Author: admin

Splunk warns that there’s little time to stop attacks once in progress

Photos of infants included in misconfigured S3 bucket

Microsoft also admits it was hit by ransom group

Some tips on how to keep your network safe – even (or perhaps especially!) if you think you’re safe already.

A new steady stream of attacks against network-attached storage devices from the Taiwan-based vendor is similar to a wave that occurred in January.

The data-extortion gang got at Microsoft’s Azure DevOps server. Meanwhile, fellow Lapsus$ victim and authentication firm Okta said 2.5 percent of customers were affected in its own Lapsus$ attack.

The Office of Inspector General has audited NASA’s insider threat program:

While NASA has a fully operational insider threat program for its classified systems, the vast majority of the Agency’s information technology (IT) systems — including many containing high-value assets or critical infrastructure — are unclassified and are therefore not covered by its current insider threat program. Consequently, the Agency may be facing a higher-than-necessary risk to its unclassified systems and data. While NASA’s exclusion of unclassified systems from its insider threat program is common among federal agencies, adding those systems to a multi-faceted security program could provide an additional level of maturity to the program and better protect agency resources. According to Agency officials, expanding the insider threat program to unclassified systems would benefit the Agency’s cybersecurity posture if incremental improvements, such as focusing on IT systems and people at the most risk, were implemented. However, on-going concerns including staffing challenges, technology resource limitations, and lack of funding to support such an expansion would need to be addressed prior to enhancing the existing program.

Further amplifying the complexities of insider threats are the cross-discipline challenges surrounding cybersecurity expertise. At NASA, responsibilities for unclassified systems are largely shared between the Office of Protective Services and the Office of the Chief Information Officer. In addition, Agency contracts are managed by the Office of Procurement while grants and cooperative agreements are managed by the Office of the Chief Financial Officer. Nonetheless, in our view, mitigating the risk of an insider threat is a team sport in which a comprehensive insider threat risk assessment would allow the Agency to gather key information on weak spots or gaps in administrative processes and cybersecurity. At a time when there is growing concern about the continuing threats of foreign influence, taking the proactive step to conduct a risk assessment to evaluate NASA’s unclassified systems ensures that gaps cannot be exploited in ways that undermine the Agency’s ability to carry out its mission.

Finding someone who hasn’t heard of TikTok in 2022 would be quite the achievement. As one of the most popular social media platforms of the moment, it is not only being used by our tweens, teens and even grownups to connect but also as a crucial way to tell important stories amidst a backdrop of natural disasters and even war.  

As parents, we know we need to keep up with the latest social media platforms but let’s be real – we don’t always have enough time. So, I’m going to do the hard work for you. Here’s my overview of TikTok – what it is, the risks, and most importantly, how you can help your kids (or yourself) stay safe while using it. You’re welcome!! 

What Actually Is Tik Tok? 

Tik Tok is a social media platform that can be downloaded on any smartphone via an app. Once you’ve signed up to the app and become a user, you can create and then share short videos of 15 seconds in length on any topic. 

The app started life as Musical.ly, a super popular video streaming app that also allowed users to make funny 15-second videos, many of which focussed on lip-syncing. By mid-2017, the app had over 200 million registered users.  In 2018, the app was taken over by Chinese company ByteDance and all of its users (and their content) were moved to TikTok. 

How Popular is Tik Tok? 

According to Hootsuite, TikTok is the 6th most used social media platform in the world. As of late September 2021, TikTok had over a billion monthly users and as of August last year, it overtook Facebook to become the world’s most downloaded app. Facebook does, however, have more monthly users, reporting a massive 2.74 billion users as of August 2021.  

Who Is Using It? 

It appears TikTok is used by females (57%) more than males (43%) however its user base is very diverse and cuts across all age categories – yes, even us parents! But brands hoping to reach younger female audiences are without a doubt using TikTok to showcase their wares. What is interesting is that although we all think that TikTok dominates the Gen Z market, research shows that it doesn’t rank as the top choice for younger users – in fact only 4.3% of users name it as their favorite platform. Users between 16 and 24 nominate Instagram as their top choice! 

How Old Do You Need To Be To Use TikTok? 

Unlike other social media platforms, there is no minimum age requirement when using TikTok. The company says that it adjusts a user’s privacy settings based on the birthday entered when setting up the account. If a user is under the age of 13, they will automatically be directed into the TikTok for Younger Users program which has additional privacy and safety protections. Of course, anyone can lie about their age, but TikTok has said publicly that it has moderators trained to predict when a user is suspected of being underage. 

What Are The Risks of Tiktok? 

As you would know, there are risks associated with using all social media platforms and TikTok is no exception. However, in my opinion the majority of these can be managed with a combination of critical thinking, parental controls, and preparation – more about these later.  

But let’s go worst-case scenario for one moment. Here are the potential risks that your child could encounter: 

• Contact from online predators 
• Inappropriate content: sexualized, violent, racist  
• Potentially damaging conversations around mental health 
• Anxiety from potentially poor reaction to their videos 

How To Manage The Risks On Tiktok? 

Unfortunately, it isn’t possible to keep our tweens and teens in a bubble – I know, so disappointing! So, the best and only option is to prepare them for challenges online and arm them with tools to navigate the tricky stuff. Here’s my advice on how to best help them manage TikTok:  

1. Download The App & Start a Conversation 

Knowledge is power, my friends. So, download the app and have a play so you better understand it. Then, why not ask your experienced in-house ‘TikTokers’ to show you how it works. Use this as an opportunity to ask them what they do when they see something that concerns them, or how they would manage approaches from people they don’t know. Why not weave in reminders about the importance of online privacy and the permanence of their digital footprint? Commit to making these conversations regular.  

2. Foster A Critical Thinking Mindset 

Helping your kids become critical thinkers is, without doubt, one of the best ways of helping them prepare for life’s challenges – both online and offline. Being able to rigorously question ideas and assumptions rather than accepting them at face value is your kids’ golden ticket! So, if they are approached by friendly (but ill-intentioned) strangers online or sent a link to a super compelling offer online, they will have the ‘smarts’ to realise that all is not as it seems and to hit delete! 

3. Use TikTok’s Parental Controls Or Help Them Set Up Privacy & Safety Settings  

If the horse has already bolted and your tween or teen has been using TikTok for a while, then introducing boundaries might be tricky but don’t give up! TikTok has a Family Pairing feature which allows parents to link their TikTok account to their teen’s account so they can control the settings remotely. This might be a good option if your child is younger or just starting out on TikTok. This gives parents the power to turn on Restricted Mode, screen time limits, and also turn off the direct message option.  

Leverage Tiktok’s Privacy Controls 

If your child has been using TikTok for some time and you want to pull things back, then why not work with them to set up their privacy and safety features. I find kids always respond best when you explain why you are doing something so assure them you are just wanting to keep them safe. TikTok has a long list of features you can enable that will make your offspring’s experience that much safer. From turning off downloads, filtering comments to introducing screen time limits, there is a great range of ways of making the TikTok experience much less risky. Check out the full list from TikTok here. 

So, next time you hear your kids reference TikTok, don’t immediately feel a pang of guilt that you don’t really know what they are talking about. You’ve got this! Download the app, take a look around, read this post a few more times, and you’ll be fine! And remember, our kids don’t expect us to be experts straight away, or even at all. They just need to know that we’re interested in all parts of their life and respect just how important their digital life is to them. 

You’ve got this!! 

Take care all 

Alex xx 

The post A Parent’s Guide to TikTok appeared first on McAfee Blog.

Editor’s Note: This is the third in a series of articles about how we can help our elder parents get the most out of digital life—the ways we can help them look after their finances and health online, along with how they can use the internet to keep connected with friends and family, all safely and simply. 

Now here’s a great topic. Spending more quality time with our folks, even if they’re far away. That’s the beauty of a family video chat. It’s a way to connect with more than voice. It’s a way to share moments together. 

If your parents and the older loved ones in your family haven’t come around to the idea of video chats just yet, now’s a good time to give it a try. Video chats are far easier to enjoy than ever, and with a little initiative from you, the family can gather around a video chat rather quickly. In fact, there’s plenty you can do to get them started.  

Video chats may be old hat to you, but it’s likely quite new to them 

Clearly, a video chat is different than a phone call. Beyond the technological differences, it’s quite a different way of interacting. After all, there you are, face-to-face, talking over a device. And that may feel a little awkward, especially for our parents. They’ve lived lives where long-distance conversations meant using a phone that was anchored to the kitchen wall. 

So aside from the technical considerations of video chats, there’s a degree of freedom that may leave our parents wondering what to do and how to act in this new medium. Just like when we first used video chat ourselves, questions come up … Where should I be looking on the screen … How should I hold the phone … Can everyone on this call see up my nose? 

You can ease them in by taking the lead, welcoming them into the notion that your video chat can be much more than a phone call. More than simply talking, it’s a chance to create a shared space together.  

A great example is this: a co-worker recently told me about his in-laws who were scouting out retirement communities to live in. Even though his in-laws lived 2,000 miles away, they all got to do a little house-hunting together. Using a smartphone, they took room-to-room tours of model homes together, got views of the tree-lined streets, checked out the pools and rec centers, and so on. A few weeks later, they shared another video call where his in-laws walked the family through their new place after they’d settled in. And all of it started with a simple request, “Hey, turn on FaceTime so we can take a look too!” 

So, in a way, video chats truly are an opportunity to create moments together. It could be as simple as asking grandma to read a book to the kids, have mom and dad share what they’re having for a birthday dinner, or ask them to show how hard it’s snowing outside their home. Anything you can do to encourage a little free interaction of some sort may make a video chat feel far more comfortable. You can really relax and interact once you settle in and let the possibilities unfold. 

Set a time for your call 

In a way, a video call is much like dropping by the house for a visit. Placing a video call unannounced may catch mom in her curlers, so to speak. Or, as we’ve heard our parents say when they looked at a messy living room, we may catch them when “the house isn’t ready for guests.” In either case, scheduling a time for a video call gives everyone time to prepare. Whether it’s sprucing up your appearance or simply getting into the headspace for a face-to-face interaction, a designated time helps everyone get ready. 

On your end, it’s an opportunity for you to prepare as well. Do the kids have some recent schoolwork or a project they’re proud of? Have them bring it for some show-and-tell. Doing some cooking lately and you just can’t seem to get the family secret BBQ sauce just right? Bring your folks into the kitchen for some cooking advice. Find an old treasure in storage? Break it out and flip through your old grade-school art scrapbook with them on the call. As you prepare, think about sharing and moments, some of the things you’d like to do together over a video call. That’ll make it all the more special. 

Picking a platform for your video call—smartphones and tablets are a straightforward way to go 

As you know, there are plenty ways to hold a video call. There’s a good chance you’ve used several platforms and apps yourself already, whether with friends, work, or a mix of both. So when it comes to picking what’s best for your video call, the question to ask here is what’s your parent’s comfort level with technology. 

If your parents are pretty comfortable with technology, you can share one of my earlier articles on video calls with them, which walks through the ins and outs of different apps and options. If they’re a little less savvy with technology, ideally they have a smartphone or tablet that they can use. Chances are, that device will have video calling built right in, such as Apple’s FaceTime or Google Duo on Android devices—both of which make video calls an easier “point and shoot” experience.  

Even if you’re using different devices, you can still use apps like FaceTime between Androids and iPhones. It’s rather straightforward, as all it takes is for one party or other to click a link. Additionally, Google Duo is available as an app in Apple’s App Store, which makes it easy for everyone to get on one platform as needed. 

Video calls on laptops and computers 

If a smartphone or tablet isn’t in the picture, there are certainly options for laptops and computers, several you may also know well already. Of the free and relatively straightforward apps out there, you can choose from: 

Zoom

With a free account that can run through a browser window, you and your parents can enjoy a call without having to manually download an app. 

Skype

This comes standard on Windows PCs and supports apps for all kinds of tablets and smartphones too. If you want to create a video chat without an account, you can simply visit this page and start an instant video chat with a click.  

Google Meet

Free to anyone with a free Google Gmail account, you can use Google Meet just by clicking its icon from your Google apps menu or by visiting https://meet.google.com/. Like Zoom and Skype, it can run in the window of a browser, so there’s no app to manually download. 

Of course, your folks will need a camera and microphone for their computer. If they don’t have one, there are plenty of moderately priced web cameras that include a microphone. I suggest getting one with a physical lens cap. That way they can protect privacy. Of course, they can always simply disconnect it when they’re not using it. 

Setting up a laptop or computer for video calls may take a little bit of work. You can help your parents by walking them through the process with these articles: 

• If they have a Windows computer, you can check out this quick article to get the audio set up and this article for setting up the camera.  
• For Macs, check out this article for setting up audio and this article for setting up video. 

Keeping safe on your calls 

Once you’re all set up, here are a few things that you and your parents can do to help keep your calls private and secure.   

1) Set a password 

If your video chap app generates a link that others can click to join in, be sure to create a password that uninvited parties can’t join in as well. Also, don’t be shy about asking your family members to use a password on the calls they initiate. It’s pretty much standard practice nowadays. 

2) Double-check any video chat invitation links 

Likewise, with any chat link that’s sent to you, be sure that link is legitimate. Confirm the link with the family member who sent it, particularly if you weren’t expecting one. (This is another good reason to schedule calls. Family members will be on the lookout for that link.) 

3) Use security software 

Make sure that you’re using comprehensive online protection software that helps steer you clear of scam emails and links, along with browser protection that blocks links that could send you to sketchy websites. That way, if you do get sent a bogus invite link from a scammer, you’ll be protected. 

4) Keep your apps and operating system up to date 

Aside from giving you the latest features and functionality, updates also often include essential security improvements. Set your computer to update itself automatically and consider using security software that will scan for vulnerabilities and install updates automatically as needed. 

Chat it up! 

An interesting closing note is that getting comfortable with video chat may open a world of other possibilities as well. Perhaps once they get online and see how video chats work, they’ll reach out to other friends and them get in on it too, creating more opportunities to reach out and spend time with others. In other words, you may really start something here by getting mom and dad on video chat. 

Additionally, early research has shown that older adults who use regularly technologies like video chat have seen positive impacts in their long-term memory compared to those who just interacted over the phone or in person. Similarly, research has shown that the use of technology, in general, can enhance mental health for older adults as well.  

With that, I hope you’ll give it a try with your parents and older loved ones. Meet the inevitable technical bumps in the road with a smile because this journey will be absolutely worth it. For all of you. 

The post Helping Mom & Dad: Family Video Chats appeared first on McAfee Blog.

Microsoft and identity management platform Okta both this week disclosed breaches involving LAPSUS$, a relatively new cybercrime group that specializes in stealing data from big companies and threatening to publish it unless a ransom demand is paid. Here’s a closer look at LAPSUS$, and some of the low-tech but high-impact methods the group uses to gain access to targeted organizations.

First surfacing in December 2021 with an extortion demand on Brazil’s Ministry of Health, LAPSUS$ made headlines more recently for posting screenshots of internal tools tied to a number of major corporations, including NVIDIA, Samsung, and Vodafone.

On Tuesday, LAPSUS$ announced via its Telegram channel it was releasing source code stolen from Microsoft. In a blog post published Mar. 22, Microsoft said it interrupted the LAPSUS$ group’s source code download before it could finish, and that it was able to do so because LAPSUS$ publicly discussed their illicit access on their Telegram channel before the download could complete.

“This public disclosure escalated our action allowing our team to intervene and interrupt the actor mid-operation, limiting broader impact,” Microsoft wrote. “No customer code or data was involved in the observed activities. Our investigation has found a single account had been compromised, granting limited access. Microsoft does not rely on the secrecy of code as a security measure and viewing source code does not lead to elevation of risk.”

While it may be tempting to dismiss LAPSUS$ as an immature and fame-seeking group, their tactics should make anyone in charge of corporate security sit up and take notice. Microsoft says LAPSUS$ — which it boringly calls “DEV-0537” — mostly gains illicit access to targets via “social engineering.” This involves bribing or tricking employees at the target organization or at its myriad partners, such as customer support call centers and help desks.

“Microsoft found instances where the group successfully gained access to target organizations through recruited employees (or employees of their suppliers or business partners),” Microsoft wrote. The post continues:

“DEV-0537 advertised that they wanted to buy credentials for their targets to entice employees or contractors to take part in its operation. For a fee, the willing accomplice must provide their credentials and approve the MFA prompt or have the user install AnyDesk or other remote management software on a corporate workstation allowing the actor to take control of an authenticated system. Such a tactic was just one of the ways DEV-0537 took advantage of the security access and business relationships their target organizations have with their service providers and supply chains.”

The LAPSUS$ Telegram channel has grown to more than 45,000 subscribers, and Microsoft points to an ad LAPSUS$ posted there offering to recruit insiders at major mobile phone providers, large software and gaming companies, hosting firms and call centers.

Sources tell KrebsOnSecurity that LAPSUS$ has been recruiting insiders via multiple social media platforms since at least November 2021. One of the core LAPSUS$ members who used the nicknames “Oklaqq” and “WhiteDoxbin” posted recruitment messages to Reddit last year, offering employees at AT&T, T-Mobile and Verizon up to $20,000 a week to perform “inside jobs.”

Many of LAPSUS$’s recruitment ads are written in both English and Portuguese. According to cyber intelligence firm Flashpoint, the bulk of the group’s victims (15 of them) have been in Latin America and Portugal.

“LAPSUS$ currently does not operate a clearnet or darknet leak site or traditional social media accounts—it operates solely via Telegram and email,” Flashpoint wrote in an analysis of the group. “LAPSUS$ appears to be highly sophisticated, carrying out increasingly high-profile data breaches. The group has claimed it is not state-sponsored. The individuals behind the group are likely experienced and have demonstrated in-depth technical knowledge and abilities.”

Microsoft said LAPSUS$ has been known to target the personal email accounts of employees at organizations they wish to hack, knowing that most employees these days use some sort of VPN to remotely access their employer’s network.

“In some cases, [LAPSUS$] first targeted and compromised an individual’s personal or private (non-work-related) accounts giving them access to then look for additional credentials that could be used to gain access to corporate systems,” Microsoft wrote. “Given that employees typically use these personal accounts or numbers as their second-factor authentication or password recovery, the group would often use this access to reset passwords and complete account recovery actions.”

In other cases, Microsoft said, LAPSUS$ has been seen calling a target organization’s help desk and attempting to convince support personnel to reset a privileged account’s credentials.

“The group used the previously gathered information (for example, profile pictures) and had a native-English-sounding caller speak with the help desk personnel to enhance their social engineering lure,” Microsoft explained. “Observed actions have included DEV-0537 answering common recovery prompts such as “first street you lived on” or “mother’s maiden name” to convince help desk personnel of authenticity. Since many organizations outsource their help desk support, this tactic attempts to exploit those supply chain relationships, especially where organizations give their help desk personnel the ability to elevate privileges.”

SIM-SWAPPING PAST SECURITY

Microsoft said LAPSUS$ also has used “SIM swapping” to gain access to key accounts at target organizations. In a fraudulent SIM swap, the attackers bribe or trick mobile company employees into transferring a target’s mobile phone number to their device. From there, the attackers can intercept any one-time passwords sent to the victim via SMS or phone call. They can also then reset the password for any online account that allows password resets via a link sent over SMS.

“Their tactics include phone-based social engineering; SIM-swapping to facilitate account takeover; accessing personal email accounts of employees at target organizations; paying employees, suppliers, or business partners of target organizations for access to credentials and multifactor authentication (MFA) approval; and intruding in the ongoing crisis-communication calls of their targets,” Microsoft wrote.

Allison Nixon is chief research officer at Unit 221B, a cybersecurity consultancy based in New York that closely tracks cybercriminals involved in SIM-swapping. Working with researchers at security firm Palo Alto Networks, Nixon has been tracking individual members of LAPSUS$ prior to their forming the group, and says the social engineering techniques adopted by the group have long been abused to target employees and contractors working for the major mobile phone companies.

“LAPSUS$ may be the first to make it extremely obvious to the rest of the world that there are a lot of soft targets that are not telcos,” Nixon said. “The world is full of targets that are not used to being targeted this way.”

Microsoft says LAPSUS$ also has been known to gain access to victim organizations by deploying the “Redline” password-stealing malware, searching public code repositories for exposed passwords, and purchasing credentials and session tokens from criminal forums.

That last bit is interesting because Nixon said it appears at least one member of LAPSUS$ also was involved in the intrusion at game maker Electronic Arts (EA) last year, in which extortionists demanded payment in exchange for a promise not to publish 780 GB worth of source code. In an interview with Motherboard, the hackers claimed to have gained access to EA’s data after purchasing authentication cookies for an EA Slack channel from a dark web marketplace called Genesis.

“The hackers said they used the authentication cookies to mimic an already-logged-in EA employee’s account and access EA’s Slack channel and then trick an EA IT support staffer into granting them access to the company’s internal network,” wrote Catalin Cimpanu for The Record.

Why is Nixon convinced LAPSUS$ was behind the EA attack? The “WhiteDoxbin/Oklaqq” identity referenced in the first insider recruitment screenshot above appears to be the group’s leader, and it has used multiple nicknames across many Telegram channels. However, Telegram lumps all aliases for an account into the same Telegram ID number.

Back in May 2021, WhiteDoxbin’s Telegram ID was used to create an account on a Telegram-based service for launching distributed denial-of-service (DDoS) attacks, where they introduced themself as “@breachbase.” News of EA’s hack last year was first posted to the cybercriminal underground by the user “Breachbase” on the English-language hacker community RaidForums, which was recently seized by the FBI.

WHO IS LAPSUS$?

Nixon said WhiteDoxbin — LAPSUS$’s apparent ringleader — is the same individual who last year purchased the Doxbin, a long-running, text-based website where anyone can post the personal information of a target, or find personal data on hundreds of thousands who have already been “doxed.”

Apparently, Doxbin’s new owner failed to keep the site functioning smoothly, because top Doxbin members had no problems telling WhiteDoxbin how unhappy they were with his stewardship.

“He wasn’t a good administrator, and couldn’t keep the website running properly,” Nixon said. “The Doxbin community was pretty upset, so they started targeting him and harassing him.”

Nixon said that in January 2022, WhiteDoxbin reluctantly agreed to relinquish control over Doxbin, selling the forum back to its previous owner at a considerable loss. However, just before giving up the forum, WhiteDoxbin leaked the entire Doxbin data set (including private doxes that had remained unpublished on the site as drafts) to the public via Telegram.

The Doxbin community responded ferociously, posting on WhiteDoxbin perhaps the most thorough dox the community had ever produced, including videos supposedly shot at night outside his home in the United Kingdom.

According to the denizens of Doxbin, WhiteDoxbin started out in the business of buying and selling zero-day vulnerabilities, security flaws in popular software and hardware that even the makers of those products don’t yet know about.

“[He] slowly began making money to further expand his exploit collection,” reads his Doxbin entry. “After a few years his net worth accumulated to well over 300BTC (close to $14 mil).”

WhiteDoxbin’s Breachbase identity on RaidForums at one point in 2020 said they had a budget of $1 million in bitcoin with which to buy zero-day flaws in Github, Gitlab, Twitter, Snapchat, Cisco VPN, Pulse VPN and other remote access or collaboration tools.

“My budget is $100000 in BTC,” Breachbase told Raidforums in October 2020. “Person who directs me to someone will get $10000 BTC. Reply to thread if you know anyone or anywhere selling this stuff. NOTE: The 0day must have high/critical impact.”

KrebsOnSecurity is not publishing WhiteDoxbin’s alleged real name because he is a minor (currently aged 17), and because this person has not officially been accused of a crime. Also, the Doxbin entry for this individual includes personal information on his family members.

Nixon said that prior to launching LAPSUS$, WhiteDoxbin was a founding member of a cybercriminal group calling itself the “Recursion Team.” According to the group’s now-defunct website, they mostly specialized in SIM swapping targets of interest and participating in “swatting” attacks, wherein fake bomb threats, hostage situations and other violent scenarios are phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address.

“The team is made up of Cyber-enthusiasts who major in skills including security penetration, software development, and botting,” reads the now-defunct Recursion Team website. “We plan to have a bright future, and we hope you do too!”