Information Technology

Image: Alessio Festa
European football club Manchester United disclosed on late Friday a cyber-security incident that impacted its internal systems.

The football club said it’s still investigating the incident and couldn’t say if the breach allowed the intruders to access data associated with fans or store customers.
While the club remained tight-lipped about what hackers managed to access, they said the incident didn’t impact its primary media channels, such as its website and mobile apps.
“All critical systems required for matches to take place at Old Trafford remain secure and operational and tomorrow’s game against West Bromwich Albion will go ahead,” club officials said in a press release issued late Friday night.
United officials said they detected and took swift actions to contain the attack, which minimized its impact. The club says it’s now working with security experts to investigate the incident and minimize the IT disruption. Manchester police was also notified of the incident.
Manchester United is the second major UK club to disclose a major security breach. In July 2018, a hacker accessed FC Liverpool’s IT network and collected data on the club’s fans.
But Man-U and Liverpool aren’t alone. Other UK football clubs were also targeted by spear-phishing attacks and BEC scammers looking to hijack club payments, according to a report published by the UK National Cyber Security Centre in July this year.

The same report also revealed that one unnamed club also suffered a ransomware attack that impacted its access gate turnstiles. The incident was remediated in time for the next match, allowing fans to enter the stadium. More

Drawing little attention to themselves, multiple threat actors have spent the past two-three years mass-scanning the internet for ENV files that have been accidentally uploaded and left exposed on web servers.

techrepublic cheat sheet

ENV files, or environment files, are a type of configuration files that are usually used by development tools.
Frameworks like Docker, Node.js, Symfony, and Django use ENV files to store environment variables, such as API tokens, passwords, and database logins.
Due to the nature of the data they hold, ENV files should always be stored in protected folders.
“I’d imagine a botnet is scanning for these files to find API tokens that will allow the attacker to interact with databases like Firebase, or AWS instances, etc.,” Daniel Bunce, Principal Security Analyst for SecurityJoes, told ZDNet.
“If an attacker is able to get access to private API keys, they can abuse the software,” Bunce added.
More than 1,100 ENV scanners active this month alone
Application developers have often received warnings about malicious botnets scanning for GIT configuration files or for SSH private keys that have been accidentally uploaded online, but scans for ENV files have been just as common as the first two.

More than 2,800 different IP addresses have been used to scan for ENV files over the past three years, with more than 1,100 scanners being active over the past month, according to security firm Greynoise.

Similar scans have also been recorded by threat intelligence firm Bad Packets, which has been tracking the most common scanned ENV file paths on Twitter for the past year.

185.234.218.174 (🇵🇱) is mass scanning the internet for these paths:/admin-app/.env/api/.env/app/.env/apps/.env/back/.env/core/.env/cp/.env/development/.env/docker/.env/fedex/.env/local/.env/private/.env/rest/.env/shared/.env/sources/.env/system/.env. . . pic.twitter.com/vIBDk7Wbnl
— Bad Packets (@bad_packets) February 19, 2020

Threat actors who identify ENV files will end up downloading the file, extracting any sensitive credentials, and then breaching a company’s backend infrastructure.
The end goal of these subsequent attacks can be anything from the theft of intellectual property and business secrets, to ransomware attacks, or to the installation of hidden crypto-mining malware.
Developers are advised to test and see if their apps’ ENV files are accessible online and then secure any ENV file that was accidentally exposed. For exposed ENV files, changing all tokens and passwords is also a must. More

Video: VPN: Why you should hide your IP address
TANSTAAFL. If you’ve read your Heinlein, you know it’s an acronym for “There ain’t no such thing as a free lunch.” That phrase has actually been around since the days of Old West saloons. If you bought a drink, the saloon would provide you with a free lunch. There was a catch, of course. The lunches were so salty that patrons wound up buying more and more drinks, to slake their thirst.

Directory

The best VPNs in 2020
VPNs aren’t essential only for securing your unencrypted Wi-Fi connections in coffee shops and airports. Every remote worker should consider a VPN to stay safe online. Here are your top choices for best VPNs in 2020 and how to get set up.
Read More

There’s always a catch.
Think about Facebook. We use it for free, but in return for that attention, Facebook catalogs vast amounts of information about us, which it uses for targeted advertising. Google became one of the world’s most profitable companies on the back of “giving away” free search (along with little ads on the side). The result was almost total dominance of the digital advertising industry.
TANSTAAFL.
All of that brings us to VPN services. Let’s do a two minute recap of what a VPN is, first. VPN (or Virtual Private Network) is a term used for services that allow you to encrypt your internet traffic between your computer and a destination computer on the VPN service. This is particularly necessary when using something like a hotel’s open Wi-Fi service, so that other guests can’t watch all your traffic and steal juicy bits, like credit card numbers and passwords.
I did a great intro to VPNs for CNET, our sister site. If you don’t know which VPN service to use, I compared a bunch of commercial VPN providers in The Best VPN services of 2020, analyzing them against 20 different factors.

That directory was a study of commercial VPN services. I limited my analysis to commercial services for a reason: TANSTAAFL.
There are also many free VPN services, but I don’t trust them. You probably shouldn’t either.
Here’s the thing: Running a VPN service is expensive. You need either servers and data lines, or you’re paying a cloud vendor like Amazon for every bit received, sent, and stored. Either way, it costs money. So, think about this: If you’re running a free VPN service, how do you pay for all that expense?
You. In the back of the room. I see your hand up. “Ads,” you say. Yep, that’s a possibility. Some free VPN services plaster ads on your browser display and sell those to whomever will pay.
I see another hand. “Stolen data.” That’s a possibility, too. If you were a criminal organization or a terrorist ring, and you wanted to pick up a lot of credentials quickly, one easy way would be to open up a free VPN and wait for people to just hand you their secret information. As P.T. Barnum is said to have said, “There’s a sucker born every minute.”
TASBEM. In other words, TANSTAAFL.
OK, one more. “Lead in for upgrade sales.” Yeah, that works, too. Some vendors will offer a small amount of free access and when you eat up that bandwidth, they’ll ask you to upgrade. Try before you buy is a proven method for selling services, it’s perfectly legitimate, and it’s often good for both the vendor and the customer.
You may also see some universities, activists, and other well-meaning groups offer free VPNs, but the problem is that they are resource constrained. That means that you’re bound to see either slowdowns or stoppages because they can’t afford the resources needed to provide the service. Some of those groups might also harvest information as you use their services, for use sometime in the future to further whatever their agendas might be.
The bottom line, though, is this: It’s just not worth risking your personal and financial data on a free VPN service. The VPN services I rated range from about $6 to $12 per month, or about $40 to $120 per year. It’s usually a better deal to pay for the whole year at once.
The cost of identity theft keeps going up, both in out-of-pocket expenses and in the time and hassle to clean up the mess. When it comes to a service that’s designed to transfer your personal credentials and keep them safe, isn’t it worth spending just a few bucks to save potentially thousands of dollars, hundreds of hours, and an unmeasurable amount of stomach acid?
For me, it is. I’m using a commercial VPN right now, as I write this. For the peace of mind and digital protection, it’s a few bucks well spent.
*By the way, if you haven’t read Robert Heinlein’s The Moon is a Harsh Mistress, I recommend it highly. It’s a Hugo and Nebula-award winning novel. One word of warning: It’s quite political (1960s political). But it’s also brilliant science fiction — a must read for any serious student of the genre.
You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV.
PREVIOUS AND RELATED COVERAGE

VPN services 2020: The ultimate guide to protecting your data on the internet
Whether you’re in the office or on the road, a VPN is still one of the best ways to protect yourself on the big, bad internet.
How to use a VPN to protect your internet privacy
A virtual private network can go a long way to make sure that neither your ISP, nor anyone else, can snoop on what you do on the internet.
The best mobile VPNs can ensure your privacy anywhere
Going mobile? Stay secure. Here’s how find an effective VPN service. (Hint: You can’t trust every VPN provider.)
Several privacy-busting bugs found in popular VPN services
The bugs can leak real-world IP addresses, which in some cases can identify individual users and determine a user’s location. More

Image: Durpal Project // Composition: ZDNet
The team behind the Drupal content management system (CMS) has released this week security updates to patch a critical vulnerability that is easy to exploit and can grant attackers full control over vulnerable sites.

Drupal, which is currently the fourth most used CMS on the internet after WordPress, Shopify, and Joomla, gave the vulnerability a rating of “Critical,” advising site owners to patch as soon as possible.
Tracked as CVE-2020-13671, the vulnerability is ridiculously simple to exploit and relies on the good ol’ “double extension” trick.
Attackers can add a second extension to a malicious file, upload it on a Drupal site through open upload fields, and have the malicious executed.
For example, a malicious file like malware.php could be renamed to malware.php.txt. When uploaded on a Drupal site, the file would be classified as a text file rather than a PHP file but Drupal would end up executing the malicious PHP code when trying the read the text file.
Drupal devs urge site admins to review recent uploads
Normally, files with two extensions would be detected, but in a security advisory published on Wednesday, Drupal devs said the vulnerability resides in the fact that the Drupal CMS does not sanitize “certain” file names, allowing some malicious files to slip through.
Drupal devs say this “can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations.”

Security updates were released for the Drupal 7, 8, and 9 versions to correct the file upload sanitization procedures.
But the Drupal team also urges site admins to review recent uploads for files with two extensions; in case the bug has been discovered and exploited by attackers before the patch.
“Pay specific attention to the following file extensions, which should be considered dangerous even when followed by one or more additional extensions:
phar
php
pl
py
cgi
asp
js
html
htm
phtml
“This list is not exhaustive, so evaluate security concerns for other unmunged extensions on a case-by-case basis,” Drupal devs said.
It is surprising that such a bug was discovered in Drupal. The double-extension trick is one of the oldest tricks in the book, and it’s one of the main attack vectors that CMS products validate when processing upload fields.
The issue has also been a major issue for Windows users, where malware authors often distribute files with two extensions, such as file.png.exe.
Because Windows hides the last file extension by default, the EXE extensions is hidden while only the first one is shown, tricking users into believing they’re opening an image but, in fact, are actually running an executable file that eventually installs malware. More

A part of the CyberSeal ads posted on a hacking forum
Image: ZDNet
Romanian police forces have arrested on Thursday two individuals suspected of running three online services meant to aid malware development and distribution.
The arrests are part of a joint operation that included the FBI, Europol, Australian, and Norwegian police.
Investigators said the two Romanian suspects are believed to be the creators of three services named CyberSeal, DataProtector, and CyberScan.
The first two are so-called “crypter” services. These types of tools allow malware developers to scramble their malware’s code to bypass and evade antivirus software.
The third service, called CyberScan, worked as a clone of Google’s VirusTotal service. It allowed malware authors to upload and scan their new malware releases and see if it would be detected by antivirus software.
The difference between CyberScan and VirusTotal was that CyberScan didn’t share scan results with antivirus vendors, allowing malware authors to test the detectability of their payloads without having to fear that a “detection alert” would be sent back to the antivirus company and trigger an investigation.
The two suspects had been active on the malware scene since at least 2014 when they first began advertising CyberSeal. The two other services were launched in 2015 (DataProtector) and 2019 (CyberScan).

All three were advertised on multiple hacking forums for prices ranging from $40 to $150.

An ad for the DataProtector crypter service on a well-known hacking forum
Image: ZDNet

An ad promoting the CyberScan service
Image:ZDNet
Europol said the three tools have often been used to crypt and test different types of malware, such as RATs (Remote Access Trojans), information stealers, and ransomware.
More than 1,560 malware authors used the two crypting services to scramble the code of more than 3,000 malware strains.
Authorities cracked down against the gang yesterday, Thursday, November 19, when they searched four locations in the cities of Bucharest and Craiova in Southern Romania and made the two arrests.
According to Romania’s Directorate for Investigating Organized Crime and Terrorism (DIICOT), two other persons were also questioned, believed to be part of the group.
Investigators also took down servers in Romania, Norway, and the US. The cyber-seal.org and cyberscan.org domains, used to host two of the services, are now offline. More

Microsoft says it is the first company in the world to respond to recommendations by Europe’s privacy watchdogs following a decision by Europe’s top court over data being shipped to the US. 
The Court of Justice of the European Union (CJEU) in July struck down the EU-US Data Privacy Shield, throwing into question how companies – in particular US tech giants, but also thousands of European businesses – would send data across to the US without contravening Europe’s General Data Protection Regulation (GDPR). 

More on privacy

Julie Brill, Microsoft’s chief privacy officer, boasts that the maker of Windows 10, Office, and Azure is the first entity in the world to meet recommendations outlined by Europe’s data-protection heads last week. 
“Today, we’re announcing new protections for our public sector and enterprise customers who need to move their data from the European Union, including a contractual commitment to challenge government requests for data and a monetary commitment to show our conviction,” said Brill. 
“Microsoft is the first company to provide these commitments in response to last week’s clear guidance from data protection regulators in the European Union.”
European privacy authorities, under the European Data Protection Board (EDPB), last week adopted several recommendations to reflect the so-called ‘Schrems II’ ruling. 
“As a result of the ruling on July 16, controllers relying on Standard Contractual Clauses (SCCs) are required to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data in the third country, if the law of the third country ensures a level of protection of the personal data transferred that is essentially equivalent to that guaranteed in the European Economic Area (EEA),” the EDPB said.  

“The CJEU allowed exporters to add measures that are supplementary to the SCCs to ensure effective compliance with that level of protection where the safeguards contained in SCCs are not sufficient.”
US tech companies were forced to make significant adjustments to their terms with users and customers after Austrian lawyer and activist Max Schrems won a privacy lawsuit that he had filed against Facebook in 2013. He argued that information about Europeans sent to US servers could be used by US law enforcement. 
He lodged the case after former National Security Agency (NSA) contractor Edward Snowden in 2013 showed that the agency was conducting mass surveillance on US citizens and foreigners through Google, Microsoft, Facebook and other tech giants. 
Schrems’ lawsuit resulted in the CJEU in 2015 invalidating the EU-US Safe Harbor principle, which for 15 years permitted organizations to send data from Europe to the US. 
The demise of Safe Harbor gave birth to the EU-US Privacy Shield, which came into effect in August 2016. But Schrems filed another lawsuit and in July the ECJ ruled that the new agreement too violated GDPR rules in what is referred to as the ‘Schrems II’ ruling. 
Brill says Microsoft promises to contest all government requests for public-sector or enterprise customer data where it has a lawful reason to. 
“This strong commitment goes beyond the proposed recommendations of the EDPB,” said Brill. 
Microsoft also promises to “provide monetary compensation to these customers’ users if we disclose their data in response to a government request in violation of” GDPR. 
“It shows Microsoft is confident that we will protect our public-sector and enterprise customers’ data and not expose it to inappropriate disclosure.” More

Google is upping the security for at least some of the conversations on its Messages app by adding end-to-end encryption.
It will be rolling out end-to-end encryption on Messages, starting with one-on-one conversations between people using the Rich Communication Services-based version of the app.

“End-to-end encryption ensures that no one, including Google and third parties, can read the content of your messages as they travel between your phone and the phone of the person you’re messaging,” the company explained.
“We recognize that your conversations are private and it’s our responsibility to keep your personal information safe.”
SEE: Managing and troubleshooting Android devices checklist (TechRepublic Premium)
The end-to-end encryption will roll out to beta testers beginning this month and continue into next year, the company said, and eligible conversations will automatically upgrade to the new level of security, although this encryption will only be available when both people in the conversation have Messages installed and chat features on.
Google has been gradually rolling out RCS, the successor to SMS, which aims to bring to texting the same sorts of features you’d find in chat apps like Apple’s iMessage and WhatsApp.  

The company has been working with device makers and mobile operators to encourage them to offer the richer features available as result of the shift to RCS, like sending and receiving better quality photos and videos, chatting over Wi-Fi or data, and knowing when your message has been read. The advertising giant said it has now completed the global rollout of chat features and that anyone using Messages should now have access to these additional features, either from their phone company or from Google. More

Cyber criminals could exploit emerging technologies including artificial intelligence and machine learning to help conduct attacks against autonomous cars, drones and Internet of Things-connected vehicles, according to a report from the United Nations, Europol and cybersecurity company Trend Micro.
While AI and machine learning can bring “enormous benefits” to society, the same technologies can also bring a range of threats that can enhance current forms of crime or even lead to the evolution of new malicious activity.

Artificial Intelligence

“As AI applications start to make a major real-world impact, it’s becoming clear that this will be a fundamental technology for our future,” said Irakli Beridze, head of the Centre for AI and Robotics at the United Nations Interregional Crime and Justice Research Institute. “However, just as the benefits to society of AI are very real, so is the threat of malicious use,” he added.
SEE: Cybersecurity: Let’s get tactical (ZDNet/TechRepublic special feature) | Download the free PDF version (TechRepublic)
In addition to super-powering phishing, malware and ransomware attacks, the paper warns that by abusing machine learning, cyber criminals could conduct attacks that could have an impact on the physical world.
For example, machine learning is being implemented in autonomous vehicles to allow them to recognise the environment around them and obstacles that must be avoided – such as pedestrians.
However, these algorithms are still evolving and it’s possible that attackers could exploit them for malicious purposes, to aid crime or just to create chaos. For example, AI systems that manage autonomous vehicles and regular vehicle traffic could be manipulated by attackers if they gain access to the networks that control them.

By causing traffic delays – perhaps even with the aid of using stolen credit card details to swamp a chosen area with hire cars – cyber attackers could provide other criminals with extra time needed to carry out a robbery or other crime, while also getting away from the scene.
The report notes that as the number of automated vehicles on the roads increases, the potential attack surface also increases, so it’s imperative that vulnerabilities and issues are considered sooner rather than later.
But it isn’t just road vehicles that cyber criminals could exploit by exploiting new technologies and increased connectivity; there’s the potential for attackers to abuse machine learning to impact airspace too.
Here, the paper suggests that autonomous drones could be of particular interest to cyber attackers – both criminal or nation-state-backed – because they have the potential to carry ‘interesting’ payloads like intellectual property.
Exploiting autonomous drones also provides cyber criminals with a potentially easy route to making money by hijacking delivery drones used by retailers and redirecting them to a new location – taking the package and selling it on themselves.
Not only this, but there’s the potential that a drone with a single board computer could also be exploited to collect Wi-Fi passwords or breach routers as it goes about its journeys, potentially allowing attackers access to networks and any sensitive data transferred using them.
SEE: 10 tech predictions that could mean huge changes ahead
And the report warns that these are just a handful of the potential issues that can arise from the use of new technology and the ways in which cyber criminals will attempt to exploit them.
“Cybercriminals have always been early adopters of the latest technology and AI is no different. As this report reveals, it is already being used for password guessing, CAPTCHA breaking and voice cloning, and there are many more malicious innovations in the works,” said Martin Roesler, head of forward-looking threat research at Trend Micro
One of the reasons the UN, Europol and Trend Micro have released the report is in the hope that it’ll be seen by technology companies and manufacturers and that they become aware of the potential dangers they could face – and work to solve problems before they become a major issue.
MORE ON CYBERSECURITY More