what happens when your Spy starts spying on you - JP Morgan security chief "went rogue," collecting data on some of the bank's senior executives and sparking an internal scandal.

With the help of more than 100 engineers from the data mining company Palantir, Peter Cavicchia III collected emails, browser histories and GPS locations from company phones, as well as transcripts from recorded phone conversations. The original surveillance, started in 2009, was sanctioned by the bank as a means to keep tabs on potentially dishonest traders, according to a Bloomberg News report published Thursday.

The extensive data collection, however, came to an abrupt halt after Cavicchia "went rogue," collecting data on some of the bank's senior executives and sparking an internal scandal, the report said. He was forced to resign in 2013.


https://www.cnbc.com/2018/04/19/jp-morgan-reportedly-had-to-oust-a-security-chief-backed-by-palantir.html

Irony - RSA conference is a security conference and their app was leaky (again)

You wouldn’t expect the organisers of a seminar on nuclear physics to hand out conference badges that were contaminated with dangerous levels of radioactivity.

You wouldn’t expect to attend a workplace health and safety training course in a conference centre where the fire exits had been padlocked shut


RSAC was back in the “do as I say not as I do” limelight again in 2014, issuing an official mobile app for the event that hooked into the event database so you could see the schedule of talks, with any last-minute updates or changes automatically shown.

Unfortunately, the database pulled down by the app also included details of all the other conference delegates who had registered to use the app so far – meaning that anyone who installed the app after you would get to see your details, too.

At RSAC 2018, Twitter user @svblxyz found similar security problems to those of 2014 in this year’s conference app.

Amongst other things, the app contained URLs from which database content could be downloaded, apparently including the real names of other mobile app users.


https://nakedsecurity.sophos.com/2018/04/20/rsa-conference-has-a-leaky-app-again/

iPhone fans - Your phoned can be "TrustJack"ed.

Trustjacking attackers would be able to view a victim's device screen essentially in real time by installing the developer image suitable for a particular iPhone's iOS version, and then taking continuous screenshots. And they could steal content such as photos, app data and SMS and iMessage chat history simply by creating an iTunes back-up.

The only action required on the part of the victim is agreeing to "trust" the connected device when responding to an Apple security notification acknowledging the presence of an unknown machine.



Attackers have the power to remotely view victims' mobile screens, exfiltrate valuable content, or even install malicious spy apps disguised in the package of genuine apps.The victim does not even have to enable the iTunes Wi-Fi sync feature

Symantec recommends that iOS users reset their list of trust devices and enable encrypted back-ups in iTunes while implementing a strong password.


https://www.scmagazine.com/trustjacking-exploit-abuses-itunes-feature-to-spy-on-ios-devices/article/759686/

Chrome Users - Check if you have installed any of these FAKE MALICIOUS extensions

• AdRemover for Google Chrome™ (10 million+ users)
• uBlock Plus (8 million+ users)
• [Fake] Adblock Pro (2 million+ users)
• HD for YouTube™ (400,000+ users)
• Webutation (30,000+ users)

Discovered by Andrey Meshkov, co-founder of Adguard, these five malicious extensions are copycat versions of some legitimate, well-known Ad Blockers.

The malicious extension then receives commands from the remote server, which are executed in the extension 'background page' and can change your browser's behavior in any way.

https://thehackernews.com/2018/04/adblocker-chrome-extention.html

You think you have secured your endpoints with latest and greatest tools. What if the attacker can steal your data without touching your endpoints?

RSAC demo - IoT was  hacked to steal PII. 
In the demo, the IoT device need not be directly connected to the target network device. It doesn't require sophisticated hacking skills — Metasploit tools or the Linux command line will suffice

The attack begins with an exploit of a surveillance camera via the Devil's Ivy vulnerability — a remote code execution vulnerability in an open source gSOAP library that was discovered by the Senrio team last summer. A patch for the vulnerability already exists but was not applied to this camera model — and that's not unusual.

Once the camera is compromised, the attackers then have a bird's-eye view of an employee at his workstation and the items on his desk — which include a router and a network access server (NAS). The attackers can then watch the user's keystrokes when logging in to the NAS.


How can enterprises defend against attacks like these? Carlton takes a deep breath. 

"First, find what [IoT] devices are on your network," she says. "Then we'll talk."  

https://www.darkreading.com/vulnerabilities---threats/first-public-demo-of-data-breach-via-iot-hack-comes-to-rsac/d/d-id/1331588

Do you Monitor Shadow Admin accounts? Cloud shadow admins can be used to compromise the entire cloud infrastructure

Shadow Admin are network accounts with sensitive privileges, typically overlooked because they are not members of a highly privileged Active Directory group. “Instead, shadow admin accounts are granted their privileges through the direct assignment of permissions using access control lists on AD objects"


In a session on Thursday researchers offered nearly a dozen proof-of-concept scenarios where an inside-attacker can silently persist and abuse cloud platforms to escalate user privileges to cause harm or access protected company data.

they can launch a new machine, connect to the machine and assign the machine permissions. Next, they can use those permissions to shut down cloud instances, exfiltrate data from databases or run crypto mining code.

An adversary can maliciously terminate Amazon Elastic Compute Cloud (EC2) instances running within a targeted company

“The terrifying thing is we have discovered ten different examples just like this,” Lazarovitz said. “In each example the attacker only needs one permission to escalate and gain full admin rights.”


https://threatpost.com/cloud-credentials-new-attack-surface-for-old-problem/131304/

Exploit (PoC) is now available for the remote code execution vulnerability (CVE-2018-0886) in MS Windows. Applying 03/2018 Patch is not enough.Using non-privileged accounts is also recommended.

Discovered by researchers at Cybersecurity firm Preempt Security, the issue (CVE-2018-0886) is a logical cryptographic flaw in CredSSP that can be exploited by a man-in-the-middle attacker with Wi-Fi or physical access to the network to steal session authentication data and perform a Remote Procedure Call attack


When a client and server authenticate over RDP and WinRM connection protocols, a man-in-the-middle attacker can execute remote commands to compromise enterprise networks.

Though researchers also warned that patching alone is not sufficient to prevent this attack, IT professionals are also required to make some configuration to apply the patch and be protected.

Blocking the relevant application ports including RDP and DCE/RPC would also thwart the attack, but researchers say this attack could even be implemented in different ways, using different protocols.

It is a good idea to decrease the use of privileged account as much as possible and instead use non-privileged accounts whenever applicable.


https://thehackernews.com/2018/03/credssp-rdp-exploit.html