Kwampirs Malware Targets Healthcare Sector; Beware of USBs in the Mail; Injunctions Against VoIP Carriers for Facilitating Fraudulent Robocalls

In defending against threats like Kwampirs, do not focus too much on specific indicators of compromise. They will change quickly, and are only useful to detect past infections. Instead, verify how well you are able to detect the techniques the malware uses to spread. For example, Kwampirs like other malware, seeks out administrative shares and installs as a new service. These are fairly generic techniques used by other malware as well. Implementing techniques to detect this type of behavior has the benefit that it will not just detect this particular malware, but more generically help identify malicious behavior.

Johannes Ullrich

A good analogy for security awareness around this issue is to equate USB sticks that aren't from IT or a store to be like a piece of what kids used to call ABC gum: Already Been Chewed gum. Don't put ABC USB drives in your computer's mouth.

John Pescatore

It remains imperative to not insert unknown or untrusted media in systems. Right now many users are working from home outside many of the normal corporate security controls, so increased attention to work-from-home security measures is appropriate. Also, while enabling controls which limit the insertion of removable media to approved devices only will help raise the bar, the current environment makes it attractive for the user to insert these into their personal devices, so be sure to include that scenario in your awareness training.

Lee Neely

Carriers of all flavors have refused to filter malicious calls/data that are known to be from spoofed addresses. It is good to see courts and the FTC (noted in another item) start to put appropriate pressure on them. Imagine if the water company said "Well, we knew the dangerous chemicals were in the water, but we just pass the water from left to right; don't blame us. But, we will sell you a water cleaning service."

John Pescatore

The elderly are some of the hardest users to protect, as they have not "grown up" with these threats, and are not necessarily connected with, or may not understand security awareness campaigns. Taking the time to work with them one-on-one to understand call security and enabling appropriate controls is the best mitigation while technical and carrier level controls evolve.

Lee Neely

While this bug remains in iOS 13.4, it also impacts iOS 13.3.1 and later. The problem is the VPN does not terminate all existing network connections when established. The primary risk is moderate, as this can be used to reveal metadata about the device's connections as most application connections are themselves encrypted and short lived. The risk can be partly mitigated by enabling auto-connect features in third-party VPNs or setting the always connected feature of managed devices accessing the corporate VPN.

Lee Neely

The FTC was awarded a prestigious SANS Difference Maker's award a few years ago. It is good to see them continuing to make a difference.

John Pescatore

What is needed is the implementation of security solutions such as SHAKEN / STIR to raise the bar on VoIP call security. Take note of the FTC advice on robocalls, particularly COVID-19 related ones, at core: hang up, don't press any buttons, better still don't answer unrecognized calls. Leverage options to block unwanted calls. Some services have free call blocking tools, iOS allows you to silently send unrecognized callers to voicemail and Android allows you to block anonymous callers.

Lee Neely

Creating fraudulent accounts may not be criminal but it is unethical and not something we want to encourage. In this case it contaminates the application and interferes with its objective.

William Hugh Murray

There needs to be a balance between supporting research for bug identification and restricting activities which are out of scope of the bug bounty program. This typically requires an organization of some size and maturity to have the resources to manage this balance as well as verify and respond to issues discovered.

Lee Neely

Since Voatz has been discouraging bug bounty style assessment of the security of its product, and points to the Department of Homeland Security as evaluating the remote voting application, no elections should use the software until DHS completes an exhaustive evaluation, any and all issues noted are fixed, the DHS re-evaluates the app and publicly gives it a clean bill of health for state and local use.

John Pescatore

Said another way, Voatz has decided that inviting unknown "researchers" to attack its application is not a good idea.

William Hugh Murray