You are here: Home / malware

Posts

profile

Buffer Overflow, a Common Attack

/0 Comments/in /by

Data can exceed a buffer’s capacity. Not many people may know or have heard about buffer overflow, but we are here to help you understand this dangerous web threat. To put it simply, most programs that run in our computers manipulate data of some form. This data could originate from data associated with the program or logged data that is stored on your computer. The computer assigns this data to a temporary storage, also known as a “buffer”, where they can be quickly used and deployed.

buffer overflow

What is Buffer Overflow?

Now, imagine a buffer as an empty cup that can be filled with water or ice. It has the capacity to store a fixed amount of water or, in this case, data. If there is more water than it can hold, the water will leak and overflow onto your table. Buffer overflow happens in a very similar, albeit a bit more complicated way. Buffers have a limited amount of data they can store and if the buffer is overwhelmed with extra data, it will naturally fall into adjacent buffers to make up the storage.

The overflow of data can be caused by a simple programming error made during its development. However, malicious hackers are able to enact an overflow and perform severe damage to any computing system.

How Does Buffer Overflow Affect You?

According to the SANS Institute, a buffer overflow may cause havoc on network systems and applications. More specifically, buffer overflows can:

  1. Corrupt data that was stored in other buffers, which may lead to a 404 error.
  2. Interrupt the normal flow of programs.
  3. Shut down an operating system.
  4. Run malicious programs through the excess data.

So How Can I Prevent Buffer Overflow?

Buffer Overflow comes in many sizes and these days, they can come also as viruses. Therefore, if you don’t have a firewall and an antivirus software, we strongly advise to install them at once. Make updates as soon as possible when your antivirus and firewall programs ask your permission. In addition, avoid opening unknown and suspicious emails as they can execute malicious programs or malware that can lead to your PC becoming a zombie bot. Don’t install suspicious third party programs because this could be a gateway to allow hackers to mess with your operation system.

This blog post was originally featured on cloudbric.com. Visit their blog for more insight, news, and accessible information on web threats and trends. If you would like to learn more about Cloudbric’s logic-based WAF service, please contact info@cloudbric.com.

profile

Why Hack Pokemon Go? The Saga Continues…

/0 Comments/in /by

When Pokemon Go launched a few weeks ago, I thought back to my childhood days of watching the show. But little did I know that I would end up this worried about the cyber security issues regarding the game. A couple of weeks ago, I wrote a post regarding the authorization issues of the game, which largely had to do with the iOS devices attempting to download and authenticate the Google accounts. This week I want to follow up on this phenomenon, especially as it looks like releases in other parts of the world have been happening or look to be imminent.

Pokemon Go, a Hacker’s Paradise

Because the game didn’t have a global release but a limited one (to the USA and ANZ), there were fans around the world itching to get their hands on the game. Hence, third-party apps (which are unverified and should be avoided) and mirrored apps began to appear. Third party applications are not developed by the original developer, but developed by other companies (most of the time for opportunities where they can make some profit or gain recognition). Mirrored or cloned applications are those that may resemble the original but most often are ploys for infecting malware onto a device.

While mirrored applications are caught fairly quickly because of security measures, eager users were quicker to get to them than security managers. Sure enough, it was found that for Android users, many versions of the repackaged Pokemon Go games were infected with malware. This could hand over sensitive data to a hacker or even take control of the entire device. For example, a malware called Droidjack is a remote access tool executed on Android devices which allows for access into infected devices.

What’s the Response?

pokemon go guidelines in japan

credits to NISC

The organizational responses differed greatly. On one hand, Japan responded in an open manner where last week, NISC (National Center of Incident Readiness and Strategy for Cybersecurity) sent out a friendly infographic. Through 9 steps, it reminded people of the guidelines one should follow when playing the game. We won’t go into the translation of all the guidelines, but in particular, #1 (identity issues) and #2 (double checking for third party applications) have to do with cyber security measures.

On the other hand, countries like Malaysia are wondering if barring the game entirely might be a safer method. Last week, a referendum was called for by a well-known journalist from the New Strait Times to keep the game from entering the country. The journalist stated that it was a national concern in terms of the military as well as society as a whole. There are others who have said that the game goes against Islamic religion and could be offensive to the culture.

It’s safe to say that this trend should not be ignored if governments are starting to become involved.

So What’s a Gamer to Do?

Realistically, we’ll continue to see news headlines about the next incident regarding this game. Within cyber security, hackers will continue to target the apps and the users for two reasons. The most obvious answer is that of profit – with a cloned app, hackers can take advantage of eager users and reap financial benefits. The second not-so-obvious reason is that sometimes hackers do it for an adrenaline rush. With a big trend like this where every other headline is about the game, they want their piece of the fame and the recognition. This adrenaline-seeking does not look like it will stop anytime soon. That’s why it’s the responsibility of the user to be careful.

Some might tell you to stop playing. Go get some fresh air. However, let’s not forget that this is a major phenomenon of a game. Literally everyone and their mother is playing it. So what are some realistic things you can do?

Here are my top three tips:

  1. Stay away from third-application software. Niantic will bring it to your country soon enough – in fact, the game was released in Germany and Japan last week, and it’s now available in over 30 countries.
  2. Still take into account authorization issue. As the game becomes more and more popular, more hackers will be targeting Niantic’s databases. Go into Google’s security page and look for the application to see what you are authorizing.
  3. Consider a security solution for your mobile device. Look for one that will detect malware-infected versions of applications so that you’re preventing infections. It’s really no use trying to remedy them after your device has already been infected. If you’re in Korea, you might consider D’Amo, Penta Security’s encryption solution. With a component made for smartphones in the PKI line, it can protect the data that is in your device.

So let’s have a discussion. What is the current viewpoint of Pokemon Go in your country among the general population? What is your governmental organization doing regarding the potential (physical and cyber) security issues? What are you doing regarding Pokemon Go? 

car security using gps or navigation

Security in IoT

/0 Comments/in /by

Since its first introduction 15 years ago, the Internet of Things (IoT) has now become one of the hottest topics. These days, thousands of new IoT products are launched into the market each year. Although the first IoT product was only a modified Coca Cola machine, IoT is now a part of our everyday lives. Now, we feel that this is a great change. Information security is often a neglected topic, but with IoT, it’s begun to turn heads.

Stories have been already published to show that security measures are needed for IoT products as IoT hacks are on the rise. With smart car hacks, baby monitors hacks, and children’s toys hacks running rampant, we have to ask about security. Technically speaking, not all IoT products need security. Children’s bracelets that only sense a child’s mood through body temperature do not need as many security measures compared to bracelets that track a child’s location. Security is often concerned only when data is evaluated as being valuable when compromised.

How Is Security Different for IoT Businesses?

Currently, there are three major types of security that businesses regularly use:

Physical Security

Physical security is the protection of personnel, hardware, programs, networks, and data from physical circumstances and events that could cause serious losses or damages. Examples of physical security include CCTV surveillance, security guards, access control protocols, etc.

Information Security

The second type of security is information security. Information security is a set of business processes that protects information regardless of how the information is formatted or whether it is being processed, in transit or stored. The most common methods of information security are: encryption, malware detection, and digital signatures.

different security for IoT

Convergence Security

The third and newest type of security is convergence security. Although the quickest growing, convergence security is a new security concept. Its meaning is just what its name suggests—a convergence or combination of physical and information security. With convergence security, the security systems of a company are joined together with the company’s IT solutions. This allows the company’s physical security to play an integral role to IT. Perhaps it may become the ultimate solution to IoT security.

Many people are mistaken that convergence security is difficult to develop. However, it is just the action of incorporating information security technology to existing industry systems. Convergence security is just the act of customizing physical and information security to an industry’s protocol. It does not require a whole new concept of security algorithms. For example, if a manufacturing factory is transitioning into a smart factory, where all the equipment is automated, security is needed to ensure that hackers do not interfere with manufacturing schedules and output. The factory can then work with an information security firm to make sure previous physical security measures are updated with the newly implemented information security scheme, thereby maintaining their existing security measures while updating protocols to meet industry convergence security standards.

Top Five Industries of IoT Security Development

The development of IoT can be categorized into five different industries. Just as industries vary with the type of data or functions that they process, their actual security regulations also vary. For example, the automotive industries security regulations are much stricter than those of consumer electronics. Also, the extent of what security solutions have actually developed is based on the extent in which that industry has been developed. Because as the demand for the product or service skyrockets, so does the demand for its security. Because of these reasons, five industries have been identified as focal points in the demand for IoT security development.

1. Automotive

Probably the most pressing IoT security issues is smart car technology. Duk Soo Kim, the CTO of Penta Security Systems, said that “Security technology has been used to protect the assets of businesses and people, while smart car security protects those people’s lives.” It is clear that hacking smart cars or transportation system/traffic information systems can directly lead to serious physical damage and/or casualties. The US Department of Transportation has already taken key steps toward requiring security technology to be installed in every smart car in the U.S by proposing regulations for standard Vehicle-to-Vehicle (V2V) technology. Smart car security solutions such as AutoCrypt, CycurLIB, ArgusIDPS and Aerolink are already available in the market.

2. Consumer Electronics

Consumer electronics are the most common of IoT products. From major tech conferences, such as CES and the Internet of Things World Forum to television commercials, you can see that IoT is quickly becoming a part of our common lives. Although we have seen a surge in consumer electronic hacks in the past couple of years, the focus of smart consumer electronics remains to be “connectivity,” with little focus on security development. For example, home appliance manufacturers call its new refrigerator as “family hub” since items are more connected, but home appliance companies often don’t highlight how the data being collected is protected. Much to our surprise, reports of refrigerators containing spam began circulating starting in 2014, awakening the dangers of what is called thingbot.

3. Smart Office

Smart offices, also known as smart buildings or smart businesses, are a rising trend in companies. With the rising concern that smart offices are an easy target to hackers, it is imperative to develop smart office security as hackers can affect a business’ productivity when they access a building’s communications system. Security for standard buildings have been incorporated in the the past. However, smart offices now involve managing and restricting access that include physical, remote, network, and device level factors.

4. Smart Factory

A smart factory is a factory with a fully integrated automation solution in its facility. In smart factories, industrial control systems (ICS), which are computer based systems, are installed to monitor and control industrial processes such as power, oil, gas pipelines, water distribution and wastewater collection systems.

The most used type of ICS is Supervisory Control And Data Acquisition (SCADA), which allows factory workers to simplify their operational duties by only needing to use electronic communications instead of local documents. Despite its convenience, SCADA is not completely secure as it was proven during the huge malware attack in June 2014 in the European SCADA systems. A malware called Stuxnet was uploaded to European SCADA control systems and sabotaged major confidential projects as well as industrial control system software.

5. Smart Grid

A Smart Grid is when Information and Communications Technology (ICT) is incorporated with the existing electric grids so that the information about producing and consuming electricity is exchanged in real time. According to the U.S. Congressional Research Service, attacks on the U.S. power grid are continuing to increase. As countries’ economies, governments and securities rely on electricity, there is a need to build strong convergence security around smart grids’ industrial control systems.

These five categories vary in terms of their services and information processed, but it is imperative any company that deals with people’s safety (both physical and digitally) must invest in security. For products that are integrated with IoT, physical or information security is no longer safe enough. As the demand for IoT products and services increase, these companies need to commit to creating convergence security systems that completely secure customers’ products and private information.

This blog post was originally featured on cloudbric.com. Visit their blog for more insight, news, and accessible information on web threats and trends. If you would like to learn more about Cloudbric’s logic-based WAF service, please contact info@cloudbric.com.

office-96107_1920

Are You Protected from an Internal Data Breach?

/0 Comments/in /by

When prompted with the word “hacking,” often times, people’s first thought is of a guy sitting in the dark on his laptop trying to access a company’s server hundreds of miles away. However, according to Infosecurity Europe, 42% of security professionals consider hack attacks to come from day-to-day activities like insider threats.  Although the media often talks about hack attacks as though many of them come from far off lands, in reality, many of the successful attacks come from an insider data breach —the 2014 J.P. Morgan hack being a prime example. For many hack attacks, the assailants are actually much closer than most think.

Employee data breach… knowingly or unknowingly

Infosecurity Europe released its 2015 Industry survey in April discussing how organizations perceive cyber security threats to their businesses as well as their prevention and security strategies. According to a group of 1,336 enterprise web security professionals, 32% of respondents believed that the greatest risks to their organizations were external attacks like the ones that we imagined before—with strangers orchestrating them. These attacks include DDoS, malware, injection attacks, etc.  However, the second largest concern at 21% was insider threats. This section consists of careless or malicious employees and third parties. These people all have something in common—they have access to administration rights to the company’s server or web apps. They are the ones working on these assets. They can develop them and import or export customer personal information.

With the increase in hostility in the cyber environment, 72% of cyber professionals are now calling for more risk-based approaches in information security. 61% of them assume that their own employees are the source to internal data breaches. Many want to create internal security infrastructures that actually protect their systems from employees as well. Traditional methods like training employees about web security is no longer enough. Insider threats are now responsible for 43% of data breaches. So now, enterprises are looking to develop and launch information security systems that shield them from the very employees that helped build them.

The need for better systems

While these companies admit that building a culture around information security is important, they stress the importance of creating systems that protect their sensitive data. One method to protecting their data is proper authorization. As the J.P. Morgan hack started with an employee’s username and password being used to send millions of customers’ information to hackers, if an employee is granted such high-level rights, customers’ personal data can be compromised. Companies need to decrease employees’ admin rights, so they cannot access or import customers’ credit card or account information.

Investing toward information and web security is critical. However, sometimes hacks do not always come externally. Instances of data breach will continue to increase, and companies need to invest in internal security methods to prevent precious customer data from being compromised and ultimately, damaging the companies’ reputations. Internal security methods can start with granting proper authorization rights to employees—no employees should have free access to customers’ personal identifiable information like credit card or account information. Once companies limit this access, then we are one step closer to a safer cyber environment.

 

This blog post was originally featured on cloudbric.com. Visit their blog for more insight, news, and accessible information on web threats and trends. If you would like to learn more about Cloudbric’s logic-based WAF service, please contactinfo@cloudbric.com.