Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Leaky images and oth ...

 Business

Reports, articles, marketing materials — all are document types most of us handle at some point. We write and edit them on computers, e-mail them to colleagues or friends, share them in the cloud, hand them to clients, and so much more. If a file you intend to show to others contains information they shouldn’t   show more ...  

see, however, you could run into problems. Let’s figure out how to prevent that. Capricious images Secrets such as passwords in the background often show up in images, and by no means do all editing tools get rid of them properly. For example, even if you thoroughly blur over sensitive information with a semitransparent brush, simply tweaking the brightness and contrast is sometimes enough to reveal the secret. To find out how an image can inadvertently spill confidential information — and how to hide it — read this post. In a nutshell, to really hide passwords, bar codes, names, and other secret data in images you work with in a graphics editor, you need to remember two things. First, perform any blurring with 100% opaque tools. Second, publish the image in a “flat” format such as JPG or PNG to prevent others from stripping it into separate layers. But what if you see secret information in an image that’s embedded into a text document? Mischievous PDFs Let’s say you’re about to send a brochure to a client when you realize one of the images contains a colleague’s personal data. You draw a black rectangle over it, using the paid version of Adobe Acrobat on your office computer. All set, right? Concealing part of an image in Adobe Acrobat Reader Alas, if you send that document, the client will still be able to glean too much information about your colleague. Acrobat is not made for image editing, and it has no function to combine a picture with whatever you draw on top of it, so anyone who opens the file can delete or move rectangles and other surface graphics. Any user can simply move away a black rectangle drawn in Adobe Acrobat Reader Exporting from Word to PDF In some cases, it’s handy to adjust an image in the format in which you created the document (for example, DOCX), and then export it to PDF format. For example, if you crop an image, the trimmed part will not transfer to the PDF. Many people use that simple method for light edits on an image in a document. However, it’s important to remember that not every image edit works to hide information in that way. For example the black rectangle trick will still fail. Original image Covering part of an image with a rectangle in Microsoft Word If, after exporting the MS Word file to PDF, you open the resulting file in Adobe Reader and then copy and paste the image back into Word, you will see the original image with no obscuring rectangle. Copy an image from a PDF Paste into Word. Magic! When you export from Word to PDF, the original image and the object drawn on top are not combined. They’re saved separately. Any concealed bits remain in the file as well. Ultimately, Microsoft Word is not designed for image editing any more than Acrobat Reader is. If you see a picture that needs altering in a text document, do the editing in a proper graphics editor and then reinsert it in the document. Microsoft Office Document Inspector Images are not the only items in a document that can retain private information. Others include headers and footers; tracked revisions, comments, and hidden text; linked files such as Excel spreadsheets that form the basis of charts in a report; sometimes even the name of a document author meant to be anonymous. A single file can be full of such trifles, and it’s easy to forget any or all of them. To help detect such potential information breaches in good time, Microsoft Office provides the Document Inspector tool. It scans everything mentioned above, including metadata (such as author’s name), headers and footers, hidden text, embedded objects, and so on. To inspect a file using Document Inspector in Office 365: Open the File tab; Select Info; Click Check for Issues; Select Inspect Document. The names of the settings may differ depending on the version of Word. If Document Inspector finds sensitive data, it suggests removing it or recommends a safer alternative. For example, if you added a chart from Excel as an interactive object, the tool recommends inserting it as a picture instead — that way the recipient will see it but not be able to examine the original table. Document Inspector finds confidential data As for secrets in images, however, Document Inspector is of no use, because it doesn’t even look at them. You will have to recheck those manually, guided by the tips above. Google Docs remembers everything Sometimes a document needs editing by a team of colleagues, in which case, PDF is not usually the best format (because of its relative dearth of collaboration tools). Using Word documents locally and sending them around by e-mail is also not a good option; version control is virtually impossible, and the process is too time-consuming, not least because people have to take turns. Help is at hand in the form of cloud solutions, which allow joint editing of the same copy of a document. However, considering privacy, it’s important to remember that cloud office suites record every action, and the full changelog is accessible to anyone who edits the file. If you accidentally inserted an object or text with sensitive information into a cloud document, even if you spot the mistake and remove the information immediately, it will remain in the change history for your fellow contributors to see. The change history contains the deleted image Even if you deleted all confidential information from the cloud file before making it publicly available, anyone with access to the file can view the change history and roll it back. Google Docs lets users roll back changes The problem has a simple solution. If you plan to invite someone to edit an online document with sensitive data in images or other elements you want to hide, create a new file and copy into it only what you want your colleague to see. Another tip: To avoid pasting anything into a shared document by accident, check what’s in the clipboard first by pasting it into a local file to make sure it’s exactly what you want to share. How not to leak info in a document To sum up, here’s how to keep private information in shared documents private — from colleagues and coeditors, not to mention the general public: Carefully check document contents before sharing; Use dedicated graphics programs to edit images. Use 100% opaque elements to block information and save images in formats that don’t support layering: JPG or PNG; Be particularly careful with cloud documents, which keep a record of each file’s entire change history, potentially enabling other people to restore deleted or changed information; Do not give coauthors access to cloud documents that ever contained secret data; instead, create a new file and copy across only nonsensitive information; Check Word documents with Document Inspector. Download cloud documents in DOCX format and check them as well; Be attentive and don’t rush.

image for QAnon/8Chan Sites Br ...

 A Little Sunshine

A phone call to an Internet provider in Oregon on Sunday evening was all it took to briefly sideline multiple websites related to 8chan/8kun — a controversial online image board linked to several mass shootings — and QAnon, the far-right conspiracy theory which holds that a cabal of Satanic pedophiles is   show more ...  

running a global child sex-trafficking ring and plotting against President Donald Trump. Following a brief disruption, the sites have come back online with the help of an Internet company based in St. Petersburg, Russia. The IP address range in the upper-right portion of this map of QAnon and 8kun-related sites — 203.28.246.0/24 — is assigned to VanwaTech and briefly went offline this evening. Source: twitter.com/Redrum_of_Crows. A large number of 8kun and QAnon-related sites (see map above) are connected to the Web via a single Internet provider in Vancouver, Wash. called VanwaTech (a.k.a. “OrcaTech“). Previous appeals to VanwaTech to disconnect these sites have fallen on deaf ears, as the company’s owner Nick Lim reportedly has been working with 8kun’s administrators to keep the sites online in the name of protecting free speech. But VanwaTech also had a single point of failure on its end: The swath of Internet addresses serving the various 8kun/QAnon sites were being protected from otherwise crippling and incessant distributed-denial-of-service (DDoS) attacks by Hillsboro, Ore. based CNServers LLC. On Sunday evening, security researcher Ron Guilmette placed a phone call to CNServers’ owner, who professed to be shocked by revelations that his company was helping QAnon and 8kun keep the lights on. Within minutes of that call, CNServers told its customer — Spartan Host Ltd., which is registered in Belfast, Northern Ireland — that it would no longer be providing DDoS protection for the set of 254 Internet addresses that Spartan Host was routing on behalf of VanwaTech. Contacted by KrebsOnSecurity, the person who answered the phone at CNServers asked not to be named in this story for fear of possible reprisals from the 8kun/QAnon crowd. But they confirmed that CNServers had indeed terminated its service with Spartan Host. That person added they weren’t a fan of either 8kun or QAnon, and said they would not self-describe as a Trump supporter. CNServers said that shortly after it withdrew its DDoS protection services, Spartan Host changed its settings so that VanwaTech’s Internet addresses were protected from attacks by ddos-guard[.]net, a company based in St. Petersburg, Russia. Spartan Host’s founder, 25-year-old Ryan McCully, confirmed CNServers’ report. McCully declined to say for how long VanwaTech had been a customer, or whether Spartan Host had experienced any attacks as a result of CNServers’ action. McCully said while he personally doesn’t subscribe to the beliefs espoused by QAnon or 8kun, he intends to keep VanwaTech as a customer going forward. “We follow the ‘law of the land’ when deciding what we allow to be hosted with us, with some exceptions to things that may cause resource issues etc.,” McCully said in a conversation over instant message. “Just because we host something, it doesn’t say anything about we do and don’t support, our opinions don’t come into hosted content decisions.” But according to Guilmette, Spartan Host’s relationship with VanwaTech wasn’t widely known previously because Spartan Host had set up what’s known as a “private peering” agreement with VanwaTech. That is to say, the two companies had a confidential business arrangement by which their mutual connections were not explicitly stated or obvious to other Internet providers on the global Internet. Guilmette said private peering relationships often play a significant role in a good deal of behind-the-scenes-mischief when the parties involved do not want anyone else to know about their relationship. “These arrangements are business agreements that are confidential between two parties, and no one knows about them, unless you start asking questions,” Guilmette said. “It certainly appears that a private peering arrangement was used in this instance in order to hide the direct involvement of Spartan Host in providing connectivity to VanwaTech and thus to 8kun. Perhaps Mr. McCully was not eager to have his involvement known.” 8chan, which rebranded last year as 8kun, has been linked to white supremacism, neo-Nazism, antisemitism, multiple mass shootings, and is known for hosting child pornography. After three mass shootings in 2019 revealed the perpetrators had spread their manifestos on 8chan and even streamed their killings live there, 8chan was ostracized by one Internet provider after another. The FBI last year identified QAnon as a potential domestic terror threat, noting that some of its followers have been linked to violent incidents motivated by fringe beliefs. Further reading: What Is QAnon? QAnon: A Timeline of Violent Linked to the Conspiracy Theory

 Trends, Reports, Analysis

Microsoft is at the top when it comes to hacker impersonations, with Microsoft products and services featuring in nearly a fifth of all global brand phishing attacks in the third quarter of this year.

 Malware and Vulnerabilities

A group of researchers from the Ben-Gurion University of the Negev demonstrated that it is possible to fool commercial advanced driver-assistance systems by displaying virtual objects (phantoms).

 Breaches and Incidents

A large number of 8kun and QAnon-related sites are connected to the Web via a single web hosting provider based in Vancouver, Washington, called VanwaTech (a.k.a. “OrcaTech“).

 Identity Theft, Fraud, Scams

With health insurance open enrollment season just around the corner, US consumers preparing to change or add to their health coverage should watch out for scammers, the Better Business Bureau warns.

 Breaches and Incidents

A hacker has breached the forum of Albion Online, a popular free medieval fantasy MMORPG, and stole usernames and password hashes, the game maker Sandbox Interactive GmbH disclosed on Saturday.

 Geopolitical, Terrorism

The financial leaders of the world’s seven biggest economies said some prominent strains of ransomware had been linked to groups that “are vulnerable to influence by state actors.

 Identity Theft, Fraud, Scams

Phishing campaigns have started to use Basecamp, a web-based project management solution, as part of malicious phishing campaigns that distribute malware or steal users' login credentials.

 Malware and Vulnerabilities

Besides the use of digital signatures to feign legitimacy, the main modification seen in the new GravityRAT campaign is support for multiple platforms besides Windows, such as Android and macOS.

 Trends, Reports, Analysis

According to research from Akamai, the largest of these attacks sent over 200Gbps of traffic at their targets as part of a sustained campaign of higher bandwidth and throughput than prior attacks.

 Malware and Vulnerabilities

The vulnerability itself affects Microsoft SharePoint Foundation 2013 Service Pack 1, SharePoint Enterprise Server 2016, and SharePoint Server 2019, but not SharePoint Online as part of Office 365.

 Trends, Reports, Analysis

Most phishing is focused on a small number of domain registrars and registries and hosting providers. Of all the maliciously registered domains, 65% is used within five days of registration.

 Threat Actors

The cybercriminals behind ransomware attacks have lots of options to access corporate networks. A recent report published by Accenture states that outsourced network hacking is a thriving business.

 Feed

This Metasploit module exploits a server-side include (SSI) in SharePoint to leak the web.config file and forge a malicious ViewState with the extracted validation key. This exploit is authenticated and requires a user with page creation privileges, which is a standard permission in SharePoint. The web.config file   show more ...  

will be stored in loot once retrieved, and the VALIDATION_KEY option can be set to short-circuit the SSI and trigger the ViewState deserialization.

 Feed

ReQuest Serious Play F3 Media Server version 7.0.3 suffers from an unauthenticated remote code execution vulnerability. Abusing the hidden ReQuest Internal Utilities page (/tools) from the services provided, an attacker can exploit the Quick File Uploader (/tools/upload.html) page and upload PHP executable files that results in remote code execution as the web server user.

 Feed

Red Hat Security Advisory 2020-4274-01 - The Apache Commons Collections library provides new interfaces, implementations, and utilities to extend the features of the Java Collections Framework. Issues addressed include a code execution vulnerability.

 Feed

Red Hat Security Advisory 2020-4272-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include HTTP request smuggling and buffer overflow vulnerabilities.

 Feed

ReQuest Serious Play F3 Media Server version 7.0.3 suffers from a debug log disclosure vulnerability. An unauthenticated attacker can visit the message_log page and disclose the webserver's Python debug log file containing system information, credentials, paths, processes and command arguments running on the device.

 Feed

A Java deserialization vulnerability exists in the QRadar RemoteJavaScript Servlet. An authenticated user can call one of the vulnerable methods and cause the Servlet to deserialize arbitrary objects. An attacker can exploit this vulnerability by creating a specially crafted (serialized) object, which amongst other   show more ...  

things can result in a denial of service, change of system settings, or execution of arbitrary code. This issue was successfully verified on QRadar Community Edition version 7.3.1.6 (7.3.1 Build 20180723171558).

 Data loss

The trials and tribulations of London's Hackney Council continue after it suffered a "serious cyber attack" last week. The real-life victims of a cyber attack are the thousands of innocent residents, some of whom may desperately need money in their pocket to pay their rent, living in fear of eviction and homelessness.

 Business + Partners

Reading Time: ~ 3 min. Fine-tuning privacy for any preference A DNS filtering service that accommodates DNS over HTTPS (DoH) can strengthen an organization’s ability to control network traffic and turn away threats. DoH can offer businesses far greater control and flexibility over their privacy than the old system.   show more ...  

The most visible use of DNS is typically the browser, which is why all the usual suspects are leading the charge in terms of DoH adoption. This movement has considerable steam behind it and has extended beyond just applications as Microsoft, Apple and Google have all announced their intent to support DoH. Encrypting DNS requests is an indisputable win for privacy-minded consumers looking to prevent their ISPs from snooping on and monetizing their browsing habits. Businesses, on the other hand, should not easily surrender this visibility since managing these requests adds value, helping to keep users from navigating to sites known to host malware and other threats. Here are three examples of how. 1.  By enhancing DNS logging control Businesses have varying motivations for tracking online behavior. For persistently troublesome users—those who continuously navigate to risky sites—it’s beneficial to exert some control over their network use or even provide some training on what it takes to stay safe online. It can also be useful in times of problematic productivity dips by helping to tell if users are spending inordinate amounts of time on social media, say. On the other hand, for CEOs and other strategic business units, tracking online activity can be cause for privacy concerns. Too much detail into the network traffic of a unit tasked with investigating mergers and acquisitions may be unwanted, for example. “If I’m the CEO of a company, I don’t want people paying attention to where I go on the internet,” says Webroot DNS expert Jonathan Barnett. “I don’t want people to know of potential deals I’m investigating before they become public.” Logging too much user information can also be problematic from a data privacy perspective. Collecting or storing this information in areas with stricter laws, as in the European Union, can unnecessarily burden organizations with red tape. “Essentially it exposes businesses to requirements concerning how they’re going to use that data, who has access to it and how long that data is preserved” says Barnett. By optionally never logging user information and backing off DNS logging except when a request is deemed a security threat, companies maintain both privacy and security. 2. By allowing devices to echo locally With DoH, visibility of DNS requests is challenging. The cumulative DNS requests made on a network help to enhance its security as tools such as SIEMs and firewalls leverage these requests by controlling access as well as corelating the requests with other logs and occurrences on the network.  “Let’s say I’m on my network at the office and I make a DNS request,” explains Barnett. “I may want my DNS request to be seen by the network as well as fielded by my DNS filtering service. The network gets value out of DNS. If I see inappropriate DNS requests I can go and address the user or fix the device.” Continuing to expose these DNS requests through an echo to the local network provides this, while the actual requests are secure and encrypted by the DNS protection agent using DoH. This option achieves the best of both worlds by adding the security of DoH to the security of the local network. 3. By allowing agents to fail open DNS is instrumental to the functionality of the internet. So, the question is, what do we do when a filtered answer is not available? By failing over to the local network, it’s assured that the internet continues to function. However, there are times when filtering and privacy are more important than connectivity. Being able to choose if DNS requests can leak out to the local network helps you stay in control by choosing which is a priority.  “Fail open functionality essentially allows admins to make a tradeoff between the protection offered by DNS filtering and the productivity hit that inevitably accompanies a lack of internet access,” says Barnett. Privacy your way The encryption of DoH enables options for fine-tuning privacy preferences while preserving the security benefits of DNS filtering. Those that must comply with the needs of privacy-centric users now have control over what is revealed and what is logged, while maintaining the benefits of communicating using DoH. Click here to read related blogs covering the transition to DNS over HTTPS. The post What DoH Can Really Do appeared first on Webroot Blog.

2020-10
Aggregator history
Monday, October 19
THU
FRI
SAT
SUN
MON
TUE
WED
OctoberNovemberDecember