Eliana Willis

Members of Congress are continuing their push against facial recognition used by the federal government in the wake of the IRS decision to stop using ID.me facial recognition software.On Wednesday, Secretary Alejandro Mayorkas, Rep. Pramila Jayapal, and Rep Ayanna Pressley joined Senators Ed Markey and Jeff Merkley in calling for DHS to end its use of Clearview AI’s facial recognition technology.”Facial recognition tools pose a serious threat to the public’s civil liberties and privacy rights, and Clearview AI’s product is particularly dangerous. We urge you to immediately stop the Department’s use of facial recognition technology, including Clearview AI’s tools. Clearview AI’s technology could eliminate public anonymity in the United States,” the members of Congress wrote in a letter to Homeland Security.”It reportedly allows users to capture and upload photos of strangers, analyze the photographed individuals’ biometric information, and provide users with existing images and personal information of the photographed individuals found online. Clearview AI reportedly scrapes billions of photos from social media sites without permission from or notice to the pictured individuals. In conjunction with the company’s facial recognition capabilities, this trove of personal information is capable of fundamentally dismantling Americans’ expectation that they can move, assemble, or simply appear in public without being identified. Reports indicate that use of this technology is already threatening to do so.”They go on to explain that the use of facial recognition technology would deter people from participating in marches and rallies “for fear of being permanently included in law enforcement databases.”The technology poses unique threats to Black communities, other communities of color, and immigrant communities, the members of Congress added, noting that three Black men have already been wrongfully arrested based on mistakes made by a facial recognition system. Studies from the National Institute of Standards and Technology (NIST) have also found that Black, Brown, and Asian individuals were up to 100 times more likely to be misidentified than white male faces with most facial recognition tools available. According to the letter, facial recognition software is being promoted widely among law enforcement agencies, and “reviews of deployment of facial recognition technology show that law enforcement entities are more likely to use it on Black and Brown individuals than they are on white individuals.”

“Additionally, past law enforcement use of this technology reportedly targeted Black Lives Matter activists. Use of increasingly powerful technologies like Clearview AI’s have the concerning potential to violate Americans’ privacy rights and exacerbate existing injustices,” Jayapal, Markey, Pressley, and Merkley wrote. “Therefore, as the authors of the Facial Recognition and Biometric Technology Moratorium Act (S. 2052/H.R. 3907) — which would halt a federal agency or official from using these technologies — we urge you to stop use of facial recognition tools, including Clearview AI’s products.”The Department of Homeland Security did not respond to requests for comment. The letter comes two days after the Internal Revenue Service (IRS) announced that it will no longer be using ID.me facial recognition software. The agency added in a statement that it will “transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts.”The IRS had faced overwhelming backlash from civil rights groups and members of Congress from both parties, all of whom questioned how the IRS could begin the use of facial recognition without advance warning. But the issue revealed that the IRS was one of many federal and state agencies using facial recognition tools to provide access to vital government services and benefits. ID.me’s facial recognition tools are already used by 27 states for their unemployment benefits systems, according to CyberScoop, while 30 states and 10 federal agencies also use ID.me for other government services. The Veterans Affairs Administration and Social Security Administration both use facial recognition.More than 70 million Americans who filed for unemployment insurance, pandemic assistance grants, child tax credit payments, or other services have already had their faces scanned by ID.me. Several civil rights groups — including Fight for the Future, Algorithmic Justice League, the Electronic Privacy Information Center, and others — that started a protest movement last week designed to stop the IRS plan have expanded the effort to other agencies.Caitlin Seeley George, campaign director at Fight for the Future, told ZDNet they have updated their campaign page, dumpID.me, and are urging the Veterans Affairs Administration, the Social Security Administration, the US Patent and Trademark Office, and the many states using ID.me for unemployment benefits to follow the example of the IRS.”Veterans trying to access their benefits, elderly people trying to access Social Security Administration resources, and those applying for unemployment benefits in dozens of states are all facing the same problems and threats that caused the IRS to stop using ID.me. Many of these essential services are critical for marginalized groups, people who are already disproportionately targeted by surveillance and misidentified by facial recognition technologies,” Seeley George said. “No one should be coerced into giving their biometric information to a third party vendor for seven years or longer in order to access these essential government services. We expect all the lawmakers who spoke out against the broad use of facial recognition by the IRS to push these other agencies to stop using ID.me and any other biometric verification tools.”ID.me to let users delete selfiesIn the wake of the IRS decision, ID.me founder and CEO Blake Hall said they decided to modify their process and will now allow people to choose to verify their identity with a human agent without going through a “selfie check.” Agencies will now be able to choose this option, and Hall said they were also going to allow ID.me users to delete their selfie or photo at account.ID.me beginning on March 1.Aubrey Turner, the executive advisor at identity access management software company Ping Identity, listed several other authentication methods that agencies could use to replace their reliance on facial recognition as a means to stop fraud. He said they could use security keys (FIDO), mobile push, behavioral biometrics, authenticator apps like Google Authenticator, SMS, email, or voice. But all have their pros and cons relative to the balance of security and end-user convenience, he noted.”Static Knowledge Based Answers (KBAs) can no longer be trusted as a means of identity verification and authentication. Facial recognition as implemented by ID.me may not be the answer for IRS, but neither is UID + password. We deserve and should demand better as citizens,” Turner said. “What’s done is done as far as the IRS ending the relationship with ID.me, but how Congress plans to secure taxpayer accounts after abandoning ID.me is now my biggest question and concern.” More

A growing wave of increasingly sophisticated ransomware attacks poses a threat to critical infrastructure and organisations around the world – and attacks will continue as long as victims keep giving in to ransom demands, a joint advisory by cybersecurity bodies in the US, UK and Australia has warned. The advisory from the UK’s National Cyber Security Centre (NCSC), Australian Cyber Security Centre (ACSC), Federal Bureau of Investigation (FBI), National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) has detailed the growing risk posed by ransomware and has urged businesses to take action to protect themselves from attacks.

ZDNet Recommends

The NCSC describes ransomware as “the biggest cyber threat facing the United Kingdom”, with education one of the top targets of ransomware gangs, alongside businesses, charities, local government and the health sectors.SEE: A winning strategy for cybersecurity (ZDNet special report)The FBI, CISA and NSA warn that 14 of the 16 US critical infrastructure sectors have been targeted by ransomware, including defence, industrial systems, emergency services, food and agriculture, government and information technology, while the ACSC has warned that ransomware attacks continue to target critical infrastructure across Australia.In what represents the first international joint advisory on ransomware, organisations are being urged to take action in order to defend against attacks and avoid becoming a victim.”Ransomware is a rising global threat with potentially devastating consequences but there are steps organisations can take to protect themselves,” said Lindy Cameron, CEO of the NCSC.

“To help ensure organisations are aware of the threat and how to defend themselves we have joined our international partners to set out the very latest threat picture alongside key advice”.Mitigation advice includes implementing multi-factor authentication, employing a zero-trust strategy, and training users, so they can identify and report phishing attacks.”We live at a time when every government, every business, every person must focus on the threat of ransomware and take action to mitigate the risk of becoming a victim,” said Jen Easterly, director of CISA.”Reducing risk to ransomware is core to CISA’s mission as the nation’s cyber defense agency, and while we have taken strides over the past year to increase awareness of the threat, we know there is more work to be done to build collective resilience,” she added.Some of the key techniques ransomware groups are using to launch attacks include gaining access to networks via phishing, exploiting stolen Remote Desktop Protocol (RDP) passwords, brute force attacks, and taking advantage of unpatched vulnerabilities.The paper also warns that cyber-criminal services for hire and ransomware-as-a-service schemes are becoming increasingly professional and efficient, even offering “help centres” to talk victims through how to make the ransom payments required for the decryption key required to restore the network. Ransomware attacks are still evolving and the alert warns that one way in which this is happening is the increasing targeting of cloud infrastructure, which can affect multiple organisations at once.SEE: DDoS attacks that come combined with extortion demands are on the riseCyber criminals are also increasingly targeting managed service providers (MSPs), abusing the widespread and trusted access into clients in order to affect multiple organisations at once. The security agencies warn that it’s likely that ransomware gangs will increase attacks targeting MSPs, as will attacks that target other elements of the software supply chain. Each of the cybersecurity authorities in the United States, Australia and United Kingdom warns that, so long as victims are paying ransoms, ransomware attacks will continue.”If the ransomware criminal business model continues to yield financial returns for ransomware actors, ransomware incidents will become more frequent. Every time a ransom is paid, it confirms the viability and financial attractiveness of the ransomware criminal business model,” the alert warns.The paper suggests that by applying cybersecurity hygiene protocols, including updating operating systems and software in a timely manner, using offline backups and deploying multi-factor authentication, organisations can take major steps towards avoiding becoming another ransomware victim.MORE ON CYBERSECURITY More

Qbot, otherwise known as Qakbot or QuakBot, is an old software threat to Windows users that pre-dates the first iPhone, but it’s still being improved for nefarious efficiency.  The malware emerged in 2007, making it almost an antique in the new service-led ransomware world, but the malware is still nimble and efficient, according to cybersecurity outfit DFIR’s analysis of a sample its researchers found in October. 

ZDNet Recommends

Qbot is known for reaching Windows PCs via phishing emails and exploiting bugs in key apps like Microsoft’s email client, Outlook. The malware recently gained a module that reads email threads to improve the message’s apparent legitimacy to victims. SEE: Cybersecurity: Let’s get tactical (ZDNet special report)The malware’s operators rely on clickable phishing messages, including tax payment reminders, job offers, and COVID-19 alerts. It can steal data from Chrome, Edge, email, and online bank passwords. DFIR researchers looked at a case where initial access wasn’t known but was likely delivered via a tainted Microsoft Excel document that was configured to download malware from a web page and then used a Windows schedule task to get higher level access to the system. Qbot’s authors have learned to live off the land by utilizing legitimate Microsoft tools. In this case, it used these tools to raid an entire network within 30 minutes of the victim clicking on a link in the Excel sheet. 

“Thirty minutes after initial access, Qbot was observed collecting data from the beachhead host including browser data and emails from Outlook. At around 50 minutes into the infection, the beachhead host copied a Qbot dll to an adjacent workstation, which was then executed by remotely creating a service. Minutes later, the beachhead host did the same thing to another adjacent workstation and then another, and before we knew it, all workstations in the environment were compromised.” The attack affected PCs on the network but not servers, according to DFIR.Qbot’s operators have branched out to ransomware. Security firm Kaspersky reported that Qbot malware had infected 65% more PCs in the six months to July 2021 compared to last year. Microsoft spotlighted the malware for its modular design that makes it difficult to detect. The malware hides malicious processes and creates scheduled tasks to persist on a machine. Once running on an infected device, it uses multiple techniques for lateral movement.The FBI has warned that Qbot trojans are used to distribute ProLock, a “human-operated ransomware”.  More

The Federal Bureau of Investigation (FBI) is warning about a big uptick in scams using smartphone SIM swapping to defraud victims. Subscriber Identity Module (SIM) swapping is an old trick, but the FBI has issued a new alert about it because of a massive leap in reported cases in 2021 compared to previous years.    

ZDNet Recommends

Smartphones are critical tools for authenticating to online services, such as banks that use SMS for sign-in codes. It is a serious problem – if crooks can gain control of these services, they can access the victim’s bank, email, social media, and bank accounts. Complaints to the FBI’s Internet Crime Complaint Center (IC3) have skyrocketed in the past year.SEE: Cybersecurity: Let’s get tactical (ZDNet special report)From January 2018 to December 2020, the FBI received 320 complaints related to SIM-swapping incidents with losses of approximately $12 million. In 2021, it received 1,611 SIM-swapping complaints with losses of more than $68 million, the FBI warned in a new public service announcement. Scammers abuse the support services of mobile network operator call centers by calling them and posing as customers to get a new SIM card. The victim doesn’t know a new SIM card is connected to their phone number, which gives attackers the access they need.”Once the SIM is swapped, the victim’s calls, texts, and other data are diverted to the criminal’s device. This access allows criminals to send ‘Forgot Password’ or ‘Account Recovery’ requests to the victim’s email and other online accounts associated with the victim’s mobile telephone number,” the FBI’s IC3 warns. 

“Using SMS-based two-factor authentication, mobile application providers send a link or one-time passcode via text to the victim’s number, now owned by the criminal, to access accounts. The criminal uses the codes to login and reset passwords, gaining control of online accounts associated with the victim’s phone profile.” To improve security, many organizations use SMS messages as a form of multi-factor authentication because the account owner is assumed to have control over the device. Codes delivered via SMS are convenient because of high adoption and the belief that SMS is better than just relying on a password that can be compromised. SIM swapping is one way for crooks to circumnavigate this security.As Microsoft and others have argued, SMS is an insecure and unreliable way to deliver codes for authenticating to online accounts. Microsoft wants organizations to use apps, such as its Authenticator, because they’re a harder target to compromise.The FBI details the many ways in which attackers can not only dupe but also entice employees of mobile network operators for nefarious goals. From the attacker’s perspective, the rise of cryptocurrencies like Bitcoin and exchanges’ reliance on phones for authentication adds to the appeal of SIM-swapping scams. “Criminal actors primarily conduct SIM swap schemes using social engineering, insider threat, or phishing techniques,” the FBI’s IC3 says. The attacker often impersonates a victim and tricks the mobile carrier’s employees into switching the victim’s mobile number to a SIM card in the criminal’s possession. “Criminal actors using insider threat to conduct SIM swap schemes pay off a mobile carrier employee to switch a victim’s mobile number to a SIM card in the criminal’s possession. Criminal actors often use phishing techniques to deceive employees into downloading malware used to hack mobile carrier systems that carry out SIM swaps,” says the FBI’s IC3.SIM swapping is a real problem. T-Mobile in December confirmed SIM swapping was behind a major data breach. A former employee of a US mobile carrier was sentenced in October for taking bribes of up to $500 a day to swap phone numbers. Operators also lack procedures to help customers when they become victims of SIM-swapping scams, as detailed in a personal account in 2019 by ZDNet’s mobile specialist Matthew Miller. It’s a global problem for telcos, too. Australia’s Telstra now flags to banks when a mobile number is ported to counter SIM-swapping attacks.The FBI’s tips for protecting yourself include:Do not advertise information about financial assets, including ownership or investment of cryptocurrency, on social media websites and forums.Do not provide your mobile number or account information over the phone to representatives that request your account password or pin. Verify who they really are by dialing the customer service line of your mobile carrier.Avoid posting personal information online, such as mobile phone number, address, or other personal identifying information.Use a variation of unique passwords to access online accounts. More

Brute-forcing passwords, as well as the exploit of ProxyLogon vulnerabilities against Microsoft Exchange Server, were among the most popular attack vectors last year. 

According to ESET’s Q3 Threat Report, covering September to December 2021, while the rates of supply chain attacks rose over 2020, 2021 was defined by the continual discoveries of zero-day vulnerabilities powerful enough to wreak havoc on enterprise systems. The discovery of zero-day flaws in Exchange Server and Microsoft’s emergency patches to resolve the on-premise issues continued to haunt IT administrators well into the year.  Brute-force and automated password guessing, such as through dictionary-based attacks, were the most frequent attack vectors detected according to ESET telemetry. Attacks against remote desktop protocol (RDP) increased by 274% during the four-month period.  “The average number of unique clients that reported at least one such attack per day shrank by 5% from 161,000 in T2 2021 to 153,000 in T3 2021,” the report says. “In other words, the intensity of RDP password-guessing attacks is growing rapidly, yet the pool of potential victims is becoming smaller.” Also: One in seven ransomware extortion attempts leak key operational tech recordsPublic-facing SQL servers and SMB services also saw an uptick in credential-based attacks. 

However, exchange Server’s ProxyLogon bugs secured the second spot when it came to popular attack vectors. “Microsoft Exchange servers ended up under siege again in August 2021, with ProxyLogon’s “younger sibling”, named ProxyShell, exploited worldwide by several threat groups,” the report says.  The last four months of 2021 also revealed the consequences of a critical vulnerability in Log4j. Tracked as CVE-2021-44228, the remote code execution (RCE) flaw in Log4j issued a CVSS severity score of 10.0, sent teams scrambling to patch the problem. Threat actors instantaneously began attempting to exploit the vulnerability. Even though the issue was only made public in the last three weeks of 2021, ESET has recorded CVE-2021-44228 among the top five attack vectors of the year.  Ransomware, as expected, remains a thorn in the side of businesses today. ESET says its “worst expectations” of this malware variant were surpassed during 2021, with critical infrastructure attacked — including the assault against Colonial Pipeline — and over $5 billion in cryptocurrency transactions tied to ransomware campaigns were recorded during the first half of 2021 alone.  The research also notes a recent surge in Android banking malware, rising by 428% in 2021 in comparison to 2020. According to ESET, infection rates associated with Android banking Trojans — such as SharkBot, Anatsa, Vultur, and BRATA — have now reached the same levels as adware.  See alsoHave a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Organisations worldwide including in Asia-Pacific are expected to increase their focus on building trust, with several appointing chief trust officers to lead efforts. The move will be necessary especially as ransomware and supply chain attacks are projected to escalate this year. At least five global companies currently have dedicated executive roles that oversee trust matters. None are from Asia-Pacific, according to Jinan Budge, principal analyst with Forrester, where she looks at Asia-Pacific security and risk research. She pointed to a 2022 prediction, in which Forrester expected at least 15 Global 500 organisations to appoint chief trust officers. Reporting directly to their CEO, these roles initially would look at security, privacy, and risk management, before expanding their efforts to encompass brand strategy, corporate values, and other human-centric aspects of trust.

Other organisations also were expected to add such responsibilities to an existing C-level executive, such as chief information security officers, according to the Forrester report, which Budge co-authored. The analyst told ZDNet that Asia-Pacific enterprises must start looking more closely at the issue of trust, especially as such discussions surfaced amongst consumers. She noted that privacy and confidentiality were the top five priorities for consumers in Asia-Pacific when they made online purchases. She added that Forrester expected two chief trust officers appointed this year to be from this region.

Apart from the need to build trust, enterprises also should be concerned about brain drain in the security sector, she said. One in 10 experienced security professionals were expected to exit the industry this year, according to Forrester’s predictions. With more than 3 million roles already unfilled globally, the lack of talent in security would be further compounded as executives suffered from burnout. Forrester’s 2021 figures revealed that 51% of cybersecurity professionals experienced extreme stress, while 65% said they considered leaving their job due to work stress as well as poor financial incentives and limited promotion and career development. Budge noted that the brain drain also would impact organisations in Asia-Pacific and affect all aspects of cybersecurity, including national security. She urged businesses and chief information security officers to address the issue by looking at ways to attract and retain stuff. These should include efforts to reduce team burnout, create opportunities for career development, and nurture a good culture. Supply chain attacks likely to escalate Asked about security challenges that would escalate this year, Yihao Lim, Mandiant Threat Intelligence’s principal intelligence advisor, said third-party attacks would continue to persist because they were difficult to detect and combat. Third parties were trusted source and organisations often push out software patches and updates from these partners without first testing them in a sandbox, Lim said in an interview. These sometimes would be applied directly on production servers, resulting in malware being deployed without much scrutiny. Third-party suppliers served as pivot points for hackers targeting businesses in the wider ecosystem, he added. Pointing to high profile supply chain attacks such as SolarWinds and Kaseya, he noted that these involved applications that were used by multiple customers and were highly reputable. Forrester predicted that third-party attacks would account for 60% of global security incidents in 2022, with 55% of security professionals acknowledging their organisation last year experienced a security incident or breach involving supply chain providers. Some 27% of organisations experienced at least 10 such disruptions in 2021, compared to just 4.8% the year before. The research firm underscored the need for companies to deploy tools for risk assessment, supply chain mapping, real-time risk intelligence, and business continuity management. Budge added that while these attacks were not new, they were expected to increase as the pandemic further accelerated the growth and expansion of third-party ecosystems. Companies were not only tapping the innovation of external partners rather than developing their own products, but also collaborating with third parties to drive their digital engagement with customers. Furthermore, Asia’s role as a major manufacturing hub made the region a bigger target of supply chain attacks, said Righard Zwienenberg, ESET’s senior research fellow. He, too, expected such attacks to likely worsen this year. Zwienenberg noted that the change in work environment due to the pandemic provided cybercriminal with a lot more options in seeking out vulnerable systems, including those that resided within the wider supply chain ecosystem. These could comprise non-IT suppliers that might not know how to ensure their networks and data were adequately secured in a remote or hybrid work infrastructure, he said. Security risks from the accelerated shift to remote work were likely more prevalent in Asia-Pacific, he added, where organisations were less accustomed to such work practices. This meant they were less prepared in facilitating the move, while maintaining their overall security posture. Vulnerabilities on employees’ personal devices or home routers brought new threats to corporate networks, he said. If enterprise networks were not segmented as a security measure, ransomware then could easily spread and move to the wider supply chain ecosystem. Zwienenberg suggested that organisations mitigate such risks by restricting user access to what was essential to their job, so they did not have access to the entire corporate network.

Access segmentation would enable companies to quickly isolate systems in the event of a security incident or breach, and prevent the rest of their network from being compromised, he said. They also should implement other security tools such as multifactor authentication, network monitoring, and threat detection, he added. For instance, companies should be able to detect if an employee’s home router was unsecured and deny access. He noted that there still were many organisations in Asia-Pacific that did not have such tools in place to ensure their networks were secured. Interestingly, Forrester had forecasted insider threats to climb significantly in 2021, but this did not materialised. In fact, incidents of insider threats fell last year, Budge said. She theorised that this mismatch might be due to the shift towards remote work, which impacted organisations’ ability to effectively detect insider threats. Because it became difficult to determine what was “normal” behaviour within the network, due to the change in how users accessed corporate data, companies likely were unable to detect insider threats even if these surfaced. The ability to do so may prove critical as ransomware attacks are expected to further gain ground. Lim noted that ransomware and extortion incidents saw significant growth last year and would continue to climb this year. Threat actors had been proactive in attempts to shame their victims, for example, by contacting media agencies with proof they had access to the victim’s systems. They would do so to get the attention of the victim, which could be a high profile financial company, knowing that data leaks would have repercussions such as lawsuits and damaged reputation for the victim. Such extortion attempts had been highly effective, he said, adding that they would continue to escalate this year amidst the public attention and profits they generated for cybercriminals. “Shaming victims is effective because, especially in Asia-Pacific, organisations would try to keep security breaches confidential and would not even admit them when asked. Now, they can’t even play dumb because hackers are shaming them publicly,” Lim said. By identifying their victims and demonstrating they had access to customer information, cyber attackers were establishing some form of non-repudiation, in which businesses could no longer deny they suffered a security breach. This added pressure on them to pay the ransom to prevent their customers’ data from being leaked, he noted. “The hackers know it’s lucrative, so this trend will continue to persist this year,” he said. He advised organisations to consider all legal and regulatory implications if they had operations in countries such as the US, where they might be sanctioned if they paid up ransom in state-sponsored attacks. Growing geopolitical tensions can drive cybersecurity threats In fact, an increasingly unstable global geopolitical landscape could fuel cyberattacks, including those targeting critical information infrastructures (CII), said Acronis’ co-founder Serguei Beloussov, in a video interview with ZDNet. Pointing to increased tensions between countries such as the US, Russia, and China, he said these could lead to more attacks that disrupt national infrastructures. Security risks were further exacerbated with hacking tools readily available online, Beloussov said. The number and sophistication of such tools not only had increased, but also were more varied, making cyber attacks more efficient and inexpensive to launch.

This could lead to more ransomware attacks against smaller targets such as small and midsize businesses and individuals, he said. While these were less profitable, the wide variety and availability of tools made it easier for hackers to expand the spread of their targets for more returns. Voicing his concerns about raising geopolitical tensions, he said this might push governments to focus on developing cyberweapons. This, in turn, likely would lead to such tools eventually finding their way out of cyber laboratories, and into the hands of conventional bad guys. Beloussov said: “Imagine a scenario when a government launches a cyber attack on another government, and a cybersecurity company detects the activity and investigates it. It figures out how the attack is carried out and publishes the details, from which the bad guys then are able to learn from.” Be it ransomware or supply chain attacks, Budge said the fundamentals remained important in managing security threats. Regardless of the type of attack or vulnerabilities, the analyst advised companies to be strategic and avoid a knee-jerk reaction to security. Beloussov underscored basic things businesses should do to better safeguard against security threats, including running security tools on their systems and devices and maintaining backups of their data. Beyond securing physical access, they also should ensure all systems were regularly checked and updated and properly configured, he said. “The important thing is to take the common sense approach and adopt basic precaution, such as running penetration and vulnerability,” he added. “You need to know how well prepared you are in dealing with all types of attacks.” Zero trust slow to gain momentum in Asia-Pacific And while zero trust had been widely pitched as an essential cybersecurity framework, Budge noted that its adoption remained low in Asia-Pacific for various reasons. First, its label had led to confusion in a region where many cultures were built and reliant on trust. Second, Asian markets largely were risk adverse, she said, with companies only moving to adopt something when another had actually done so. This was starting to change, with more organisations over the past 12 months taking their first steps towards zero trust. However, it required significant transformation on the company’s part, encompassing added investment in technology, resources, and culture. Not all organisations in Asia-Pacific had sufficient people or resources to adopt a zero trust architecture, she said, adding that this also had resulted in its low adoption. Furthermore, vendors in the region were touting such tools as the panacea and silver bullet to  everything related to security. This would not sit well with businesses here, Budge said. Citing figures from Forrester, she noted that just 13% of security leaders in Asia-pacific described zero trust as a top strategic cybersecurity priority in 2021. According to Lim, Singapore’s take on “assume breach position” underscored the importance of zero trust mindset. He noted that businesses should consider two key points this year, with regards to security. First, apply principles of least privilege in establishing the types of network access. Users should only be given access to what they needed for their role and this should be regularly reviewed, especially as employees move from one department to another, he said. Echoing Zwienenberg’s advice, Lim also recommended companies put in place some form of network segmentation, which would help prevent widespread outage when a security incident occurred. Networks could be segregated by functions, enabling attacks to be contained within a zone so an affected section would not affect another. He further emphasised that moving to the cloud did not necessary mean an organisation’s environment would be fully secured. He pointed to the shared responsibility model adopted amongst most cloud providers, he said customers also had to ensure due diligence in securing their own environment, such as implementing the right configuration and administrative tasks. Shared responsibility models typically outlined security boundaries that were under the cloud vendor’s purview and those that should be undertaken by the customers.  RELATED COVERAGE More

Lazarus has been tied to a new campaign attacking hopeful job applicants in the defense industry. 

The advanced persistent threat (APT) group has been impersonating Lockheed Martin in the latest operation. The Bethesda, Maryland-based company is involved in aeronautics, military technology, mission systems, and space exploration. Lockheed Martin generated $65.4 billion in sales in 2020 and has approximately 114,000 employees worldwide.  Lazarus is a state-sponsored hacking group with ties to North Korea. The prolific and sophisticated group is generally financially-motivated and is believed to be responsible for serious attacks in the past beginning with the WannaCry ransomware outbreak, as well as the $80 million heist against Bangladeshi Bank, assaults against freight companies, and South Korean supply chains.  On February 8, Qualys Senior Engineer of Threat Research Akshat Pradhan revealed a new campaign using Lockheed Martin’s name to attack job applicants.  In a similar way to past activities that abused the reputation of Northrop Grumman and BAE Systems, Lazarus is sending targets phishing documents pretending to offer employment opportunities.  The documents, named Lockheed_Martin_JobOpportunities.docx and Salary_Lockheed_Martin_job_opportunities_confidential.doc, contain malicious macros which trigger shellcode to hijack control flow, retrieve decoy documents, and create Scheduled tasks for persistence. 

Living Off the Land Binaries (LOLBins) are also abused to further the compromise of the target machine. However, when the malicious scripts attempted to pull in a further payload, an error was returned — and so Qualys can’t be sure what the final malware package was meant to achieve.  “We attribute this campaign to Lazarus as there is significant overlap in the macro content, campaign flow, and phishing themes of our identified variants as well as older variants that have been attributed to Lazarus by other vendors,” Pradhan says.  This isn’t the first time Lazarus has exploited job candidates or vacancies. F-Secure has previously found samples of phishing emails, masquerading as job offers, that were sent to a system administrator belonging to a targeted cryptocurrency organization. In related research, Outpost24’s Blueliv cybersecurity team has named Lazarus, Cobalt, and FIN7 as the most prevalent threat groups targeting the financial industry today. ZDNet has reached out to Lockheed Martin and we will update when we hear back.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More