Archiv für die Kategorie: RSS Feeds

By Ben Nahorney Everyone has a spam folder. It’s often disregarded as a dark, bottomless pit for fake emails from FedEx, pharmacy offers, and introductory emails from women far too amorous to be anything but fantastical. You’d be right to largely ignore this folder.
Yet each day new emails end up in it. Most of us have learned to leave it well enough alone. Still, few would admit to having no curiosity as to what’s in there. To satisfy this curiosity, we’ve dug into spam folders to explore the current types of messages being sent and find out what happens if you click the links and open the attachments. In essence, we’re opening these spam messages so you don’t have to.
Do not try this at home
This exploration is meant to inform, showcasing some of the scams and threats currently out there. However, in all of the spam messages we’ve examined, the links were clicked and attachments opened within a secure, sandbox environment.
In this case we used Cisco Threat Grid, which is an advanced sandboxing tool that can analyze threats against millions of other samples to fully understand its behaviors in a historical and global context, and then provide context-rich analytics and threat intelligence. We’ve also coupled this with Cisco Umbrella Investigate, which provides an excellent view of the relationships and history of particular internet domains and IP.
While most of the spam we looked at was prosaic, many were not. It’s mostly the latter that we’re showcasing here. Opening these emails on your own computer or device is very risky and can end up compromising it. In short, do not try this at home.
Snake oil sales
Let’s start off with the more mundane spam emails—the ones that more often than not simply attempt to part a fool from their money.
If there were a unified theory of spam it would be that it plays to both our aspirations and our insecurities: get in shape, lose weight, get a great night’s sleep, get the girl/guy, protect your family, improve your credit score, etc. There’s a wide variety of these emails that play to these desires—far too many to cover in any detail. Consider these as a smattering of what’s currently out in the spam landscape.

In this type of spam messages, many of the message bodies share similar characteristics. This points to the use of email spam kits that leverage templates for crafting emails. These kits go far beyond the email bodies too, allowing all sorts of customization. For instance, some of the examples above were marked as “high importance” and flagged for follow-up before they even hit the spam folder.

Text only spam
Sometimes saying nothing is more effective than saying anything at all. That’s certainly the case with spam, as bare-bones spam messages are very popular. For instance, some emails just put the recipient’s name in the body, along with a link. The link leads to a get-rich-quick scheme in the guise of a fake news report about a Bitcoin investment platform. A “Try Now” link on the page leads to a second site that gives the user an option to register.

Spam promising romance or intimate encounters with strangers is also very common. Many are clearly advertisements, while others are attempts to begin a rapport before asking the victim for money. In this case, the site that you are directed to depends on the country you’re visiting it from. In general, these links guide users to lesser-known dating and meet-up sites, where it’s likely the scammers are generating ad revenue through click-through programs.

Social networking spam
Likes, comments, and profile views are the lifeblood of social networking, and the networks often entice users to return to their sites by sending emails on the user’s profile activity. In this particular example, the scammers have lifted the look of a LinkedIn email notifying the user that their profile had appeared in searches. If any of the links in the email are clicked, the page that loads isn’t LinkedIn. Instead, the user is notified that they are the “5-billionth search.” As a result, they can claim prizes ranging from gift cards to hardware devices. However, before receiving their prize, the user is required to fill out a survey and provide some personal details. More than likely the gift card never materializes.

Are they safe?
In each of the examples shown so far, there were indications that some sort of suspicious activity could be taking place. However, there was no smoking gun. Some sites and IP addresses appeared to have participated in past phishing campaigns or other malicious activity. So while these scams may not be performing malicious activity today, there’s nothing to say they won’t be tomorrow.

So now that we’ve covered the suspicious, let’s move on to the obviously malicious.
Log in to view
In the following example, the email appears to hint at an upcoming disbursement. While the details are sparse, the idea of unexpected money could lead a curious individual to click. After all, the email simultaneously warns the user that the email is from outside their organization and that it comes from a “trusted sender,” hoping that the recipient will let their guard down.

While it looks like the document is attached, the email only contains an image of an attachment. Clicking it does take the recipient to an actual Word doc, hosted on a SharePoint subdomain.

This document contains a link to what appears to be another document. Clicking that link opens another window containing what looks like an Office 365 login page:

Clicking the first link will take the user to another page that requests the user use their Office login details:

When they click the “Sign in” button, the user is redirected to a legitimate Office 365 page that presents an error message:

However, login details entered into the previous page have been logged on the malicious site, successfully stealing them from the user.

This type of spam isn’t exclusive to Office 365. There are plenty of instances where the bad actors go after other valuable login details, such as those from other webmail accounts, subscription services, or social media accounts.
Package delivery spam
This popular type of spam has proven to be effective enough that it’s used for a variety of objectives. The shipping companies impersonated vary widely and the spam emails are often modeled directly after email notifications you would receive from the actual company.

In other cases, the emails are a little more toned down, arriving as plaintext and including attachments rather than links.

The attached document, if opened, doesn’t show the user the promised contact form. In fact, it doesn’t appear to do anything at all. However, behind the scenes the attachment has compromised the computer with a trojan called “Hawkeye.” This threat is an infostealer that is often used to extract passwords from email and web browser applications, as well as log keystrokes, harvest stored credentials, screenshots, and network activity.

The worst of the worst
The bad actors behind Emotet are one of the largest malicious spam email peddlers these days. We’ve discussed this threat our Defending against today’s critical threats report, and Talos Intelligence has published multiple blogs on the threat. The folks behind Emotet have a few tricks up their sleeves when it comes to email distribution. Their spam campaigns often leverage news headlines and regularly utilize package delivery spam as described above.

Emotet also often pulls a trick that’s less likely to end up in your spam folder with ordinary email filters applied. These emails often arrive as replies to email conversations you may already be having with someone you know, usually an acquaintance, a co-worker, or an associate in another organization you do business with.

The attachments in these cases, if opened, generally download a copy of Emotet, effectively compromising the system.

How to protect yourself
The simplest way to protect yourself from spam emails such as these is to simply leave them in your spam folder. However, not all spam filtering applications are created equal and sometimes such messages can end up in your inbox—in particular some of the latter examples showcased here. The best thing you can do to identify spam is check for anomalies in the email messages you receive:
Multiple spelling and grammar errors in emails that appear to come from legitimate organizations should raise a red flag.
Move your mouse over URLs without clicking them. If the URL that appears at the bottom of the browser window looks at all suspicious, don’t click it.
Check the From: address. Does the name align with the email address? If not, disregard it.
Beyond the user-based aspects of identifying spam, a layered approach to security is critical in defending an organization from such threats.
Spam filtering software for email is critical. Deploying a robust email threat defense like Cisco Email Security that utilizes URL blocking capabilities and Advanced Phishing Protection’s machine learning to understand and authenticate email identities and behavioral relationships filter out spam emails and prevent attacks.
Endpoint protection software can also assist in detecting and quarantining malicious attachments. Cisco AMP for Email Security defends your business against such threats. Not only that, but AMP analyzes emails for threats such as zero-day exploits hidden in malicious attachments. It gives you advanced protection against spear phishing, ransomware, and other sophisticated attacks.
Tools for dynamically sandboxing threats, such as Cisco Threat Grid, can be used to analyze threats in a safe environment. Even better, integrate sandboxing so that it happens automatically in the background for new files and URLs arriving in email to quickly understand if they are malicious.
Finally, solutions such as Cisco Umbrella can not only block access to malicious sites, stopping many threats in their tracks, but additional tools like Umbrella Investigate provide further threat intelligence around a URL, domain, or IP address to better understand the sites your organization comes in contact with.
Enjoyed reading this Threat of the Month? Subscribe to the Threat of the Month blog series and get alerted when new blogs are published.
The post Explorations in the spam folder appeared first on Cisco Blogs.

Source:: Cisco Security Notice

By Jeff Reed Making Security an Enabler, so Your Business Can Take an Exponential Leap
I joined the Cisco Security team the week after the RSA Conference in 2017. At that time there was a lot of discussion around the journey Cisco Security was on, particularly around our efforts to deliver an integrated architecture. For the previous years we had been integrating threat intelligence, context sharing and our anti-malware engine across our portfolio and were seeing dramatic improvements in key metrics such as time to detection.
But from the perspective of a security practitioner’s daily experience with our portfolio, we were failing. The user experience was siloed, it took too long to stitch our products (and third-party products) together, and even the navigation and look and feel of our products varied dramatically.
Shortly after that RSA we made the decision to focus our attention on the operational experience of our Security products, realizing that the usability component was equally as important as the underlying architecture. We stood up a team to lead us on that journey and began laying the foundation for what would become a huge leap forward for Cisco Security and for our customers.

Today we are introducing Cisco SecureX – a new way for users to experience Cisco’s Security portfolio. Cisco SecureX streamlines our customers‘ operations with increased visibility across their security portfolio and provides out-of-box integrations, powerful security analytics, and automated workflows to speed threat detection and response. SecureX is an open, cloud-native platform that connects Cisco’s integrated security portfolio and customers‘ security portfolios for a simpler, more consistent experience across endpoints, cloud, network, and applications.
The foundational capabilities of SecureX
SecureX builds on the foundational work we’ve been doing over the past 2.5 years, including Cisco Threat Response, common user experience, single sign on, secure data sharing between on-prem and the cloud and more. But it does a whole lot more. The best way to experience SecureX is to visit us at the RSA conference. For those of you who can’t make it, here are some of the most important capabilities of the platform:
Unified visibility
SecureX provides unified visibility across all parts of your security portfolio – Cisco or third-party solutions – delivering metrics, activity feed and the latest threat intelligence. I am particularly excited about the operational metrics capabilities of SecureX: Mean Time to Detection, Mean Time to Remediation, and Incident burndown times. These metrics are derived from full case management capabilities native to the SecureX platform. Case management enables SecureX customers to assign cases, track them to closure, and add relevant artifacts captured during investigation.
Automation
SecureX brings full multi-domain orchestration and automation capabilities to our customers using a no/low-code approach and intuitive drag-and-drop interface to deliver high-performance and scalable playbook capability. The SecureX orchestration and automation capabilities use an adapter model that allows users to quickly and easily orchestrate across Security, Networking, IoT, Cloud, Collaboration, and Data Centers. SecureX already has 50+ adaptors across these domains and will continue to develop more.
Playbooks
SecureX will deliver pre-built playbooks, and customers can also develop their own playbooks tailored to their own environment of Cisco and non-Cisco products. With our phishing playbook for example, end users can submit suspicious email to SecureX to get a recommendation of whether it is malicious or not. If the submitted email is malicious, the end user will be notified of recommended next steps, and an event will be generated in SecureX alerting the security team. To deliver this capability, the playbook pre-processes email to extract observables, determines the verdict for observables, hunts for targets involved and takes mitigation and/or preventative actions such as isolating the targets involved, blocking the malicious domain as necessary, etc.
Managed threat hunting
Only Cisco can bring multi-domain managed threat hunting capability across endpoint, cloud, email, etc. because of the breath and scope of our product portfolio. Multi-domain managed threat hunting detects threats leveraging a combination of intel and data techniques to surface activity that might have slipped past traditional threat, behavioral, and ML-based techniques. High fidelity threats confirmed by our Talos and Research teams are then communicated to customers through the SecureX activity panel as well as via emails with detail artifacts, targets involved, and remediation recommendations.
Fast time to value
Unlike other security platforms in the market, SecureX helps customers get value quickly. Getting started is simple – if you have a CCO account, login and add products to SecureX by providing API keys and adding on-prem devices (for Firewall and on-prem Email solutions). If you don’t have a CCO account, create a SecureX account on the homepage, add products to SecureX by providing an API key and adding on-prem devices (for Firewall and on-prem Email solutions). You are ready to go in minutes vs. hours and days.
Learn More about SecureX
These are just some examples of what you’ll be able to do with the first release of SecureX. The platform will continue to evolve so your security can keep up with the speed of business, and your business can keep taking new leaps.

Be one of the first to experience how we’re redefining
and simplifying security with our new platform —
Sign up for our SecureX Waitlist

Or, join us to learn more about SecureX at the RSA Conference.

The post Introducing SecureX appeared first on Cisco Blogs.

Source:: Cisco Security Notice

By Talos Group
Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between Feb 14 and Feb 21. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
Read More
Reference:
TRU02212020 – This is a JSON file that includes the IOCs referenced in this post, as well as all hashes associated with the cluster. The list is limited to 25 hashes in this blog post. As always, please remember that all IOCs contained in this document are indicators, and that one single IOC does not indicate maliciousness. See the Read More link above for more details.
The post Threat Roundup for February 14 to February 21 appeared first on Cisco Blogs.

Source:: Cisco Security Notice

By Jeff Reed My cybersecurity trends outlook for 2020 builds on my forecast for 2019. Identity and application security are still top-of-mind this year, but in new and more advanced ways.
As we approach RSA 2020, these are four trends in cybersecurity that I expect will make an impact this year.
1. Zero Trust goes beyond the hype and becomes reality.
Zero Trust had its buzzword breakout at RSA 2018, but there were a lot of questions. What is it? What does it mean? What does a Zero Trust architecture truly look like? As this security approach matures, it’s clear why Zero Trust is so important – there’s data to prove it.
According to the 2017 Verizon Data Breach Report, 81% of breaches involved compromised credentials
According to Imperva, 54% of web app vulnerabilities have a public exploit available to hackers
According to Positive Technologies, 92% of external penetration tests led to a breach of network perimeters
As a colleague of mine says, “Hackers aren’t breaking into networks, they’re logging onto networks.” We need to be smarter about how we establish the identity of a user or device connecting to a network or application before access is approved or denied. The principles of Zero Trust are consistent, but the “how” varies depending on what’s being protected – whether it’s a user, container, IoT device, or something else.
Zero Trust technology is maturing and customers are gaining a more consistent understanding of it as they begin this journey. Moving to Zero Trust is the No. 1 topic for many customers I speak with and it was a top priority for many at Cisco’s CISO Forum.
2. Customers lean toward a platform approach that embraces best-of-suite, instead of best-of-breed.
Security is complex, and CISOs today don’t want a complex solution to an already complex problem. In response, we’re beginning to see a majority of customers shift from a “best-of-breed” to “best-of-suite” approach to security solutions.
I’m seeing a push for fewer strategic partners and more out-of-the-box value from products designed to work together. And I think that push is only going to get stronger. Many CISOs I talk with can’t afford to spend more money for more tools that require more effort to get a team up and running on each tool. This loss of time keeps security teams from high-value work, like applying security insights to keep the enterprise secure.
As I mentioned in my most recent blog post, our annual CISO survey revealed a trend toward vendor consolidation, which tells us CISOs are looking for ways to make network security easier to manage. This trend toward simple solutions will only continue in 2020 and will be a key topic for Cisco Security at the 2020 RSA Conference.
3. SASE principles take hold as cloud security replaces on-prem security.
I personally hope 2020 is the year we can agree on a new acronym for SASE (pronounced “sassy”). But even if it isn’t, the underlying principles of Secure Access Service Edge are legitimate as more customers adopt security in the cloud. You can read more about the principles of SASE in this article from SDxCentral.
Gartner’s recent 2019 Hype Cycle Report states SASE will be as disruptive to network and network security architectures as IaaS was to the architecture for data center design. The principles of SaaS (software as a service) will unlock a new set of capabilities for security as SASE connects individual users and equipment to the cloud – which, by the way, is now a highly dependable and trustworthy place to house all of your applications and services.
This trend is important because the move to cloud is fundamentally changing how users and devices connect to applications and data. As this happens, we need to re-think the type of security controls required and where those controls should be placed. The ideal model will provide flexibility to security teams to place those controls optimally based on the traffic and access patterns of their environment. In some cases those controls will continue to reside on-prem, but increasingly those controls will move to a cloud edge.
We have already seen this with DNS security, and now are seeing capabilities such as secure web gateway and cloud delivered firewall. A key to this transition will be meeting the security efficacy requirements—and is an area that we at Cisco are leaning into.
4. Security moves into application development via DevSecOps.
Another key point coming from Cisco’s CISO Forum is the continued evolution of application security. We’re seeing it in the plethora of new technologies targeting this space. But I’m also seeing a significant change in the organizational model to deal with it. One of the more surprising data points from our fall CISO Forum was the number of CISOs who are embedding security staff directly into application development teams, often without establishing an ongoing relationship with the security organization. DevSecOps enables greater security knowledge within application development teams, gives security a true stake in the development process, and enables security to build relationships within apps teams.
In my conversations with CISOs over the last few years, I’ve seen application security rise dramatically in importance. And now we’re seeing this come to fruition as security talent is moved into the application development process.
A benchmark in the security industry each year is the RSA Conference, and this year is no exception. We’ll be talking about how these trends are already making an impact in the industry and within Cisco’s security strategy. I hope you can join us in San Francisco on February 24-28, 2020.
Be sure to follow me on Twitter and LinkedIn for the latest announcements from Cisco Security during RSA 2020. It’s going to be big.
The post 4 Cybersecurity Trends that Will Make an Impact in 2020 appeared first on Cisco Blogs.

Source:: Cisco Security Notice

By Talos Group By Vanja Svajcer.
In one of our previous posts, we discussed the usage of default operating system functionality and other legitimate executables to execute the so-called “living-off-the-land” approach to the post-compromise phase of an attack. We called those binaries LoLBins. Since then, Cisco Talos has analyzed telemetry we received from Cisco products and attempted to measure the usage of LoLBins in real-world attacks.
Specifically, we are going to focus on MSBuild as a platform for post-exploitation activities. For that, we are collecting information from open and closed data repositories as well as the behavior of samples submitted for analysis to the Cisco Threat Grid platform.
What’s new?
We collected malicious MSBuild project configuration files and documented their structure, observed infection vectors and final payloads. We also discuss potential actors behind the discovered threats.
Read More >>
The post Building a bypass with MSBuild appeared first on Cisco Blogs.

Source:: Cisco Security Notice