Home Tags RSA

Tag: RSA

An updated rhev-hypervisor package that fixes several security issues,bugs, and enhancements is now available.Red Hat Product Security has rated this update as having Importantsecurity impact.

A Common Vulnerability Scoring System (CVSS) basescore, wh...
The 25th anniversary edition of the annual RSA Conference was held from Feb. 29 to March 4 in San Francisco's Moscone Center, showcasing the best and the worst that the security world has to offer, ranging from new products (check out eWEEK's slide sho...
An out-stretched arm slowly disappears... Response to the critical web-crypto-blasting DROWN vulnerability in SSL/TLS by cloud services has been much slower than the frantic patching witnessed when the Heartbleed vulnerability surfaced two years ago. DROWN (which stands for Decrypting RSA with Obsolete and Weakened eNcryption) is a serious design flaw that affects network services that rely on SSL and TLS.

An attacker can exploit support for the obsolete SSLv2 protocol – which modern clients have phased out but is still supported by many servers – to decrypt TLS connections. Successful attacks would give hackers the ability to intercept encrypted traffic (eg, passwords, credit card numbers, sensitive corporate data, etc) as well as impersonate a trusted cloud provider and modify traffic to and from the service using a man-in-the-middle attack. The Heartbleed bug meant attackers could read the memory of the systems protected by the vulnerable versions of OpenSSL. Pretty much anything in memory – SSL private keys, user passwords, and more – was open to thieves preying on unpatched systems as a result of the flaw, which emerged in April 2014. After one week, the number of cloud services vulnerable to Heartbleed fell from 1,173 to 86 (or a 92.7 per cent reduction).

By comparison, susceptibility to DROWN has only fallen from 653 to 620 (5.1 per cent) in the week since it burst onto the scene on Tuesday 1 March, according to figures from Skyhigh Networks' Cloud Security Labs. Skyhigh reckons 98.9 per cent of enterprises use at least one vulnerable service.

The average organisation uses 56 vulnerable cloud services, it reports. One-third of all HTTPS websites were potentially vulnerable to the DROWN attack at the time it was disclosed last week. Other experts, such as iSight Partners, reckon that DROWN is nowhere near as easy to exploit at Heartbleed because in the case of DROWN, an attacker already needs to be perched on a target network before feeding vulnerable systems attack traffic, among other factors. Heartbleed, by contrast, was much easier to exploit.

Even so, the DROWN vulnerability is a good candidate for prompt triage, particularly by the likes of cloud services, which market themselves as an agile and flexible enterprise computing resource. “Companies are adopting cloud services in record numbers, most of which have gone a long way to prove their worth and security to even the most cloud-sceptic industries such as financial services,” said Nigel Hawthorn, EMEA Marketing Director at Skyhigh Networks. “The cloud service industry acted fantastically in response to Heartbleed, and we need to see the same kind of response to DROWN today, which we haven’t to date.” Skyhigh Networks' technology allows organisations to monitor employee cloud use and lock down banned apps. ® Sponsored: DevOps for Dummies 2nd edition
IDG.TV | Mar 8, 2016 At the 2016 RSA Conference, CSO talked with John Grimm and Peter Galvin from Thales e-Security about their latest data encryption report.

The big trends: More companies are moving sensitive data to the cloud, but a lot of organizat...
Ecryption, bug bounties and threat intel dominated the mindshare of the cybersecurity hive mind at RSAC last week. SAN FRANCISCO, CALIF. – RSA Conference 2016 -- With one of the biggest crowds ever to hit Moscone for RSA Conference USA, the gathering last week of 40,000 security professionals and vendors was like a convergence of water cooler chatterboxes from across the entire infosec world. Whether at scheduled talks, in bustling hallways or cocktail hours at the bars nearby, a number of definite themes wound their way through discussions all week. Here's what kept the conversations flowing. Encryption Backdoors The topic of government-urged encryption backdoors was already promising to be a big topic at the show, but the FBI-Apple bombshell ensured that this was THE topic of RSAC 2016.

According to Bromium, a survey taken of attendees showed that 86% of respondents sided with Apple in this debate, so much of the chatter was 100 different ways of explaining the inadvisability of the FBI's mandate. One of the most colorful quotes came from Michael Chertoff, former head of U.S.

Department of Homeland Security: "Once you’ve created code that’s potentially compromising, it’s like a bacteriological weapon. You’re always afraid of it getting out of the lab.” Bug Bounties In spite of the dark cast the backdoor issue set over the Federal government's relations with the cybersecurity industry, there was plenty of evidence of positive public-private cooperation.

Exhibit A: the "Hack the Pentagon" bug bounty program announced by the DoD in conjunction with Defense Secretary Ash Carter's appearance at the show. While bug bounty programs are hardly a new thing, the announcement of the program shows how completely these programs have become mainstream best practices. "There are lots of companies who do this,” Carter said in a town hall session with Ted Schlein, general partner at Kleiner Perkins Caufield & Byers. “It’s a way of kind of crowdsourcing the expertise and having access to good people and not bad people. You’d much rather find vulnerabilities in your networks that way than in the other way, with a compromise or shutdown.” Threat Intel There was no lack of vendors hyping new threat intelligence capabilities at this show, but as with many hot security product categories threat intel is suffering a bit as the victim of its own success.

The marketing machine is in full gear now pimping out threat intel capabilities for any feature even remotely looking like it; one vendor lamented to me off the record, "most threat intel these days is not even close to being real intelligence." In short, threat intel demonstrated at the show that it was reaching the peak of the classic hype cycle pattern. RSAC attendees had some great evidence of that hanging around their necks. Just a month after the very public dismantling of Norse Corp., the show's badge holder necklaces still bore the self-proclaimed threat intelligence vendor's logos.

But as Robert Lee, CEO of Dragos Security, capably explained over a month ago in the Norse fallout, this kind of failure (and additional disillusionment from customers led astray by the marketing hype) is not necessarily a knock on the credibility of threat intel as a whole.
It is just a matter of people playing fast and loose with the product category itself. "Simply put, they were interpreting data as intelligence," Lee said. "There is a huge difference between data, information, and intelligence.
So while they may have billed themselves as significant players in the threat intelligence community they were never really accepted by the community, or participating in it, by most leading analysts and companies.

Therefore, they aren’t a bellwether of the threat intelligence industry." Related Content: Find out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Register today and receive an early bird discount of $200. Ericka Chickowski specializes in coverage of information technology and business innovation.
She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio More Insights
Always check the headers Storage drive biz Seagate is lousy at keeping its own data safe: it accidentally handed over the crown jewels of its employees' private information to persons unknown. A Seagate employee was fooled by an email that masqueraded as an internal memo from the CEO: the message requested people's W-2 forms, and the worker duly handed over the paperwork to fraudsters thinking the request was legit. The forms include colleagues' social security numbers, income figures, work and home addresses, and other data useful to identity thieves.

Anyone who worked at Seagate at any point in 2015 will have had their details leaked. "On March 1, 2016, Seagate Technology learned that the 2015 W-2 tax form information for current and former US-based employees was sent to an unauthorized third party in response to a phishing email scam," the biz said in a statement to The Reg. "At this point we have no information to suggest that employee data has been misused, but caution and vigilance are in order. We deeply regret this mistake and we offer our sincerest apologies to everyone affected." Seagate has informed the IRS, America's taxmen, about the scam, and the FBI has launched an investigation.
In the meantime, the tax authorities will be scrutinizing returns from Seagate employees more carefully this year, and the firm has given staff two years of credit fraud protection. This is the busiest time of the year for Americans and their tax affairs, both legitimate and illegitimate, and last week something similar happened to Snapchat.

The fear is that with this information scammers can file false tax records impersonating employees and funnel refunds into the crooks' bank accounts. Seagate can, at least, take comfort in the fact that it's better at this stuff than the actual IRS.

Earlier this month, the tax agency was forced to admit it let slip up to 700,000 tax forms thanks to flaws in its electronic filing system. Seagate's woes do, however, show the importance of checking the details on emails to avoid getting phished.

Too many people are still getting caught out by official-looking emails and not double checking when sending out sensitive info. Public-key encryption cofounder Whitfield Diffie put it best last week at the RSA conference when he was asked what his first reaction was when he was emailed to say he'd won the Turing Prize – the tech industry's Nobel Prize. "I spent a long time checking the email headers very, very carefully," he joked. ® Sponsored: Addressing data governance requirements in a dispersed data environment
IDG.TV | Mar 7, 2016 At the 2016 RSA Conference, CSO's Steve Ragan chats with Chris Wyospal, co-founder and CTO of Veracode, about the importance of liability insurance for companies that may be affected by data breaches. Similar Sec...
IDG.TV | Mar 7, 2016 At RSA Conference, we catch up with Markus Jakobsson, Founder and CTO of ZapFraud, about the latest trends in consumer and enterprise scams (phishing schemes), including the very successful "email from the CEO" trick. Similar Secu...
The cyber attacks of the future may be hard to spot, and nations may fight over fiber. In recent weeks, the digital security discussion has been focused on a certain fruit-flavored company's public battle with a three-letter agency.

But Kaspersky Principal Security Analyst Vicente Diaz is considering the far larger, and far more complicated, fights that nations might carry on in the digital world. You Don't Need StuxnetIn his presentation at RSA, Diaz made a distinction between three kinds of attacks.

The first were exotic attacks, developed and deployed at great expense by nation states.

Think Stuxnet, the complex malware allegedly developed by the U.S. and Israel to physically disable Iranian nuclear enrichment machinery. The second were so-called "middle-class" attacks, which are assembled by knowledgeable teams of hackers.

The third category encompassed all other attacks, usually carried out by individuals with little to no technical knowledge, who purchase malicious payloads and delivery mechanisms from the digital black market.The problem with complicated nation-state campaigns like Stuxnet is that they make attribution easier. When it comes to determining who is capable of developing and deploying such an attack, "the list of countries is very short," said Diaz. In the future, Diaz predicted that nation states will move away from exotic attacks and focus on middle-class attacks that are as simple and stealth as possible. "Now you don't need to develop Stuxnet-like malware just to attack," said Diaz. "Ukraine was attacked by BlackEnergy, which is not in the same league as Stuxnet." The key is obtaining the physical and digital infrastructure, like the cable that connects the global Internet. "It's good for cyber espionage but also good for attacking an adversary," said Diaz. "You can use it in an offensive way, or you can use it to get information from the people who are using this infrastructure." As an example, Diaz said that if you control the Internet infrastructure, you can simply snatch passing data rather than having to target specific devices.This approach sounds similar to the one used by the NSA in its massive data collection operations exposed by Edward Snowden, which used the position of the United States Internet infrastructure to intercept data traveling around the world. The Fight for Digital TerritoryDiaz believes that the importance of Internet infrastructure will spark conflict between nations. "Control over physical infrastructure is where the next big battles will happen," he said. He pointed to efforts made by Brazil to construct its own trans-Atlantic Internet connection and efforts within Europe to foster the development of Internet business and infrastructure within national borders. Conflicts over control of the Internet could take many forms, and need not be offensive.
Instead, countries might form alliances to create spheres of influence over the Internet.

For example, Diaz pointed to a diplomatic agreement between the U.S. and China, where the two countries agreed not engage in cyber attacks for financial gain. Diaz said this agreement was an example of one such alliance, and hinted that it would have wide-ranging consequences. "Obviously these alleged attacks will probably move to some other country because they still need to get this data," he said. Digital resources are already playing a role in warfare and politics.

This week saw confirmation from the Department of Defense that the U.S. was bringing cyber capabilities to bear against ISIS.

Also speaking at the RSA conference, Secretary of Defense Ashton Carter declined to go into specifics about these operations, but said they were focused on disrupting ISIS's command and communications capabilities. What Diaz is describing is more like the groundwork for larger operations.
It's also a shift in how diplomacy, as well as warfare, will be carried out since the fiber traveling through a stretch of land (or ocean) may be as a valuable as the land, its people, or its resources to a nation state developing its cyber capabilities. But perhaps the most important point is Diaz's prediction that attacks will simplify, rather than increase, in complexity.
If Diaz is correct, then the kind of cyber attack that worries NSA Director Rogers might be indistinguishable from the everyday work of a hacker and nearly impossible to spot.
IDG.TV | Mar 7, 2016 At the 2016 RSA Conference, CSO chats with Grayson Milbourne of Webroot, about the latest malware trends it saw from its customer base, including the growing importance of polymorphic malware and the flaws in signature-based detect...
IDG.TV | Mar 7, 2016 At the 2016 RSA Conference, CSO's Steve Ragan chats with Joseph Opacki from PhishLabs about how cyber-criminals are becoming increasingly smarter about targeting specific high-end business users to try and steal data or money. Sim...
IDG.TV | Mar 7, 2016 At the 2016 RSA Conference in San Francisco, CSO chats with SecureAuth about their behavioral biometrics technology, which allows or prevents access depending on a person's keystroke and mousing techniques.

Could this method replac...