Information Technology

Consumers in Singapore and Australia share more personal information now than they did two years ago, but more in the two Asian markets will ditch service providers that suffer a data breach than their global counterparts. The former also are disgruntled about having to provide their data to use online services.Some 67% of respondents across Singapore and Australia felt they had little choice but to divulge their personal information in order to use online services. In fact, 54% said they shared their data with so many organisations online each day that they could not verify each company’s ability to safeguard personal data, according to a survey commissioned by security vendor Imperva. Conducted by YouGov, the online study polled 6,773 consumers in the two Asian markets as well as the US and UK, with 1,079 respondents from Singapore and 1,004 from Australia. 

More in Singapore and Australia, at 46%, said they shared more personal information now than they did two years ago, compared to the global average of 33%. Feeling compelled to share their personal data, 37% in the Asian markets said their trust in digital services providers’ willingness to safeguard their personal data had dipped over the past five years. The global average for this was 41%. Specifically, retailers and online games services providers were deemed the least trustworthy in protecting confidential information, with just 5% of respondents in Asia expressing trust in these companies. Another 8% trusted social media platforms such as Facebook and Twitter. Government and financial organisations were amongst the most trusted. Some 44% had complete trust in the former, while 41% trusted financial business would keep their personal data private.Some 50% in the two Asian markets would stop or had stopped using services from companies that suffered a serious data breach, higher than the global average of 43%. Despite their lack of trust in some businesses, respondents appeared more willing to reveal personal data on cloud-based messaging platforms. Some 23% admitted to having said something via these services to a colleague, friend, or family member that could damage a relationship. Another 18% acknowledged to uttering offensive, such as homophobic and racist, statements while 16% had intentionally lied on these messaging platforms.Across the board, 37% in Singapore and Australia had discussed private topics via a cloud messaging app or service, despite 93% acknowledging they could face serious consequences if these conversations were leaked. Some 45% would feel violated if this happened, while 29% said they could lose their job if their conversations on cloud messaging platforms were leaked. Imperva’s Asia-Pacific Japan regional vice president, George Lee, said: “Consumers face a disheartening Catch-22 scenario: they need digital services to operate in modern life, but their trust in these services is deteriorating. Businesses need to focus on who is accessing their data and protecting the paths a cybercriminal might exploit to get to the data. Taking a data-centric security approach must be part of every organisation’s strategy as consumers grow increasingly cynical of the services they use.”According to Forrester’s 2021 State of Enterprise Breaches, 68% of respondents in Asia-Pacific revealed they suffered at least one security breach last year, higher than the global average of 63%. Businesses in this region took a median of 33 days to identify and eradicate an attack and 11 days to recover from an attack. They lost a median of $2.2 million per breach. Globally, organisations spent a median of 27 days identifying and eradicating an attack as well as 10 days to recover from a breach. It cost businesses a median of $2.4 million in total per breach.RELATED COVERAGE More

The US Treasury Department on Thursday linked a notorious North Korean hacking group to a massive $600 million cyber breach last month. The connection was clear when the Treasury Department updated its sanctions listing for the hacking group, called Lazarus Group. The federal agency added a cryptocurrency address that was used to steal $600 million from the Ronin network, a blockchain network created by the Vietnamese game company Sky Mavis.  

The Ronin network powers the play-to-earn game Axie Finity. Sky Mavis created the network to get around Ethereum network congestion. Last month, the company revealed it had 173,600 in Ethereum (ETH) and 25.5 million USD coins drained from the Ronin network. At the time, the crypto assets were valued at over $600 million.Sky Mavis on Thursday acknowledged the new Treasury Department listing. “We are still in the process of adding additional security measures before redeploying the Ronin Bridge to mitigate future risk. Expect the bridge to be deployed by end of month,” the company said. “We would like to extend a thank you to all law enforcement agencies who have supported us in this ongoing investigation.”To put the $600 million heist in context, hackers from North Korea stole nearly $400 million worth of cryptocurrency in 2021, according to blockchain analysis firm Chainalysis. Lazarus is among the most prolific and sophisticated of the hacking groups with links to North Korea. The group was responsible for the destructive wiper attack on Sony Pictures Entertainment in 2014. More

Over half of all ransomware attacks reported during the first three months of this year are the work of just two cyber criminal outfits. According to analysis of recorded ransomware attacks between January and March 2022 by cybersecurity researchers at Digital Shadows, LockBit 2.0 and Conti were the two most active ransomware gangs during the three-month reporting period, accounting for 58% of all incidents. And of the two, LockBit is by far the most prolific, accounting for 38% of ransomware attacks. That’s almost twice the number of recorded attacks by the Conti ransomware group, which accounted for 20% of campaigns in the same period.  Both groups steal data from their victims and threaten to publish it on leak sites if the ransom isn’t paid. According to Digital Shadows, LockBit leaked the information of over 200 victims during the first quarter of the year – the most leaks thus far.While these two gangs were the busiest, other threats included Hive ransomware, Vice Society ransomware and Blackbyte ransomware, among others. SEE: Cybersecurity: Let’s get tactical (ZDNet special report)Conti ransomware has remained a major threat, despite February’s Conti Leaks, which revealed much about the inner workings of the ransomware group. Internal chat logs and other information got leaked after Conti publicly posted a message of support for Russia’s invasion of Ukraine. But this setback doesn’t seem to have dissuaded those behind Conti, who continue to conduct ransomware attacks. “While the Conti chat leak is likely to have some impact on the group, it is unlikely that this will significantly affect the group’s market share. Conti has shown no signs of slowing down since the chat logs and source code leak,” Ivan Righi, senior cyber threat intelligence analyst at Digital Shadows told ZDNet.”However, the leak is a blow to the group’s reputation, and could therefore affect its ability to attract new affiliates and have a long-term impact on its ability to grow,” he added.One ransomware group does seem to have disappeared. Researchers note that PYSA ransomware, which was the third most active ransomware group during the final three months of 2021 appears to have dropped off the radar. Another previously prolific ransomware group, Revil, also appears to have stopped operating.But while some ransomware groups seem to disappear, other new ransomware threats continue to appear. Some new ransomware groups which have appeared since January 2022 which have been listed by Digital Shadows include Stormous, Night Sky, Zeon, Pandora, Sugar, and x001xs. It’s likely that individuals involved in groups which shut down simply find new work with other ransomware gangs. “New ransomware groups are created at a similar rate to groups being shut down. This is likely because affiliates frequently move from groups that are no longer active to those that are emerging,” said Righi.”Regardless of the external factors and shifts in targeting, ransomware is likely to remain one of the biggest threats to organizations worldwide over the next quarter,” he added. There are several steps which businesses can take to avoid falling victim to ransomware. These include applying security patches to software and operating systems as quickly as possible, so cyber criminals can’t exploit known vulnerabilities to enter and exploit networks.  Organisations should also roll out multi-factor authentication to all users to provide an extra barrier to attacks and if it’s suspected that a password has been hacked, it should be changed immediately. MORE ON CYBERSECURITY More

A new type of information stealer has been added to the Haskers Gang malware portfolio. On Thursday, researchers from Cisco Talos said that the malware, dubbed ZingoStealer, is being offered for free to Haskers Gang Telegram group members.

ZDNet Recommends

The best security key

While robust passwords help you secure your valuable online accounts, hardware-based two-factor authentication takes that security to the next level.

Read More

Active since at least 2020, the Haskers Gang group isn’t your typical, small collective of cybercriminals. Instead, the ‘community’ comprises of a few founders — likely based in Eastern Europe — and thousands of casual members. Haskers Gang communicates via Telegram and Discord to share ‘community’ updates, tools, and its latest activities. The Telegram group has just under four thousand subscribers who share tips on cracks, crypters, bypassing security measures and hacking software. Telegram is also abused to manage the malicious executables and exfiltrated data packages.According to the researchers, the attackers target gamers through cheat codes, pirated software and tend to focus on Russian-speaking victims. The new ZingoStealer information stealer can harvest account credentials, Chrome and Firefox browser data, and Discord tokens, among other datasets. In addition, the malware will try to tap into any cryptocurrency wallet credentials held by browser extensions from services including BitApp, Coinbase, Binance, and Brave. ZingoStealer may also be used in conjunction with other malware strains, including RedLine Stealer. RedLine Stealer contains your typical stealer functions alongside the ability to harvest VPN account credentials and login details, impacting vendors including NordVPN, OpenVPN, and ProtonVPN. In January, Fortinet observed the malware being spread in a phishing campaign taking advantage of the COVID-19 pandemic. Furthermore, ZingoStealer can also be used to deploy a cryptocurrency miner on infected systems. Also known as cryptojacking, cybercriminals may quietly execute a cryptocurrency miner in attacks that steal computing power to mine for coins — and these virtual assets are sent to wallets controlled by threat actors. In this case, a custom version of XMRig, a Monero (XMR) miner, is deployed. The hackers internally refer to this miner as “ZingoMiner.” ZingoStealer was first released in March this year. Even though it is a new form of malware, its code has already undergone extensive development, and there are multiple versions in the wild. However, while a free version of ZingoStealer has been released, the threat group is also attempting to cash in with a subscription version, also known as malware-as-a-service (MaaS), which costs roughly 300 roubles ($3). This variant also contains a crypter called ExoCrypt. It is possible multiple threat groups will adopt the stealer in the future, especially as a free option is available.”While the malware is new, Cisco Talos has observed that it is undergoing consistent development and improvement and that the volume of new samples being observed in the wild continues to increase as more threat actors attempt to leverage it for nefarious purposes,” the researchers said. See alsoHave a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Microsoft has carried out another legal-technical takedown against cyber criminals, this time to dismantle the ZLoader botnet’s infrastructure.ZLoader malware has infected thousands of organizations, mostly in the US, Canada and India, and is known to have distributed the Conti ransomware.      

Microsoft has now received a court order from the US District Court for the Northern District of Georgia that allowed it to seize 65 domains the ZLoader gang had been using for command and control (C&C) for its botnet built from malware that infected businesses, hospitals, schools, and homes.SEE: Clueless hackers spent months inside a network and nobody noticed. But then a ransomware gang turned upThose domains now direct to a Microsoft sinkhole, outside of the control of the ZLoader gang. Microsoft also gained control over the domains ZLoader used for its domain generation algorithm (DGA), which are used to automatically create new domains for the botnet’s C2.”Zloader contains a domain generation algorithm (DGA) embedded within the malware that creates additional domains as a fallback or backup communication channel for the botnet. In addition to the hardcoded domains, the court order allows us to take control of an additional 319 currently registered DGA domains. We are also working to block the future registration of DGA domains,” said Amy Hogan-Burney, general manager of Microsoft’s Digital Crimes Unit. Microsoft led the action against ZLoader in partnership with researchers from ESET, Lumen’s Black Lotus Labs, and Palo Alto Networks Unit 42. Avast also assisted in Microsoft’s DCU European investigation. According to ESET, Zloader had about 14,000 unique samples and more than 1,300 unique C&C servers.Microsoft acknowledges ZLoader is not finished and is also working with ISPs to identify and remediate infections on infected systems. It’s also referred the case to law enforcement. Microsoft in 2020 used a similar legal-technical approach to taking down the Trickbot botnet.  Microsoft in its technical analysis of ZLoader notes that the group used Google Ads to distribute Ryuk ransomware, allowing it to bypass email security and have it appear in the browser instead. Malicious ads and email were its primary delivery mechanisms. Each campaign impersonated known tech brands, including Java, Zoom, TeamViewer, and Discord.   “The actors would purchase Google Ads for key terms associated with those products, such as “zoom videoconference.” Users who performed Google searches for those terms during a specific time would be presented with an advertisement that led to the form grabbing malicious domains,” Microsoft explains. For email delivery, the group often used Microsoft Office attachments and abused macros to infect machines. The lures to trick victims into opening a document and enable macros included COVID-19 alerts, overdue invoice payments and fake resumes.  It is probably not the end of the story yet, though. “Our disruption is intended to disable ZLoader’s infrastructure and make it more difficult for this organized criminal gang to continue their activities. We expect the defendants to make efforts to revive ZLoader’s operations,” Microsoft said. More

Hackers have developed custom tools to gain full system access to a number of industrial control system (ICS) and supervisory control and data acquisition (SCADA) devices, according to the US Cybersecurity and Infrastructure Security Agency (CISA). The warning comes in a joint cybersecurity advisory released by the Department of Energy (DOE), CISA, the NSA, and the FBI that urges all critical infrastructure operators to immediately bolster the security of their ICS/SCADA devices and networks. 

ZDNet Recommends

The custom-made tools have been developed for programmable logic controllers (PLCs) from Schneider Electric and OMRON Sysmac NEX, as well as Open Platform Communications Unified Architecture (OPC UA) servers.SEE: This sneaky type of phishing is growing fast because hackers are seeing big paydaysCISA says the tools allow for “highly automated exploits” against targeted devices.  ICS security firm Dragos, which has studied the tools, dubs it Pipedream, the seventh-known piece of ICS-specific malware following Stuxnet, Havex, BlackEnergy, Crashoverride, and Trisis. It attributes the malware to an advanced persistent threat (APT) actor it calls Chevronite. “Pipedream is a modular ICS attack framework that an adversary could leverage to cause disruption, degradation, and possibly even destruction depending on targets and the environment,” Dragos explains. Mandiant calls the malware INCONTROLLER. In early 2022, it worked with Schneider Electric to analyze the malware.  The APT group can disrupt ICS devices after gaining a foothold in a target’s operational technology (OT) network, which should be isolated from the internet. The attackers can also compromise Windows workstations used by engineers with an exploit for known vulnerabilities in ASRock motherboard drivers, according to CISA. One known ASRock vulnerability is tracked as CVE-2020-15368 and affects the AsrDrv103.sys. The exploit for it can be used to execute malicious code in the Windows kernel, which is below the visibility of anti-malware technology.The agencies stress that energy sector organizations in particular need to implement detections and mitigations detailed in the alert. “By compromising and maintaining full system access to ICS/SCADA devices, APT actors could elevate privileges, move laterally within an OT environment, and disrupt critical devices or functions,” CISA notes. Devices known to be targeted by the APT group include: Schneider Electric MODICON and MODICON Nano PLCs, including (but may not be limited to) TM251, TM241, M258, M238, LMC058, and LMC078;OMRON Sysmac NJ and NX PLCs, including (but may not be limited to) NEX NX1P2, NX-SL3300, NX-ECC203, NJ501-1300, S8VK, and R88D-1SN10F-ECT; and OPC Unified Architecture (OPC UA) servers.   Schneider Electric notes in a security bulletin about the malware that it is not aware of any confirmed or potential use of the malware, but notes: “The framework has capabilities related to disruption, sabotage, and potentially physical destruction.”   The agencies are urging organizations to “isolate ICS/SCADA systems and networks from corporate and internet networks using strong perimeter controls, and limit any communications entering or leaving ICS/SCADA perimeters.” They also recommend using multi-factor authentication for remote access to ICS networks and devices, to change all passwords to them regularly, and remove all default passwords.   The alert for the energy sector follows multiple warnings from the US government for all organizations to bolster cybersecurity amid rising tensions after Russia’s invasion of Ukraine. Satellite operator Viasat recently confirmed wiper malware knocked out thousands of end-user modems in Europe on the day Russia invaded Ukraine. More

Image: Getty Images/iStockphoto
Three out of four government agencies and critical infrastructure entities in the Asia-Pacific region have flagged extended detection and response (EDR-XDR) solutions as being the most difficult to implement for bolstering cyberdefence efforts, according to a Trellix cybersecurity survey.The findings arise after cybersecurity firm Trellix surveyed 200 IT security professionals from Indian, Australian, and Japanese government agencies and critical infrastructure providers that have 500 or more employees.The survey comes amidst government agencies and critical infrastructure entities in the region facing increasingly more cyber attacks, Trellix said.Last month, IBM said the Asia-Pacific was the most targeted region last year, accounting for one in four cybersecurity attacks launched worldwide. In that region, Australia, India, and Japan experienced the most incidents.Among Australian and Indian respondents, 76% and 77% of them, respectively, identified EDR-XDR solutions as the most difficult for organisations to implement. Meanwhile, for Japanese respondents, 71%, said the same thing.The root of this difficulty differed between the countries, however, with 60% of Indian respondents identifying a lack of implementation expertise as the biggest barrier for implementing new cybersecurity solutions. For almost half of Australian respondents, they said a lack of in-house staff resources was the biggest barriers for the implementation of new cybersecurity solutions. Japanese respondents flagged a lack of implementation expertise and a lack of recognition from leadership for the need to invest as the top barriers.Due to the rising number of cyberthreats, organisations also told Trellix that the task of uplifting software supply chain risk management policies and processes was “extremely or highly difficult”.74% percent of surveyed Japanese respondents said this was the case, while 65% and 63% of Indian and Australian respondents, respectively, echoed the same sentiment. 79% of Australian respondents, 82% of Indian respondents, and 66% of Japanese respondents also voiced concerns that there has historically been little oversight over how and where cybersecurity products are developed.In terms of what the surveyed organisations believed would be most beneficial for upping cybersecurity standards across the Asia-Pacific region, 86% flagged government prescribing higher cybersecurity standards as one of the core solutions. “The software supply chain attacks on SolarWinds and Microsoft focused global attention on the seriousness of software supply chain cyber threats and how complicated it is to protect against them. They also realise that their governments can play a significant role in improving their cyber defenses,” Trellix said.Another new survey, this one performed by BDO, revealed that organisations in Australia and New Zealand are making less ransomware payments but have also seen other adverse impacts grow. For instance, the number of security incidents involving data recovery efforts saw a rise of nearly 160%, with a 5% increase in reportable data breaches accompanying this.”Respondents are realising it’s important to look at cyber security incidents as more than just ransoms paid. Industry professionals have noticed that although the number of ransoms being paid is decreasing, the targeting of larger organisations or ‘big game hunting’ of ransoms is maturing,” BDO said.According to BDO, the increase in data recovery exercises correlates with respondent data that indicated a 175% year-on-year increase of emails being the source of respondent data breaches. BDO said this uptick is another instance of remote work introducing a range of new systems and issues, such as document sharing and distribution.Cyber attacks are also becoming more advanced, requiring significantly more time to recover from, respondents told BDO. Compared to 2020, the number of cyber attacks in 2021 causing multiple days of system downtime increased by nearly 215%.Amidst this growing landscape, the Australian and Japanese governments have added more resources to protect against threats. Last year, Japan’s Ministry of Defense announced plans to bolster its cybersecurity unit by bringing on 800 new cyber staff to help defend against increasingly sophisticated attacks. In Australia, the federal government pledged to create 1,900 new government jobs over the next five years for one of its cyber agencies, although some experts have expressed concern that those jobs may not be filled due to the country’s tech skills shortage.Related coverage More

I will start this out by reminding everyone that you should be using a password manager to store and protect all of your passwords. We’ve reached a point where password managers should be considered an absolute must to help with privacy and security.

That being said, if you’re a user of macOS, then there’s a way to manage your passwords with a built-in tool. Said tool is the Keychain Access tool which is built-into macOS and is ready to serve in the traditional user-friendly way of Apple apps. So, if you’re still not ready to jump on board the password manager trend (you should be), at least you have an option that’s ready to serve.I’m going to show you how to open the Keychain Access tool and how to use it to locate (and even change) a saved password in macOS and even create a new Keychain item.The only thing you’ll need to follow along is an Apple laptop or desktop. I’ll demonstrate it on a MacBook Pro running macOS Monterey (version 12.2.1). With that said, let’s get to work.Opening the Keychain Access toolTo open the Keychain Access tool, click on the Launchpad located in the Dock. From there, type keychain and then click on the icon for Keychain Access. In the resulting window, click on the Passwords tab to reveal every entry (Figure 1) that’s been saved to macOS.Figure 1The macOS Keychain Access saves passwords, secure notes, certificates, and keys.Make sure to click Local items in the left navigation and you’ll see every password entry that’s been saved locally.Viewing a password within the Keychain Access toolYou can either scroll through the listing or use the search tool to locate the entry you want to view. Once you’ve located the entry in question, double-click it or right-click it and click Get Info from the resulting menu.A new window will appear (Figure 2) containing all of the information for that entry.Figure 2An entry for a server I have on my LAN includes plenty of information.As you can see, the password is hidden from sight. To view the password for the entry, click Show password and, when prompted, type the password for your user account. The password will then appear in the field. You can then either copy it to the clipboard and use it or you can change it (if necessary).To change the password, simply erase what’s there and type the new entry. After changing the password, make sure to click Save Changes and the password will be updated.Creating a password entryCreating a new password entry in Keychain Access is just as simple. From the Passwords tab, make sure to click Local Items and then click the New icon at the top (small square with a diagonal line). When the new window appears (Figure 3), type a name (or URL) for the Keychain item, add an account name (a username), and then type the password associated with the item.Figure 3Creating a new password entry to be stored in the Keychain Access tool.

ZDNet Recommends

The best Macs

Apple’s Mac lineup can be confusing as the company transitions from Intel processors to its own Apple Silicon processors. But we’re here to help.

Read More

Make sure to pay attention to the Password Strength indicator. You always want to be using strong passwords. If your password is weak or fair, make it more complicated until you reach an Excellent rating.Click Add to save the new entry. And that’s all there is to locating/editing a password entry in macOS and even creating a new entry. If you’re not ready to migrate to a full-blown password manager, you should at least start using the Keychain Access tool until you’re ready to make the jump.Read also: More