an MSSP means access to the latest technology without worrying about license costs.

If both are important, try a hybrid model

Of course, some large organizations might need an in-house security presence.

“Generally, the larger you become, the more you need someone internally. That is where a co-managed model makes the most sense,” Barlow says.

In a hybrid model, companies tap outside support to collaborate with an internal security executive or team. This approach allows for more scalability while also providing the business with plenty of expertise through their relationship with the MSSP.

“Maybe you want to outsource a portion of the services because you can’t cover 24-7. Or maybe you need coverage on weekends,” Barlow says.

One major benefit to tapping outside support: your in-house team will have more time to focus on mission-critical objectives.

“With a hybrid approach, the internal IT and security teams can pivot to focus on more revenue generating activities,” Barlow says.

Click here to learn more.

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Cyber Security

Prevention or Detection: Which Is More Important for Defending Your Network?

Published

on

When it comes to physically protecting a building, you have two primary defenses: prevention and detection. You can either prevent people from entering your property without your permission, or you can detect when they have already trespassed onto your property. Most people would prefer to prevent any trespassing, but a determined adversary is always going to be able gain access to your building, given enough time and resources. In this scenario, detection becomes the only alternative.

The same holds true for protecting assets in the digital world. We have the same two primary defenses: prevention and detection. And just like in the physical world, a determined adversary is going to gain access to your digital assets, given enough time and resources. The question will be: How quickly are you able to determine that an adversary has penetrated your network?

If you can’t prevent, you must discover

This is where detection comes in. Do you have the right tools and procedures in place to find attacks quickly when they are occurring? Most businesses do not. It takes days, weeks, and often even months before an attack is discovered. The gap between breach and discovery is known as dwell time, which is estimated to be more than 200 days in most cases and, according to IBM, as many as 280 days in some instances. If it takes this long to discover that an attack is in process, it may be impossible to determine the root cause if you don’t have enough historical data to review.

Therefore, it is just as important, and maybe even more important, to spend money increasing your ability to detect when a breach has occurred rather than to determine when a breach is actively occurring or to see that specific firewall (FW) or intrusion detection system (IDS) rules have actively prevented an attack. New attacks are taking place all the time, and bad actors are constantly coming up with new ways of infiltrating your network. It is important to understand that, at some point, a bad actor is going to get through and penetrate your network. What will be vitally important is whether you are able to see the attack when it is taking place, or shortly after, or whether instead the attack will be discovered weeks or months after the fact. In the latter case, do you have enough historical data to go back and determine when the attack started, or will that data be long gone by the time you notice something is wrong?

Saving the data you need

It is important to have several months’ worth of data so that you can go back and determine the initial compromise on your network. Having an advanced network detection and response (NDR) tool such as NETSCOUT’s Omnis Cyber Intelligence (OCI) can ensure that you have the data you need. OCI stores all of the relevant information, including layer 2-7 metadata and packets that you need to determine the root cause of an attack—not just flow data that won’t help in this situation.

How much historical network traffic are you storing? Do you have enough data to go back and research the start of an attack if it occurred 200 days ago? Or are you going to rely on catching bad actors faster than the industry average? It is important to understand the need for leveraging both prevention and detection capabilities and ensuring that you have enough storage to thoroughly investigate an attack when it occurs.

Watch this video to see how NETSCOUT can help your back-in-time investigation.

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Cyber Security

Want to Help Your Analysts? Embrace Automation and Outsourcing.

Published

on

While the security tools we choose to invest in can undoubtedly make or break our success, one area we tend to focus less on is the human component of cybersecurity. Yet today, two-thirds of global leaders claim that the global skills shortage creates additional cyber risks for their organization, including 80% who reported experiencing at least one breach during the last 12 months that they attributed to the cybersecurity skills gap.

The always-changing threat landscape, with fewer skilled people makes it nearly impossible to keep ahead of threats. That’s why it’s time to talk about the human element – specifically your Security Operations Center (SOC) analysts – and their role in your cybersecurity framework.

Helping the Humans in Your Security Stack: Enhance, Automate, and Outsource

When you consider your security stack, you probably immediately think of the technology you use. And you’re likely already consuming these as a service. Security vendors operate, maintain, and improve critical security capabilities for the tech you use, keeping those tools tuned to be resilient against the latest threats so your team can focus on more critical tasks.

But what about the people? They’re just as much a part of your security stack as any firewall, endpoint, application, devices, or sandboxing tool. But there’s likely less of a roadmap for their continual improvement. Your analysts are playing a constant catch up game with alerts, which leaves no time for professional development. You’ve probably considered evaluating which tasks the SOC performs that you could automate or outsource, but a lengthy list of other to-dos often means that process improvements get deprioritized.

If your team is overwhelmed, you’re not alone. Here’s the good news: You can take steps to strengthen your organization’s security posture while simultaneously reducing your analysts’ workloads (and lowering the chances that they’ll burn out).

The first is to enhance their capabilities by choosing the right technology and making time for training when possible. Next is to automate many of your team’s processes to improve accuracy, mean time to detection (MTTD), and mean time to remediation (MTTR). Lastly, there are simply some aspects of cybersecurity you’ll want to outsource to keep your team focused on the most critical tasks.

Enhance Their Capabilities with the Right Technology and Training Opportunities

If you’re like most of us, your SOC teams are heads-down sifting through alerts, logs, and tasks. They find it challenging to find the time to stay sharp as they’re focused on the evolving threat landscape and supporting (and improving) your organization’s security posture.

That said, practice – even if done every few months ­– will make your team better and faster in responding to attacks. Make the time for it. Build and test your processes and playbooks, and then allocate time for tactical training sessionsbased on real-world attacks. Consider partnering with an outside organization to help hone skills and provide additional insights into potential security gaps. Also, take advantage of onboarding and training programs that support short learning curve objectives.

Automate Processes to Improve Accuracy and Efficiency

The goal of every cybersecurity leader today should be to establish a unified security framework across the entire organization that prioritizes synergetic systems and centralized processes to deliver ML-powered automation. If you’re just starting with automation, looking within your team and identifying repetitive processes that may benefit from automation is a good jumping-off point. Consider log review, bot activity monitoring, and initial alert triage for starters.

Remember that AI and ML are only as good as the data they’re trained on and the people who teach and optimize them. When engaging with vendors offering ML-powered solutions, you must look inside the organization and figure out who’s designing their models. What datasets are they working with? What AI training models do they use? Ensure that the processes and automation used to gather, process, identify, and respond to incidents are trustworthy. 

Outsource to Improve (or Redirect) Your Team’s Focus

The current intensity we see across the threat landscape, both in velocity and sophistication, means we all need to work harder to stay on top of our game. But that can only get you so far. Working smarter means outsourcing certain tasks – like incident response and threat hunting – so your team can refocus on other strategic priorities.

This is why relying on a Managed Detection and Response (MDR) provider, Incident response (IR) or a SOC-as-a-service offering is helpful. Such enhancements are a critical way to eliminate noise, help your team focus on their most important tasks, and advance your business. Outsourcing can either be used as a temporary measure until your analysts are past the learning curve of new technology, or you can use these services as a permanent extension of your security team, adding professional expertise when and where you need it.

Don’t Forget About Employee Cybersecurity Education

There are many ways to support your SOC analysts, from enhancing their skills through training and certification to outsourcing your detection and response activities.

Yet security is everyone’s job, not just the responsibility of you and your analysts. In many cases, your employees are your first line of defense, which is why everyone in the organization must understand basic cybersecurity principles.

When you invest in ongoing training programs to help your workforce enhance their security knowledge, combined with tools like ongoing phishing simulation services, you enable them to be strong partners to your SOC. It’s one more important opportunity – beyond training, automation, and outsourcing – to support the people who are part of your cybersecurity stack.

Learn more about how Fortinet’s team of cybersecurity experts can help you enhance, automate, and outsource critical security functions to keep your organization secure.  

 

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Trending

URGENT: CYBER SECURITY UPDATE