Malvertisement evolution - Perform three checks before forwarding the victim to a malicious website.

1. The user agent must be mobile-specific - Sites being targeted by the malware are all optimized to be viewed primarily via mobile device.
2. Battery level must be between 20 and 76 percent - To avoid detection from scanners
3. HTTP referrer must be specified - avoid detection by known security vendors

https://www.scmagazine.com/home/security-news/assault-and-battery-malvertising-campaign-checks-user-device-charge-as-anti-detection-technique/

Do you have a process to decom your old apps/websites? - Don't worry, even some Fortune 500 companies forget it. Here are some scary stats.

• 70% of FT Global 500 firms have access to a portion of their websites being sold on the internet black market. 
• 92% of external web applications have exploitable security flaws or weaknesses.
• 19% percent of the companies examined have external unprotected cloud storage.
• 27%of the U.S. companies have at least one external cloud storage (e.g. AWS S3 bucket) accessible without any authentication from the internet.
• WordPress- 94% have a default admin location (on /wp-admin URL) not protected by any additional means.

https://threatpost.com/threatlist-dead-web-apps-haunt-70-percent-of-ft-500-firms/138659/

MISCONFIGURATION (in the cloud) - Leads to "data breach" That was yesterday's news, today, Threat actors have exploited misconfigured Docker containers to deliver cryptomining malware

The attacks weren’t the result of the Docker engine being compromised or problems within Docker’s enterprise platform but instead were the result of misconfiguration set up at the administrator level

The attackers often exploited the misconfigurations to create Docker containers    through exposed API ports and then installing a wget package using system package manager, using wget to download an auto-deployment script, converting the script from DOS to Unix format, setting the executable permissions for the script, and running the script.

In order to prevent similar attacks researchers recommend organizations: harden their security posture; ensure that container images are authenticated, signed, and from a trusted registry; enforce the principle of least privilege; properly configure how much resources containers are allowed to use; and enable Docker’s built-in security features to help defend against threats.

https://www.scmagazine.com/home/security-news/cybercriminals-exploit-misconfigured-container-to-deliver-cryptominer/

Why is "Security in the cloud" (your responsibility) important? (Don't confuse it with "security of the cloud", which is the vendor's responsibility)

Nearly half – 46 percent – of 37,000 Twitter users polled by Armor over a 13-week period said they’ve put sensitive data in the cloud, while 41 percent said they’d do so in the next two years.

In addition, 47 percent did not understand what shared responsibility means in the realm of cloud security.

https://www.scmagazine.com/home/security-news/armoru-poll-finds-46-of-37k-twitter-users-have-put-sensitive-data-in-cloud/

Is it time to move away from "AppSec" to "Software Security"?

If , you agree with the following statements are true:

1. Software is the umbrella for anything written in code; an application is a component of software and just as vulnerable.
2. Applications allow a user to perform a task or activity while software executes that task or activity.
3. Application security came about as initial security testing focused on testing a running application, much like quality assurance testing, and ignored the back-end software components.
4. If something is written in a coding language, then it needs to be tested to ensure it is secure. All software is written in a coding language.
5. Software is the ecosystem of technology while applications are the entry point into that ecosystem.

These four priorities are a good place to start:

1. Organizations need to move beyond the barriers and limitations of traditional gated security approaches and move to a new era of full visibility and control over their software exposure at any stage of the development life cycle.
2. Proper and consistent training should be funded and provided across entire organizations.
3. Remediation efforts need to be made into actionable insights that address vulnerabilities within the entire SDLC.
4. Everyone that touches software and participates in the security of it needs to be forward thinking, forgetting the typical nuances of the past.

https://www.darkreading.com/attacks-breaches/appsec-is-dead-but-software-security-is-alive-and-well/a/d-id/1333096

Good News for windows 10 users - Microsoft has built Windows Defender to run in a sandboxed environment.

With Windows Defender running in a restrictive process execution environment, attackers who break in are stuck inside the isolated environment and can't affect the rest of the system.

The feature is now available to Windows Insiders to test in upcoming versions of Windows 10. If you are not in the program and can't wait for Microsoft to release it in full, you can force-enable Windows Defender to run in a sandbox on Windows 10 version 1703 and later.

Windows Defender runs with high privileges to scan systems for malicious content; because of this, it's already a prime target for cyberattacks. If someone successfully exploits a bug in Windows Defender, an entire system can be taken over.



https://www.darkreading.com/analytics/windows-defender-first-full-antivirus-tool-to-run-in-a-sandbox/d/d-id/1333141

Can you rely on that little "green lock" in your browser - Not any more if the following is true.

By the end of 2016, less than 1% of phishing attacks leveraged Web certificates, he continues. By the end of 2017, that number had spiked to 30%. 
"We expect by the end of this year more than half of attacks are [going to be] done using Web certificates," 

Web certificates provide a low-cost means for attackers to convince victims their malicious sites are legitimate, explains Alejandro Correa


https://www.darkreading.com/attacks-breaches/deepphish-simulating-malicious-ai-to-act-like-an-adversary/d/d-id/1333135