Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Google Docs Phishing Scam a Game Changer
Newest First  |  Oldest First  |  Threaded View
JulietteRizkallah
50%
50%
JulietteRizkallah,
User Rank: Ninja
5/8/2017 | 4:08:12 PM
Best Mitigation
will be identity governance.  Control access, certify access periodically, identify rogue and orphan accounts, revoke access/accounts when needed.
macker490
50%
50%
macker490,
User Rank: Ninja
5/6/2017 | 7:50:29 AM
same 2 fundamental issues
the attack exploits the same 2 fundamental issues

 

(1) failer to authenticate source of message

(2) vulnerable operating software

 

PGP/GPG has been available now for years -- since the 90s.    the problem of authentication in a digial net will not be solved until PGP/GPG is adopted as a General Practice.    2FA doesn't do it.   ( read hack stories on ss7 this week )   .    biometrics don't help -- the digital representation of your fingerprint can be stolen just like a copy of your SSN.    but you can't change your fingerprint   ( unless you wear a latex "forgery" fingerprint ) like you can your password

 

at least adopt PGP/GPG.     these can be incorporated into (e.g.) Outlook, Thunderbird, Echelon, Claws.   once configured   ( IT Job ) -- it's easy to use ---- ALL THE TIME

to do it isn't trivial: you have to learn how to verify identifications ( "keys" in PGP/GPG ).   alas,   that is what this problem is all about.

as far as the o/s goes -- avoid using an o/s that is easily compromised.    you know what i'm talking about
AcklenX
100%
0%
AcklenX,
User Rank: Apprentice
5/5/2017 | 11:26:43 AM
The endpoint under attack is the user

The endpoint under attack is the user.  And users need an update that helps them protect against these types of attacks.  If users think that knowing the sender means they can trust the email... they need an update (specific, relevant training), because that's just not true (e.g. have you never received an email from a trusted friend asking you to wire money because they were robbed while traveling abroad and now they're stuck?). Likewise, if you think you can trust the url you see in the address bar because it starts with https and has a green lock next to it, you need an update (e.g. Phishing with Unicode Domains).

Security awareness training doesn't cut it.   It's too slow to create a "patch".  Better offerings allow peers to report phish they detected, that their peers may have missed, but who clicked first? That software is even slower pushing new training to users (how often do you go through the security awareness training?).  And all of that can only happen after the compromise has occurred (perhaps to you), been detected, analyzed, remediated, packaged, pushed, and applied(more training).  And these are people we're talking about, so even if it's been pushed, they may not apply the new information pushed to them.  

And that's the real problem... training does nothing the protect you if you don't apply it.  Coupled with the recognition that secure web/email gateways don't cut it either ("There is absolutely no role of endpoint security products to detect and protect against such an attack"), and it's pretty clear that the only fix is to patch users and enforce the application their updated knowledge in the real world.  

The users are the endpoint, and the security software has to run on them. 

 

Quincy

 

 



US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16649
PUBLISHED: 2019-09-21
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the...
CVE-2019-16650
PUBLISHED: 2019-09-21
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the se...
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.