Cybersecurity Comes under Scanner as Google Chrome Users Hit by Spyware Campaign

Google | June 19, 2020

Cybersecurity Comes under Scanner as Google Chrome Users Hit by Spyware Campaign
  • A newly discovered spyware effort attacked users through 32-million downloads of extensions to Google’s market-leading Chrome web browser.

  • Instead, they siphoned off browsing history and data that provided credentials for access to internal business tools.

  • The extensions were designed to avoid detection by antivirus companies or security software that evaluates the reputations of web domains.


A newly discovered spyware effort attacked users through 32-million downloads of extensions to Google’s market-leading Chrome web browser, researchers at Awake Security said, highlighting the tech industry’s failure to protect browsers as they are used more for e-mail, payroll and other sensitive functions. Alphabet’s Google said it removed more than 70 of the malicious add-ons from its official Chrome Web Store after being alerted by the researchers in May.


When we are alerted of extensions in the Web Store that violate our policies, we take action and use those incidents as training material to improve our automated and manual analyses, Google spokesperson Scott Westover said. Most of the free extensions purported to warn users about questionable websites or convert files from one format to another. Instead, they siphoned off browsing history and data that provided credentials for access to internal business tools.



Read more: 65% OF PHISHING THREATS FACING REMOTE WORKERS IMPERSONATE GOOGLE-BRANDED WEBSITES

When we are alerted of extensions in the Web Store that violate our policies, we take action and use those incidents as training material to improve our automated and manual analyses.

~ Google spokesperson Scott Westover said


Based on the number of downloads, it was the most far-reaching malicious Chrome store campaign to date, said Awake co-founder and chief scientist Gary Golomb. Google declined to discuss how the latest spyware compared with prior campaigns, the breadth of the damage, or why it did not detect and remove the bad extensions on its own despite past promises to supervise offerings more closely.


It is unclear who was behind the effort to distribute the malware. Awake said the developers supplied fake contact information when they submitted the extensions to Google.“Anything that gets you into somebody’s browser or e-mail or other sensitive areas would be a target for national espionage as well as organised crime,” said former National Security Agency engineer Ben Johnson, who founded security companies Carbon Black and Obsidian Security.


We do regular sweeps to find extensions using similar techniques, code and behaviours,” Google’s Westover said, in identical language to what Google gave out after Duo’s report.


The extensions were designed to avoid detection by antivirus companies or security software that evaluates the reputations of web domains, Golomb said. If someone used the browser to surf the web on a home computer, it would connect to a series of websites and transmit information, the researchers found. Anyone using a corporate network, which would include security services, would not transmit the sensitive information or even reach the malicious versions of the websites. All of the domains in question, more than 15,000 linked to each other in total, were bought from a small registrar in Israel, Galcomm, known formally as CommuniGal Communication.


In an e-mail exchange, Galcomm owner Moshe Fogel told Reuters his company had done nothing wrong. “Galcomm is not involved, and not in complicity with any malicious activity whatsoever,” Fogel wrote. “You can say exactly the opposite, we co-operate with law enforcement and security bodies to prevent as much as we can.” Fogel said there was no record of the inquiries Golomb said he made in April and again in May to the company’s e-mail address for reporting abusive behaviour, and he asked for a list of suspect domains. Reuters sent him that list three times without getting a substantive response. The Internet Corp for Assigned Names and Numbers, which oversees registrars, said it had received few complaints about Galcomm over the years, and none about malware.


Read more: LEVERAGING THREAT INTELLIGENCE TO TACKLE CYBERTHREATS IN TIMES OF COVID-19

Spotlight

Did you know that the average company has 75 different security products? It's no surprise; modern security needs are multifaceted and many enterprise organizations are operating so quickly that they don’t have the time to put together comprehensive security strategies. But to be successful, organizations need to shift from mult

Spotlight

Did you know that the average company has 75 different security products? It's no surprise; modern security needs are multifaceted and many enterprise organizations are operating so quickly that they don’t have the time to put together comprehensive security strategies. But to be successful, organizations need to shift from mult

Related News

SOFTWARE SECURITY

Lookout and CipherCloud Together are Ready to Redefine Security from Endpoint to Cloud

Lookout | March 15, 2021

In the current event, Lookout, Inc announced that it had acquired CipherCloud. Lookout, Inc is a leading cybersecurity company. It is now joining hands with CipherCloud, a leading cloud-native security company, operates in the emerging Secure Access Service Edge (SASE) market. They both blaze a new path together to combine and create an integrated endpoint-to-cloud security solution. By this combination, Lookout will be in a unique position to deliver the industry's first end-to-end platform that will secure an organization's entire data path from an endpoint to the cloud. This will later empower customers with a single source of unified policies and provide end-to-end security to accelerate their digital transformation. CipherCloud solutions are related to several developing SASE categories. This includes Secure Web Gateway (SWG), Zero-Trust Network Access (ZTNA), Cloud Access Security Broker (CASB), and Data Loss Prevention (DLP). Together these solutions will deliver data security, comprehensive visibility, threat protection, and compliance for cloud-based applications. Familiar to this, CipherCloud has already been providing services to many of the world's largest global enterprises and government institutions seeking protection and security through cloud technology. The purpose of this integrated endpoint-to-cloud security solution is accelerated by the adoption of cloud applications, proliferation of remote users, data transitioning of the corporate data center into the cloud, and more network traffic flowing to public cloud services. To tackle the security challenges caused by the above trends, businesses in this industry need a cohesive platform that can track activity and enforce policies from the endpoint device to cloud-based applications. And the need to stop zero-day attacks on data information across the entire end-to-end path, this integrated solution can fill the gaps immediately, keeping all information secured in one place. Jim Dolce, CEO of Lookout, highlights this acquisition. Gartner forecasts that the SASE market will nurture at a CAGR of 42% over the next five years and would reach almost $11 billion by 2024. With the acquisition of CipherCloud, Lookout is head-on with the transformation to cloud infrastructure and is in a unique position to deliver value to its customers. Besides all, the integration of CipherCloud and Lookout technologies will also remove friction, augment usability and convenience, enable user freedom and reduce operational costs compared to a collection of siloed point products. The integrated Lookout platform will authorize a growing number of businesses to deliver critical applications to users working anywhere securely. Jim Dolce, CEO, Lookout, puts his words expressing his version about this acquisition. He says that "We couldn't be more excited to welcome the CipherCloud team to Lookout. Our two organizations share a common passion for accelerating cloud adoption with cloud-native solutions that secure critical data." Joining hands with CipherCloud is the next phase of our enterprise market expansion. By this, we will be extending our reach from endpoint into cloud, where the applications and data reside. Through this combination, we will deliver endpoint-to-cloud security by keeping elements of our solutions together into a single cloud-delivered offering." Apart from this, Pravin Kothari, Founder, and CEO, CipherCloud, also speaks, "as a pioneer of the Cloud Access Security Broker market, CipherCloud has allowed organizations worldwide to achieve their digital transformation. Today, we take the exciting next step on the road to SASE by integrating our strengths with Lookout to deliver endpoint-to-cloud security for the modern workforce."

Read More

PLATFORM SECURITY

Credence Security Signs Partnership Agreement with Infosec Ventures to Deliver Human-Centric Security Solutions to the Middle East

Credence Security | August 25, 2021

Credence Security, a leading regional specialized value-added distributor for cybersecurity, forensics, governance, risk and compliance solutions, today announced that it has signed a partnership agreement with Infosec Ventures' HumanFirewall, a leader in human cyber risk mitigation and management. Under the agreement, Credence Security will be responsible for promoting and delivering Infosec Ventures' HumanFirewall® platform across its robust channel network in the Middle East. Infosec Ventures' offerings are available entirely on-premises or in a local cloud, in line with compliance and data sovereignty regulations, specifically for mission critical organizations in the government as well as large enterprises. Hackers are increasingly preying on the human element of cybersecurity, as a primary attack vector. According to the Verizon 2021 Data Breach & Incident Report (DBIR), over 85% of data breaches involved human error. In the Middle East, a 2020 study by the Ponemon Institute and IBM Security, revealed that the average cost of a data breach per company in the region is $6.53 million, which is higher than the global average of $3.86 million per incident. The report also identified human error among the most common root causes of data breaches in the UAE and Saudi Arabia. Additionally, similar industry studies have indicated that more than 90% of successful cyber-attacks begin with an email. These figures highlight a significant need for solutions that will not only safeguard business-critical systems but will also transform employees into an organization's best cybersecurity asset. HumanFirewall® transforms employees from an organization's weakest link into their strongest line of defence. It is a world-first security awareness and training platform that also works when real attacks strike. It augments with technology what humans lack in attention. It gamifies the learning experience via phishing simulations, builds individual risk-profiles, rewards real-time reporting, remediates incidents instantly, orchestrates auto-blacklisting enterprise wide via easy to deploy one-click integration with Microsoft 365 (O365), Google Workspace (formerly GSuite) and Exchange. The solution is trusted by top corporations in 142 countries. "We selected Credence Security as our regional value-added distributor based on our shared ethos of being a channel-centric business. Besides their proven market expertise and extensive channel network, Credence Security has a strong understanding of our needs and vision as a leading vendor in the region. Also, like us, they are passionate about cybersecurity. We are confident that by partnering with a premier distributor such as Credence Security, we can further accelerate our already strong local presence and fast-track our growth." Garreth Scott, Managing Director, Credence Security, said, "People's desire to quickly process information with minimal effort has created a unique vulnerability in the digital age, making them the weak links in the cyber chain. We firmly believe that HumanFirewall's innovative cybersecurity tools, backed by its exceptional team of industry experts, address a compelling demand for a modern approach to securing the human element. We are looking forward to bringing their ground-breaking solutions to our partners and customers across the Middle East region." ABOUT CREDENCE SECURITY: Established in 1999, Credence Security, a PAN-EMEA speciality Value-added Distributor, is a leader in Cybersecurity, Forensics, Governance, Risk and Compliance. With headquarters in Dubai and regional offices in Johannesburg, London, Nairobi, and Hyderabad. We are a pure-play provider of security and forensics solutions, to both public and private sector enterprises across Europe, Middle East, Africa and India, through a select network of specialist resellers. ABOUT HUMANFIREWALL HumanFirewall transforms employees from an organisation's weakest link into their strongest line of defence. It is a world-first security awareness and training platform that also works when real attacks strike. It augments with technology what humans lack in attention. It gamifies the learning experience via phishing simulations, builds individual risk profiles, rewards real-time reporting, remediates incidents instantly, orchestrates auto-blacklisting enterprise-wide via easy to deploy one-click integration with O365, GSuite and Exchange. Trusted by top corporations in 142 countries.

Read More

Terranova Security Recognized as a computer-based software framework for security awareness Representative Vendor in the Gartner

prnewswire | August 26, 2020

Gartner, Inc. has recognized Terranova Security as a Security Awareness Program Platforms Representative Vendor in its 2020 Market Guide for Security Awareness Computer-Based Training (SACBT). Terranova Security, a 2019 Gartner Peer Insights Customers' Choice vendor for SACBT, received the Peer Insights distinction as a vendor in a market that includes ready-to-use, interactive software modules. The effectiveness of the Terranova Security Awareness Platform is based on its content delivery capabilities, sophisticated and scalable reporting metrics, integrations with broader corporate learning systems, and the ability to test and evaluate the awareness training efficacy across a given end-user population. These capabilities help global organizations tackle some of the biggest challenges for security awareness programs: measuring security awareness activities, tailoring messaging for different audiences, and building a security-centric culture.

Read More