Triton is the world’s most murderous malware, and it’s spreading

By

technologyreview.com

13 mins

View Original

As an experienced cyber first responder, Julian Gutmanis had been called plenty of times before to help companies deal with the fallout from cyberattacks. But when the Australian security consultant was summoned to a petrochemical plant in Saudi Arabia in the summer of 2017, what he found made his blood run cold.

The hackers had deployed malicious software, or malware, that let them take over the plant’s safety instrumented systems. These physical controllers and their associated software are the last line of defense against life-threatening disasters. They are supposed to kick in if they detect dangerous conditions, returning processes to safe levels or shutting them down altogether by triggering things like shutoff valves and pressure-release mechanisms.

The malware made it possible to take over these systems remotely. Had the intruders disabled or tampered with them, and then used other software to make equipment at the plant malfunction, the consequences could have been catastrophic. Fortunately, a flaw in the code gave the hackers away before they could do any harm. It triggered a response from a safety system in June 2017, which brought the plant to a halt. Then in August, several more systems were tripped, causing another shutdown.

The first outage was mistakenly attributed to a mechanical glitch; after the second, the plant's owners called in investigators. The sleuths found the malware, which has since been dubbed “Triton” (or sometimes “Trisis”) for the Triconex safety controller model that it targeted, which is made by Schneider Electric, a French company.

In a worst-case scenario, the rogue code could have led to the release of toxic hydrogen sulfide gas or caused explosions, putting lives at risk both at the facility and in the surrounding area.

Gutmanis recalls that dealing with the malware at the petrochemical plant, which had been restarted after the second incident, was a nerve-racking experience. “We knew that we couldn’t rely on the integrity of the safety systems,” he says. “It was about as bad as it could get.”

In attacking the plant, the hackers crossed a terrifying Rubicon. This was the first time the cybersecurity world had seen code deliberately designed to put lives at risk. Safety instrumented systems aren’t just found in petrochemical plants; they’re also the last line of defense in everything from transportation systems to water treatment facilities to nuclear power stations.

Triton’s discovery raises questions about how the hackers were able to get into these critical systems. It also comes at a time when industrial facilities are embedding connectivity in all kinds of equipment—a phenomenon known as the industrial internet of things. This connectivity lets workers remotely monitor equipment and rapidly gather data so they can make operations more efficient, but it also gives hackers more potential targets.

Those behind Triton are now on the hunt for new victims. Dragos, a firm that specializes in industrial cybersecurity, and where Gutmanis now works, says it’s seen evidence over the past year or so that the hacking group that built the malware and inserted it into the Saudi plant is using some of the same digital tradecraft to research targets in places outside the Middle East, including North America. And it’s creating new strains of the code in order to compromise a broader range of safety instrumented systems.

Red alert

News of Triton’s existence was revealed in December 2017, though the identity of the plant’s owner has been kept secret. (Gutmanis and other experts involved in the initial investigation decline to name the company because they fear doing so might dissuade future targets from sharing information about cyberattacks privately with security researchers.)

Some notable cyber-physical threats

• 2010 💥 Stuxnet Developed by America’s National Security Agency, working in conjunction with Israeli intelligence, the malware was a computer worm, or code that replicates itself from computer to computer without human intervention. Most likely smuggled in on a USB stick, it targeted programmable logic controllers which govern automated processes, and caused the destruction of centrifuges used in the enrichment of uranium at a facility in Iran.
• 2013 🕵️‍♂️ Havex Havex was designed to snoop on systems controlling industrial equipment, presumably so that hackers could work out how to mount attacks on the gear. The code was a remote access Trojan, or RAT, which is cyber-speak for software that lets hackers take control of computers remotely. Havex targeted thousands of US, European, and Canadian businesses, and especially ones in the energy and petrochemical industries.
• 2015 ⚡️ BlackEnergy BlackEnergy, which is another Trojan, had been circulating in the criminal underworld for a while before it was adapted by Russian hackers to launch an attack in December 2015 on several Ukranian power companies that helped trigger blackouts. The malware was used to gather intelligence about the power companies’ systems, and to steal log-in credentials from employees.
• 2016 ⚡️ CrashOverride Also known as Industroyer, this was developed by Russian cyber warriors too, who used it to mount an attack on a part of Ukraine’s electrical grid in December 2016. The malware replicated the protocols, or communications languages, that different elements of a grid used to talk to one another. This let it do things like show that a circuit breaker is closed when it’s really open. The code was used to strike an electrical transmission substation in Kiev, blacking out part of the city for a short time.

Over the past couple of years, cybersecurity firms have been racing to deconstruct the malware—and to work out who’s behind it. Their research paints a worrying picture of a sophisticated cyberweapon built and deployed by a determined and patient hacking group whose identity has yet to be established with certainty.

The hackers appear to have been inside the petrochemical company’s corporate IT network since 2014. From there, they eventually found a way into the plant’s own network, most likely through a hole in a poorly configured digital firewall that was supposed to stop unauthorized access. They then got into an engineering workstation, either by exploiting an unpatched flaw in its Windows code or by intercepting an employee’s login credentials.

Since the workstation communicated with the plant’s safety instrumented systems, the hackers were able to learn the make and model of the systems’ hardware controllers, as well as the versions of their firmware—software that’s embedded in a device’s memory and governs how it communicates with other things.

It’s likely they next acquired an identical Schneider machine and used it to test the malware they developed. This made it possible to mimic the protocol, or set of digital rules, that the engineering workstation used to communicate with the safety systems. The hackers also found a “zero-day vulnerability”, or previously unknown bug, in the Triconex model’s firmware. This let them inject code into the safety systems’ memories that ensured they could access the controllers whenever they wanted to.

Thus, the intruders could have ordered the safety instrumented systems to disable themselves and then used other malware to trigger an unsafe situation at the plant.

The results could have been horrific. The world’s worst industrial disaster to date also involved a leak of poisonous gases. In December 1984 a Union Carbide pesticide plant in Bhopal, India, released a vast cloud of toxic fumes, killing thousands and causing severe injuries to many more. The cause that time was poor maintenance and human error. But malfunctioning and inoperable safety systems at the plant meant that its last line of defense failed.

More red alerts

There have been only a few previous examples of hackers using cyberspace to try to disrupt the physical world. They include Stuxnet, which caused hundreds of centrifuges at an Iranian nuclear plant to spin out of control and destroy themselves in 2010, and CrashOverride, which Russian hackers used in 2016 to strike at Ukraine’s power grid. (Our sidebar provides a summary of these and other notable cyber-physical attacks.)

However, not even the most pessimistic of cyber-Cassandras saw malware like Triton coming. “Targeting safety systems just seemed to be off limits morally and really hard to do technically,” explains Joe Slowik, a former information warfare officer in the US Navy, who also works at Dragos.

Other experts were also shocked when they saw news of the killer code. “Even with Stuxnet and other malware, there was never a blatant, flat-out intent to hurt people,” says Bradford Hegrat, a consultant at Accenture who specializes in industrial cybersecurity.

"Ariel Davis"

It’s almost certainly no coincidence that the malware appeared just as hackers from countries like Russia, Iran, and North Korea stepped up their probing of “critical infrastructure” sectors vital to the smooth running of modern economies, such as oil and gas companies, electrical utilities, and transport networks.

In a speech last year, Dan Coats, the US director of national intelligence, warned that the danger of a crippling cyberattack on critical American infrastructure was growing. He drew a parallel with the increased cyber chatter US intelligence agencies detected among terrorist groups before the World Trade Center attack in 2001. “Here we are nearly two decades later, and I’m here to say the warning lights are blinking red again,” said Coats. “Today, the digital infrastructure that serves this country is literally under attack.”

At first, Triton was widely thought to be the work of Iran, given that it and Saudi Arabia are archenemies. But cyber-whodunnits are rarely straightforward. In a report published last October, FireEye, a cybersecurity firm that was called in at the very beginning of the Triton investigation, fingered a different culprit: Russia.

The hackers behind Triton had tested elements of the code used during the intrusion to make it harder for antivirus programs to detect. FireEye’s researchers found a digital file they had left behind on the petrochemical company’s network, and they were then able to track down other files from the same test bed. These contained several names in Cyrillic characters, as well as an IP address that had been used to launch operations linked to the malware.

That address was registered to the Central Scientific Research Institute of Chemistry and Mechanics in Moscow, a government-owned organization with divisions that focus on critical infrastructure and industrial safety. FireEye also said it had found evidence that pointed to the involvement of a professor at the institute, though it didn’t name the person. Nevertheless, the report noted that FireEye hadn’t found specific evidence proving definitively that the institute had developed Triton.

Researchers are still digging into the malware’s origins, so more theories about who’s behind it may yet emerge. Gutmanis, meanwhile, is keen to help companies learn important lessons from his experience at the Saudi plant. In a presentation at the S4X19 industrial security conference in January, he outlined a number of them. They included the fact that the victim of the Triton attack had ignored multiple antivirus alarms triggered by the malware, and that it had failed to spot some unusual traffic across its networks. Workers at the plant had also left physical keys that control settings on Triconex systems in a position that allowed the machines’ software to be accessed remotely.

Triton: a timeline

• 2014 Hackers gain access to network of Saudi plant
• June 2017 First plant shutdown
• August 2017 Second plant shutdown
• December 2017 Cyberattack made public
• October 2018 Fireeye says Triton most likely built in Russian lab
• January 2019 More details emerge of Triton incident response

If that makes the Saudi business sound like a security basket case, Gutmanis says it isn’t. “I’ve been into a lot of plants in the US that were nowhere near as mature [in their approach to cybersecurity] as this organization was,” he explains.

Other experts note that Triton shows government hackers are now willing to go after even relatively obscure and hard-to-crack targets in industrial facilities. Safety instrumented systems are highly tailored to safeguard different kinds of processes, so crafting malware to control them involves a great deal of time and painstaking effort. Schneider Electric’s Triconex controller, for instance, comes in dozens of different models, and each of these could be loaded with different versions of firmware.

That hackers went to such great lengths to develop Triton has been a wake-up call for Schneider and other makers of safety instrumented systems—companies like Emerson in the US and Yokogawa in Japan. Schneider has drawn praise for publicly sharing details of how the hackers targeted its Triconex model at the Saudi plant, including highlighting the zero-day bug that has since been patched. But during his January presentation, Gutmanis criticized the firm for failing to communicate enough with investigators in the immediate aftermath of the attack.

Schneider responded by saying it had cooperated fully with the company whose plant was targeted, as well as with the US Department of Homeland Security and other agencies involved in investigating Triton. It has hired more people since the event to help it respond to future incidents, and has also beefed up the security of the firmware and protocols used in its devices.

Andrew Kling, a Schneider executive, says an important lesson from Triton’s discovery is that industrial companies and equipment manufacturers need to focus even more on areas that may seem like highly unlikely targets for hackers but could cause disaster if compromised. These include things like software applications that are rarely used and older protocols that govern machine-to-machine communication. “You may think nobody’s ever going to bother breaking [an] obscure protocol that’s not even documented,” Kling says, “but you need to ask, what are the consequences if they do?”

"Ariel Davis"

An analog future?

Over the past decade or so, companies have been adding internet connectivity and sensors to all kinds of industrial equipment. The data captured is being used for everything from predictive maintenance—which means using machine-learning models to better anticipate when equipment needs servicing—to fine-tuning production processes. There’s also been a big push to control processes remotely through things like smartphones and tablets.

All this can make businesses much more efficient and productive, which explains why they are expected to spend around $42 billion this year on industrial internet gear such as smart sensors and automated control systems, according to the ARC Group, which tracks the market. But the risks are also clear: the more connected equipment there is, the more targets hackers have to aim at.

To keep attackers out, industrial companies typically rely on a strategy known as “defense in depth.” This means creating multiple layers of security, starting with firewalls to separate corporate networks from the internet. Other layers are intended to prevent hackers who do get in from accessing plant networks and then industrial control systems.

These defenses also include things like antivirus tools to spot malware and, increasingly, artificial-intelligence software that tries to spot anomalous behavior inside IT systems. Then, as the ultimate backstop, there are the safety instrumented systems and physical fail-safes. The most critical systems typically have multiple physical backups to guard against the failure of any one element.

The strategy has proved robust. But the rise of nation-state hackers with the time, money, and motivation to target critical infrastructure, as well as the increasing use of internet-connected systems, means the past may well not be a reliable guide to the future.

Russia, in particular, has shown that it’s willing to weaponize software and deploy it against physical targets in Ukraine, which it has used as a testing ground for its cyber arms kit. And Triton’s deployment in Saudi Arabia shows that determined hackers will spend years of prodding and probing to find ways to drill through all those defensive layers.

Fortunately, the Saudi plant’s attackers were intercepted, and we now know a great deal more about how they worked. But it’s a sobering reminder that, just like other developers, hackers make mistakes too. What if the bug they inadvertently introduced, instead of triggering a safe shutdown, had disabled the plant’s safety systems just when a human error or other mistake had caused one of the critical processes in the plant to go haywire? The result could have been a catastrophe even if the hackers hadn’t intended to cause it.

Experts at places like the US’s Idaho National Laboratory are urging companies to revisit all their operations in the light of Triton and other cyber-physical threats, and to radically reduce, or eliminate, the digital pathways hackers could use to get to critical processes.

Businesses may chafe at the costs of doing that, but Triton is a reminder that the risks are increasing. Gutmanis thinks more attacks using the world’s most murderous malware are all but inevitable. “While this was the first,” he says, “I’d be surprised if it turns out to be the last.”

Phishing alert

Phishing alert: One in 61 emails in your inbox now contains a malicious link

By

zdnet.com

View Original

The number of phishing attacks is on the rise, more than doubling in recent months, with one in 61 emails delivered to corporate inboxes found to contain a malicious URL.

Analysis by security provider Mimecast found that between August to November and December to February, the number of emails delivered despite featuring a malicious URL increased by 126 percent.

These malicious links are one of the key methods cyber criminals use to conduct criminal campaigns: by distributing phishing emails which encourage users to click through to a link.

The emails are often designed to look like they come from legitimate senders – like a company, or a colleague – in order to gain the trust of the victim, before duping them into clicking the malicious link.

The purpose of the malicious URL could be to deploy malware onto the PC or it could encourage the victim to enter sensitive information into a fake version of a real service – like a retailer, a bank or an email provider– in order to trick the user into giving up passwords and other data.

Attackers then either use this as a jumping off point for further attacks, or they look to sell it to other cyber criminals on underground forums.

In total, Mimecast analysed 28,407,664 emails delivered into corporate inboxes which were deemed "safe" by security systems and found that 463,546 contained malicious URLs – the figure represents an average of one malicious email getting through for every 61 emails which arrive.

Given the sheer number of emails sent back and forth by employees every single day, that represents a significant security risk and a potential gateway for hackers looking to conduct malicious activity.

"Email and the web are natural complements when it comes to the infiltration of an organization. Email delivers believable content and easily clickable URLs, which then can lead unintended victims to malicious web sites," said Matthew Gardiner, cybersecurity strategist at Mimecast.

"Cybercriminals are constantly looking for new ways to evade detection, often turning to easier methods like social engineering to gain intel on a person or pulling images from the internet to help 'legitimize' their impersonation attempts to gain credentials or information from unsuspecting users," he added.

Taking Facebook Quizzes Could Put You at Risk for Identity Theft

by Kirstin Fawcett

From phishing schemes to a thief pilfering your passport, there are plenty of ways to fall victim to identity theft. And now, participating in Facebook quizzes is one of them. As ABC News reports, the seemingly harmless surveys that populate your feed could wind up providing unscrupulous hackers with the answers to your online security questions.

Popular Facebook quizzes often ask users to answer a series of sharable personal questions, ranging from the name of their pet to their birth city. Some people see them as a fun way to bond with friends, or a way to make new ones. But as one local police department in Massachusetts recently noted on Facebook, many of these queries are similar—if not identical—to security questions used by banks and other institutions.

"Please be aware of some of the posts you comment on," the Sutton Police Department in Massachusetts wrote in a cautionary message. "The posts that ask what was your first grade teacher, who was your childhood best friend, your first car, the place you [were] born, your favorite place, your first pet, where did you go on your first flight … Those are the same questions asked when setting up accounts as security questions. You are giving out the answers to your security questions without realizing it."

Hackers can use these questions to build a profile and hack into your accounts or open lines of credit, the department said. They could also trick you into clicking on malicious links.

Experts say it's OK to take part in a Facebook quiz, but you should never reveal certain personal facts. Take quizzes only from respected websites, and always carefully vet ones that ask for your email address to access the poll or quiz. And while you're at it, consider steering clear of viral memes, like this one from 2017, which asked Facebook users to name memorable concerts (yet another common security question).

A Cute Toy Just Brought a Hacker Into Your Home

If anyone ordered any of these cute little dolls, you may want to reconsider. 

Originally written By SHEERA FRENKEL    DEC. 21, 2017

Earlier this year, Germany’s Federal Network Agency, the country’s regulatory office, said the My Friend Cayla doll was “an illegal espionage apparatus.” Credit Tony Cenicola/The New York Times

SAN FRANCISCO — My Friend Cayla, a doll with nearly waist-length golden hair that talks and responds to children’s questions, was designed to bring delight to households. But there’s something else that Cayla might bring into homes as well: hackers and identity thieves.

Earlier this year, Germany’s Federal Network Agency, the country’s regulatory office, labeled Cayla “an illegal espionage apparatus” and recommended that parents destroy it. Retailers there were told they could sell the doll only if they disconnected its ability to connect to the internet, the feature that also allows in hackers. And the Norwegian Consumer Council called Cayla a “failed toy.”

The doll is not alone. As the holiday shopping season enters its frantic last days, many manufacturers are promoting “connected” toys to keep children engaged. There’s also a smart watch for kids, a droid from the recent “Star Wars” movies and a furry little Furby. These gadgets can all connect with the internet to interact — a Cayla doll can whisper to children in several languages that she’s great at keeping secrets, while a plush Furby Connect doll can smile back and laugh when tickled.

But once anything is online, it is potentially exposed to hackers, who look for weaknesses to gain access to digitally connected devices. Then once hackers are in, they can use the toys’ cameras and microphones to potentially see and hear whatever the toy sees and hears. As a result, according to cybersecurity experts, the toys can be turned to spy on little ones or to track their location.

“Parents need to be aware of what they are buying and bringing home to their children,” said Javvad Malik, a researcher with cybersecurity company AlienVault. “Many of these internet-connected devices have trivial ways to bypass security, so people have to be aware of what they’re buying and how secure it is.”

The problem isn’t new, but it’s growing as manufacturers introduce a wider range of toys that can connect online, part of an overall trend of “smart” electronics. About 8.4 billion “connected things” will be in use worldwide this year, according to estimates from research firm Gartner, up 31 percent from 2016, with the number projected to rise to 20.4 billion by 2020.

Sarah Jamie Lewis, an independent cybersecurity researcher who tested toys ahead of the holiday season, said many of the products did not take basic steps to ensure their communications were secure and that a child’s information would be protected. She said the toys acted as “uncontrolled spy devices” because manufacturers failed to include a process that would allow the gadget to connect to the internet only through certain trusted devices.

Consider the Furby Connect doll made by Hasbro, a furry egg-shaped gadget that comes in teal, pink and purple. Researchers from Which?, a British charity, and the German consumer group Stiftung Warentest recently found that the Bluetooth feature of the Furby Connect could enable anyone within 100 feet of the doll to hijack the connection and use it to turn on the microphone and speak to children.

Researchers recently found the Furby Connect’s Bluetooth connection could be hijacked by hackers, letting them turn on the doll’s microphone and speak to children.Credit Tony Cenicola/The New York Times

Then there’s the Q50, a smart watch for children. Marketed as a way to help parents easily communicate with and keep track of their kids, bugs in the watch would allow hackers to “intercept all communications, remotely listen to the child’s surroundings and spoof the child’s location,” according to a report by Top10VPN, a consumer research company this month.

And the BB-8 droid, which was released with “The Last Jedi” this month, also had an insecure Bluetooth connection, according to Ms. Lewis’s tests.

SinoPro, the Chinese manufacturer of the Q50 watch, and Genesis, the maker of the Cayla doll, did not respond to requests for comment. Sphero, the maker of the BB-8 connected droid, said the toy is “adequately secure.” Hasbro said the Furby Connect complies with the United States Children’s Online Privacy Protection Act, and that it hired third-party testers to perform security testing on the toy and app.

Toy manufacturers have long searched for ways to bring toys alive for children. While microphones and cameras introduced some level of responsiveness, those interactions were generally limited to a canned response preset by a manufacturer. Internet connections opened up a new wealth of possibilities; now the toys can be paired with a computer or cellphone to allow children to constantly update their toys with new features.

The My Friend Cayla doll, for example, uses speech recognition software coupled with Google Translate. The doll’s microphone records speech and then transmits it over the internet, a function that leaves it open to hackers, according to cybersecurity researchers. If the doll’s owner does not designate a specific cellphone or tablet with which the doll should have an internet connection, anyone within 50 feet of the toy can use the Bluetooth connection to gain access to it. Security researchers have also raised concerns over what type of data the doll collects, and how the data is used.



Last year, a cyberattack on VTech Holdings, a digital toymaker, exposed the data of over 6.4 million people, including names, date of birth and gender, in what experts said was the largest known breach to date that targeted children.

For parents looking to fulfill their holiday wish-lists, the first step is knowing about the risks involved with internet-connected toys. Earlier this year, the F.B.I. issued a broad warning about such toys, advising parents to pay particular attention to how a toy connected to the internet. If a toy connects wirelessly through Bluetooth, it should require some type of unique pin or password, to make sure that connection is secure.

The F.B.I. also recommended that connected toys be able to receive updates from the manufacturers so they are kept up-to-date. And if the toy stores data, parents should investigate where that data is stored and how securely the company guards the data of its customers.

At a Target store this month in Emeryville, Calif., Sarah Lee, a 37-year-old mother of three, said she was rethinking her choices of presents for her children after hearing about the risks of connected toys.

“That’s so scary, I had no idea that was possible,” she said. “What’s the worst hackers can do? Wait, no, don’t tell me. I’d just rather get my kids an old-fashioned doll.”

Beware of this smartphone scam on Cyber Monday

Here is how to get deals without getting hacked

This Cyber Monday, nearly $11 billion in holiday shopping could be at risk of diversion and theft.

Black Friday and Cyber Monday is a busy time for scam artists.

American shoppers are gearing up for the biggest shopping week of the year, with revenue expected to surpass the $9.36 billion spent over the four-day Black Friday weekend in 2016 — and fraudsters are ready to cash in on it.

Some $10.8 billion in 2017 holiday shopping could be at risk of diversion and theft, according to a study of five leading e-commerce retail brands from cybersecurity company RiskIQ. Think twice before you download the app for your favorite store: More than 32,000 malicious mobile apps are leveraging the names of those five brands to lure customers into scams, the research found, and 1 in 25 mobile apps found under a “Black Friday” search in app stores were unsafe to use.

Emails are already being sent from scammers impersonating brands including Amazon AMZN, +2.58% Walmart WMT, +0.22% Kohl’s KSS, +1.03% Ray-Ban, and Michael Kors offering huge discounts of up to 80% off, a separate report from security company Barracuda networks found.

With attacks becoming more pervasive and sophisticated, consumers have to be cautious when looking for deals online over the next week.

Here are five ways to protect yourself while shopping online:

1. Create unique usernames and passwords

If you are able to remember your password, it’s probably not a great one. Security experts suggest using complex passwords that include a variety of numbers and characters, or long strings of random words. The majority of internet users have dozens of accounts, making it difficult to remember every password. To keep track, use a password manager like LastPass or 1Password, or go the old school route and write passwords down on paper to be stored in a safe place.

Most consumers know by now that using the same password for every site is poor privacy practice, but many overlook the importance of username security, said Shaun Murphy, CEO of online security-focused social platform SNDR. “To keep your online history private from criminals, create a unique username for each website on which you shop. For example, YourName+StoreName is a better username than your name plus a few numbers.”

Consumers who choose to use a password manager should be sure to keep the master password in a safe place. Password managers aren't impervious to hackers (LastPass announced a hack in 2015) so be sure to change all passwords regularly.

2. Monitor your bank account

This time of year, consumers are often making an unusually high number of purchases, so they should be extra vigilant to make sure account activity is legitimate. “A lot of theft that occurs goes unnoticed, and once it is noticed often the goods and services have been delivered,” said Marc Boroditsky, vice president at security app Authy. He suggests turning on notifications to be alerted when purchases are made. “That kind of visibility gives me confidence I can confirm there is not fraud on my account and allows me to participate in the process.”


Many banking apps allow users to set mobile notifications for all account activity. Some vendor sites like Amazon AMZN, +2.58%   also offer the option to receive text message notifications when purchases are made, and the ability to receive status updates on shipments. The influx of alerts may be a nuisance at any other time of the year, but are worth the distraction around the holiday spending season.

3. Beware of odd links

Thousands of malicious mobile apps and misleading landing pages put users at risk of being hacked, according to the RiskIQ study. When shopping online, make sure you are shopping on a store’s actual website before inputting any personal information or a credit card number. Bad web design is a major red flag for scam webpages.

Users should make sure the URL is correct and begins with “HTTPS,” or has a lock symbol next to the web address, which means it is encrypted. Double check promotional emails that advertise deals to make sure the sender’s email routes to the website of the company it is claiming to be (something like info@walmart.com rather than info@walmart.co or info@wallmartcustomerservice.com, for example).

Nearly 30% of shopping is expected to be done on mobile devices this year, which aren’t as safe as once thought: in 2015 it was found that 85 applications had infected users with malware, according to RiskIQ. Nearly 1 million blacklisted apps used the name of one of the top five e-commerce brands in their app titles or descriptions to trick customers. Be sure to only download apps from the official Google GOOG, +0.45%   or Apple AAPL, +0.01%   app stores, and research them well before using them. Don’t rely on reviews alone, as they can be easily spoofed — your best bet is to download apps that are linked on the retailer’s official website if possible.

4. Don’t shop on public Wi-Fi

When making Cyber Monday purchases, be sure to shop on secure Wi-Fi at home, not a coffee shop, airport, or other public network. If you must shop while on the go, use a mobile device with a data plan or a personal hot spot created from your phone. Stand-alone mobile hot spots can also be purchased from phone providers like Verizon. Users shopping by laptop on public Wi-Fi can also implement a Virtual Private Network (VPN) like Private internet Access or Freedome to obscure and protect their web traffic and better ensure security.

5. Use two-step authentication


Nearly every email client now allows users to opt for two-step authentication, which works as a normal login with a username and password but requires a verification code sent through a separate device like a phone for access. This second layer of security is a great way to ensure the only person who signs into your account is you. In addition to setting up two-step authentication on email, Cyber Monday shoppers should check if the retailers they are purchasing from offer their own security measures. Vendors like Amazon and Etsy ETSY, +1.48%   offer two factor authentication -- check out TwoFactorAuth.org to see if the store you’re purchasing from does as well.

This article was written by KARI PAUL, REPORTER and appears at:  https://www.marketwatch.com/story/5-tips-for-safe-shopping-on-cyber-monday-2016-11-21

Key Windows 10 Anti-Malware Tech Critically Broken

Over a decade ago, Microsoft added support for a key malware mitigation technique that makes it harder for rogue applications to predict which code will be loaded into specific target addresses. This technique, called address space layout randomization (ASLR), stores data in different locations each and every time the application is run. If your code is riddled with security flaws, ASLR won’t secure it, but it will (hopefully) make it a little harder to find and therefore exploit. Or at least, that’s how it’s supposed to work — but Windows 10, it turns out, has a teensy little problem. It stores its supposedly randomized data in exactly the same place, each and every time.

To understand the magnitude of the failure, it may help to think of a loose analogy. Imagine you have an insecure mailbox that’s constantly being robbed. One hypothetical way to deal with this problem is to have many mailboxes scattered across your property. Each day, your long-suffering postal worker puts your mail (4-5 pieces) in a subset of available mailboxes (let’s say, 30 mailboxes total). A person could still search your property and find them, but it’s going to take longer and be more obvious.

Actually, with Windows 7 and EMET System-wide ASLR, the loaded address for eqnedt32.exe is different on every reboot. But with Windows 10 with either EMET or WDEG, the base for eqnedt32.exe is 0x10000 EVERY TIME.

Conclusion: Win10 cannot be enforce ASLR as well as Win7! pic.twitter.com/Jp10nqk1NQ

— Will Dormann (@wdormann) November 15, 2017

Now, imagine that instead of putting your 4-5 pieces of mail in up to five different locations, your mailman stuck it in exactly the same locations, each and every time. That’s more or less what’s happening here and it’s a problem afflicting both Windows 8 and Windows 10. Without any entropy (randomness), there’s no protection offered at all.

There are two ways to enable ASLR. One is to use the /DYNAMICBASE flag provided by the Visual C++ linker. This method still works perfectly, as far as anyone can tell. But since relying on programmers or vendors to always keep their code properly secure is a recipe for disaster, Microsoft also provides tools to force applications to use ASLR whether they’re designed to do so or not. This capability is baked into the Fall Creators Update as the Windows Defender Exploit Guard and was previously available as Microsoft EMET (Enhanced Mitigation Experience Toolkit), a GUI for enabling security measures already baked into the OS. The screenshot below shows the newer Defender Exploit Guard baked into Windows 10 FCU.

The problem is this: Apparently Microsoft’s default ASLR implementation fails to activate a key sorting method of ASLR, known as “bottom-up ASLR.” Microsoft’s own technical documentation describes bottom-up ASLR as method of assigning a base address by searching “for a free region starting from the bottom of the address space (e.g. VirtualAlloc default).” Enabling ASLR without simultaneously enabling bottom-up ASLR means that memory values are stored in exactly the same location each and every time. Here’s how CERT describes the problem:

Although Windows Defender Exploit guard does have a system-wide option for system-wide bottom-up-ASLR, the default GUI value of “On by default” does not reflect the underlying registry value (unset). This causes programs without /DYNAMICBASE to get relocated, but without any entropy. The result of this is that such programs will be relocated, but to the same address every time across reboots and even across different systems. Windows 8 and newer systems that have system-wide ASLR enabled via EMET or Windows Defender Exploit Guard will have non-DYNAMICBASE applications relocated to a predictable location, thus voiding any benefit of mandatory ASLR. This can make exploitation of some classes of vulnerabilities easier.

It finishes on the cheery note that there’s no practical solution to the problem currently available for deployment, but individuals can reenable the security ASLR is supposed to provide by importing the following registry key:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel]
“MitigationOptions”=hex:00,01,01,00,00,00,00,00,00,00,00,00,00,00,00,00

As always, we do not recommend mucking about in the registry unless you are certain you know what you’re doing. US-CERT has some additional details on both the problem and this fix available on its website. And yes, Windows 7 users, you get to preen a bit — this problem does not affect your operating system.

By Joel Hruska on November 20, 2017 at 3:12 pm