Information Technology

An investigation into the Fronton botnet has revealed far more than the ability to perform DDoS attacks, with the exposure of coordinated inauthentic behavior “on a massive scale.”

On Thursday, cybersecurity firm Nisos published new research revealing the inner workings of the unusual botnet. Fronton first hit the headlines back in 2020 when ZDNet reported that a hacktivist group claimed to have broken into a contractor for the FSB, Russia’s intelligence service, and published technical documents appearing to show the construction of the IoT botnet on the intelligence service’s behalf.At the time, it was thought that the botnet was destined to perform distributed denial-of-service (DDoS) attacks on a vast scale. However, after analyzing further documents related to Fronton, Nisos believes that DDoS attacks are only one of many capabilities.  Instead, Nisos says Fronton is “a system developed for coordinated inauthentic behavior,” and the implementation of particular software, dubbed SANA, shows that the botnet’s true purpose could be for misinformation and the spread of propaganda rapidly and automatic fashion.  SANA consists of a web-based dashboard and a variety of functions, including: Newsbreaks: tracks messages, trends, and their responses Groups: bot management Behavior Models: functions for creating bots able to impersonate human social media users  Response Models: how to react to messages & content including breaking news Dictionaries: stores phrases, words, quotes, and comments for use across social media, including positive, negative, and neutral reactions Albums: stores image sets for platform bot accounts.SANA also permits users to create social media accounts with generated email and phone numbers and to spread content across social networks, blogs, forums, and more. In addition, users can set schedules for posts/reactions, and configuration includes how many likes, comments, and reactions a bot should create.  According to the researchers, Fronton operators can also specify how many ‘friends’ a fake bot account should maintain.  “The configurator also allows the operator to specify a minimum frequency of actions, and a minimum interval between actions,” the researchers say. “It also appears that there is a machine learning (ML) system involved that can be turned on or off based on behavior observed on social media.” As of April 2022, the web portal has moved to a different domain but is active. Previous and related coverageHave a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Companies should immediately patch or remove VMware products affected by newly disclosed critical flaws, warns the US Cybersecurity and Infrastructure Security Agency (CISA).The drastic measure of removing the products if they can’t be patched is based on past exploitation of critical VMware flaws within 48 hours of disclosure, according to CISA. 

ZDNet Recommends

VMware on Wednesday 18 May disclosed multiple security flaws in VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), VMware Cloud Foundation, and vRealize Suite Lifecycle Manager. SEE: Just in time? Bosses are finally waking up to the cybersecurity threatThe vulnerabilities are being tracked as CVE-2022-22972 and CVE-2022-22973, which are respectively an authentication bypass with a severity score of 9.8 out of 10, and a local privilege escalation vulnerability with a score of 7.8. An attacker with network access to the management user interface could access it without the need for a password, VMware warns in an advisory. Patches are available and VMware is urging customers to apply them or mitigate the issues immediately, warning in a separate blogpost that the “ramifications of this vulnerability are serious”.   CISA has told US federal civilian agencies to immediately patch them or remove the affected products on the basis of near immediate and widespread exploitation of two VMware flaws – CVE-2022-22954 and CVE-2022-22960 – in the same products in April. VMware released patches for them in April but attackers quickly reverse engineered the patches and chained them together for exploitation. “Malicious cyber actors were able to reverse engineer the vendor updates to develop an exploit within 48 hours and quickly began exploiting these disclosed vulnerabilities in unpatched devices,” CISA said. “Based on this activity, CISA expects malicious cyber actors to quickly develop a capability to exploit CVE-2022-22972 and CVE-2022-22973, which were disclosed by VMware on May 18, 2022.” Security firm Rapid7 observed active exploitation in the wild on April 12, six days after VMware issued patches. Soon after, several public proof-of-concept exploits were being used to install coin miners on vulnerable systems. Attackers chained together CVE-2022-22954 (a server-side template injection issue affecting VMware Workspace ONE Access and Identity Manager) with CVE-2022-22960 (a local privilege escalation bug) to escalate to root privileges. CISA issued an emergency directive requiring federal agencies to immediately patch the April VMware flaws as it had done with the Apache Log4j “Log4Shell” flaws. SEE: Cloud computing security: New guidance aims to keep your data safe from cyberattacks and breachesThe security authority has issued the same directive to federal agencies for the latest VMware flaws, noting the flaws “pose an unacceptable risk” to federal civilian agencies.   “CISA expects threat actors to quickly develop a capability to exploit these newly released vulnerabilities in the same impacted VMware products. Exploiting the above vulnerabilities permits attackers to trigger a server-side template injection that may result in remote code execution (CVE-2022-22954); escalate privileges to ‘root’ (CVE-2022-22960 and CVE-2022-22973); and obtain administrative access without the need to authenticate (CVE-2022-22972),” it says. Cybersecurity authorities from other nations have not issued alerts about the latest VMware flaws. CISA, however, recommends all organizations to patch them swiftly if vulnerable systems are accessible from the internet. VMware has published mitigation steps for some of the affected products.  More

Written by

Adrian Kingsley-Hughes, Contributor

Adrian Kingsley-Hughes
Contributor

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over two decades to helping users get the most from technology — whether that be by learning to program, building a PC from a pile of parts, or helping them get the most from their new MP3 player or digital camera. Adrian has authored/co-authored technical books on a variety of topics, ranging from programming to building and maintaining PCs.

Full Bio

Apple released iOS 15.5 on Monday, and while we already knew what new features this release brought with it before it was released, there were a few things we didn’t know that have since become clear.First, we have information on the security contents of the release.

ZDNet Recommends

The best iPhones

You can find iPhone models directly from Apple starting from $399.

This is a big pile of patches — over two dozen. To make matters more serious, quite a few of these can be triggered remotely, and some through malicious websites. And while none of the patched vulnerabilities seem to be actively exploited by attackers at this time, it makes sense to get those installed as soon as possible so that you’re protected. Better to be safe than sorry.You can check out the security information for iOS 15.5 here, and for all Apple updates here.Must read: Not seeing iOS updates? Check these settingsOne of the reasons that people quote for not updating promptly is a worry that the update is going to cause more harm than good. While Apple certainly has had more than its fair share of flakey updates over the years, I’m happy to report that this doesn’t seem to be one of them.The testing I’ve carried out suggests that battery life following this update is good — it’s certainly no worse than the previous update — and so there are no nasty shocks coming your way in this department.I’ve also been testing performance, and overall usability, and again, nothing showstopping has unveiled itself. If anything, I feel like my iPhone is a little more responsive following this update, although such small changes are hard to measure. On the benchmarking front, iOS 15.5 seems to be on par with iOS 15.4.1. No better, but also no worse. And that’s a win.To check what version of iOS your device is running, tap on Settings > General, then on Software Update. Here you will not only be able to see what version of iOS your iPhone is running, but you can also download and install any updates you’ve missed. And it doesn’t take long. On a half-decent internet connection, your iPhone will be done in under 30 minutes.And it’s not just your iPhone that will need updating — there are also updates for iPadOS, watchOS, tvOS, and macOS out the past few days.So get busy updating!

ZDNet Recommends More

Google aims to boost software supply chain security with an initiative that promises to offer enterprise open-source software users access to the same secure packages used by its own developers to build and maintain code.Google said there has been a 650% year-on-year increase in cyberattacks aimed at open-source software suppliers with the intention of exploiting weaknesses in the ecosystem to go after other targets. “That’s what we’ve been having a real hard look at, is fundamentally how to get ahead of any digital supply chain problems so we’re not in the same position we’re in today on the physical supply chain,” said Sunil Potti, VP of Google Cloud Security.

“And the equivalent of that in the digital supply chain is open-source software. In our opinion, while we’ll have to take an end-to-end view of securing the supply chain, pretty much every company on the planet is exposed to open source software,” he added.SEE: A winning strategy for cybersecurity (ZDNet special report)The packages offered to Google Cloud customers as the Assured Open Source Software service are verifiably signed by Google and are regularly scanned and analysed for vulnerabilities in order to ensure users are as protected against bugs and exploits as possible. They are built using Google’s Cloud Build platform, complete with evidence of verifiable compliance with SLSA (Supply chain Levels for Software Artifacts) – a security framework and check-list of standards and controls to prevent code tampering, improve integrity and secure packages, as well as being distributed from an Artifact Registry secured and protected by Google.This is based on the process used within Google where each step of the build is actively secured during the entire end-to-end process, as well as maintaining separate secured copies of the source code.”Assured OSS allows enterprise customers to directly benefit from the in-depth, end-to-end security capabilities and practices we apply to our own OSS portfolio by providing access to the same OSS packages that Google depends on,” said a Google blog post.Supply chain vulnerabilities are a common tool used by cyber criminals and many incidents begin with attackers exploiting newly discovered zero-day cybersecurity vulnerabilities. However, even if a security patch is provided, organisations can be slow rolling them out, making them vulnerable to attackers. With the new offering, Google Cloud hopes to make managing open-source and supply chain vulnerabilities easier – therefore helping organisations of all sizes stay secure against cyberattacks.”It’s a way for every customer – it could be a two-person shop to a 100,000 employee bank – who leverages or builds code to rely on a curated set of open source packages that Google themselves have invested in to protect our own developers over many years, that we’re now bringing to market in the form of this Assured Open Source package,” said Potti.MORE ON CYBERSECURITY More

Cyber attackers regularly exploit unpatched software vulnerabilities, but they “routinely” target security misconfigurations for initial access, so the US Cybersecurity and Infrastructure Security Agency (CISA) and its peers have created a to-do list for defenders in today’s heightened threat environment. CISA, the FBI and National Security Agency (NSA), as well as cybersecurity authorities from Canada, New Zealand, the Netherlands, and the UK, have compiled a list of the main weak security controls, poor configurations, and poor security practices that defenders should implement to thwart initial access. It also contains the authorities’ collective recommended mitigations.  

“Cyber actors routinely exploit poor security configurations (either misconfigured or left unsecured), weak controls, and other poor cyber hygiene practices to gain initial access or as part of other tactics to compromise a victim’s system,” CISA says. SEE: Just in time? Bosses are finally waking up to the cybersecurity threaThe list of actions includes all obvious candidates, such as enabling multi-factor authentication (MFA) on key systems, such as virtual private networks (VPNs), but which are prone to misconfigurations when implemented in complex IT environments. For example, last year Russian hackers combined a default policy shared by multiple MFA solutions and a Windows printer privilege of escalation flaw to disable MFA for active domain accounts and then establish remote desktop protocol (RDP) connections to Windows domain controllers. This complexity can also be seen in the choice of, deployment and use of VPNs, whose adoption escalated after the pandemic struck.  Recent research by Palo Alto Networks found that 99% of cloud services utilize excessive permissions, against the well-known principle of least privilege to limit opportunities for attackers to breach a system.   The security controls outlined in CISA’s list serve as a useful checklist for organizations, many of which deployed remote-working IT infrastructure hastily due to the pandemic, and amid today’s heightened geopolitical tensions due to Russia’s invasion of Ukraine. It also follows the EU joining the US-Five Eyes in jointly blaming the Russian military on this year’s cyberattack against Viasat’s European satellite broadband users.   As noted in the joint alert, attackers commonly exploit public-facing applications, external remote services, and use phishing to obtain valid credentials and exploit trusted relationships and valid accounts. The joint alert recommends MFA is enforced for everyone, especially since RDP is commonly used to deploy ransomware. “Do not exclude any user, particularly administrators, from an MFA requirement,” CISA notes.Incorrectly applied privileges or permissions and errors in access control lists can prevent the enforcement of access control rules and could give unauthorized users or system processes access to objects.  Of course, make sure software is up to date. But also don’t use vendor-supplied default configurations or default usernames and passwords. These might be ‘user friendly’ and help the vendor deliver faster troubleshooting, but they’re often publicly available ‘secrets’. The NSA strongly urges admins to remove vendor-supplied defaults in its network infrastructure security guidance. “Network devices are also often pre-configured with default administrator usernames and passwords to simplify setup,” CISA notes. “These default credentials are not secure – they may be physically labeled on the device or even readily available on the internet. Leaving these credentials unchanged creates opportunities for malicious activity, including gaining unauthorized access to information and installing malicious software.” SEE: What is ransomware? Everything you need to know about one of the biggest menaces on the webCISA notes that remote services, such as VPNs, lack sufficient controls to prevent unauthorized access. Defenders should add access control mechanisms like MFA to reduce risks. Also, put the VPN behind a firewall, and use IDS and IPS sensors to detect suspicious network activity. Other key problems include: strong password policies are not implemented; open ports and internet-exposed services that can be scanned via the internet by attackers; failure to detect or block phishing using Microsoft Word and Excel documents booby-trapped with malicious macros; and poor endpoint detection and response. CISA’s recommendations include control access measures, implanting credential hardening, establishing centralized log management, using antivirus, employing detection tools and searching for vulnerabilities, maintaining configuration management programs, and implementing patch management. CISA also recommends adopting a zero-trust security model, but this is likely a long-term goal. US federal agencies have until 2024 to make significant headway on this aim.  The full list of security ‘don’ts’ includes: More

Researchers have exposed the inner workings of Wizard Spider, a hacking group that pours its illicit proceeds back into the criminal enterprise.

On Wednesday, PRODAFT published the results of an investigation into Wizard Spider, believed to either be or be associated with the Grim Spider and Lunar Spider hacking groups.According to the cybersecurity firm, Wizard Spider, likely Russian in origin, runs an infrastructure made up of a “complex set of sub-teams and groups, [..] has huge numbers of compromised devices at its command and employs a highly distributed professional workflow to maintain security and a high operational tempo.” Today’s more sophisticated cybercriminal operations, whether purely for profit or working for state interests — as with many advanced persistent threat (APT) groups — often operate business-style models. This includes hiring top talent and creating a financial framework to deposit, transfer, and launder proceeds. In Wizard Spider’s case, this also means pouring some of its profits back into development with investments in tools and software, and paying for new hires. The report suggests that the group commands “hundreds of millions of dollars in assets.” “The group’s extraordinary profitability allows its leaders to invest in illicit research and development initiatives,” the researchers say. “Wizard Spider is fully capable of hiring specialist talent, building new digital infrastructure, and purchasing access to advanced exploits.” PRODAFT says that Wizard Spider focuses on compromising enterprise networks and “has a significant presence in almost every developed country in the world, and many emerging economies as well.” Victims have included defense contractors, enterprise firms, supply chain vendors, hospitals, and critical utility providers. Wizard Spider’s attacks tend to start through spam and phishing using QBot and the SystemBC proxy. The group may also infiltrate businesses through compromised email threads between employees in Business Email Compromise (BEC) schemes. Once there’s a crack in the door, the group will deploy Cobalt Strike and will attempt to grab domain administrator privileges. The Conti ransomware strain is deployed, machines and hypervisor servers are encrypted, and a ransomware demand is made. Victims are managed through a locker control panel.
PRODAFT
Wizard Spider also uses virtual private networks (VPNs) and proxies to hide their tracks. However, the group has also invested in some unusual tools, including VoIP systems and employees tasked with cold-calling individuals and scaring them into paying up after a security incident.This is a tactic employed in the past by a handful of other ransomware groups including Sekhmet, Maze, and Ryuk. Coveware suspects that this kind of ‘call center’ work may be outsourced by cybercriminals, as the templates and scripts used are often “basically the same.”Another tool of note is the Wizard Spider cracking station. This custom kit stores cracked hashes and runs crackers to try and secure domain credentials and other forms of common hashes. The station also updates the team on cracking status. As of now, there are 32 active users. Several intrusion servers were also discovered containing a cache of tactics, techniques, exploits, cryptocurrency wallet information, and encrypted .ZIP files containing notes made and shared by attack teams. “The Wizard Spider team has shown itself capable of monetizing multiple aspects of its operations,” PRODAFT says. “It is responsible for an enormous quantity of spam on hundreds of millions of devices, as well as concentrated data breaches and ransomware attacks on high-value targets.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Written by

Eileen Yu, Contributor

Eileen Yu
Contributor

Eileen Yu began covering the IT industry when Asynchronous Transfer Mode was still hip and e-commerce was the new buzzword. Currently an independent business technology journalist and content specialist based in Singapore, she has over 20 years of industry experience with various publications including ZDNet, IDG, and Singapore Press Holdings.

Full Bio

Singapore has set up a facility to assess and certify systems for their cybersecurity robustness. Manufacturers and developers will be able to have their products tested and certified at the new centre, through which the government hopes to drive the testing, inspection, and certification (TIC) sector for cybersecurity.The SG$19.5 million ($13.99 million) National Integrated Centre for Evaluation (NICE) will facilitate vulnerability assessment of software and hardware products, physical hardware attacks, and security measures, said Cyber Security Agency of Singapore (CSA) and Nanyang Technological University (NTU), which jointly launched the facility on Wednesday. They noted that access to security evaluation facilities were difficult, due largely to high equipment cost and deep expertise typically required to carry out cybersecurity evaluation, at the highest assurance levels. 

Located on NTU Smart Campus, NICE would provide this access to evaluators and developers as well as house a team of research and technical staff with the expertise to use the equipment. NTU’s deputy president and provost professor Ling San said: “The rising threat of cyberattacks makes it vital that institutions, companies, and agencies stay one step ahead of cyberthreats. Properly evaluating hardware to ensure they are designed with security in mind, rather than added on as an afterthought, is the first step in keeping our cyber-physical systems safe.”CSA’s chief executive and commissioner of cybersecurity David Koh added that it was important to ensure new emerging technologies were securely designed, as Singapore moved towards a digital future. Internet of Things (IoT) and increasing use of cyber-physical systems had led to the growth of devices and hardware components, such as communication points and sensors. Citing forecasts from Business Insider Intelligence, CSA said there would 64 billion IoT devices worldwide by 2025.”These components present themselves as potential entry points for hackers and malicious actors,” the agency said. “End-users have little means to assess if these components are secure and need to rely on independent experts to perform such security evaluation.”It added that NICE would support Singapore’s push for greater security evaluation by providing a central platform on which to test and certify products. The centre also would facilitate research and development in advanced security evaluation techniques. In addition, Singapore Accreditation Council (SAC) would work closely with CSA and NiCE to develop relevant accreditation programmes. These would include SAC’s IT testing programmes that enabled accredited TIC companies to assure the accuracy and consistency of their test reports and certificates that facilitated CSA’s initiatives, such as the Cybersecurity Labelling Scheme (CLS).As of end-April, more than 200 products had been submitted for labelling under this scheme. To further streamline the labelling process, CSA on Wednesday also unveiled a new initiative, dubbed “CLS-Ready”. This would enable security functionalities enabled by CLS-Ready hardware to bypass the need to be tested again at the end-device level. For example, manufacturers could use a chip that was certified CLS-Ready in their end-user device, saving them time and cost when testing their device against CLS Level 4. By using a CLS-Ready chip, these devices would not need to go through another round of CLS Level 4 testing, as the core security mechanism in the chip already would have been assured as CLS-Ready, CSA explained.Manufacturers applying for CLS-Ready labels would have to submit an application with supporting evidence and assessment report by an approved lab. These labels would remain valid as long as the devices were supported with security updates, up to a maximum of five years. To encourage adoption, CSA said application fees for CLS-Ready labels would be waived until October 2022.First introduced in October 2020, the labelling scheme was expanded in January last year to include all consumer IoT devices such as smart lights, smart door locks, smart printers, and IP cameras. The scheme, which initially applied only to Wi-Fi routers and smart home hubs, rates devices according to their level of cybersecurity features. While voluntary, the initiative aimed to motivate manufacturers to develop more secure products, moving beyond designing such devices to optimise functionality and cost, as well as enable consumers to identify products with better security features, CSA said.CLS assesses and rates smart devices into four levels based on the number of asterisks, each indicating an additional tier of testing and assessment the product has gone through. Level one, for instance, indicates a product has met basic security requirements such as ensuring unique default passwords and providing software updates, while a level four product has undergone structured penetration tests by approved third-party test labs and fulfilled level three requirements.RELATED COVERAGE More

Written by

Chris Duckett, APAC Editor

Chris Duckett
APAC Editor

Chris started his journalistic adventure in 2006 as the Editor of Builder AU after originally joining CBS as a programmer. After a Canadian sojourn, he returned in 2011 as the Editor of TechRepublic Australia, and is now the Australian Editor of ZDNet.

Full Bio

Perth city
Image: Getty Images
The Auditor-General of Western Australia has once again given state authorities a whack for security weaknesses in IT systems used in the state, with a report on its Public Health COVID Unified System (PHOCUS) tabled on Wednesday. PHOCUS is used within WA to record and track and trace positive COVID cases in the state, and can contain personal information such as case interviews, phone calls, text messages, emails, legal documents, pathology results, exposure history, symptoms, existing medical conditions, and medication details. The cloud system can also draw information in from the SafeWA app on check-ins — which the Auditor-General previously found WA cops were able to access — as well as from flight manifests, transit cards, business employee and customer records, G2G border-crossing pass data, and CCTV footage. The report found WA Health only used encryption in its test environment, was not able to tell if malicious activity was occurring, and lacked a contract management plan with its vendor. “WA Health did not keep logs of user ‘view’ access to information in PHOCUS. Only ‘edits’ (changes or deletions) to information in the system were logged but WA Health did not monitor these logs for inappropriate activity,” the report said. “WA Health will not know if personal or medical information is inappropriately accessed (viewed or edited by WA Health staff or their third party vendors). “Following our audit enquiries, WA Health advised us they have now implemented a process to monitor edit access (data changes), but had not implemented a process to log view access (to detect snooping) due to perceived system performance issues.” The department also encrypted personal and medical information after the audit, increased data masking to all information in its test environment, and implemented a file upload denylist and brought a malware scanner online after the Auditor-General found potentially malicious files could be uploaded to the system. “There were no data loss prevention controls in place to prevent unauthorised sharing of personal and medical information in PHOCUS, and WA Health did not monitor documents shared with external and unauthenticated parties. Poor controls can result in unauthorised disclosure of sensitive information and reputational damage to WA Health,” the report said. Further, the report said WA Health’s third-party vendor had full access to the information in the production environment, which WA Health said was assessed and balanced against the need to build the system quickly; two administrator accounts were left over from a previous vendor; and vendor contracts lacked “important security requirements”. In response to the audit, WA Health said due to implementing four other COVID-related systems at the same time, the issues were appropriately managed and balanced development speed, quality, and resource demands. “No breach of privacy has occurred in relation to the system, continuous data cleansing and quality checking is undertaken, no inaccuracies in case status impacting management were found and no inappropriate use of the system was recorded,” the department said. “This demonstrates the robustness of PHOCUS and that the data is well managed and secure.” Related CoverageWA government allocates AU$25.5m to expand cybersecurity servicesThe Office of Digital Government’s cybersecurity unit will score additional personnel under the funding.Auditor finds WA Police accessed SafeWA data 3 times and the app was flawed at launchWA Health released SafeWA check-in information for purposes other than COVID-19 contact tracing, with six requests being made by the police despite government messaging that the information would only be used to support contact tracing.WA Auditor-General drags local governments over horrendous cyber risk managementUsage of out-of-date software came in for special treatment from the Western Australia Auditor-General, with one entity vulnerable to a 15-year vulnerability.Western Australia sets out digital to-do list in first roadmap releaseThe hard border state is running 22 projects across 12 government agencies to get it a step closer to achieving its whole-of-government digital strategy.328 weaknesses found by WA Auditor-General in 50 local government systemsThe computer systems of 50 Western Australian local government entities were probed and the result was the finding of 328 control weaknesses, with 33 considered as significant by the Auditor-General. More