Security

Security automation startup Veriti launches out of stealth with $18.5M • ZebethMedia

By zebethcontrolPosted on November 8, 2022Posted in AI, cybersecurity, Enterprise, funding, Security, startup, StartupsNo Comments

Veriti, a platform for unifying cybersecurity infrastructure, today emerged from stealth with $18.5 million in funding, a combination of $12 million from Insight Partners and a $6.5 million round led by NFX and Amiti. According to CEO Adi Ikan, the newly announced capital is being put toward scaling Veriti’s business operations and developing its product suite. Veriti’s launch comes as VCs continue to show enthusiasm for cybersecurity startups despite the generally unfavorable funding climate. According to PitchBook data, venture capital investments in the security sector this year eclipsed $13.66 billion — up from $11.47 billion in 2020. And the global cybersecurity market is projected to be worth over $500 billion by 2030. Founded in 2021 by Ikan and Oren Koren — both ex-Check Point executives — Veriti integrates with a company’s existing security stack to evaluate risk posture by analyzing security configurations, logs, sensor telemetries and threat intelligence feeds. The platform taps AI to identify which events might be impacting business uptime and present the root cause, as well as which security policy improvements need to be taken to remediate the impacts. “Enterprise security posture is usually sub-optimal. This is due to many reasons, including tool sprawl, increased complexity, massive amounts of data and limited resources,” Koren told ZebethMedia in an email interview. “This is what inspired us to build Veriti’s platform — to address these complexities and help IT and security stay on top of this challenge.” Koren makes the case that Veriti can augment security teams’ efforts in spotting security gaps, ultimately reducing the time spent on monitoring and maintenance tasks. The growing number of security solutions in organizations can introduce complexity because each solution has its own functions and tools to learn, he argues, while the volume of alerts issued by the solutions end up creating murky visibility into the actual security posture. Koren isn’t exactly an unbiased source. But he’s not the only one who’s observed these troubling trends in enterprise security. One recent survey of over 800 IT professionals found that almost 60% were receiving over 500 cloud security alerts per day, and that the alert fatigue created by the volume caused 55% to miss critical alerts on either a daily or weekly basis. “While affording more expansive security capabilities, the proliferation of security solutions creates room for misconfigurations that can result in inadvertent security gaps and adversely impact the business by blocking legitimate applications and users,” Ikan said via email. “IT and security leadership today have a poor idea of the true utilization of security investments and of the effective security posture of their organizations.” Veriti’s challenge will be demonstrating that its approach is superior to the other security posture-analyzing platforms on the market. Rival vendor Secureframe provides a service that integrates with cloud providers and apps to understand its customers’ security postures. Hunters, another competitor, aims to automate the threat-hunting process by taking in data from networking and security tools to detect stealth attacks. It’s very early days for Veriti — Koren wouldn’t reveal the size of the company’s customer base or current revenue. But he’s betting that Veriti’s tech expertise will help it stand out from the pack. “By leveraging modern techniques like machine learning, focusing on automation, we aim to provide a way for modern teams to maximize security posture while minimizing issues that impact business uptime,” he said. As the idiom goes: time will tell.

Ransomware gang threatens to publish thousands of Australians’ health data • ZebethMedia

By zebethcontrolPosted on November 8, 2022Posted in data breach, medibank breach, ransomware, SecurityNo Comments

A ransomware group with suspected links to the notorious Russia-speaking REvil gang has threatened to release the personal information of millions of Medibank customers after the Australian private health insurance giant pledged it would not pay the cybercriminals’ ransom demand. Medibank, Australia’s largest health insurance provider, first disclosed a “cyber incident” on October 13, saying at the time that it detected unusual activity on its network and took immediate steps to contain the incident. Days later, the company said that customer data might have been exfiltrated. In an update posted this week, the Melbourne-based Medibank admitted that the attackers accessed roughly 9.7 million customers’ personal information, including names, birth dates, email addresses, and passport numbers. The cybercriminals also accessed health claims data for almost 500,000 customers, including service provider names and locations, where customers received certain medical services, and codes associated with diagnosis and procedures administered. For 5,200 users of Medibank’s My Home Hospital app, the cybercriminals accessed some personal and health claims data and, for some, next of kin contact details. Medibank CEO David Koczkar said that while the health insurance giant believes that the attackers likely exfiltrated all of the data they were able to access, the organization would not pay the ransom demand. “Based on the extensive advice we have received from cybercrime experts, we believe there is only a limited chance paying a ransom would ensure the return of our customers’ data and prevent it from being published,” Koczkar said. The chief executive added that paying could even encourage the hackers to adopt a triple-extortion tactic by attempting to extort customers directly. Following Koczkar’s announcement, a ransomware gang believed to be a rebrand of the defunct REvil group threatened to leak the stolen Medibank data. The new dark web leak site, seen by ZebethMedia, listed Medibank as one of its victims and said it planned to release the exfiltrated data publicly. The gang did not say how much data it exfiltrated from Medibank’s network, and did not share evidence of its claims. The links between the new leak site and REvil, which went dark after U.S. authorities pushed the operation offline in October after the gang targeted ransomware attacks against Colonial Pipeline, JBS Foods and U.S. technology firm Kaseya, remains unclear. Brett Callow, a ransomware expert and threat analyst at Emsisoft, said that the new operation uses a variant of REvil’s file-encrypting website and that REvil’s old website now redirects to the new leak site. Medibank described the gang’s threats as a “distressing development,” in a second update published on Tuesday, and urged customers to be vigilant with all online communications and transactions. “We unreservedly apologise to our customers. We take seriously our responsibility to safeguard our customers and support them,” said Koczkar. “The weaponization of their private information is malicious, and it is an attack on the most vulnerable members of our community.” Medibank added that it is working with the Australian Government, including the Australian Cyber Security Centre and the Australian Federal Police, in order to try and prevent the sharing and sale of customer data. News of the Medibank attack comes just weeks after Australia’s second largest telco Optus was breached. The Australian government confirmed an upcoming legislative change that would see companies that fail to adequately protect people’s data face fines of $50 million or more.

SolarWinds says it’s facing SEC ‘enforcement action’ over 2020 hack • ZebethMedia

By zebethcontrolPosted on November 7, 2022Posted in cyberattacks, espionage, russia, Security, SolarWindsNo Comments

The long hangover from a 2020 state-sponsored compromise still isn’t over for SolarWinds, as the software giant targeted by Russian government hackers has to pony up $26 million to shareholders and face possible enforcement action from the federal government. In a recent 8-K filing with the U.S. Securities and Exchange Commission, SolarWinds said it reached an agreement with shareholders, who sued the company alleging they were misled about the 2020 hack. Investors accused the software house, which makes network management tools used by corporations and government departments, of misrepresenting its security and failing to adequately monitor cybersecurity risks. SolarWinds will not accept any liability or admit fault as part of the shareholder suit, if a court agrees to the settlement. SolarWinds was initially hacked as far back as in 2019 by hackers associated with Russia’s foreign intelligence service, who broke in to the company’s network and planted a backdoor in the company’s flagship Orion network management product, which when pushed as a tainted software updates to customers, allowing the Russian hackers to further access the networks of every network running the compromised SolarWinds software. News of the attack began to emerge a year later in late 2020. Several government departments, including NASA, the Justice Department, and Homeland Security, were compromised by the mass breach, with the bulk of victims including private companies, like security giant FireEye, Fortune 500 companies, and hospitals and universities. The U.S. government later attributed the hack to the Russian government as part of a long-running espionage campaign. In the same filing, SolarWinds also said it received a Wells notice from the SEC, informing the company of the regulator’s intention to file enforcement action “with respect to its cybersecurity disclosures and public statements, as well as its internal controls and disclosure controls and procedures.” SolarWinds said its disclosures and public statements at the time of the breach were “appropriate,” but did not elaborate. The SEC began investigating the SolarWinds breach in 2021, including whether some companies failed to disclose that they were affected by the breach and allegations of possible insider trading, according to The Washington Post. Spokespeople for the SEC, which does not comment on its investigations, and SolarWinds, did not respond to a request for comment.

UK government is scanning British internet space for zero-day threats • ZebethMedia

By zebethcontrolPosted on November 7, 2022Posted in cybersecurity, NCSC, Security, UK government, Vulnerabilities, zero dayNo Comments

The U.K.’s National Cyber Security Centre has launched a new program that will continually scan every internet-connected device hosted in the United Kingdom for vulnerabilities to help the government respond to zero-day threats. The NCSC, part of the Government Communications Headquarters that acts as the U.K.’s public-facing technical authority for cyber threats, says it launched the initiative to build a data-driven view of “the vulnerability and security of the U.K.” It’s similar to efforts by Norway’s National Security Authority, which last year saw the agency look for evidence of exploitation of Microsoft Exchange vulnerabilities targeting internet users in the country. Slovenia’s cybersecurity response unit, known as SI-CERT, also said at the time that it was notifying potential victims of the Exchange zero-day bug in its internet space. The NCSC’s scanning activity will cover any internet-accessible system that is hosted within the U.K., the agency explains, and will hunt for vulnerabilities that are common or particularly important due to widespread impact. The NCSC says it will use the data collected to create “an overview of the U.K.’s exposure to vulnerabilities following their disclosure and track their remediation over time.” The agency also hopes the data will help to advise system owners about their security posture on a day-to-day basis and to help the U.K. respond faster to incidents, like zero-day vulnerabilities that are under active exploitation. The agency explains that the information collected from these scans includes any data sent back when connecting to services and web servers, such as the full HTTP responses, along with information for each request and response, including the time and date of the request and the IP addresses of the source and destination endpoints. It notes that requests are designed to collect the minimum amount of information required to check if the scanned asset is affected by a vulnerability. If any sensitive or personal data is inadvertently collected, the NCSC says it will “take steps to remove the data and prevent it from being captured again in the future.” The scans are performed using tools running from inside the NCSC’s dedicated cloud-hosted environment, allowing network administrations to easily identify the agency in their logs. U.K.-based organizations can opt out of having their servers scanned by the government by emailing the NCSC a list of IP addresses they want excluded. “We’re not trying to find vulnerabilities in the U.K. for some other, nefarious purpose,” explained Ian Levy, the NCSC’s outgoing technical director, in a blog post. “We’re beginning with simple scans, and will slowly increase the complexity of the scans, explaining what we’re doing (and why we’re doing it).”

2023 will be the year of cyber-risk quantification • ZebethMedia

By zebethcontrolPosted on November 7, 2022Posted in Column, cyber risk quantification, cybersecurity, EC Column, EC Cybersecurity, Security, StartupsNo Comments

CRQ is the hottest thing in cybersecurity right now John Chambers Contributor John Chambers is the founder and CEO of JC2 Ventures. Previously, he served as executive chairman and CEO of Cisco. Geopolitical tensions, supply chain challenges, an economic slowdown, an ongoing pandemic and more have meant that companies and people have been impacted in ways that will change how business will be conducted for many years to come, and the ripple effects of these converging variables will be felt for a long time. As headlines continue to be dominated by increasing interest rates, businesses must ensure their budget is being spent efficiently. But despite the economic downturn, the cybersecurity and AI industries have grown steadily over the past 18 months or so. Cybersecurity is critical to businesses’ revenue, growth, reputation and overall function. But are we doing everything to manage the level of risk that exists in our hyperconnected world, or is there a missing link? Cybersecurity is growing more crucial every year A Nasdaq report suggests that 14 market days after a breach becomes public, the average share price of a company bottoms out and underperforms by -3.5% on the stock exchange. An even more alarming data point is that businesses accrue more than 50% of post-breach damages as long-tail costs. More specifically, 31% of expenses are accrued in the second year, and 24% are accrued more than two years after the breach in highly regulated industries. Still, 29% of CEOs and CISOs and 40% of Chief Security Officers admit their organizations are unprepared for the rapidly changing threat landscape.

Crime group hijacks hundreds of US news websites to push malware • ZebethMedia

By zebethcontrolPosted on November 3, 2022Posted in Evil Corp, hackers, malware, Proofpoint, ransomware, SecurityNo Comments

A cybercriminal group has compromised a media content provider to deploy malware on the websites of hundreds of news outlets in the U.S., according to cybersecurity company Proofpoint. The threat actors, tracked by Proofpoint as “TA569,” compromised the media organization to spread SocGholish, a custom malware active since at least 2018. The media company in question is not named, but was notified and is said to be investigating. Sherrod DeGrippo, vice president of threat research and detection at Proofpoint, tells ZebethMedia that the organization provides “both video content and advertising to major news outlets.” DeGrippo added that 250 U.S. national newspaper sites and regional websites are affected, including media organizations serving Boston, Chicago, Cincinnati, Miami, New York, Palm Beach, and Washington, D.C. It’s unclear how the unnamed media company was compromised, but DeGrippo added that TA569 “has a demonstrated history of compromising content management systems and hosting accounts.” The SocGholish malware is injected into a benign JavaScript file that is loaded by the news outlets’ websites, which prompts the website visitor to download a fake software update. In this campaign, the prompt takes the form of a browser update for Chrome, Firefox, Internet Explorer, Edge, or Opera. “If the victim downloads and executes this ‘fakeupdate’ they will be infected by the SocGholish payload,” said DeGrippo. “This attack chain requires interaction from the end user at two points: accepting the download and executing the payload.” SocGholish serves as an “initial access threat,” which if successfully planted have historically served as a precursor to ransomware, according to Proofpoint. The threat actors’ end goal, the company says, is financial gain. Proofpoint tells ZebethMedia that it “assesses with high confidence” that TA569 is associated with WastedLocker, a variant of ransomware developed by the U.S.-sanctioned Evil Corp group. The company added that it does not believe TA569 is Evil Corp, but rather acts as a broker of already-compromised devices for the hacking group. It was revealed earlier this year that Evil Corp uses a ransomware-as-a-service model in an effort to skirt U.S. sanctions. The gang was sanctioned December 2019 due to its extensive development of Dridex malware, which the gang used to steal more than $100 million from hundreds of banks and financial institutions.

AstraZeneca password lapse exposed patient data • ZebethMedia

By zebethcontrolPosted on November 3, 2022Posted in astrazeneca, cybersecurity, data security, healthcare, SecurityNo Comments

Pharmaceutical giant AstraZeneca has blamed “user error” for leaving a list of credentials online for more than a year that exposed access to sensitive patient data. Mossab Hussein, chief security officer at cybersecurity startup SpiderSilk, told ZebethMedia that a developer left the credentials for an AstraZeneca internal server on code sharing site GitHub in 2021. The credentials allowed access to a test Salesforce cloud environment, often used by businesses to manage their customers, but the test environment contained some patient data, Hussein said. Some of the data related to AZ&ME applications, which offers discounts to patients who need medications. ZebethMedia provided details of the exposed credentials to AstraZeneca, and the GitHub repository containing the credentials was inaccessible hours later. In a statement, AstraZeneca spokesperson Patrick Barth told ZebethMedia: “The protection of personal data is extremely important to us and we strive for the highest standards and compliance with all applicable rules and laws. Due to an [sic] user error, some data records were temporarily available on a developer platform. We stopped access to this data immediately after we have been [sic] informed. We are investigating the root cause as well as assessing our regulatory obligations.” Barth declined to say for what reason patient data was stored on a test environment, and if AstraZeneca has the technical means, such as logs, to determine if anyone accessed the data and what, if any, data was exfiltrated. Credentials, like usernames and passwords, that are exposed or inadvertently published to sites like GitHub are an increasingly common discovery for security researchers like SpiderSilk’s Hussein. In the past few years, the startup has discovered exposed data belonging to Samsung, the controversial facial recognition startup Clearview AI; and the since-rebooted movie subscription MoviePass. In August, Hussein discovered credentials belonging to Microsoft employees that had been posted inadvertently to GitHub, which Microsoft owns. “This isn’t the first time we’ve come across leaked credentials put on Github by engineers due to human error, and it just keeps happening across the board,” Hussein told ZebethMedia. “The risk in these accidental leaks is that they occur randomly, and the exploitation path is often straightforward (i.e. making threat actors’ jobs easier).”

Applications security startup Apiiro pulls in $100M Series B from A-list investors • ZebethMedia

By zebethcontrolPosted on November 3, 2022Posted in Apiiro, applications security, General Catalyst, Israeli startups, Security, StartupsNo Comments

At a time when large rounds are a thing of the past, especially in the early stages, Apiiro, an applications security startup, announced a $100 million Series B today from several top shelf Silicon Valley firms. What is attracting this kind of investment in a time when investors otherwise are in a period of belt tightening? The company is working to help developers and security operations find and solve issues that could result in vulnerabilities, and do so in a proactive manner, says company co-founder and CEO Idan Plotnik. “Developers and application security engineers today are literally overwhelmed with siloed tools, manual risk assessment processes and too many alerts with false positives without any context. Apiiro helps developers and application security engineers to proactively fix the most critical risks to the business with actionable context using one solution,” he explained. Unlike similar tools, Apiiro isn’t just checking the CI/CD pipeline or production for vulnerabilities, it starts at the design phase. “Before you start to code, at the design phase when you just create a user story with a new feature request, we analyze the text and raise a flag when a potential risky feature is requested,” he said. Beyond that, the company is aiming to be a set of guard rails for the development team as the application moves through design, building and production. What’s more, Plotnik says, it is not simply about pointing out potential vulnerabilities like Log4j, it’s finding the ones that could matter most to the team. That can help cut down on the noise and limit the number of fixes. “Let’s say in my code base that I have 5000 Log4j instances with a CVSS score (risk assessment score) of 10, but in your runtime you have only 100 of them and only 50 of them are actually exposed to the internet in a high business impact application. This is why we’re looking at context… to make sure developers fix only the most critical risks, ones that attackers can actually exploit,” Plotnik said. Quentin Clark, managing director at lead investor, General Catalyst, says that his firm invested this kind of money because security is a category that’s constantly changing and they saw a lot of potential here. “Security is one of these areas where you have to sort of rebuild the tooling to keep up with the changes in the development and operating platforms. So as the environment in which applications are being built changes so too must security tools, and so there’s an opportunity to go build a big important company here,” Clark told ZebethMedia. It probably doesn’t hurt that Plotnik reports that the company grew ARR 400% in the third quarter. The startup is up to 90 employees and it will be doubling in the coming year with the help of this substantial investment. He says that building a diverse workforce is one of the company’s five core values, and as he scales the company up, he is trying to adhere to that. “We proactively hire women, and we are also trying to train people to get into the software engineering and cybersecurity space [to expand the available pool of underrepresented applicants],” he said. Today’s $100 million round was led by General Catalyst with participation by Greylock and Kleiner Perkins. The company did not share the valuation. The total raised so far is $135 million, per Crunchbase. It’s worth noting that in September, Israeli business publication Globes, was reporting rumors that Palo Alto Networks was interested in buying the company for around $550 million. Last month Jewish Business News reported that the talks had broken down and the company was looking for additional funding.

India metro smart cards vulnerable to ‘free top-up’ bug • ZebethMedia

By zebethcontrolPosted on November 3, 2022Posted in cybersecurity, india, metro, Security, smart cards, TransportationNo Comments

A smart card bug lets anyone ride the metro for free India’s mass rapid transit systems — or metro, as it’s known locally — rely on commuter smart cards that are vulnerable to exploitation and allow anyone to effectively travel for free. Security researcher Nikhil Kumar Singh discovered a bug impacting Delhi Metro’s smart card system. The researcher told ZebethMedia that the bug exploits the top-up process that allows anyone to recharge the metro train’s smart card as many times as they want. Singh told ZebethMedia he discovered the bug after inadvertently getting a free top-up on his metro smart card using an add-value machine at a Delhi Metro station. The bug exists, Singh says, because the metro recharge system does not properly verify payments when a traveler credits their metro smart card using a station add-value machine. He said that the lack of checks means a smart card can be tricked into thinking it was topped up even when the add-value machine says that the purchase failed. A payment in this case is marked as pending, and subsequently refunded, allowing the person to effectively ride the metro for free. “I tried it on Delhi Metro’s system and was able to get a free recharge,” Singh told ZebethMedia. “I still have to initiate a recharge by paying for it using PhonePe or Paytm, but because the recharge still remains pending, it will be refunded after 30 days. That is why it is technically free,” he said. Singh shared with ZebethMedia a proof-of-concept video he recorded in February showing how a smart card can be duped into adding value to a Delhi Metro card. After better understanding the bug, the researcher reached out to the Delhi Metro Rail Corporation (DMRC) a day later. In response, the DMRC asked Singh to share the details of the bug over email, which he did, along with a technical report and a log file demonstrating the bug in action, which ZebethMedia has seen. On March 16, Singh received a boilerplate reply, acknowledging the receipt of his email, but did not receive any further responses. Singh told ZebethMedia that the issue, which has not been fixed, exists in the smart cards themselves. Delhi Metro relies on MiFare DESFire EV1 smart cards manufactured by Dutch chipmaker NXP Semiconductors. Other metro systems, including Bengaluru, also use the same smart card system. “If the technical infrastructure is the same in other state metro trains, then this bug will work there too,” Singh told ZebethMedia. It’s not the first time security researchers have found issues with the same brand of smart cards. Past research found similar vulnerabilities affecting the same DESFire EV1 smart cards that Delhi Metro uses, as well as other European mass transit systems. In 2020, MiFare introduced the DESFire EV3 as its contactless solution with better security. Singh suggested that the smart card bug could be fixed if the metro systems migrate to DESFire EV3 cards. Three DMRC spokespeople did not answer multiple emails seeking comment. When reached, a spokesperson for NXP (via agency) was unable to provide comment by the time of publication. Bengaluru Metro Rail Corporation, the body responsible for the city’s metro service, also did not comment.

Twitter’s verification chaos is now a cybersecurity problem • ZebethMedia

By zebethcontrolPosted on November 1, 2022Posted in phishing, Security, TwitterNo Comments

Cybercriminals are already capitalizing on Twitter’s ongoing verification chaos by sending phishing emails designed to steal the passwords of unwitting users. The phishing email campaign, seen by ZebethMedia, attempts to lure Twitter users into posting their username and password on an attacker’s website disguised as a Twitter help form. The email is sent from a Gmail account, abd links to a Google Doc with another link to a Google Site, which lets users host web content. This is likely to create several layers of obfuscation to make it more difficult for Google to detect abuse using its automatic scanning tools. But the page itself contains an embedded frame from another site, hosted on a Russian web host Beget, which asks for the user’s Twitter handle, password and phone number — enough to compromise accounts that don’t use stronger two-factor authentication. Google took down the phishing site a short time after ZebethMedia alerted the company. A Google spokesperson told ZebethMedia: “Confirming we have taken down the links and accounts in question for violations of our program policies.” A screenshot of the phishing email designed to steal Twitter users’ credentials. Image Credits: ZebethMedia. The campaign appears crude in nature, likely because it was quickly put together to take advantage of the recent news that Twitter will soon charge users monthly for premium features, including verification, as well as the reported possibility of taking away verified badges of Twitter users who don’t pay. As of the time of writing, Twitter has yet to make a public decision about the future of its verification program, which launched in 2009 to confirm the authenticity of certain Twitter accounts, such as public figures, celebrities and governments. But it clearly hasn’t stopped cybercriminals — even on the lower-skilled end — from taking advantage of the lack of clear information from Twitter since it went private this week following the close of Elon Musk’s $44 billion takeover. ZebethMedia also alerted Beget to the phishing pages, but did not immediately hear back. A spokesperson for Twitter did not immediately respond to a request for comment.