Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Google Docs Phishing Scam a Game Changer
Newest First  |  Oldest First  |  Threaded View
JulietteRizkallah
50%
50%
JulietteRizkallah,
User Rank: Ninja
5/8/2017 | 4:08:12 PM
Best Mitigation
will be identity governance.  Control access, certify access periodically, identify rogue and orphan accounts, revoke access/accounts when needed.
macker490
50%
50%
macker490,
User Rank: Ninja
5/6/2017 | 7:50:29 AM
same 2 fundamental issues
the attack exploits the same 2 fundamental issues

 

(1) failer to authenticate source of message

(2) vulnerable operating software

 

PGP/GPG has been available now for years -- since the 90s.    the problem of authentication in a digial net will not be solved until PGP/GPG is adopted as a General Practice.    2FA doesn't do it.   ( read hack stories on ss7 this week )   .    biometrics don't help -- the digital representation of your fingerprint can be stolen just like a copy of your SSN.    but you can't change your fingerprint   ( unless you wear a latex "forgery" fingerprint ) like you can your password

 

at least adopt PGP/GPG.     these can be incorporated into (e.g.) Outlook, Thunderbird, Echelon, Claws.   once configured   ( IT Job ) -- it's easy to use ---- ALL THE TIME

to do it isn't trivial: you have to learn how to verify identifications ( "keys" in PGP/GPG ).   alas,   that is what this problem is all about.

as far as the o/s goes -- avoid using an o/s that is easily compromised.    you know what i'm talking about
AcklenX
100%
0%
AcklenX,
User Rank: Apprentice
5/5/2017 | 11:26:43 AM
The endpoint under attack is the user

The endpoint under attack is the user.  And users need an update that helps them protect against these types of attacks.  If users think that knowing the sender means they can trust the email... they need an update (specific, relevant training), because that's just not true (e.g. have you never received an email from a trusted friend asking you to wire money because they were robbed while traveling abroad and now they're stuck?). Likewise, if you think you can trust the url you see in the address bar because it starts with https and has a green lock next to it, you need an update (e.g. Phishing with Unicode Domains).

Security awareness training doesn't cut it.   It's too slow to create a "patch".  Better offerings allow peers to report phish they detected, that their peers may have missed, but who clicked first? That software is even slower pushing new training to users (how often do you go through the security awareness training?).  And all of that can only happen after the compromise has occurred (perhaps to you), been detected, analyzed, remediated, packaged, pushed, and applied(more training).  And these are people we're talking about, so even if it's been pushed, they may not apply the new information pushed to them.  

And that's the real problem... training does nothing the protect you if you don't apply it.  Coupled with the recognition that secure web/email gateways don't cut it either ("There is absolutely no role of endpoint security products to detect and protect against such an attack"), and it's pretty clear that the only fix is to patch users and enforce the application their updated knowledge in the real world.  

The users are the endpoint, and the security software has to run on them. 

 

Quincy

 

 



Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5735
PUBLISHED: 2020-04-08
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.
CVE-2020-5736
PUBLISHED: 2020-04-08
Amcrest cameras and NVR are vulnerable to a null pointer dereference over port 37777. An authenticated remote attacker can abuse this issue to crash the device.
CVE-2017-18646
PUBLISHED: 2020-04-08
An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. An attacker can bypass the password requirement for tablet user switching by folding the magnetic cover. The Samsung ID is SVE-2017-10602 (December 2017).
CVE-2020-5549
PUBLISHED: 2020-04-08
Cross-site request forgery (CSRF) vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier and Enterprise Ver. 2.0.1 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2020-5550
PUBLISHED: 2020-04-08
Session fixation vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier, and Enterprise Ver. 2.0.1 and earlier allows remote attackers to impersonate a registered user and log in the management console, that may result in information alteration/disclosure via unspecified vectors.