Cybersecurity expert and proven entrepreneur to help protective DNS leader drive vision and scale through hypergrowth.

**WASHINGTON--(****BUSINESS WIRE****) --** DNSFilter today announced that Jon Oberheide, former Duo Security co-founder and CTO, has joined the company's board of directors. A strategic appointment to the board, Oberheide will support the company as it continues its mission to make the internet more secure via DNS, with a specific focus on long-term strategy and supporting scale through hypergrowth.

"DNSFilter has an incredible founding team, great chemistry, and proven technology—all things I look for when joining a board," said Oberheide. "And unlike other buzzy, flash-in-the-pan security acronyms, DNSFilter provides fundamental security controls that are easy to deploy and accessible to organizations of all sizes, from small businesses to larger Fortune 500 corporations. I'm excited to join the team and for the opportunity to help scale the company to new heights."

DNSFilter delivers Protective DNS and content filtering solutions powered by Machine Learning. The offering protects organizations from phishing, malware, and other advanced internet-based threats.

The appointment comes at a time of rapid growth and recognition for DNSFilter. The company has grown roughly 250% since January 2021, and now supports more than 26 million monthly users and over 2 trillion monthly DNS queries.

Last year, the company was highlighted as one of the most innovative and compelling technologies to address cybersecurity threats and vulnerabilities through the SINET16 Innovator award. DNSFilter was also named a 2022 Black Unicorn Award winner, which honors cybersecurity companies predicted to be worth $1 billion in market value in three to five years. In 2022, the company also acquired firewall and VPN platform provider Guardian to more effectively protect users information and secure organizations against web-based threats.

"As someone who has scaled a cyber company, I’m happy to have Jon in our corner to give us guidance as we continue to grow and build our offering," said Ken Carnesi, CEO, DNSFilter. "He's a proven entrepreneur that puts in time with the companies he advises, shares lessons learned, and offers prescriptive advice on getting to the next level. We're honored to have him on our board sharing strategic advice for our next stage of growth."

Oberheide is a board member, advisor, and investor focused on cybersecurity and enterprise SaaS companies. In 2009, he co-founded Duo Security, serving as the CTO. Cisco acquired the company for $2.35 billion in 2018. Over its 12-year journey, Duo Security scaled from zero to 30,000 customers, $500 million ARR and over one thousand full-time employees. Prior, Oberheide was a security researcher. He completed his bachelor's, master's and doctorate in cybersecurity from the University of Michigan.

To learn more about DNSFilter, visit https://www.dnsfilter.com/.

**About DNSFilter**

DNSFilter is redefining how organizations secure their largest threat vector: the Internet itself. DNSFilter is making the internet safer and workplaces more productive. In 2022 the threat protection leader blocked 9.1 billion threats, more than any other threat detection software globally. With 70% of attacks involving the Domain Name System (DNS) layer, DNSFilter provides Protective DNS powered by machine learning that uniquely identifies 61% more threats than competitors on an average of seven days earlier, including zero-day attacks.

Over 26 million monthly users trust DNSFilter to protect them from phishing, malware, and advanced cyber threats. DNSFilter’s brands include Webshrinker, it’s next generation web categorization software and Guardian, a consumer app focused on privacy protection. DNSFilter.com

Former Duo Security Co-Founder Jon Oberheide Joins DNSFilter Board of Directors

Full-cycle verification platform enhances its facial biometrics verification with innovative deepfake detection technology; shares new 2023 identity fraud trends.

**MIAMI****,** **June 22, 2023** **/PRNewswire/ --** Sumsub, the global verification platform providing customizable KYC, KYB, transaction monitoring, and AML solutions for the whole customer journey, today announces the launch of its enhanced deepfakes detection technology into Sumsub's liveness and deepfake detection solution.

According to Sumsub reports, **the number of deepfakes detected in Q1 2023 was 10% greater than all of 2022 combined**. Responding to this growing threat of identity fraud, the company made major updates to its in-house liveness solution – a facial biometrics tool and integral part of KYC flow for businesses. Now, the deepfake frauddetector integrates into Sumsub's liveness solution and is enhanced to align with the latest AI technology, making sure no fraudster passes the check.

_"We noticed the emerging deepfake trend long ago and started building solutions to fight this rapidly evolving type of_ fraud_," said_ **Vyacheslav Zholudev, co-founder and CTO of Sumsub**_. "As an anti-_fraud _provider, Sumsub strives to stay ahead of the game. We continuously develop innovative_ fraud _detection solutions to combat the advancing malicious technologies and prevent the potentially high damage to digital platforms, people, and communities. Our new advanced deepfake detector reinforces our core KYC product and commitment to further enhancing the AI-driven technologies built into our anti-_fraud_solution."_

Sumsub's proprietary liveness technology easily detects spoofing attempts while authenticating real users in seconds. The system ensures users are physically present by creating a 3D FaceMap which is continuously referenced for authorizing all future actions (transactions, logins, etc).

All businesses operating online are vulnerable to deepfakes, with fintech, payments, crypto, and gambling platforms at high risk. Sumsub's internal identity fraud statistics show deepfakes continuously replace 'simple' kinds of identity fraud, such as document printouts. The data also revealed:

*   In 2022, the leader in deepfake fraud was Spain with **49.7% of all global cases**, followed by Great Britain (9.3%), and the U.S. (4.2%).
*   In Q1 2023, the most deepfakes came from Great Britain and Spain with 11.8% and 11.2% of **global deepfake** fraud, respectively.

*   Followed by Germany (6.7%), and the Netherlands (4.7%).
*   The U.S. held 5th place, representing 4.3% of global deepfake fraud cases.

*   From 2022 to Q1 2023, **the proportion of deepfakes among all** fraud **types** increased in Canada by 4,500%, the U.S. by 1,200%, Germany by 407%, and the UK by 392%\*.
*   Last quarter, a high **proportion of deepfakes among all** fraud **types** was also noticed in Australia (5.3%), Argentina(5.1%), and China (4.9%).

_"As we face the ever-evolving trends in generative AI and AI-driven_ fraud_, we anticipate AI technologies to develop quickly, and more sophisticated_ fraud _to emerge, affecting even more industries. The use of synthetic_ fraud _is rising at an alarming rate and leading to the rapid spread of misinformation, as recently seen with the fake images of the explosion at the Pentagon, resulting in significant media hype. As AI advances, more tools become available to fraudsters, and Sumsub is here to fight all kinds of synthetic_ fraud_. Our team is working on a solution to detect a large scope of AI-generated_ fraud _beyond deepfakes,_" says **Pavel Goldman-Kalaydin, Head of AI/ML at Sumsub**.

To learn more about Sumsub's deepfake detection technology please visit: https://sumsub.com/blog/liveness-and-deepfake-detection/

**About** **Sumsub**

Sumsub is a full-cycle verification platform that secures the whole user journey. With Sumsub's customizable KYC, KYB, transaction monitoring and fraud prevention solutions, you can orchestrate your verification process, welcome more customers worldwide, meet compliance requirements, reduce costs and protect your business.

Sumsub has over 2,000 clients across the fintech, crypto, transportation, trading, e-commerce and gaming industries including Binance, Mercuryo, Bybit, Huobi, Unlimint, DiDi, Poppy, and TransferGo.

Sumsub Launches Advanced Deepfakes Detector

Award-winning XEM platform introduces advanced SBOM capabilities, expanded ARM support, and additional Risk & Compliance improvements.

Tanium, the industry’s only provider of converged endpoint management (XEM), today released major enhancements to the Tanium Software Bill of Materials (SBOM) that now include Common Vulnerability and Exposures (CVE) information. Tanium's SBOM identifies software components on endpoints, including open-source software embedded in libraries within native and third-party software, enabling organizations to prioritize and remediate software supply chain risks with unmatched speed and scale. In addition to several new Risk & Compliance features, Tanium also announced the expansion of support for ARM-Based endpoints to help IT teams minimize blind spots and drastically reduce the need for separate endpoint tools. 

Software supply chain attacks continue to spike due in part to the increasing reliance of organizations on numerous third-party suppliers and service providers. To keep a firm pulse on the threats facing today's most vulnerable and highly targeted organizations, Tanium has added SBOM to its Vulnerability Management solution to find, prioritize, and remediate emerging and zero-day vulnerabilities in the software components of applications, including open-source software embedded within application libraries, across all endpoints. 

"Over ninety-two percent of applications contain open-source libraries that may contain hidden vulnerabilities like Log4j, OpenSSL, or Struts, which are exploited by attackers," said Nic Surpatanu, chief product officer, Tanium. "Federal agencies, cyber insurance providers, and other organizations are increasingly requiring an SBOM for all utilized software. Tanium SBOM is the only solution on the market that allows organizations to identify and remediate software supply chain vulnerabilities in production. This empowers DevOps and SecOps to identify and mitigate risks across development, staging, and production environments."

In addition to confronting threats introduced by reliance on open-source software, today’s organizations also grapple with continually evolving processor architecture. In fact, the use of ARM-based servers grew sevenfold between 2019 and 2022 and ARM-based computers are expected to make up thirty percent of all personal computers by 2026. In 2022, Tanium rolled out support for endpoints running ARM-based processors from Apple and Amazon. With an eye towards futureproofing, Tanium has expanded its support to additional ARM-based endpoints running Oracle Linux, RedHat, and Windows 11. 

"We expect the use of ARM-based processors to continue to grow for the foreseeable future due to its better performance and lower energy usage compared to x86-based processors," said Vivek Bhandari, VP, product marketing at Tanium. "With these enhancements, Tanium continues to empower customers to find and bring missing endpoints under management and move away from point solutions towards a single, unified platform."

Today's announcement also coincides with a host of new Risk & Compliance enhancements that will amplify the efficiency and efficacy of vulnerability and risk management programs, while also reducing the need for disparate point solutions. These include:  

*   ESXi Support: New compliance and vulnerability assessments of ESX and ESXi hypervisors via vCenter APIs empower security teams to view and perform risk assessments on all virtual servers efficiently 
*   CISA Known Exploits and Vulnerabilities (KEV): Tanium’s vulnerability assessments now include CISA KEV information on the most dangerous and active exploits, eliminating the need for manual analysis, instantly prioritizing high-risk CVEs for remediation with its integrated remediation options.  
*   Exception Management: Tanium’s Risk and Compliance solution offers the ability to create exceptions for compliance and vulnerability findings with valid reason or expiration date, enabling organizations to focus on areas that need immediate attention.  
*   Benchmark Enhancements: A new page within Tanium Benchmark allows customers to quickly visualize the health of their key operations and security metrics.  

As organizations continue to embrace digital transformation, comprehensive endpoint visibility, control, and remediation at scale and in real-time are crucial to mitigate risks from cyber threats of today – and tomorrow. To learn more about these enhancements, join the Tanium Innovation and Technology Update Wednesday, June 28, 2023, 11:00 – 11:30 am PT. Register today.

Tanium Platform Advances Threat Identification Capabilities and Enhances Endpoint Reach

Small and midsized companies work to jettison some security tools to simplify operations and reduce cost, even as any economic downturn continues to remain at bay.

Enterprises are not the only organizations looking to consolidate their security tools and vendors in the face of a potential economic slowdown — small and midsized businesses are looking to reduce their costs and simplify their security as well.

The vast majority (86%) of SMB customers using managed security service providers (MSSPs), for example, are aiming to reduce their current portfolio of security tools, according to a survey published this week by OpenText. The majority of those businesses are driven primarily by an effort to reduce costs (28%) or to simplify complex security environments (26%), the survey found.

Consolidation does not just benefit the company, but can help the provider of security services as well, says Geoff Bibby, senior vice president at OpenText Cybersecurity, a cybersecurity conglomerate.

"Consolidation is two-fold," he says. "Businesses are going to service providers because they don't have the staffing or financial resources to purchase and manage multiple tools, and from the service-provider perspective, fewer tools — and fewer vendors — means simplified billing and greater ease of doing business."

Consolidation of vendors has become a major trend following the rush to adapt to the pandemic-era business landscape by moving more services to the cloud. By mid-2022 — when 83% of companies predicted a downturn in the coming year — three-quarters of companies planned to reduce the number of security vendors they used, up from 29% in 2020. The top strategies explored by companies were reducing non-essential spending (43%), re-evaluating vendors (30%), and decommissioning infrastructure (29%), according to Spiceworks Ziff Davis's "2023 State of IT" report.

Efforts to cut costs remain strong, despite a reprieve in the dark economic forecast. A majority of economists (59%) polled in May still predict that the US would enter a recession in the next 12 months, but poor-performance predictions have remained unfulfilled as employment numbers and the stock market continue to resist a downturn.

"This is the most anticipated recession that won't ever seem to arrive, and all of the data indicates that it might never arrive because none of the factors for recession seem to be there," says Jeff Pollard, vice president and principal analyst at market intelligence firm Forrester Research.

**Optimizing Vendors and Security Services**

Yet while economic risks certainly spurred concerns over IT and IT-security budgets, initiatives to both simplify and reduce the cost of security operations inside companies has a life of its own, Pollard says.

"If you go back ... to the heady days of growth just nine months ago or so, what I was consistently hearing from security leaders was: too many tools, too many products," he says. "And it wasn't based on an economic argument. It was based on simplification of technology and portfolio rationalization — they felt like they had too many security controls and too many security products."

Business intelligence firm Gartner sees a similar picture. Most midsized enterprises (MSEs) — firms with $50 million to $1 billion in revenue and up to 2,500 employees — are looking to reduce the number of vendors, but rather than focus on consolidation, the companies are looking to optimize their security operations, says Patrick Long, an analyst with Gartner.

Such optimization generally focuses on two approaches. Outsourcing to service providers allows companies to overcome a shortage of security workers, because there are currently 21 IT employees for every security-focused employee, he says. Another form of consolidating is through the products, adopting all-in-one suites from a single vendor, which helps reduce licensing costs and can result in more holistic security capabilities, he says.

Currently, two-thirds of MSEs (68%) are pursuing security-vendor reduction strategies, while the remaining third have delayed consolidation but will likely simplify their security within the next three years, Long says.

"They are optimizing their architecture and integration strategies, vendor management, workforce management, and their costs," he says, adding that "current economic conditions influence security vendor consolidation but is not the primary driver for consolidation."

**Integration Still a High Hurdle**

Reducing the number of security products is not easy. Licensing can often become a blocker, especially if a company signed long contract periods, and products from the same vendors do not always have seamless integration, says Forrester's Pollard. In addition, any adoption of an integrated product will require a security team to learn the new system, so efficiency gains can take a while to materialize, he says.

"When you buy a bundle and consolidate, in theory, the product will integrate well, but what I really hear from a lot of security leaders is that the cost savings, frankly, doesn't often materialize," Pollard says. "Because what you wind up having to do is learn a new product, a new solution, and people have to get trained on it, so you have to modify your processes."

Yet companies are making headway. Overall, companies that pursue consolidation have seen IT security costs decrease by more than 2%, with data security costs reduced by a quarter and identity management shrink by more than a third, says Ben Pippenger, chief strategy officer at Zylo, a SaaS management platform.

"There tends to be some redundancy within security categories," he says, pointing out the cloud identity and access management are among the top-15 most redundant software functions, with nearly five applications handling that capability in the average company.

"While security is an important business function, it's one that could still likely benefit from consolidation," he says.

Even With No Recession, Smaller Firms Aim to Consolidate Security Tools

The announcement was posted on Twitter via the Rewards for Justice Twitter account, alongside encrypted messaging system options for anyone to get into contact should they have viable information.

The Cybersecurity and Infrastructure Security Agency (CISA) has teamed up with the FBI to offer a $10 million reward to anyone that can offer intelligence on the Cl0p ransomware gang.

The group, a Russian gang that extorts its victims with threats of publishing private data, has racked up hundreds of victims, including agencies within the United States government itself, most recently exploiting various MOVEit vulnerabilities such as CVE-2023-35708, CVE-2023-34362, and CVE-2023-35036.

In a tweet posted by the US Department of State's "Rewards for Justice" program, the feds announced the award, stating "Do you have info linking Cl0p ransomware gang or any other malicious cyber actors targeting US critical infrastructure to a foreign government? Send us a tip. You could be eligible for a reward." 

In addition, the image posted in the tweet reads, "Reward up to $10 million. For information on the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious cyber activities against US critical infrastructure in violation of the Computer Fraud and Abuse Act. Send us your information on Signal, Telegram, WhatsApp, or via our Tor-based tip line below."

Due to the nature of the cybercrime gang and the possibility of retaliation should anyone come forward with information regarding the group, all messaging systems that the US State Department suggests in the tweet are encrypted. 

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

CISA, FBI Offer $10M for Cl0p Ransomware Gang Information

The "nOAuth" attack allows cross-platform spoofing and full account takeovers, and enterprises need to remediate the issue immediately, researchers warn.

Organizations that have implemented the "Log in with Microsoft" feature in their Microsoft Azure Active Directory environments could potentially be vulnerable to an authentication bypass that opens the door to online and cloud account takeovers.

According to researchers at Descope, who dubbed the attack "nOAuth," the issue is an authentication implementation flaw that affects multitenant OAuth applications in Azure AD, Microsoft's cloud-based identity and access management service. A successful attack gives a bad actor full run of a victim's accounts, with the ability to establish persistence, exfiltrate data, explore if lateral movement is possible, and so on.

"OAuth and OpenID Connect are open, popular standards which millions of Web properties already use," says Omer Cohen, CISO at Descope. "If 'Log in with Microsoft' is improperly implemented, several of these apps could be vulnerable to account takeover. Small businesses with fewer developer resources could especially be impacted."

**Inside the nOAuth Cyberattack Threat**

By way of background, OAuth is an open, token-based authorization framework that allows users to log into applications automatically, based on previous authentication to another trusted app. This is familiar to most people from the "Log in with Facebook" or "Log in with Google" options available on many e-commerce websites.

In the Azure AD environment, OAuth is used to help manage user access to external resources, such as Microsoft 365, the Azure portal, and thousands of other SaaS applications using OAuth apps.

"Azure Active Directory also manages internal resources like apps on your corporate intranet and any cloud apps developed by your own organization by providing authentications via OAuth, OIDC, and other standard protocols," according to the Descope analysis. In other words, it holds the keys to a lot of important corporate data.

The weakness allows bad actors to perform cross-platform spoofing simply by using an unwitting victim's email address to impersonate them, according to Descope's analysis on the issue, released this week.

"In usual OAuth and OpenID Connect implementations, the user’s email address is used as the unique identifier by applications," explained researchers at Descope. "However, in Microsoft Azure AD, the 'email' claim returned is mutable and unverified, so it cannot be trusted."

That means that anyone with malicious intent and a decent amount of platform knowledge can simply set up an Azure AD account, and arbitrarily change the email attribute under "Contact Information" in that account to control the email authentication claim.

"\[This\] allows the attacker to use 'Log in with Microsoft' with the email address of any victim they want to impersonate," the researchers explained. "They can take over victims' accounts on any app that uses 'email' claim as the unique identifier for Microsoft OAuth and does not validate that email address, completely bypassing authentication."

The attack flow is unnervingly simple:

1.  The attackers accesses their Azure AD account as an administrator.
2.  The attackers change the "email" attribute of their account used for authentication to the victim’s email address.
3.  Since Microsoft does not require the email change to be validated on Azure AD, the system merges the two accounts and gives the attackers access to the victim's environment.

**A Far-Ranging Authentication Weakness**

To better understand the scope of the problem, the Descope researchers created a nOAuth proof-of-concept (PoC) exploit and tested it "with a white-hat attack on hundreds of websites and applications to check if any of them were vulnerable," they said. "We found that quite a few of them were."

Amid the sitting ducks were a design app with millions of monthly users, a publicly traded customer experience company, a leading multicloud consulting provider, as well as several SMBs and early-stage startups.

"We also informed two authentication platform providers that were merging user accounts when 'Log in with Microsoft' was used on an existing user account," according to the report. "In this instance, merging the attacker account with a legitimate user account would hand full control over the user account to the attacker. As a result, all of their customers using 'Log in with Microsoft' would have been vulnerable."

These findings, according to the researchers, "are a drop in the ocean of the Internet," and there are likely many, many thousands of other users that could be affected.

Microsoft has always issued general guidance to users to not to use an email address as a unique identifier for authentication, but after Descope informed Microsoft of the breadth of the issue, the computing giant has revamped its Azure AD OAuth implementation guidance to include two new claims to use, and dedicated sections on claim verification.

"If your app uses 'Log in with Microsoft' and you handle authentication in-house, it’s critical that you check if you use the email claim returned by Azure AD as the unique identifier," Cohen notes. "If so, remediation steps should be taken to ensure the claim used as the unique identifier for the user is the 'sub' (Subject) claim to avoid potential exploitation."

**Incorrect OAuth Implementations Plague Businesses**

Incorrect implementations of OAuth have been coming to light at big businesses lately, showcasing a need for organizations to lock down this potentially damaging attack vector.

In March, for instance, flaws in the authorization system of the Booking.com website came to light that could have allowed attackers to take over user accounts and gain full visibility into their personal or payment-card data, as well as log in to accounts on the website's sister platform, Kayak.com.

And in May, a bug tracked as CVE-2023-28131 was found in the OAuth implementation of Expo, an open source framework for developing native mobile apps for iOS, Android, and other Web platforms using a single codebase. The flaw threatened the accounts of any users that used various and social media accounts to log in to an online service that uses the framework.

Cohen underscores that the OAuth standard and others like it are trustworthy and strong authentication approaches but that businesses need to make sure to work with cybersecurity and authentication experts when building them in.

"These standards are extremely complicated to work with," he says. "Authentication isn’t something you can just add on and check a box. Implementing these standards correctly is critical to the security of the application."

He adds, "If businesses chose to implement these standards in-house, then they must have regular pen testing and review of the implementation, or they can use an authentication platform that is built by security experts."

He stresses that the importance of this can't be understated, given that cybercriminals are actively looking for these types of weaknesses.

"These are very typical attack vectors exploited," Cohen notes. "Attackers use these to cause widespread harm."

He adds, "With the increase of organizations adopting cloud technologies and SaaS applications, identity is the new firewall. If user authentication is not well-designed, it doesn’t matter how secure the application is itself as you will leave the front door open to cyberattacks."

Azure AD 'Log in With Microsoft' Authentication Bypass Affects Thousands

Dark data may be your most elusive asset, but it can also be your most costly if you don't protect it.

What is something that comprises more than half of companies' data repositories, but most aren't even aware they have? It's dark data, information companies unknowingly gather that is not integral to day-to-day business interactions and therefore often sits in the background. While that data is seemingly unnecessary to most companies, it's invaluable to cybercriminals.

**What Is Dark Data?**

At a time when many companies are focused on collecting, analyzing, and acting on data they receive from customers, it's not surprising that the amount of latent (or dark) data is accumulating far beyond what they planned to store, protect, and potentially purge. For example, when you consider that Netflix spent nearly $10 million a month in 2019 to store its data in the cloud, you can see how much dark data storage might be costing a company.

Gartner equates dark data to dark matter in physics. Dark data extends beyond any published sensitive data elements. It can include personal information from customers or past employees, but might also include nontraditional data such as systems backups, log files, configuration files, sensitive internal procedures, email backups or "spools," scanned document repositories, and human resources information. These are all dark data sources that attackers may want to sell or use.

And while there are some regulatory bodies that aim to protect information that might be considered dark data, such as the US Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR) in Europe, many companies continue to store this data long after they are required to do so.

**How to Protect Dark Data**

Every company needs to prioritize its customer and employee data, so how can you protect something you don't even know you have? Further, how do you prioritize this among the other cyber vulnerabilities in your organization? Here are five steps you can take:

1.  **Increase visibility of data:** Start by building a data inventory to map the information you know about. Next, perform threat modeling to identify security needs, locate threats and vulnerabilities, assess severity, and prioritize solutions. This will help you understand what data you have and explore how it may be at risk. This process allows you to understand and quantify threats so that you can better prioritize remediation of identified security risks.
    
2.  **Think like the adversary:** Leverage offensive testing (such as using ethical hackers and professional security testers) to try to breach defenses like an attacker would. This will help you find and address vulnerabilities.
    
3.  **Counter the adversary:** Once you have a complete view of your data footprint and threat model, apply or reinforce security controls in target areas (for example, endpoint detection and response, logging and monitoring, content interception and inspection for Web traffic, and patching). Consider steps 1–3 as a continuous improvement cycle of data discovery.
    
4.  **Shrink the battlespace:** Delete sensitive personal data that is no longer necessary. Minimize data collected and design code-level controls to support data retention periods. This limits the proliferation of sensitive data throughout your environment.
    
5.  **Avoid technology infatuation:** Data loss prevention (DLP) tools help avoid accidents, but they should not be considered a catch-all for data security. Most DLP technologies are weak and can lull organizations into a false sense of security. Like all things cyber and privacy, data protection is about getting people, process, and technology working in balance and harmony. Reinforce carefully chosen tools with crisp processes (detailed and well-documented playbooks and blueprints), workflows, and runbooks, and make sure they're managed and led by thoughtful people with real expertise.
    

**Latent Data May Be Risky Data**

There are well-known cases where large organizations found themselves the victims of dark data breaches. Data that was latent and secondary to their business models was suddenly extremely costly in terms of brand trust and legal fees.

Just because you don't see it or use it doesn't mean your data is not dangerous. Dark data should be a consideration for every organization. It should be accounted for, protected, and regularly purged (as applicable) to keep cybercriminals at bay. Dark data may be your most elusive asset, but it can also be your most costly if you don't protect it.

5 Steps for Minimizing Dark Data Risk

A ready-made, low-complexity path to pwning the popular enterprise VPN clients for remote workers is now circulating in the wild.

A security researcher has dropped a proof-of-concept (POC) exploit for a just-patched, high-severity security vulnerability in Cisco's client software for remote workers looking to connect to VPNs.

The bug (CVE-2023-20178) is an arbitrary file delete vulnerability in the Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows, which could allow authenticated attackers to escalate privileges to SYSTEM level with no user interaction.

As Cisco explained in its patch advisory earlier this month: "A vulnerability in the client update process of could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established."

Security researcher Filip Dragović released an exploit that does just that via a public GitHub posting this week. It uses a process called "vpndownloader.exe," which is started in background when a user connects to a VPN using either the Cisco Secure or AnyConnect software.

"It will create directory in c:\\windows\\temp with default permissions," explained Dragović, who originally discovered the flaw and reported it to Cisco. "After creating this directory, vpndownloader.exe will check if that directory is empty, and if it's not, it will delete all files/directories in there. This behavior can be abused to perform arbitrary file delete as NT Authority\\SYSTEM account."

After that, cyberattackers can employ a known tactic to create a SYSTEM shell for abusing Windows Installer behavior and elevating privileges, he added.

Organizations should patch their clients immediately — while Cisco noted no known exploitation at the time of patching, that will likely quickly change with a PoC circulating in the wild. Successful exploitation is "noncomplex," according to the researcher, and the software has a history of being targeted by cyberattackers looking to take over data-rich VPN sessions.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Patch Now: Cisco AnyConnect Bug Exploit Released in the Wild

More connectivity means more potential ways into your enterprise, so securing every main attack surface is imperative.

Greater connectivity and enhanced digital operations can deliver a number of business benefits, but they also create a broader, more dynamic environment to defend. Fortunately, about 98% of cyberattacks can be mitigated with basic security hygiene, according to the "Microsoft Digital Defense Report 2022."

Still, cyberthreats are getting more sophisticated and becoming more coordinated, making it even more important for organizations to secure their six main attack surfaces. Here's a look at each, including the central risks and where to focus effort and resources — along with one takeaway that links them all. 

**Email Threats Abound**

Phishing attacks grew by 61% from 2021 to 2022, while 35% of ransomware incidents involve the use of email, costing businesses approximately $2.4 billion in 2021 alone, according to the FBI. 

Along with URL checking and disabling macros, it's crucial to provide regular education to employees about how to spot ever-more realistic phishing email. As the quality of social engineering improves, everyone needs regular reminders of their role in protecting the enterprise.

**A Broader Definition Of 'Identity'**

Securing identity across the organization is essential to protecting access to your systems and data. Threat actors are getting more creative in circumventing multifactor authentication (MFA), with techniques such as adversary-in-the-middle phishing attacks and token abuse. Widely available phishing kits have made it even easier — and affordable — for threat actors to steal credentials. 

Cloud access, third-party accounts, and workload identities must also be protected. Workload identities, in particular, are often overlooked during permissions audits. Security teams should consider all of the potential meanings of "identity," both human and automated. 

**Endpoints Provoke Concern**

Managing an ever-growing array of endpoints complicates security further. On average, according to Microsoft's report, 3,500 connected devices in an enterprise are unprotected by an endpoint detection and response agent. 

Unmanaged or unpatched devices can not only be infected, but they can easily become avenues to compromise an organization. For servers, in particular, the subsequent access to user credentials and the network can quickly lead to IP theft and ransomware attacks. Prioritizing improved endpoint visibility and security hygiene is critical for defending against these threats.

**IoT Devices Can Create Additional Vulnerabilities**

By 2025, IDC expects more than 41 billion Internet of Things (IoT) devices across enterprise and consumer environments working alongside operational technology (OT). 

With many routers and networks now hardened against attacks, IoT devices are appealing targets for threat actors. In a Ponemon Institute study, 35% of respondents said an IoT device was the point of compromise, and many business devices are running outdated software with well-known vulnerabilities.

Greater IoT security is fast becoming recommended or required of manufacturers in the US and abroad. Greater visibility into every connected device is an absolute must. 

**The Conundrum of Cloud**

Whether single, hybrid or multicloud, cloud resources can pose a security challenge. Many organizations struggle to gain end-to-end visibility across their cloud ecosystems, which can lead to security gaps. Microsoft's research found that 84% of organizations that suffered ransomware attacks did not integrate their multicloud assets with their security tooling — a critical oversight. Also, cloud apps can present risks due to both misconfigurations and hidden, code-based vulnerabilities that could be mitigated from the start through security by design and default.

Closing identity and misconfiguration gaps — combined with robust tools for attack response — go a long way toward securing the whole cloud environment, from the corporate network to cloud services.

**Exponential External Exposure**

Today's external attack surface reaches far beyond an organization's own assets. Multiple clouds, digital supply chains, and third-party ecosystems make it hard to see the full scope of this exposure. In fact, a 2020 Ponemon report showed that 53% of organizations had at least one data breach caused by a third party in the previous two years.

Finding weak links in defenses often means thinking like threat actors: Since attackers look for the easiest way in, what are the most likely entrance points? Understanding what can be exploited across your external attack surface is the key to defending it.

All of these attack surfaces have something in common: Protection takes both visibility and awareness. Visibility can be achieved through tools and strategies, but awareness of oncoming risks requires accurate, timely threat intelligence. Knowing how seemingly unrelated events and signals can point to an imminent threat — and understanding where and how that threat can take advantage of the six main attack surfaces — gives security teams a crucial advantage in an ever-evolving risk environment.

6 Attack Surfaces You Must Protect

Camaro Dragon (Mustang Panda) is spreading a malware variant of WispRider quickly across the globe even through air gaps, often unbeknownst to users.

Espionage malware that spreads by self-propagating through infected USB drives is back, surfacing recently in an incident at a European healthcare institution, researchers have found.

Researchers at Check Point Research discovered the backdoor, which they've dubbed WispRider. The campaign is the work of the Chinese-state-sponsored APT that Check Point tracks as "Camaro Dragon," but which is probably better known as Mustang Panda (aka Luminous Moth and Bronze President).

Check Point first discovered the malware when an employee who had participated in a conference held in Asia came home with an infected USB drive, researchers revealed in a blog post published June 22. Apparently, the employee — dubbed "Patient Zero" by the researchers — had shared his presentation with fellow attendees using his USB drive, and one of his colleagues there passed on the infection from his computer, they said.

"Consequently, upon returning to the healthcare institution in Europe, the employee inadvertently introduced the infected USB drive, which led to spread of the infection to the hospital's computer systems," Check Point researchers wrote in the report.

The incident shows how the APT, which previously primarily focused its cyber espionage activities on organizations in Southeast Asia, is now extending its reach globally, they said. Indeed, despite China's tacit support for Russia's war against Ukraine, Mustang Panda already was seen last year mounting a cyberespionage campaign against the Russian military.

The research also highlights the "alarming" role USB drives play in spreading malware quickly and often unbeknownst to users — even across air-gapped systems. "These malicious programs possess the ability to self-propagate through USB drives, making them potent carriers of infection, even beyond their intended targets," Check Point researchers wrote in the post.

**WispRider, an Evolving Malware Payload**

The main payload of the campaign discovered by the researchers is called WispRider, which is a backdoor outlined in a report late last year by Avast — in which the toolset was called "SSE." It's since been fortified with additional features, Check Point researchers said.

For one, it propagates through USB drives using a launcher called HopperTick, and also includes a bypass for SmadAV, an antivirus solution popular in Southeast Asia. The malware also performs DLL-side-loading using components of security software, such as G-DATA Total Security, and of two major gaming companies, Electronic Arts and Riot Games, the researchers said. Check Point notified the companies of the use of their components in the malware, they said.

WispRider and Hopper Tick align with other tools by wielded by Mustang Panda in terms of infrastructure and operational goals, allowing for their attribution to the Chinese APT, the researchers noted. Related malware also used by the threat actor include a Go-based backdoor called TinyNote, and a malicious router firmware implant named HorseShell.

The WispRider infection begins when a benign USB thumb drive is inserted into an infected computer, the researchers explained. The malware detects a new device inserted into the PC and manipulates its files, creating several hidden folders at the root of the thumb drive. It then copies into the thumb drive a Delphi loader with the name of the original thumb drive, and a USB thumb drive icon.

Interestingly, there is no special technique used in this USB infection flow to automatically run the Delphi launcher; instead, it relies on social engineering, the researchers explained.

"The victims can no longer see their files on the drive and are left only with the executable, which they will likely click to reveal their files — thereby setting off an infection flow of the machine," they wrote in the post.

WispRider acts as both an infector and backdoor, side loading as a DLL that includes both the USB infector component and the backdoor itself, the researchers said. It has execution flows to run both from an infected machine or to infect a machine if it hasn't already been infected, they explained.

The latter "is likely an alternative infection vector which delivers the malware to the targeted network when the actors cannot rely on the USB propagation, as they can’t physically access the machine to plug in an infected drive," researchers wrote.

Moreover, based on known tactics of Mustang Panda, the non-USB WispRider infections likely originate via "spear-phishing campaigns that deliver an archive with all the infection-related files and assure the legitimate executable runs with a relevant argument," they wrote.

**Mitigating USB-Borne Cyber Threats**

USB-propagated infections have been around for two decades, but are increasingly becoming a popular attack vector of APTs and other large cybercriminal groups because of how rapidly threat actors can spread various types of malware via this vector. It also allows them to sneak malware onto otherwise heavily secured networks via individual devices, the users of which may be unaware that they are carrying an infection.

Indeed, the FBI warned earlier this year of a USB cyberattack campaign in which threat group FIN7 was actually mailing thumb drives to US organizations with the explicit goal of delivering ransomware into their environments.

Due to the increasing nature and large surface area of these attacks, Check Point researchers made a number of recommendations to help organizations protect themselves against USB drive-based attacks:

*   Raise awareness among employees of the potential dangers of using USB drives from unknown or untrusted sources, and encourage cautious behavior and discourage the use of unfamiliar drives on corporate devices;
*   Organizations also should establish strict and clear guidelines regarding the use of USB drives with any device that's connected to the corporate network, and even consider limiting or prohibiting their use unless obtained from trusted sources;
*   In fact, it is a good idea for enterprises to seek secure alternatives to USBs altogether, such as cloud storage or encrypted file-sharing platforms, the researchers noted. This will reduce reliance on physical USB drives and mitigate associated risks;
*   And, keeping security measures up to date overall by updating antivirus software and other security software across all devices, as well as periodically scanning USB drives for potential infections, can also help protect corporate networks.

Source

DARKReading