Ransomware Deploys Virtual Machine; Coronavirus Phishing Scheme Using Excel; Majority of Apps Contain Flaws via Open-Source Libraries

The targets chosen are more likely to be running VirtualBox, so its presence alone is not necessarily a red flag. This attack installs an unsigned SunxVM VirtualBox MSI from 2009, which should trigger endpoint defenses. Unplanned disabling of backup and remote management utilities also merits follow-up. As this group is also known for exfiltrating data, expect threats of data disclosure to accompany ransom demands.

Lee Neely

This attack is spoofing an email from the Johns Hopkins Center providing an update on the Coronavirus-related deaths in the United States, with an attached Excel file titled 'covid_usa_nyt_8072.xls.' Additionally, Microsoft has announced they are making some of their COVID-19 related threat intelligence open-source to help customers better protect themselves by providing the community a more complete view of attackers' tactics, techniques, and procedures (TTPs). Information is being provided via threat intelligence sharing feeds for Azure Sentinel Customers, and for the public on GitHub. See: https://www.microsoft.com/security/blog/2020/05/14/open-sourcing-covid-threat-intelligence/

Lee Neely

The Veracode paper breaks down flaws by language type, with PHP having the most flaws including, at least, a Proof of Concept (Poc) exploit. This introduces the burden of not only monitoring and updating your Open-Source libraries but also integrating these releases with current software lifecycle update processes. The good news is the majority of identified open-source flaws are addressed in small updates unlikely to break applications, reducing the risk and difficulty of remaining current.

Lee Neely

Good reminder that open source software is just as likely to have vulnerabilities in it as commercial software. A key takeaway from the Veracode report: "Fixing most library-introduced flaws in most applications can be accomplished with only a minor version update. Major library upgrades are not usually required!"

John Pescatore

This has come up before with financial institutions scanning customers PCs trying to protect customers with compromised PCs from fraud, usually from the login page but not always. In general, in the US and in EU at least, it has been ruled to be legal and not violate various Computer Misuse Acts. But, generally accepted practice is to at least notify, if not obtain permission, for doing this kind of thing. If your organization is asking for advice on doing this kind of thing, best to involve legal counsel.

John Pescatore

While this is intended as an anti-fraud measure to make sure that a user's system is secure, the user is not granting permission for this activity, which is concerning with current privacy regulations. As the scan is run via a JavaScript, your local firewall is not going to block it. It can be blocked with browser extensions like NoScript and uBlock Origin, or by using a browser which is not targeted, such as Brave.

Lee Neely

Payment card data is still too easy to monetize, now more so in "card not present" transactions. Online merchants should prefer check-out proxies (e.g. PayPal, Apple Pay, Click-to-Pay) to processing payments themselves. Telephone merchants should separate order taking from payment taking.

William Hugh Murray

The environment in which most of us work is dramatically more hostile than it was two years ago but our security is not much better, sometimes even worse. Keep doing the same thing, expect worse results.

William Hugh Murray

This paper also lays out the current meeting security mechanisms and differentiates between meeting access control features, such as a meeting password, and securing the meeting content, which may use a symmetric key. Take note of where connectors are required to extend encryption to certain devices and the limitations of those connections.

Lee Neely

I did a webinar with Zoom Head of Product Security Randy Barr, and he gave details on what Zoom has done to date to address needed security improvements and what is on the roadmap for the rest of their first 90 day plan. Encryption gets the press attention but the increase in focus on application security and proactive pen testing, and getting input from industry CISOs are the more important initiatives. Webinar recording available at https://www.sans.org/webcasts/zooming-safely-securely-interviews-zooms-head-product-security-115500

John Pescatore

"Zoom bombing" notwithstanding, most users have more risk in their operating systems, browsers, readers, etc. than in any application. Zoom remains more vulnerable to meeting host decisions than to attacks on its crypto. Zoom is rapidly approaching "enterprise grade." However, for most system code, that still involves a reservoir of known and unknown vulnerabilities. When using any conferencing application, prefer device specific purpose-built clients to historically porous browsers.

William Hugh Murray