Google banishes cryptocurrency mining extensions from Chrome Web Store

By Tomáš Foltýn

The tech giant is taking the measure after a rise in malicious browser extensions that mine digital money by hijacking the processing power of users’ computers. The clampdown follows Google’s recent move to stop serving any and all adverts promoting virtual currencies and initial coin offerings.

Google will no longer allow cryptocurrency mining extensions in its Chrome Web Store, regardless of whether or not they are upfront about what they do, according to an announcement on the technology giant’s Chromium blog on Monday. As a result, no new mining extensions are accepted into the store in a measure effective as of Monday April 2^nd, while existing ones will be removed in late June.

Google’s extensions platform product manager James Wagner wrote that the store had previously permitted cryptocurrency mining extensions with the proviso that this was their sole purpose and the user was kept up to speed about what such an extension did.

However, Google has found that around nine out of ten extensions that include mining scripts failed to play by the book, prompting the company to introduce the blanket ban.

“Over the past few months, there has been a rise in malicious extensions that appear to provide useful functionality on the surface, while embedding hidden cryptocurrency mining scripts that run in the background without the user’s consent,” according to Google.

For example, in December, Google booted a Chrome extension that, in addition to its stated purpose, had also roped unsuspecting users into mining digital coins. The extension had amassed more than 105,000 installations over the span of several weeks.

Meanwhile, extensions with blockchain-related purposes other than mining get off scot-free in the new policy.

The latest clampdown follows a measure in March whereby Google introduced a ban, also as of June, on all adverts that promote digital currencies. This mirrored a policy change that Facebook adopted in January. Twitter followed suit in late March.

Cryptojacking, or the hijacking of the computer processors of unsuspecting users to generate virtual currencies, has exploded in popularity in recent months. Scripts mining virtual currencies have become notorious for chewing up much of a computer’s processing resources, thus affecting system performance and driving up energy bills for the usually unsuspecting users.

While malicious cryptocurrency mining is not a new phenomenon, covert campaigns picked up extra steam with the launch of the Coinhive in-browser mining service in September. Coinhive’s JavaScript has been co-opted by scammers looking to make a quick buck. The explosion in illicit coin mining roughly coincided with the dramatic rise in the prices of digital currencies.

Coinhive’s script and numerous copycats have been detected on thousands of websites, including many legitimate but compromised websites, as well as in browser extensions and plugins, and on typo-squatted domains.

Surreptitious mining scripts have also been supplied alongside malware, in malvertising campaigns, and through hijacked cloud services. Miscreants have also smuggled the scripts into at least 19 apps in Google Play Store.

https://www.welivesecurity.com/2018/04/04/google-ban-cryptocurrency-mining-extensions/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

World Backup Day celebrated annually on March 31

Tomáš Foltýn 

World Backup Day, celebrated annually on March 31, is a timely reminder of the importance of taking effective measures that can make all the difference when a data loss incident strikes. It is also a good time to pause and reflect on the rising tide of threats that organizations, notably those operating in critical industries, face in cyberspace. 

It is a safe bet to say that Hippocrates didn’t expect the wisdom of the oath named after him to extend nicely to cybersecurity one day. And yet, thousands of years later, many security practitioners will probably swear by one of the dicta contained in modern versions of the physicians’ pledge, namely that “prevention is preferable to cure”.

Nevertheless, as threats are constantly evolving and become more pervasive, incident response and recovery are increasingly jostling for the attention of organizations’ cyber-defenders. Indeed, the threat landscape gives a sense that security ills are sometimes well-nigh unavoidable. Given our reliance on technology, having a plan for how to respond when the chips are down has never been more important.

In information security, best practices in preparations for a possible emergency include implementing a robust plan for data backup and recovery. World Backup Day, celebrated since 2011, helps raise awareness of the fact that a data loss event can cost people and organizations dearly. The causes of such incidents clearly run the gamut and include a hardware or system failure, a human error, a malicious insider, and a cyberattack.

To be sure, there is also the possibility of a physical disaster. However, compared to, say, fire or flood, cyber-incidents – especially of a malicious bent – pose a range of specific challenges for both detection and recovery. To begin with, it may not even be immediately obvious that something is amiss. Also, the actual extent of the damage or the timing of the intrusion may not be immediately apparent. The risk of a contagion spreading to other systems is yet another of a number of challenges that cybersecurity incidents bring.

Whatever the cause of the incident, an organization needs to restore the lifeblood of its operations – its mission-critical data – in order to begin a recovery. The journey to restoring the organization’s vital functions begins with a pre-purchased ticket, which in this case is a robust backup of its data.

Indeed, reconstituting lost or corrupted data, especially business-critical data, can be a matter of survival for any business. In critical infrastructure, the stakes are particularly high. For services that are essential for the functioning of entire societies, even short-term disruptions can have particularly dire ramifications.

Critical data, critical infrastructure

The financial services sector, which is part of the critical infrastructure, is facing a plethora of specific and palpable cyber-risks. In a world where criminals usually follow the money, cyberattacks against financial institutions come thick and fast and in many forms and sizes. Adversaries are well resourced, organized, persistent – and often successful. To blur the threat picture further, insiders and third-party service providers with privileged access represent a threat in their own right, whether acting out of malice or negligence.

Attacks on banks may not necessarily involve “only” cyber-heists, however. There is another – and no less insidious – threat that involves attempts to harm the integrity or availability of data. These onslaughts are aimed at data corruption or at shutting out access to data altogether.

Many organizations in critical industries admit to facing attacks that are aimed at file deletion or manipulation. In the financial services sector, one worry is that this could involve large-scale data manipulation or sabotage of critical customer and business account data. In addition, networking giant Cisco recently sounded the alarm on an emerging type of attack that seeks to wreck backups and safety nets needed by organizations in order to restore their systems and data after an incursion.

Throwing a lifeline

Now, suppose that an information storage disaster hits a bank’s data center and things go so spectacularly awry that not even standard backup plans and recovery procedures are able to restore normal service promptly. Such an attack would normally involve data concerning account records; if these data are inaccessible, clients could effectively become locked out of their money.

While this nightmare scenario may strike a chord only with survivalists, preparations for any imaginable adverse turn of events are at the heart of standard business continuity and disaster recovery (BC/DR) plans, whether they involve physical, virtual or cloud-based environments.

Securing some of the most valuable information in the digital age obviously requires a multi-layered approach. To bolster their data resilience and recovery capabilities in the face of increasing threats, it turns out that banks and other financial firms in the United States are adding another layer of data protection in addition to their standard backup and recovery playbooks.

As part of our marking of World Backup Day, we will look at the extra precautions that they are taking in Part 2 of our article.

https://www.welivesecurity.com/2018/03/28/world-backup-day-saving-day-saving-data/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Attingo Datarecovery onthult hoe roekeloos bedrijven en consumenten omgaan met gevoelige gegevens

Verbijstering over het aantreffen van vertrouwelijke gegevens gebruikte datadragers

Slechts een paar muisklikken bleken genoeg om de vertrouwelijke gegevens van een grote supermarktketen boven water te krijgen, zo bleek onder meer toen Attingo Datarecovery aan de slag ging met 100 opgekochte tweedehands datadragers.

Een onderzoek dat door Attingo met enige regelmaat wordt gehouden bracht wederom schokkende resultaten aan het licht ten aanzien van de manier waarop bedrijven en particulieren hun data wissen alvorens de gegevensdragers van de hand worden gedaan. "We konden het nauwelijks geloven maar op meer dan 73 procent van de harde schijven, SSD's en SD-kaarten waren zeer gevoelige gegevens beschikbaar", vertelt Robbert Brans, Managing Director van Attingo Datarecovery. "Extra opmerkelijk is dit te noemen aangezien we sinds 2011 met deze onderzoeken juist steeds een significante afname zagen van niet correct verwijderde data. In 2014 ging het 'slechts' in 28 procent van alle gevallen mediadragers die we hierop onderzochten."

Het blijft een wijdverspreide mythe dat het eenvoudigweg wissen en formatteren van gegevens voldoende is om data te vernietigen. Brans: "Voor particulieren valt er wat geld te verdienen door afgedankte media te verkopen. Vaak zie je dan dat er maar een enkeling is die er op let dat data goed verwijderd wordt. In sommige gevallen zien we zelfs dat er helemaal geen goede pogingen zijn gedaan om gegevens te verwijderen. Slechts op een paar gegevensdragers waren de gegevens volledig vernietigd voor dat ze verkocht werden. Veel mensen missen de technische knowhow over hoe gegevens gewist moeten worden of welk resultaat het formatteren van data oplevert. Het is een misverstand dat gegevens daarna echt weg zijn", gaat Brans verder.

De data die Attingo Datarecovery aantrof betrof complete financiële dossiers van particulieren, toegang tot de gegevens die nodig zijn om te kunnen internetbankieren en onlinewinkels. Maar ook vakantiefoto's of erotische videobeelden opgenomen in de slaapkamer van de vorige eigenaar van een harddisk of andere datadrager.

Door slecht te wissen maken bedrijven zich schuldig aan zware inbreuk op gegevensbescherming. Het onderzoek laat zien dat zelf grote gerenommeerde bedrijven op een grove nalatige manier omgaan met de gegevens van nietsvermoedende burgers.

Bij particulieren schaadt het 'slechts' de maker van de beelden, bij bedrijven echter wordt daarmee de privacywetgeving geschonden. "Des te huiveringwekkend is het dat zelfs zeer gevoelige informatie te vinden is op gebruikte mediadragers. "In één geval werd de datadrager door een IT-manager zelf aan ons verkocht", gaat Brans verder.

Bijzonder opmerkelijk was wat er boven water kwam bij meerdere schijven van een servernetwerk van een grote supermarktketen. Behalve dat daardoor toegang mogelijk werd tot het interne netwerk, bleek ook dat teksten, prijslijsten, interne onderhandelingen, protocollen van leveranciers en loonlijsten van medewerkers werden gevonden. Op de afgedankte harde schijven van een volledige mailserver van een bedrijf in de logistieke sector werden duizenden e-mails van werknemers gevonden. Bij een grote kabeltelevisieprovider werden alle klantgegevens op een harde schrijf aangetroffen. Daarmee wordt duidelijk dat een goede bewustwording van gegevensbescherming bij de verkoop van gebruikte datamedia dringend nodig is.

Brans: "Van een grove nalatige behandeling van gegevens op gebruikte opslagmedia blijkt bij vele bedrijven nog altijd sprake te zijn, ondanks de nieuwe EU-verordening inzake gegevensbescherming. Privacy omvat immers ook de juiste vernietiging van gegevens van afgedankte hardware."

Attingo Datarecovery biedt professioneel gegevensherstel van defecte harde schijven, SSD's en datatapes, evenals de verificatie van gegevensdragers. Dit is met name handig voor bedrijven die ervoor willen zorgen dat hun interne gegevensverwijderingsstrategieën echt voldoende zijn.

Attingo Datarecovery

Attingo Data recovery is al meer dan 20 jaar gespecialiseerd in dataherstel. Attingo redt data van zowel complexe RAID-systemen of servers als van harde schijven, tapes of USB-sticks. De onderneming heeft drie eigen hypermoderne ISO 9001:2015 gecertificeerde cleanroomlaboratoria.

-----

Voor meer informatie :

 Robbert Brans, directeur van Attingo Datarecovery  Nederland.

Telefoon: 0252- 621 625

E-mail: info.nl@attingo.com

http://www.attingo-datarecovery.nl/

Critical Infrastructure Interview with David Harley

WeLiveSecurity sat down with David Harley (ESET) to get a better understanding of Critical Infrastructure and the role he has played in the area throughout his career.

David Harley

[Editor] How did you come to be involved with Critical Infrastructure?

[David Harley] I first took an interest in Critical Infrastructure (CI) when I started working on the security side of medical informatics. Not that what I was doing for the Imperial Cancer Research Fund (now Cancer Research UK) would have been formally considered to impact directly on CNI (Critical National Infrastructure) at that time. While healthcare has long been considered to play a part in CNI in the US and in the UK, it probably wouldn’t have been considered to include a charitable organization focused on medical research in the 1990s. Certainly I had no direct contact at that time with the relevant government agency.

However, I had a pretty wide range of responsibilities during the 11 years I was there: while I was already deeply involved with malware management issues (and had been since 1989) and therefore with security more generally, I was also deployed in first and second line customer support, even when my primary role was system administration. And since security came up time and time again, I found myself doing a lot of background research, subscribing to mailing lists that covered topics like national security, SCADA, and so on.

When I moved to the UK’s National Health Service as a senior manager in the NHS Information Authority (NHSIA) in 2001, I was initially involved in the dissemination of threat information distributed by a government agency that was specifically concerned with the maintenance of the CNI, among other things. Later my role expanded to management of the Threat Assessment Centre (TAC), which had a somewhat similar function lying somewhere between a WARP and a CERT. We don’t seem to hear so much about them now, but a WARP (Warning, Advice and Reporting Point) is a sort of small-scale CERT intended to support a small-ish community (20-100), and is more about information sharing than dealing directly with critical incidents. Since the NHS had around 1.25 million users and the TAC was plugged directly into a community of network managers who really had to solve issues rather than just flag and discuss them, the TAC was, functionally speaking, rather more than a WARP, but wasn’t large enough to be considered a CERT or CSIRT in its own right.

And I never quite escaped being the go-to person on any issues related to malware. So that got me into liaising with providers of messaging security, for instance, with the Department of Health, and other government agencies, so CNI was of more than academic interest. Not least, because I now had access to data and structured information that weren’t at that time in the public domain.

[E] So you always regarded security and Critical Infrastructure as related?

[DH] Sure. Security is and always was implicit in ‘critical’, suggesting that CI components are crucial to the security of the State and/or the population (not always the same thing, even in a democracy). You only have to look at the components that are typically considered to be ‘critical’ where CI or CNI is formally defined.

In the US, for instance, the sectors are defined here by the Department of Homeland Security, and in the UK are defined here. The UK’s Security Services administer ‘protective security’ through the Centre for the Protection of National Infrastructure (CPNI).

Of course, as governments and government policies change, so do the services for which the agencies they regulate are responsible, so both the security services and the healthcare services have changed dramatically since I left the NHS, but I doubt if CPNI or other state agencies have stopped thinking of healthcare or emergency response as being critical or in need of security. Well, we can hope…

[E] What do you see as the main difference between CI as it was regarded back in the day and as it is today, apart from the obvious improvements in technology?

[DH] When I first became interested in potential risks to CI (and SCADA – Supervisory Control And Data Acquisition – which is by no means exclusively unique to a given CNI framework, but is so often associated with CNI components such as energy utilities), most of the discussion 20-30 years ago was about potential risks. There was comparatively little understanding outside the Corridors of Power of the concept of a formalized CNI, and where damage to infrastructural components was actually sustained, it was rarely the result of specific targeting of those components. Or, at any rate, it wasn’t usually reported as such.

There are claims that the Siberian pipeline explosion of 1982 was caused by a CIA logic bomb, and a story about the NSA reprogramming a printer microchip in order to compromise Iraqi air defence computers (the so-called ‘Desert Storm virus’ of the early 1990s). However, these claims – at least, in the forms in which they were circulated – suggest a sophistication (or sheer luck) redolent of science fiction rather than historical fact. My friend and sometime co-author Robert Slade analysed the Desert Storm story rather effectively in his Guide to Computer Viruses, and we revisited the topic in Viruses Revealed. There’s rather less solid analysis (let alone evidence) to be found when it comes to the story of cyber-sabotage and the Siberian pipeline explosion.

Even before the turn of the century, however, there was recognition (if you looked in the right place) of the activities of state-sponsored or state-initiated cyber-espionage activity.

In the early noughties, reports began to become publicly available on allegedly state-sponsored hacker groups such as NCPH (subject of extensive analysis in the AVIEN book) while, there were less public reports of more ‘official’ groups. Targeting by various groups going into the second decade of the 21^st century has included petrochemical companies, military and government agencies, research labs, utilities, and major IT players in the US, putting them all well into the CI bracket. Other targets included diplomats, the offices of the Tibetan government in exile, human rights activists, and government/media/finance organizations in Estonia and Georgia. The aims seem to have gone beyond disruption of services to the theft of sensitive correspondence and documents, proprietary code, and so on.

Stuxnet still came as something of a game-changer, though, as you might gather from the sheer volume of research it generated (including ESET’s, in the extensive Stuxnet Under the Microscope). This is less so because of its sophistication, though its payload pushed anti-malware specialists into areas of research with which they were unfamiliar. Rather, it’s because Stuxnet was an attack apparently targeting a specific state rather than the world at large, even though the malware was generalized enough to be found far beyond the borders of Iran. There have been many subsequent attacks that have been described as targeting specific organizations or sectors – for instance, the ransomware Win32/Filecoder.WannaCryptor.D (often referred to as WannaCry) is sometimes talked about as if it only affected the UK’s National Health Service, which is nonsense – but targeting is rarely as clear-cut as it was in the case of Stuxnet. Yet, ironically enough, much of the speculation about Stuxnet following its discovery focused on the possibility of its re-use in very different engineering contexts. Nonetheless, Stuxnet made it clear to the media and the general public that there are resources and expertise available and already deployed against utilities considered vital by the states that maintain or at least rely on them. That’s very different from the (mostly) speculative discussions of the 1990s, and even of the years around the turn of the century, when I was directly engaged in such areas.

Read more on:

https://www.welivesecurity.com/2018/03/26/critical-infrastructure-interview/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

City of Atlanta computers held hostage in ransomware attack

Tomáš Foltýn

City officials confirm that Atlanta is dealing with a cyberattack that has locked down some internal systems and is holding them hostage using ransomware.

UPDATE: As of Friday afternoon EDT, the extent of the damage remains unclear. The Atlanta Journal-Constitution reported that Atlanta City Hall employees, when coming to work on Friday, were receiving printed instructions that, as a precaution, they should not use their computers. Hartsfield-Jackson Atlanta International Airport is playing it safe, too, in order to ensure that it remains unaffected. The world’s busiest airport has shut down its free wi-fi network and disabled some of its website’s functionalities.

The City of Atlanta’s computer network has fallen victim to a ransomware attack that has encrypted some of the city’s data, mayor Keisha Lance Bottoms announced at a press briefing on Thursday.

While the full extent of the compromise is still under investigation, the attack is known to have cut off some of the city’s online services, including “various internal and customer-facing applications” used to pay bills or access court-related information.

In addition, the mayor encouraged the city’s employees and anyone who had conducted transactions with the city to keep tabs on their bank accounts in case their personal information may have been misused.

New Atlanta Chief Operating Officer Richard Cox, who only started in the role this week, said that several departments have been affected. The departments responsible for public safety, water and airport services are operating as normal, however.

Local news channel WXIA showed a screenshot of an alleged ransom message that had been shared by a city employee. The note demands 0.8 bitcoin (roughly $6,800) per computer or 6 bitcoin ($50,000) for keys to unlock the entire system.

Figure: The announcement of the outages early on Thursday (source: Twitter)

The city learned of the attack at around 5:40 am local time on Thursday, when its IT security team noticed “something that looked peculiar” on a server and began investigating, the city’s acting Chief Information Officer Daphne Rackley was quoted as saying.

As for whether the city would pay the ransom, the mayor said that the city would seek guidance from federal authorities on how to “navigate the best course of action”.

https://www.welivesecurity.com/2018/03/23/city-of-atlanta-computers-held-hostage-in-ransomware-attack/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Pirate websites expose users to more malware, study finds

Tomáš Foltýn

The study found that the more time users spent on pirate sites the higher the likelihood that some type of malware would compromise their computers.

It is hardly a surprise to learn that navigating to pirate websites entails a higher risk of running into malware. But a researcher from Carnegie Mellon University in Pennsylvania, US, set out to quantify the risk that this ‘free lunch’ involves in a real-world setting.

Having observed the online activities of 253 people throughout 2016, Professor Rahul Telang concluded in a newly-released paper that the more time the users spent on piracy sites the higher the likelihood that some type of malware would compromise their computers.

Specifically, every doubling of the amount of time that the users spent on various illegal torrent and streaming sites resulted in a 20-percent increase in malware count on their computers, according to the paper entitled “Does Online Piracy Make Computers Insecure? Evidence from Panel Data”.

Put differently, a 100-percent rise in the time spent on pirate websites increased “the number of malware count by almost 0.05 units”. On average, the visitors of dodgy sites ran into what amounts to 0.24 of a piece of malware per month.

The higher incidence of malware delivery remained unchanged regardless of whether or not adware was included in the equation. “In short, whether we include total malware count or malware count without adware, we find that time spent on infringing sites increases the malware count by almost 20 percent,” reads the study.

Many sites that provide access to pirated content rely on adverts for revenue. However, this may expose visitors to malicious advertising, or ‘malvertising’, in which ads are conduits for a broad range of cyber-threats.

The paper’s classification of files as either benign or malicious relied on the multiscanner site VirusTotal. The paper notes, however, that its measure of malware “is probably an undercount of the actual number of malware files found on user machines since virustotal is not able to identify all malware signatures”.

Another finding gleaned from the study is the fact that people who visit pirate websites are no more likely to take extra precautions by installing anti-malware software. The installation rate for such software was roughly 60 percent for both groups, which were called “infringers” and “non-infringers” in the study. Meanwhile, the infringers were found to spend much more time browsing the internet in general.

To conduct the research, the users’ home computers were fitted with background sensors that captured their browsing data in a discreet manner. The data shed light on a number of parameters – what websites the users visited, if they had anti-malware software or firewalls installed, whether they downloaded any files from sites that make pirated content available, and whether any evidence of malware intrusion into their systems was found.

https://www.welivesecurity.com/2018/03/21/pirate-websites-malware-study/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

UK’s National Lottery urges millions of players to change their passwords

The lottery's operator has found that attackers probably used an automated method known as 'credential stuffing' to access up to 150 customer accounts.

By Tomáš Foltýn

The lottery’s operator has found that attackers probably used an automated method known as ‘credential stuffing’ to access up to 150 customer accounts.

The United Kingdom’s National Lottery is advising all of its 10.5 million registered online users to change their passwords as a safety precaution following a security incident.

The recommendation comes after the lottery’s o perator, Camelot, has detected suspicious activity on a small number of customer accounts. It has found that attackers fraudulently accessed up to 150 customer accounts earlier in March and, once inside, viewed what Camelot described as “very limited information”.

“A much smaller number – fewer than 10 accounts – have had some limited activity take place within the account since it was accessed, but no player has seen any financial loss,” according to the company’s statement.

Camelot has suspended all accounts where suspicious activity was spotted and has contacted their owners in order to help them “re-activate their accounts securely”.

“We are also urging National Lottery players to change their online password, particularly if they use the same password across multiple websites,” reads the statement.

It is understood that the hackers used a common type of automated attack known as ‘credential stuffing’, in which they leverage stolen or leaked authentication details from one online service for attempts to crack open user accounts on other websites.

The success of this attack vector is fueled by the all-too-common practice for many people to recycle their passwords across a number of online services. Frequent data breaches and troves of breached credentials that are readily available online further compound the problem.

The lottery’s website enables customers to fund their National Lottery accounts with credit or debit cards, and then spend the money on online lottery tickets or scratch cards. Camelot gave assurances for The Daily Telegraph that the user accounts do not display full card or bank account details.

In addition, Camelot said that the attackers didn’t gain access to the National Lottery’s core systems or any of its databases that would affect the lottery’s draws or the payment of prizes.

This incident is reminiscent of a similar, though larger, attack in November 2016, when cybercriminals accessed the online accounts of as many as 26,500 National Lottery customers. In September 2017, the lottery’s website and its associated app were unavailable for several hours due to a distributed denial-of-service (DDoS) attack.

https://www.welivesecurity.com/2018/03/20/national-lottery-players-change-passwords/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29