New Milum trojan used against Mid-Eastern targets

scmagazine | March 26, 2020

Kaspersky has uncovered an highly targeted attack striking a single country using a trojan written in C++ that has not been spotted before. Dubbed Milum, the trojan shows no code similarities with known campaigns reported Kaspersky’s Threat Attribution Engine and only three instances of it have bee found and are considered all part of the same operation which received the code name operation WildPressure. When successfully installed the trojan can enable a remote attacker to gain control of the device. Kaspersky found the campaign in August 2019, but in September of that year Kaspersky was able to sinkhole one of the C2 servers. By doing so it could determine most of the server’s visitors came from Middle Eastern IP addresses with the remainder being network scanners, Tor exit nodes and VPN connections. The server also contained information indicating the first attacks stated at the end of May 2019.

Spotlight

Software engineering practices strongly affect the security of the code produced. The increasingly popular Rapid Release Cycle (RRC) development methodology and easy network software distribution have enabled rapid feature introduction. RRC’s defining characteristic of frequent software revisions would seem to conflict with traditional software engineering wisdom regarding code maturity, reliability and reuse, as well as security.


Other News
SOFTWARE SECURITY

iboss Joins Microsoft Intelligent Security Association (MISA)

iboss, Inc. | June 02, 2022

iboss, a leader in Zero Trust Edge, announces the expansion of its relationship with Microsoft by joining the Microsoft Intelligent Security Association (MISA), an ecosystem of independent software vendors (ISV) and managed security service providers (MSSP) that have integrated their security products and services with Microsoft’s security products. Through this collaboration with Microsoft, joint customers benefit from secure, fast access to resources from anywhere, which also allows customers greater visibility and immediate response to threats. iboss has integrations with Microsoft Azure Active Directory, Microsoft Sentinel, Microsoft Defender for Cloud Apps and Microsoft Purview Information Protection to further enhance an organization’s value of their Microsoft 365 E5 investment. These solutions offer new capabilities that are fully integrated and simple to deploy. Identity: iboss forces modern authentication to all resources, including legacy applications under the Azure Active Directory (AAD) Umbrella. When users authenticate through Azure Active Directory, iboss grants or denies resource access on a per transaction basis, with real-time Conditional Access policies applied to reauthenticate or step-up Multi-factor Authentication with Azure Active Directory. Security: iboss integration with Microsoft Sentinel, now available in the Azure Marketplace, integrates high fidelity logs about users and resources being requested, also comes complete with real-time active defense workflows allowing SOC analysts fast automated responses to threats that matter. Deployment is live after only a few mouse clicks. In addition, iboss integration with Microsoft Defender for Cloud Apps extends visibility and protection with advanced CASB capabilities by automatically syncing policies and signatures from Microsoft Defender for Cloud Apps to enforce governance actions for secure cloud application access. Compliance: iboss detects and automatically prevents transfer of files tagged with Microsoft Purview Information Protection unified labels and leverages them with iboss Zero Trust DLP rules. In addition, full visibility into the denied transfer request between the user and resource is made available in Microsoft Sentinel to take additional steps as well as Conditional Access rules in Azure Active Directory Cloud: Protection of Azure resource workloads with iboss service being deployed and running directly inside the Azure on a per tenant basis is now available on Microsoft Azure Marketplace. With the ability of iboss service to now be deployed directly in Azure, allows for a customer’s unique IP address to be anchored to each Azure tenant ID, thus creating a tight Zero Trust linkage unmatched by any other Secure Service Edge vendor. “Our Zero Trust Edge platform enables Microsoft customers, and distributed workforces everywhere, to connect securely and directly to all applications from wherever they work. “We help Microsoft customers complete their Zero Trust journey by granting users secure access to critical resources on a per request basis. The depth and breadth of our integrations is unmatched and provides the most use-case protection scenarios. iboss is purpose-built to prevent breaches by shifting the focus from protecting the network perimeter to protecting resources, and we are proud to be expanding to cover Microsoft Security E5 applications through highly differentiated integrations.” Paul Martini, co-founder and CEO of iboss “Preventing unauthorized access to critical resources is essential for Zero Trust." said Desmond Forbes, General Manager of Business Development at Microsoft. "iboss capabilities ensure that trusted users are able to connect to protected resources from anywhere with advanced integrations across Microsoft’s Identity, Security and Compliance platform to help meet our joint customers’ Zero Trust objectives." The iboss Zero Trust platform is a purpose built, patented, cloud delivered security and has more than 100 points of presence globally. A Zero Trust Architecture built on iboss consolidates network security technologies (SWG, CASB, DLP, IPS, malware defense, browser isolation, firewall) into a single unified cloud platform and eliminates the need for a VPN while securing any device, regardless of location. By making all applications private, iboss eliminates the top three initial ransomware infection vectors as identified by Cybersecurity and Infrastructure Security Agency (CISA). With applications, data and services made only accessible through the iboss Zero Trust Edge, cyber risk is greatly reduced, breaches and data loss are prevented, and visibility and security are delivered consistently throughout an organization. About iboss, Inc. iboss is a cloud security company that enables organizations to reduce cyber risk by delivering a Zero Trust service designed to protect resources and users in the modern distributed world. Applications, data and services have moved to the cloud and are located everywhere while users needing access to those resources are working from anywhere. Built on a containerized cloud architecture, iboss delivers security capabilities such as SWG, malware defense, browser isolation, CASB and data loss prevention to protect all resources, via the cloud, instantaneously and at scale. This shifts the focus from protecting buildings to protecting people and resources wherever they are located. Leveraging a purpose-built cloud architecture backed by 230+ issued and pending patents and more than 100 points of presence globally, iboss processes over 150 billion transactions daily, blocking 4 billion threats per day. More than 4,000 global enterprises trust the iboss Cloud Platform to support their modern workforces, including a large number of Fortune 50 companies. iboss was named one of the Top 25 Cybersecurity Companies by The Software Report, one of the 25 highest-rated Private Cloud Computing Companies to work for by Battery Ventures, and CRN’s Top 20 Coolest Cloud Security Companies of 2022.

Read More

PLATFORM SECURITY

Searchlight Security Elevates Dark Web Intelligence to Board Level with New Automated Reporting

Searchlight Security | August 02, 2022

Searchlight Security, the dark web intelligence company, has introduced new automated reporting functionality into its DarkIQ dark web monitoring solution to help security analysts and MSSPs to quickly and easily communicate external threats to executives. DarkIQ is a powerful dark web monitoring solution that utilizes the most comprehensive dark web dataset on the market, and the only one that includes dark web traffic to and from the organization’s network. It takes the attributes that are most important to a business - including employee credentials, software, devices, IP addresses, network components, and company datasets - and alerts organizations to their presence in deep and dark web marketplaces, forums, and conversations, which could indicate an imminent attack. This threat intelligence is specific to the organization, removing “alert fatigue” and allowing security teams to prioritize the most urgent threats to the business. DarkIQ’s new automated reporting function builds on its existing capabilities by helping analysts to more easily communicate the dark web intelligence they discover - improving response times to possible attacks and educating the wider business on dark web threats. “Our mission is to make dark web intelligence as relevant and actionable for businesses as possible and our new reporting function is a huge part of that. Threat intelligence is only powerful if it can be understood and acted on - otherwise it is just noise. Communication is everything.” Eric Milam, EVP product at Searchlight Security DarkIQ Reporting gives enterprise security teams and MSSPs the ability to: Generate slick reports with one click - with threat intelligence data automatically pulled, inputted, and presented from the DarkIQ platform. Select the right level of detail for the audience - with an “Executive” report option for a high level summary or “Detailed” report for security personnel, which includes recommended remediative actions that should be taken based on the threat data. Add and remove reporting fields - to further customize the report to suit the audience by adding, moving, or removing components, as well as the ability for security teams to add their own analysis, context and observations. Customize design - with the ability to brand reports and change the font and color scheme, a particularly important feature for MSSPs reselling DarkIQ to their customers. Resource more effectively - with less time spent on reporting so they can spend more time protecting the business. Demonstrate Return on Investment - with the ability to show imminent threats that have been identified and prevented through dark web intelligence. Milam concluded: “In threat intelligence, the job isn’t done until the report is filed. This is a burden on security teams that we wanted to - and have been able to - alleviate, because every minute less they spend reporting is a minute more they can spend stopping the bad guys. At the same time, they have a better solution to deliver pre-attack intelligence with more clarity so the business can be more proactive in stopping imminent threats.” About Searchlight Security Searchlight Security provides organizations with relevant and actionable dark web threat intelligence, to help them identify and prevent criminal activity. Founded in 2017 with a mission to stop criminals acting with impunity on the dark web, we have been involved in some of the world’s largest dark web investigations and have the most comprehensive dataset based on proprietary techniques and ground-breaking academic research. Today we help government and law enforcement, enterprises, and managed security services providers around the world to illuminate deep and dark web threats and prevent attacks.

Read More

PLATFORM SECURITY

Talon Cyber Security Selected for Exclusive Microsoft for Startups Program

Talon Cyber Security | June 30, 2022

Talon Cyber Security, provider of the first secure enterprise browser, today announced it has been selected as a partner for Microsoft for Startups, a global program dedicated to accelerating the trajectory of high-potential startups. As a program member, Talon will receive access to Microsoft technology, mentorship and business support. “Talon is proud to be working with an established leader like Microsoft as we continue to aggressively scale to meet the demand for our secure enterprise browser. “Our goal is to make security for the future of work simple by enabling secure access for managed and unmanaged devices, and the feedback we have received from the world’s largest brands has been amazing. As we continue to gain traction, it is incredible to have the support of a true industry giant like Microsoft.” Ofer Ben-Noon, co-founder and CEO, Talon Cyber Security The traditional approach of enabling secure access to modern applications is complex, expensive and puts organizations at risk. The TalonWork browser acts as the first line of defense and control point for enterprise security, while drastically reducing complexity and cost. Talon brings enterprise-grade security to the browser, delivering native features like authentication, data loss prevention, zero trust controls and more. Customers leverage TalonWork to gain visibility into and secure SaaS applications, web activity, managed devices and unmanaged devices. Built on Chromium, TalonWork consistently delivers the high-quality user experiences required to secure the future of work. “Talon’s mission to help its customers simplify security programs for distributed workforces is a great fit for the program,” said Jeff Ma, Vice President, Microsoft for Startups, Microsoft. “We look forward to helping Talon deliver their innovative solution to our joint customers.” Talon leverages Microsoft’s infrastructure to facilitate seamless, real-time collaboration among its global team that enables it to deliver exceptional service to its customers. The company’s unique approach to security has led to significant corporate momentum. Talon won the Innovation Sandbox Contest at RSA Conference 2022, a prestigious competition where 10 industry leaders battle for the title of “Most Innovative Startup” each year. About Talon Cyber Security Talon Cyber Security is modernizing security programs and improving user experiences for hybrid work by delivering the first secure enterprise browser. Built on Chromium, the TalonWork browser provides customers with the consistent user experiences, deep security visibility, and control over SaaS and web applications needed to simplify security for the future of work. Talon was named the Most Innovative Startup of 2022 at the prestigious RSA Conference Innovation Sandbox Contest.

Read More

PLATFORM SECURITY

TAC Security Launches the ESOF Vulnerability Prediction Feature

TAC Security | June 13, 2022

TAC Security, a Silicon Valley-based Cybersecurity company, announced the launch of their ESOF Prediction Feature. The Prediction feature allows the organizations to forecast the quantity of new vulnerabilities in an asset for the coming month. The results will be based on the vulnerability specifics from anyone’s most recent scan results for each Asset type. The feature anticipates the ESOF cyber scores of various Asset types present in one’s infrastructure and based on the number, the predicted vulnerabilities are generated. The count of predicted vulnerabilities gets further divided based on severity levels for e.g., Critical, High, Medium and Low. ESOF predicts the number of vulnerabilities in the coming months and generates a cyber score based on that for the coming months. The platform will predict the following - Monthly Prediction of Vulnerabilities. Prediction of ESOF Cyber Score Prediction of Vulnerabilities that can be patched Prediction of Type of Vulnerability(s) ESOF also allows the count of predicted vulnerabilities to be compared to the number of actual vulnerabilities. The representational graphs will contain both the actual count and predictive count of the vulnerabilities for the coming months. “The prediction feature allows security teams to foresee threats and prepare for them. If the security team needs training or resources, knowing in advance allows them to invest time and resources to improve their security processes. ESOF plays an essential role in allowing teams to discover, prioritize and remediate before situation demands, rather than mass efforts like other tools,” said, Trishneet Arora, Founder and Chief Executive Officer, TAC Security. “We are thrilled to take the next step to ensure ESOF becomes Cybersecurity's Future. The Prediction feature is a revolutionary contribution by TAC Security to the ever-evolving Risk and Vulnerability Management market. The ability to foresee threats allows not only the security teams and leaders to be prepared. And gives them the chance to communicate with the whole organization, including the Board Members, so they know what to expect. It allows the organization to be well prepared and plan their resources to strengthen their security processes and reduce the chances of a breach remarkably.” Chris Fisher – CMO, TAC Security This announcement closely follows TAC Security’s recent launch of another new product, ESOF Product CyberScore. The product provides ability to generate risk scores for each product installed in the system. In addition to an individual product risk score for the product on a single asset, there is also a group score that will be based upon all the assets that have the product installed. With the overall product score, they can easily identify the most vulnerable products present in all the assets and prioritize the top 10 most vulnerable products present in the organization. The prediction model is a major stepping stone in TAC Security’s mission of ensuring a cyberscore becomes the next credit score system for organizations to be considered compliant. The ability to forecast upcoming vulnerabilities gives organizations an edge over the adversaries and continues to strengthen the risk posture of their overall IT infrastructure. About TAC Security TAC Security, headquartered in San Francisco, is a global leader in Vulnerability Management that protects Fortune 500 companies, leading enterprises, and governments around the world. TAC Security manages 5+ Million vulnerabilities through its Artificial Intelligence (AI) based Vulnerability Management Platform ESOF (Enterprise Security in One Framework). TAC Security has established strategic partnerships with leading cloud providers and managed service providers and consulting organizations including Tech Mahindra, IBM, KDDI Japan, and distributors including Dataguard Technologies LLC and Ingram Micro.

Read More

Spotlight

Software engineering practices strongly affect the security of the code produced. The increasingly popular Rapid Release Cycle (RRC) development methodology and easy network software distribution have enabled rapid feature introduction. RRC’s defining characteristic of frequent software revisions would seem to conflict with traditional software engineering wisdom regarding code maturity, reliability and reuse, as well as security.

Resources