Cyber Security News & Trends

/0 Comments/in /by

This week, Baltimore battles ransomware, IoT attacks are increasing, and the potential vulnerabilities in a driverless car are investigated.

SonicWall Spotlight

5 Steps to Robust Network Security – Business World (India)

  • IT security teams around the world are dealing with an ever-increasing level of complexity in the threat landscape. SonicWall’s Debasish Mukherjee argues that the best way to overcome these challenges is with a comprehensive approach to cybersecurity, he then recommends five steps to take in order to get there.

How to Mitigate the IoT Attacks That Are Increasing at 217.5% – IoT Agenda

  • Internet of Things (IoT) devices are expected to increase in number to 75.44 billion worldwide by 2025. Using the 2019 SonicWall Cyber Threat Report IoT Agenda explains why preventative measures need to be developed sooner rather than later.

Cyber Security News

Baltimore Ransomware Attack: NSA Faces Questions – BBC

  • After a ransomware attack currently estimated to cost at least $18M Baltimore officials are questioning why the hacking vulnerability known as EternalBlue was not disclosed when discovered by the NSA years ago. The NSA are declining to comment on the issue.

New Zealand Budget Leak: ‘Hackers’ Had Simply Searched Treasury Website – The Guardian

  • After the embargoed New Zealand budget was leaked to the opposition National Party days before it was due to be released, officials were quick to call it a hack. However, it has now been found that the documents were searchable on the New Zealand treasury website.

HawkEye Malware Campaign Upticks on Business Users – SC Magazine

  • Hawkeye, a keylogger than has been around for six years, has seen a major increase in a campaign targeting business users worldwide.

Startups: Embrace Cybersecurity Priorities From Day One – Forbes

  • Forbes argues that cybersecurity in startups should not be considered an add-on or a luxury product and provide four cybersecurity priorities that a startup needs to think about from day one.

Emotet Made up 61% of Malicious Payloads in Q1 – Dark Reading

  • A new study has found that 61% of all malware payloads in the first quarter of 2019 contained the Emotet botnet.

Security Expert: Here’s How Driverless Cars Could Be Hacked – Yahoo! Finance

  • As cars modernize and driverless cars are becoming a reality it is fair to say that they are becoming more and more like a series of interconnected computers. Yahoo! Finance looks at where the security weakpoint in these computers might be found, how it could be targeted by hackers, and how the car industry is struggling to keep up with security requirements.

Nation-State Security: Private Sector Necessity – SecurityWeek

  • Attackers with the funding and technical support of nation-states are now targeting commercial entities and the obvious split between commercial and political cyberattacks is disappearing. SecurityWeek examine the current threat landscape, including the increasing number of organizations embracing “Zero Trust” security models where all environments are considered untrusted until proven otherwise. They then offer some advice on how to ensure your organization is ready for cyberattacks.

Microsoft Issues Second Warning About Patching BlueKeep as PoC Code Goes Public – ZDNet

  • Microsoft again warned users to ensure their patches are up to date to protect against the Bluekeep vulnerability – described as similar to the EternalBlue exploit – after a proof-of-concept attack appeared online. SonicWall provides protection against this threat.

In Case You Missed It

Inside the Modern Phishing Campaigns of 2019

/3 Comments/in /by

The world of cybersecurity is dominated by headlines of malware, ransomware, data breaches, app vulnerabilities, IoT threats and botnet attacks. But phishing has been a serious threat since the early 2000s and is widely regarded as the most common attack vector for cybercriminals.

Today, phishing is not about volume. These email threats are now tuned to successfully trick a high-value target into taking a desired action: clicking on a malicious link, opening a malware-laden file, providing a password or authorizing financial transactions.

In the current cyber arms race, threat actors are constantly trying to get around security systems. In the context of email as a threat vector, phishing has evolved into spear-phishing, impersonation and Business Email Compromise (BEC) types of attacks. These messages are highly targeted with extensive social engineering efforts to carefully select and study the victim.

Global phishing volume down, attacks more targeted

Published in the 2019 SonicWall Cyber Threat Report, our Capture Labs threat researchers recorded 26 million phishing attacks worldwide, a 4.1 percent drop from 2017. During that time, the average SonicWall customer faced 5,488 phishing attacks.

2018 Global Phishing Volume

As businesses get better at blocking email attacks and ensuring employees can spot and delete suspicious emails, attackers are shifting tactics. New data suggests they’re reducing overall attack volume and launching more highly targeted phishing attacks (e.g., Black Friday and Cyber Monday attacks).

Explore the five common tactics phishers are using to steal credentials, deploy malware, infiltrate networks and damage brands.

  1. Malicious URLs and fake or spoofed websites
    With improvements in secure email solutions that mitigate phishing, cybercriminals are resorting to innovative methods to execute targeted attacks, such as using weaponized URLs in email to deliver malicious payloads or creating phishing websites with fake login pages to harvest user login credentials.In late 2017, it was reported that nearly 1.5 million phishing sites are created each month. And the detection of phishing sites has become harder because phishers are obfuscating phishing URLs with multiple redirections and URL shortners.

    In addition, about half of these phishing sites are using HTTPS and SSL certificates, which make it easier for cybercriminals to deceive their victims.

    Source: “PhishPoint: New SharePoint Phishing Attack Affects an Estimated 10% of Office 365 Users,” Avanan, August 2018.

    According to Microsoft’s security intelligence report, “attackers increasingly use popular document sharing and collaboration sites and services to distribute malicious payloads and fake login forms that are used to steal user credentials.”

  2. Phishing targeting Office 365 applications, users
    SaaS and webmail services are increasingly targeted by phishing campaigns. According to the Anti-Phishing Working Group (APWG), phishing that targeted SaaS and webmail services doubled in the fourth quarter of 2018.As Office 365 gains adoption as the most popular choice of cloud email platform across organizations of all sizes and verticals, it comes as no surprise that Microsoft is the most impersonated brand.

    “As Microsoft’s SEG market share increases, smart attackers will specifically target Microsoft’s defenses,” reports Gartner.

    This is not unconceivable because an Office 365 subscription is available to anyone with a credit card, making its security features very accessible to cybercriminals. This theoretically enables criminal groups to design phishing campaigns that can evade Microsoft’s native defenses. In fact, in another report, researchers found 25% of phishing emails bypass Office 365 security.

  3. Compromised credentials
    In January 2019, security researcher Troy Hunt discovered “Collection 1,” a trove of 773 million email addresses and 21 million passwords available for sale on Hacker Forum.These compromised user IDs and password combinations are used to carry out attacks from the inside. A common attack includes account takeover that involves threat actors compromising employee corporate credentials by either launching a credential phishing campaign against an organization or buying credentials on the Darkweb due to third-party data leaks. The threat actor can then use the stolen credentials to gain additional access or escalate privileges. Compromised credentials may remain undiscovered for months or years.
  4. Impersonation, CEO fraud and Business Email Compromise (BEC)
    According to the FBI, Business Email Compromise, or BEC, is a scam targeting businesses working with foreign suppliers and/or businesses regularly performing wire transfer payments. These sophisticated scams are carried out by fraudsters compromising email accounts through social engineering or computer intrusion techniques to conduct unauthorized transfer of funds.These types of attacks are hard to stop because they do not contain malicious links or attachments, but a message to the victim seemingly from a trusted sender requesting transfer of funds.

    The FBI Internet Complaint Center (IC3) reported last summer that from October 2013 to May 2018, total losses worldwide for known BEC scams hit $12.5 billion.

  5. Malicious PDF files and Office doc attachments
    Email attachments are a popular delivery mechanism for malicious payloads, such as ransomware and never-before-seen malware. SonicWall Capture Labs threat researchers recently found a substantial increase of malicious or fraudulent PDF files.These fraud campaigns take advantage of recipients’ trust in PDF files as a “safe” file format that is widely used and relied upon for business operations. I recommend reading “New PDF Fraud Campaign Spotlights Shifting Cybercriminal Phishing Tactics, written by Dmitriy Ayrapetov, Executive Director of Product Management, to learn more about these types of phishing campaigns and how you can stop them.

The E-rate ‘Fear Less’ Technology Infrastructure

/1 Comment/in /by

Before you begin the RFP process, it’s important to explore the technology infrastructure (specifically what’s eligible in Category Two) as defined within the E-rate program by Universal Service Administration Company (USAC) and how each relates to the E-rate funding process.

Episode 4: The E-rate Fear Less Technology Infrastructure

On the fourth episode of the E-rate Fear Less series, Holly Davis dives further into the program and reviews other options school districts have in building a secure, future-proof network with the E-rate program.

At a high level, E-rate Category Two technology in three primary pillars. Category Two components are those that relate to cyber security solutions, hardware, software and other services. For more details about E-rate categories, please review the 2019 Eligible Services List (PDF).

Technology Function
Broadband Internal Connections (IC)On-premise solution internally managed; equipment may be owned or leased.
Managed Internal Broadband Services (MIBS)Managed service solution owned, leased or hosted in the cloud.
Basic Maintenance
of Broadband Internal Connections		Support for the IC solution.
Source: 2019 Eligible Services List (PDF)

E-rate Category 2 technology funding with SonicWall

School and campus networks range in size and manage different types of sensitive data. Mitigating potential weak points in the network — and the data that can be targeted — is no easy task for standard IT teams that haven’t undergone extensive cyber security training. SonicWall network and cyber security solutions meet the needs of school districts at the highest efficacy — all at price points that fit within K-12 budgets.

If you are utilizing E-rate funding to assist you in buying your networking and cyber security solutions, SonicWall can help. Our team of E-rate funding experts ensure your SonicWall solution aligns with the rules and regulations of the E-rate program.

SonicWall Security as a Service (SECaaS) is an alternative solution for schools that do not have a large capital outlay to invest in a future-proof security solution or a dedicated IT team trained to manage cyber security.

“Security-as-a-Service provides more flexibility,” said Jenna Burros, Director of Business Services, at the Calistoga Joint Unified School District in California. “It is such an improvement to be able to have enough control to differentiate various levels of accessibility.”

Under Burros’ guidance, the California school district upgraded the flexibility and granularity of its existing content-filtering solution, while also keeping costs at minimum — a key obstacle for K-12 organizations regardless of E-rate eligibility.

With the most comprehensive channel program in the industry, combined with additional E-rate discounts, SonicWall and its partners are best positioned to meet the needs of K-12 customers and help them take full advantage of the funding E-rate provides for securing their networks.

If you are an eligible K-12 organization, please contact your preferred SonicWall reseller for information on E-rate benefits and discounts, or visit the SonicWall E-rate page for information, tools and guidance.

E-rate Episode Video Series for K-12 School Districts

What is E-rate?

To help offset funding and staffing shortages, the U.S. Department of Education and the FCC launched the E-rate program, which helps make telecommunications and information services more affordable for schools, campuses, districts and libraries.

The E-rate program is operated by Universal Service Administration Company (USAC), which has a core focus of providing underfunded organizations access to affordable technology and security services. This includes schools, libraries and rural healthcare organizations.

USAC provides a yearly Eligible Services List (ESL), which outlines which types of products and services can be procured via E-rate program discounts.

Applicant Steps & Resources

Prep: Before You Begin
Step 1: Competitive Bidding
Step 2: Selecting Service Providers
Step 3: Applying for Discounts
Step 4: Application Review
Step 5: Starting Services
Step 6:  Invoicing 

Resources provided by USAC

The E-rate ‘Fear Less’ Solution

/0 Comments/in /by

The E-rate program is critical for K-12 organizations that lack the funding to procure appropriate technology, such as networking and cyber security solutions (e.g., firewalls, wireless network security, etc.). But understanding the program — as well as confirming your E-rate eligibility — can be daunting.

Episode 3: The E-rate Fear Less Solution

On the third episode of the E-rate Fear Less series, Komplement CEO Holly Davis discusses school eligibility, discounts levels and the competitive bidding process.

E-rate discounts are based on the category of service requested, level of poverty, urban/rural status of the population served and the level of participation of students in the Nation School Lunch Program (NSLP).

  • School districts derive their discount, for purposes of determining their level of poverty, from the total percentage of students eligible for the NSLP in the school district.
  • Libraries derive their discount, for purposes of determining their level of poverty, from the NSLP eligibility percentage of the public-school district in which the main branch of the library is located.
  • Rural discount eligibility is determined at the school district or library system level. If more than 50 percent of the schools in a school district or libraries in a library system are considered rural, the district or system is eligible for the rural discount. Note: Non-instructional facilities (NIFs) are not included in this percentage calculation.

Once eligibility is confirmed, it is very important to understand that the government requires a fair and competitive bidding process. Please contact a SonicWall E-rate expert to help guide your organization through the rules and guidelines of the E-rate process.

E-rate technology discounts with SonicWall

Applicant Steps & Resources

Prep: Before You Begin
Step 1: Competitive Bidding
Step 2: Selecting Service Providers
Step 3: Applying for Discounts
Step 4: Application Review
Step 5: Starting Services
Step 6: Invoicing

Resources provided by USAC

SonicWall network and cyber security solutions meet the needs of school districts at the highest efficacy — all at price points that fit within K12 budgets.

If you are utilizing E-rate funding to assist you in buying your networking and cyber security solutions, SonicWall can help. Our team of E-rate funding experts ensure your SonicWall solution aligns with the rules and regulations of the E-rate program. SonicWall provides services in the following areas:

  • Managed Internal Broadband Services
  • Internal Connections
  • Basic Maintenance for Internal Connections

With the most comprehensive channel program in the industry, combined with additional E-rate discounts, SonicWall and its partners are best positioned to meet the needs of K12 customers and help them take full advantage of the funding E-rate provides for securing their networks.

If you are an eligible K12 organization, please contact your preferred SonicWall reseller for information on E-rate benefits and discounts, or visit the SonicWall E-rate page for information, tools and guidance.

E-rate Episode Video Series for K-12 School Districts

Know the E-rate Terminology

The E-rate program is replete of acronyms, form numbers and other unique nomenclature. Learn the key terms to successfully guide your K12 organization through the E-rate process.

VIEW THE GLOSSARY

What is E-rate?

To help offset funding and staffing shortages, the U.S. Department of Education and the FCC launched the E-rate program, which helps make telecommunications and information services more affordable for schools, campuses, districts and libraries.

The E-rate program is operated by Universal Service Administration Company (USAC), which has a core focus of providing underfunded verticals the access to affordable technology and security services. This includes schools, libraries, rural healthcare organizations and more.

USAC provides a yearly Eligible Services List (ESL), which outlines which types of products and services can be procured via E-rate program discounts.

Navigating the E-rate Program: Forms, Filling Cycles & Rules

/0 Comments/in /by

Participating in your first E-rate season can be overwhelming. It is important to understand eligibility requirements of the program since the forms and terminology can become confusing. To better understand the ins and outs of the E-rate program, watch Episode 2 of the SonicWall E-rate video series below.

Episode 2: Navigating the E-rate Program

On the second episode of the E-rate Fear Less series, Komplement CEO Holly Davis highlights key elements of the E-rate program to help you navigate the process. You will learn about the filling cycle, ESL, 470 and 471 forms, and rules of the program.

Before you get started, it’s important to remember some key dates. First, the E-rate program operates on a fiscal year (FY) calendar. This year, FY2020 is July 1, 2019, to June 30, 2020. From here, there are two primary dates to remember:

  • 470 Filing: July 1, 2019 (RFP Posting)
  • 471 Filing: January 11, 2020-March 22, 2020

Applicant Steps & Resources

Prep: Before You Begin
Step 1: Competitive Bidding
Step 2: Selecting Service Providers
Step 3: Applying for Discounts
Step 4: Application Review
Step 5: Starting Services
Step 6: Invoicing 

Resources provided by USAC

Each year, before the FCC Form 471 application filing window opens, the FCC releases Eligible Services List (ESL) for the upcoming funding year (it is typically released between September and November).

The ESL contains a description of the products and services that will be eligible for discounts, along with additional helpful information such as eligibility conditions for each category of service for each specified funding year.

Be sure to review the list before you post a form 470 request for services to properly align your products and service needs.

SonicWall and E-rate

Through its global channel of more than 23,000 technology partners, SonicWall is actively involved in helping K-12 education organizations cost-effectively obtain and deploy network security solutions. SonicWall provides a broad array of E-rate-eligible products and services, including firewalls and turnkey Security-as-a-Service solutions.

SonicWall can discuss its products and services prior to the posting of a school/library Form 470, which begins the competitive bidding process. Once Form 470 is filed, SonicWall and its partners are restricted to rules and regulations of the program and are respondents to the bidding.

If you are utilizing E-rate funding to assist you in buying your networking and cyber security solutions, SonicWall can help. Our team of E-rate funding experts ensure your SonicWall solution aligns with the rules and regulations of the E-rate program. SonicWall provides services in the following areas:

  • Managed Internal Broadband Services
  • Internal Connections
  • Basic Maintenance for Internal Connections

SonicWall integrated solutions meet the needs of school districts at the highest efficacy and at price points that fit within K-12 budget constraints. SonicWall helps reduce the total cost of ownership (TCO) for these under-funded organizations.

If you are an eligible K-12 organization, please contact your preferred SonicWall reseller for information on E-rate benefits and discounts, or visit the SonicWall E-rate page for information, tools and guidance.

What is E-rate?

To help offset funding and staffing shortages, the U.S. Department of Education and the FCC launched the E-rate program, which helps make telecommunications and information services more affordable for schools, campuses, districts and libraries.

“Eligible schools and libraries may receive discounts on telecommunications, telecommunications services and internet access, as well as internal connections, managed internal broadband services and basic maintenance of internal connections,” explains the FCC website. “Discounts range from 20 to 90 percent, with higher discounts for higher poverty and rural schools and libraries. Recipients must pay some portion of the service costs.”

The E-rate program is operated by Universal Service Administration Company (USAC), which has a core focus of providing underfunded verticals the access to affordable technology and security services. This includes schools, libraries, rural healthcare organizations and more.

USAC provides a yearly Eligible Services List (ESL), which outlines which types of products and services can be procured via E-rate program discounts.

E-rate Episode Video Series for K-12 School Districts

An Explanation of E-rate: How to Cost-Effectively Protect K12 Networks

/0 Comments/in , /by

Networks security is often too focused on traditional business. But there are more than 100,000 K12 campuses in the U.S. alone. Each have similar security challenges as the standard enterprise or business, but its users (i.e., most commonly students) require more careful and dedicated protection.

Video 1: An Explanation of E-Rate

To help K12 organizations and technology partners better understand opportunities provided by the E-rate program, SonicWall E-rate and cyber security experts explain the history of the program, its importance to K12 organizations, discount levels, and eligible technologies and solutions.

K12 At A Glance

  • 104,000 public K12 schools in the U.S.
  • 55 million public K12 student enrollment
  • Education is the No. 1 target for ransomware attacks
  • Ransomware has hit over 23 percent of educational institutions
  • U.S. K12 spends over $230 million annually on cyber security
  • Maintaining a secure network is one of the top challenges faced by K12 school districts

What is E-rate?

To help offset funding and staffing shortages, the U.S. Department of Education and the FCC launched the E-rate program, which helps make telecommunications and information services more affordable for schools, campuses, districts and libraries.

“Eligible schools and libraries may receive discounts on telecommunications, telecommunications services and internet access, as well as internal connections, managed internal broadband services and basic maintenance of internal connections,” explains the FCC website. “Discounts range from 20 to 90 percent, with higher discounts for higher poverty and rural schools and libraries. Recipients must pay some portion of the service costs.”

The E-rate program is operated by Universal Service Administration Company (USAC), which has a core focus of providing underfunded verticals the access to affordable technology and security services. This includes schools, libraries, rural healthcare organizations and more.

USAC provides a yearly Eligible Services List (ESL), which outlines which types of products and services can be procured via E-rate program discounts.

SonicWall and E-rate

Through its global channel of more than 21,000 technology partners, SonicWall is actively involved in helping K12 education organizations cost-effectively obtain and deploy network security solutions. SonicWall provides a broad array of E-rate-eligible products and services, including firewalls and turnkey Security-as-a-Service solutions.

SonicWall integrated solutions meet the needs of school districts at the highest efficacy and at price points that fit within K12 budget constraints. SonicWall helps reduce the total cost of ownership (TCO) for these under-funded organizations.

With the most comprehensive channel program in the industry, combined with additional E-rate discounts, SonicWall and our partners are best positioned to meet the needs of K12 customers and help them take full advantage of the funding E-rate provides for securing their networks.

If you are an eligible K12 organization, please contact your preferred SonicWall reseller for information on E-rate benefits and discounts, or visit the SonicWall E-rate page for information, tools and guidance.

4 Ways the WhatsApp Exploit Could Use Employees to Infiltrate Your Network

/1 Comment/in , /by

The recent WhatsApp breach was very sophisticated and clever in the manner it was delivered. And that should be expected considering who was reported as being behind the zero-day attack against the popular messaging application.

But the attack against the WhatsApp app is not just a concern for its millions of global customers. There’s a very real and imminent threat to businesses and enterprises, too.

For example, let’s assume one of your employees has WhatsApp installed on their device and it is subsequently compromised via the latest WhatsApp exploit. In many situations, this employee will, at some point, connect their device to the corporate network.

This legitimate access could be via VPN, cloud applications (e.g., Office 365, Dropbox, etc.), corporate Wi-Fi or, my personal “favorite,” plugging the device into the USB port of a corporate laptop so the phone can charge. Understanding how and where users connect to the corporate network is critical.

In most cases, organizations can’t prevent personal BYOD phones from being compromised — particularly when outside the network perimeter. They can, however, protect the network from exploits delivered via the compromised phone. Here are the four most common ways the WhatsApp vulnerability could be leveraged to infiltrate a corporate network and, more importantly, how SonicWall can prevent it:

  1. Via VPN. If an employee connects to corporate over VPN, SonicWall, for example, would be the endpoint where they establish the VPN Threat prevention (e.g., firewalls, Capture ATP) and access control (e.g., Secure Mobile Access) would prevent the WhatsApp breach from spreading any further than the compromised phone.
  2. Via Wi-Fi. In this scenario, next-generation firewalls and secure wireless access points should be in place to inspect all internal traffic and prevent the exploit from going further than the phone.
  3. Via compromised credentials. Because the WhatsApp exploit enabled attackers to steal credentials to cloud services and apps, organizations with Cloud Access Security Broker (CASB) solutions, like SonicWall Cloud App Security, would mitigate account takeovers (ATO), unauthorized access and any related data leakage.
  4. Via USB port. Users often forget that a powered USB port on their laptop is an entry point for attackers — even when doing something as innocent as charging a phone. A sound endpoint protection solution (see diagram), such as Capture Client, would monitor the connection to the laptop and inspect any malicious activity attempting to leverage the USB port to deliver malware payloads.

Cyber Security News & Trends

/0 Comments/in /by

This week, the Zombieland vulnerability leads to a patching frenzy, a global cybercrime gang is shutdown, and a GDPR update.

SonicWall Spotlight

Intel MDS ‘Zombieload’ Vulnerability Software Patch List for MSSPs – MSSPAlert

  • “Zombieload” is a recently discovered vulnerability open to side-channel attacks that affects all Intel processors manufactured since 2011. MSSPAlert quote SonicWall CEO Bill Conner on how it could be used to “pick locks” in highly secure data centers. SonicWall RTDMI technology can discover and block side channel attacks in real-time.

Creating a Culture of Resilience – New Statesman (UK)

  • The New Statesman uses the 2019 SonicWall Cyber Threat Report to review the threat landscape and, noting how cybersecurity is often “bolted onto products as an afterthought,” explains how and why a culture of cyber resilience will have to be built.

Cyber Security News

Russian Government Sites Leak Passport and Personal Data for 2.25 Million Users – ZDNet

  • An investigation into Russian government websites and user portals has found that over 2.25 million Russian citizens had their personal information, including insurance and passport details, left easily accessible online.

GDPR: Europe Counts 65,000 Data Breach Notifications so Far – BankInfoSecurity

  • European privacy authorities have received nearly 65,000 data breach notifications since the EU’s new privacy law went into full effect, with over $63 million in fines issued so far.

Rattled by Cyberattacks, Hospitals Push Device Makers to Improve Security – Wall Street Journal

  • Nervous U.S. hospitals are pressing medical-device makers to improve the cyberdefenses of internet-connected infusion pumps, biopsy imaging tables and other health-care products after being rattled by a rise in cyberattack reports in other hospitals.

Bluetooth Harvester Signals Hacking Group’s Growing Interest in Mobile – Ars Technica

  • ScarCruft, a Korean-speaking advanced persistent threat group, has launched a malware that steals Bluetooth-device information. It is likely that the malware is targeting intelligence and diplomatic agencies for political purposes.

Microsoft Warns Wormable Windows Bug Could Lead to Another WannaCry – Ars Technica

  • Microsoft is warning that the internet could see another exploit of the magnitude of WannaCry unless a high-severity vulnerability is patched. Such is the level of fear that patches for the no-longer supported Windows 2003 and XP have been issued. The vulnerability has not yet been exploited but, due to its low complexity, once the details are known an attack will likely be developed and launched very quickly.

Global Hackers Are Thwarted by FBI, Europe in $100 Million Heist – Bloomberg

  • U.S. and European law enforcement officials have dismantled a “highly specialized and international criminal network” in an operation that has been ongoing since 2016. The members of the group pooled their technical skills together online to craft and circulate malware that attempted to steal around $100 million from thousands of businesses.

Microsoft Office 365: Change These Settings or Risk Getting Hacked, Warns US Govt – ZDNet

  • The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has posted its advice for organizations using Microsoft Office 365. Its major request is that administrators at organizations turn on the many security features, like multi-factor authentication, that are not automatically enabled by default.

In Case You Missed It

Non-Standard Ports Are Under Cyberattack

/0 Comments/in /by

If you like watching superhero movies, at some point you’ll hear characters talk about protecting their identities through anonymity. With the exception of Iron Man, hiding their true identities provides superheroes with a form of protection. Network security is similar in this respect.

‘Security through obscurity’ is a phrase that’s received both praise and criticism. If you drive your car on side streets instead of the freeway to avoid potential accidents, does that make you safer? Can you get to where you need to go as efficiently? It’s possible, but it doesn’t mean you can evade bad things forever.

Difference between standard and non-standard ports

Firewall ports are assigned by the Internet Assigned Numbers Authority (IANA) to serve specific purposes or services.

While there are over 40,000 registered ports, only a handful are commonly used. They are the ‘standard’ ports. For example, HTTP (web pages) uses port 80, HTTPS (websites that use encryption) uses port 443 and SMTP (email) uses port 25.

Firewalls configured to listen on these ports are available to receive traffic. Cybercriminals know this too, so most of their attacks target the commonly used ports. Of course, companies typically fortify these ports against threats.

In response to the barrage of attacks aimed at standard ports, some organizations have turned to using ‘non-standard’ ports for their services. A non-standard port is one that is used for a purpose other than its default assignment. Using port 8080 instead of port 80 for web traffic is one example.

This is the ‘security through obscurity’ strategy. While it may keep cybercriminals confused for a while, it’s not a long-term security solution. Also, it can make connecting to your web server more difficult for users because their browser is pre-configured to use port 80.

Attacks on non-standard ports

Data in the 2019 SonicWall Cyber Threat Report indicates that the number of attacks directed at non-standard ports has grown. In 2017, SonicWall found that over 17.7% of malware attacks came over non-standard ports.

In comparison, that number was 19.2% in 2018, an increase of 8.7 percent. December 2018 alone hit an even higher number at 23%.

GET THE FULL INFOGRAPHIC

How do I protect non-standard ports?

The best defense against cyberattacks targeting services across both standard and non-standard ports is to have a layered security strategy.

Using ‘security through obscurity’ is just one layer. Relying on it too heavily, however, won’t provide the level of security you need. It may help against port scans, but it won’t stop cyberattacks that are more focused.

You’ll also want to take some other actions, such as changing passwords frequently, using two-factor authentication, and applying patches and updates. And, you’ll want to use a firewall that can analyze specific artifacts instead of all traffic (i.e., proxy-based approach).

Cyber Security News & Trends

/0 Comments/in /by

This week, SonicWall CEO Bill Conner is interviewed by SC Magazine, a Zero-Day vulnerability travelled around the world without ever being disclosed publicly, and Facebook are working to prevent election meddling in Europe.

SonicWall Spotlight

In Focus: SonicWall CEO Bill Conner – SC Magazine

  • SonicWall CEO Bill Conner joins Illena Armstrong of SC Magazine in an exclusive video interview. They discuss what companies are missing in the global cyber arms race, the non-traditional points of entry where the threats are emerging and what steps an organization can take to secure its infrastructure.

Cyber Security News

The Strange Journey of an NSA Zero-Day into Multiple Enemies’ Hands – Wired

  • Wired tell the story of an NSA-discovered zero-day vulnerability that made its way around the globe over several years; first intercepted by China, then stolen by hackers before being picked up by North Korea and Russia, all without being publicly disclosed.

Facebook Opens a Command Post to Thwart Election Meddling in Europe – New York Times

  • After the harsh criticism it faced following the 2016 US election Facebook has opened a “command post” in Ireland charged with preventing any meddling in the upcoming European election.

Hackers Steal Over $40 Million Worth of Bitcoin From One of the World’s Largest Cryptocurrency Exchanges – CNBC

  • Over $40 million worth of bitcoin has been stolen from Binance, one of the world’s largest cryptocurrency exchanges, in a “large scale security breach.” The well-organized attack managed to bypass the security checks and exited over 7,000 bitcoin, about 2% of total holdings.

Cybersecurity Jobs Abound. No Experience Required. – Wall Street Journal

  • Large tech companies are scrambling to hire hundreds of thousands of corporate hackers to defend their networks and data, pursuing workers without traditional four-year degrees or formal experience.

How to Close the Critical Cybersecurity Talent Gap – Dark Reading

  • “If we don’t change our ways, the gap will keep getting worse.” Dark Reading commentator Thomas Weithman calls for “outside-the-box thinking” to bridge the cybersecurity talent gap, suggesting introducing cybersecurity curriculum in K-12 courses and setting up programs to allow people in a similar industry to retrain.

Russian Cyberspies Are Using One Hell of a Clever Microsoft Exchange Backdoor – ZDNet

  • An email backdoor named LightNeuron that integrates directly with Microsoft Exchange is being called “one of the most complex backdoors ever spotted.” Despite being in use since 2014 it has avoided detection until very recently.

Amazon Hit by Extensive Fraud With Hackers Siphoning Merchant Funds – Bloomberg

  • A court filing has revealed that Amazon believes it was the victim of a “serious” online attack between May and October 2018. Hackers accessed around 100 seller accounts and funneled cash from loans or sales into their own bank accounts.

TRON Critical Security Flaw Could Break the Entire Blockchain – ZDNet

  • A critical vulnerability with a “high” severity rate has been found in the TRON network’s TRX cryptocurrency. If exploited the vulnerability could render the entire network unusable.

Without Strong Cybersecurity, Backdoors Will Remain Open – Silicon Republic

  • Former Europol Executive Director John O’Mahony is warning that not enough companies and individuals have “even adequate cybersecurity” in place to prevent bad actors exploiting backdoors in their networks.

In Case You Missed It