Dude Where’s My Card? | TechSNAP 198

chris

8 years ago

Adobe has a bad week, with exploits in the wild & no patch. We’ll share the details. Had your credit card stolen? We’ll tell you how.

Plus the harsh reality for IT departments, a great batch of questions, our answers & much much more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

— Show Notes: —

New flash zero day found being exploited in the wild, no patch yet

The new exploit is being used in some versions of the Angler exploit kit (the new top dog, replacing former champ blackhole)
The exploit kit currently uses three different flash exploits:
CVE-2014-8440 – which was added to the exploit kit only 9 days after being patched
CVE-2015-0310 – Which was patched today
and a 3rd new exploit, which is still being investigated
Most of these exploit kits rely on reverse engineering an exploit based on the patch or proof of concept, so the exploit kits only gain the ability to inflict damage on users after the patch is available
However, a 0 day where the exploit kit authors are the first to receive the details, means that even at this point, researchers and Adobe are not yet sure what the flaw is that is being exploited
Due to a bug in the Angler exploit kit, Firefox users were not affected, but as of this morning, the bug was fixed and the Angler kit is now exploiting Firefox users as well
Additional Coverage – Krebs On Security
Additional Coverage – PCWorld
Additional Coverage – Malware Bytes
Additional Coverage – ZDNet

How was your credit card stolen

Krebs posts a write up to answer the question he is asked most often: “My credit card was stolen, can you help me find out how”
Different ways to get your card stolen, and your chance of proving it:
Hacked main street merchant, restaurant (low, depends on card use)
Processor breach (nil)
Hacked point-of-sale service company/vendor (low)
Hacked E-commerce Merchant (nil to low)
ATM or Gas Pump Skimmer (high)
Crooked employee (nil to low)
Lost/Stolen card (high)
Malware on Consumer PC (very low)
Physical record theft (nil to low)
“I hope it’s clear from the above that most consumers are unlikely to discover the true source or reason for any card fraud. It’s far more important for cardholders to keep a close eye on their statements for unauthorized charges, and to report that activity as quickly as possible.”
Luckily, since most consumers enjoy zero liability, they do not have to worry about trying to track down the source of the fraud
With the coming change to Chip-and-Pin in the US, the liability for some types of fraud will shift from the banks to the retailers, which might see some changes to the way things are done
Banks have a vested interest in keeping the results of their investigations secret, whereas a retailer who is the victim of fraudulent cards, may have some standing to go after the other vendor that was the source of the leak
Machine Learning for Fraud Detection

15% of business cloud accounts are hacked

Research by Netskope, a cloud analysis company, finds that only one in ten cloud apps are secure enough for enterprise use
In their survey, done using network probes, gateways, and other analysis techniques (rather than asking humans), they found that the average large enterprise uses over 600 cloud applications
Many of these applications were not designed for enterprise use, and lack features like 2 factor authentication, hierarchical access control, “group” features, etc
The report also found that 8% of files uploaded to cloud storage provides like Google Drive, Dropbox, Box.com etc, were in violoation of the enterprises’ own Data Loss Prevention (DLP) policies.
The downloading numbers were worst, 25% of all company files in cloud providers were shared with 1 or more people from outside the company. 12% of outsiders had access to more than 100 files.
Part of the problem is that many “cloud apps” used in the enterprise are not approved, but just individual employees using personal accounts to share files or data
When the cloud apps are used that lack enterprise features that allow the IT and Security teams to oversee the accounts, or when IT doesn’t even know that an unapproved app is being used, there is no hope of them being able to properly manage and secure the data
Management of the account life cycle: password changes, password resets, employees who leave or are terminated, revoking access to contractors when their project is finished, etc, is key
If an employee just makes a dropbox share, adds a few other employees, then adds an outside contractor that is working on a project, but accidently shares all files instead of only specific project files, then fails to remove that person later on, data can leak.
When password resets are managed by the cloud provider, rather than the internal IT/Security team, it makes it possible for an attacker to more easily use social engineering to take over an account
Infographic
Report