The UK’s National Cyber Security Center (NCSC) has outlined the creation of a new protective domain name service (PDNS) solution in partnership with Nominet, the official registry for UK domain names.

The service, named PDNS Digital Roaming, is designed to enhance the security of public sector staff working from home as a result of the COVID-19 pandemic. The free at the point of use app will extend the protection offered by the original PDNS solution, which is delivered by Nominet, to remote networks.

PDNS has been in place since 2017, and helps keeps public sector organizations secure by hampering the use of DNS for malware distribution and operation. Last year, it was being used by over 760 public sector organizations, protecting an estimated 2.8 million staff.

PDNS Digital Roaming enables these protections to extend to employees working from home by detecting when a device is outside of its enterprise network and redirecting DNS traffic to PDNS, using the encrypted DNS over HTTPS (DoH) protocol. This applies from whichever network employees connect to the internet from.

David Carroll, MD of Nominet’s cybersecurity arm commented: “The NCSC reacted quickly to the challenges that coronavirus presented to the cyber-defense of the nation. For example, elements of the Active Cyber Defense program – including the PDNS, which is delivered by Nominet on behalf of the NCSC – were made available to many more organizations in the past year, including over 200 frontline public health bodies.

“Without a fixed IP address, staff needed another option for accessing the protections of the PDNS – PDNS Digital Roaming has been the answer. This app was launched in September to all those currently eligible to use the PDNS. By installing it on their device, staff can ensure that their DNS traffic is being directed to the PDNS and is thus protected by this innovative service.

“Keeping critical services secure has never been so important. As we position our country as a global digital leader for the future, it will be important to devise solutions that are adaptable as well as highly resilient and secure.”

At the end of last year, Infosecurity spoke to Russell Haworth, CEO of Nominet, about how the company is combatting the rise in malicious domain names since the start of the COVID-19 pandemic.

Artificial intelligence (AI) and quantum are set to be the next major technology disruptors and will have a profound impact on the cybersecurity sector, according to speakers in a session at the Consumer Electronics Show (CES) 2021.

Advancements in these areas are likely to lead to new opportunities for cyber-criminals to leverage attacks, but conversely, can also enable the development of stronger cybersecurity defenses.

Vikram Sharma, founder and CEO at QuintessenceLabs, explained that these technologies form part of the predicted “fourth industrial revolution,“ which will radically enhance our technological capabilities. “The fourth industrial revolution is really a confluence of a number of technologies, so alongside AI, 5G, robotics, 3D printing and IoT, quantum is one of these very important technologies of our time.”

He said it is critical organizations now look at how they can leverage quantum for cybersecurity purposes. This is because of its potential to provide a “robust” protection of data as well as to counter the threats this tech could pose in the hands of attackers. Sharma added: “The general consensus is we may see an adversary who has a quantum computer at the right scale to impact cybersecurity within the next five to 10 years.”

Similarly, it is critical that proactive steps are taken to tackle the use of AI by threat actors to launch attacks. Pete Tortorici, director, Joint Information Warfare at the Department of Defense (DOD) Joint Artificial Intelligence Center, outlined a number of considerations in this regard: “How are we going to understand what network incident detection is going to look like in the world of AI? How do we leverage AI to secure network capabilities? How do we build robust analytics to let us know when things have happened inside of a network?”

For organizations to successfully implement AI solutions, underlying issues first need to be resolved. Tortorici said: “A lot of organizations haven’t solved the data problem that underlies being able to get after an AI solution.” He added this can be as simple as collecting and keeping the data needed to feed their algorithm.

Another issue is meeting the demand for AI specialists and data engineers from a security standpoint. Tortorici commented: “I wonder if we have the required incentives, both educational and professional, to grow this skillset over the next several decades.” He added that at the Department of Defense there is now a strong emphasis on “cultivating and retaining talent” in this area.

In regard to quantum, Sharma said that his company has observed organizations becoming increasingly aware of the transformative potential of quantum, and “a number of them have started the process of building internal subject matter expertise within their engineering and development groups around quantum.”

However, much more focus needs to be placed on its potential impact on cybersecurity. Part of this is ensuring organizations are better educated on how to adapt their security posture. Sharma added: “While awareness of quantum is developing and generally people have some conception that there is a risk to cybersecurity, there isn’t a proper understanding of what this means in terms of implications for the cyber-technologies that are deployed today.” 

It is therefore critical that organizations prepare for the expected growth in AI and quantum, both to improve their productivity and enhance their cybersecurity. Two key factors in ensuring this is the case that were emphasized by Sharma and Tortorici were general awareness and developing the right skillsets.

The US National Security Agency (NSA) has warned enterprises that adoption of encrypted DNS services can lead to a false sense of security and even disrupt their own DNS-monitoring tools.

DNS over HTTPS (DoH) has become an increasingly popular way to improve privacy and integrity by protecting DNS traffic between a client and a DNS resolver from unauthorized access. This can help to prevent eavesdropping and manipulation of DNS traffic.

However, although such services are useful for home and mobile users and networks not using DNS controls, they are not recommended for most enterprises, the US security agency claimed in a new report.

DoH is “not a panacea,” as it doesn’t guarantee that threat actors can’t see where a client is going on the web, said the NSA.

“DoH is specifically designed to encrypt only the DNS transaction between the client and resolver, not any other traffic that happens after the query is satisfied,” the report noted.

“While this allows clients to privately obtain an IP address based on a domain name, there are other ways cyber-threat actors can determine information without reading the DNS request directly, such as monitoring the connection a client makes after the DNS request.”

Moreover, DoH can actually impair network monitoring tools designed to spot suspicious activity in DNS traffic.

“DoH encrypts the DNS traffic, which prevents enterprises from monitoring DNS with these network-based tools unless they are breaking and inspecting TLS traffic. If DoH is used with the enterprise resolver, then inspection can still occur at the resolver or using resolver logs,” the report continued.

“However, if external DoH resolvers are not blocked and DoH is enabled on the user’s browser or OS to use a different resolver, there could be issues gaining visibility into that encrypted DNS traffic.”

Malware can also use DoH to hide its C&C communications traffic, the NSA warned.

The agency urged enterprises that use monitoring tools to avoid using DoH inside their networks.

Facebook is suing two European developers for allegedly violating its terms of service by scraping user data.

Legal action has been filed in Portugal by Facebook and Facebook Ireland against two individuals working for application/extension development company Oink and Stuff.

The firm claims its software products, available for Chrome, Firefox, Edge, Opera and Android, have over one million active users.

However, the two misled users into downloading their Chrome extensions by claiming in a privacy policy that they did not collect any personal information, alleged Facebook director of platform enforcement and litigation, Jessica Romero.

She highlighted four extensions, Web for Instagram plus DM, Blue Messenger, Emoji keyboard and Green Messenger, that contained code which Facebook claims are malicious and effectively act like spyware.

“When people installed these extensions on their browsers, they were installing concealed code designed to scrape their information from the Facebook website, but also information from the users’ browsers unrelated to Facebook — all without their knowledge,” argued Romero.

“If the user visited the Facebook website, the browser extensions were programmed to scrape their name, user ID, gender, relationship status, age group and other information related to their account. The defendants did not compromise Facebook’s security systems. Instead, they used the extensions on the users’ devices to collect information.”

Facebook is seeking a permanent injunction against the defendants, demanding they delete all Facebook data in their possession.

This is just one of many cases brought by the social network against third parties it accuses of impacting user privacy, a push that began in earnest following the Cambridge Analytica scandal.

In September 2019, the firm revealed it had filed suits against LionMobi and JediMobi, two companies that used apps to infect users’ devices with click injection fraud malware, South Korean data analytics firm Rankwave and Ukrainians Gleb Sluchevsky and Andrey Gorbachov, who used quiz apps to scrape user data.

An e-commerce “scam-as-a-service” operation tried-and-tested in Russia has expanded to multiple European countries in 2020, making cybercrime groups over $6.5m in the process, Group-IB has warned.

The Singapore-based cybersecurity company claimed in a new report that “Classiscam” first appeared in Russia in the summer of 2019, but soon migrated west and hit a peak of activity over 2020 as remote workers surged online to shop.

There are now at least 40 active groups using the scam packages to con internet users out of their hard-earned cash.

“In the summer of 2020 we took down 280 scam pages as part of the Classiscam scheme, and by December that number grew 10-fold and reached up to 3000 pages,” said Yaroslav Kargalev, deputy head of CERT-GIB.

“We see that Classiscammers are now actively migrating from Russia to Europe and other countries. It’s not the first time that Russia has served as a testing ground for cyber-criminals with global ambitions.”

The groups publish ads for popular products on marketplaces and classified websites, with prices marked down to spark interest from buyers. Consumer electronics such as cameras, game consoles, laptops and smartphones are often listed.

Once the buyer gets in touch, the scammer typically takes the conversation off the marketplace to WhatsApp or other messenger channels, using local phone numbers to add authenticity.

The fraudster then asks for the victim’s delivery and contact information and sends a phishing link mimicking the real marketplace, which takes the user to a fake payment page.

Telegram bots are used to generate the ready-to-use phishing pages, streamlining the process and lowering the bar to entry for non-techie cyber-criminals.

Cybercrime groups using the service typically include three types of operative: admins, workers and callers.

Admins are responsible for recruiting new members, creating the scam pages and taking action when a bank blocks the victim’s transaction. Workers communicate directly with victims, while callers pretend to be tech support specialists.

Group-IB estimated that the most active groups make as much as $522,000 per month.

“So far, the scam’s expansion in Europe is hindered by language barriers and difficulties with cashing our stolen money abroad,” said Dmitriy Tiunkin, head of Group-IB Digital Risk Protection Department, Europe.

“Once the scammers overcome these barriers, Classiscam will spread in the West. The downside of popularity is competition among scammers, who sometimes frame each other without knowing it.”

There is a high risk of disinformation campaigns designed to spread panic and fear about the COVID-19 crisis, according to IT firm Fujitsu. In particular, it expects social engineering attacks to focus on fuelling uncertainty and doubt surrounding the effectiveness of COVID-19 vaccines as they begin to be rolled out across the world.

The company said that both criminal gangs and nation state actors will focus on controversial aspects of vaccine programs, including mandatory vaccination, health passports, mass immunity testing and lockdowns in these campaigns. These will target both businesses and individuals through a range of attack vectors, with phishing the most prominent.

There has been a huge rise in phishing campaigns observed since the start of the pandemic last year, with cyber-villains frequently using COVID-19 topics as lures.

The most sophisticated of these attacks will sow division between opposing sides, leading to more polarization and mistrust of information sources. This has been evident during recent elections such as the Brexit referendum in 2016 and the US elections last year.

Fujitsu added that it is already seeing malicious actors leverage issues around personal liberty linked to the pandemic, such as restrictions on movements and requirements to wear a facemask.

Paul McEvatt, head of cybersecurity innovation at Fujitsu, commented: “Phishing is at the heart of these attacks – the targeting of individuals based on their beliefs, or their circumstances, to socially engineer them into a compromised situation. People are more likely to fall for a phish when related to a topic they believe in or identify with. Today, the coronavirus pandemic is a global issue and a highly-emotional one, too, especially since it involves personal liberties and factors such as restriction on movement. There has probably never been a bigger topic for a disinformation attack.”

Earlier today, the European Medicines Agency revealed that documents related to COVID-19 medicines and vaccines have been leaked online following a cyber-attack on the regulator in December.