cybersecurity

Category

Posts

Bob Gourley writes from RSA:

“Every year the RSA conference brings together members of the cybersecurity community for a week of presentations, discussions, tech demos and socials. Concurrent with the event there is always a flurry of press releases. Many are designed to highlight a company’s product or service. Many, like the announcement of the new Microsoft led coalition of tech firms, might be well intentioned but highlight something that will have zero impact. But there are always a few releases that are worth focusing on.

Which leads us to the Global Cyber Alliance. The Global Cyber Alliance is an international, cross-sector effort designed to confront, address, and prevent malicious cyber activity. It is led by an icon of the cybersecurity community, Phil Reitinger, and Phil is a guy known for focusing on action that can be measured (the motto of the alliance is “Do something. Measure it.” (Read full article here).

Click here for more information about the two new open-source tools released at RSA Conference in San Francisco.

GCA McScrapy and the GCA DMARC Risk Scanner Empower

Organizations to Launch Proactive Cyber Defenses


SAN FRANCISCO, CA, April 17, 2018 – The Global Cyber Alliance today released two new free, open-source tools to enable organizations to reduce cybersecurity risks associated with website and email born cyberattacks.

GCA McScrapy enables organizations to lock down their website to remove potential security issues from third-party services and other unnecessary functionality. In addition, a new email security tool – the GCA DMARC Risk Scanner – allows organizations to determine if the organizations on which they depend, such as their trading partners and supply chain, are protecting their email domains from being spoofed or phished.

“Reducing risk is the best cyber defense,” said Philip Reitinger, president and CEO of the Global Cyber Alliance. “Among the most popular open doors that cyber criminals exploit are phishing attacks and compromise of an organization’s website. The tools we released today are designed to help stop these attacks and prevent loss to businesses.”

GCA McScrapy: Locking Down Websites

While GCA McScrapy can be used on websites developed with any content management system, nearly 60 percent of websites are designed using the WordPress platform. While WordPress is a popular platform, by its nature, its functions raise the risk of potential compromise. WordPress dynamically composes web pages using PHP and JavaScript and thus carries with it a risk for bugs and security vulnerabilities that serve as an attack vector. According to a WP WhiteSecurity October 2017 report on WordPress vulnerabilities, there are 2407 known vulnerabilities, more than half those vulnerabilities (54%) are from WordPress plugins and 31.5% are core WordPress vulnerabilities. The two most prevalent vulnerabilities are cross-site scripting and SQL injection.

GCA McScrapy converts a website into a set of static files, removing unnecessary functionality. Using a static website nullifies many concerns of cross-site scripting and SQL injection since there is no communication with the website’s content management system for dynamic content. The tool evaluates every part of a website and renders it into simple form, keeping as much functionality as possible, while removing potential security issues such as third-party services.  Not all functionality can be maintained, however, and updating websites takes extra steps, making GCA McScrapy best for websites for which security is very important.  GCA McScrapy is also highly configurable and can be adjusted to reduce scan times and scrape mobile sites. GCA McScrapy is free for anyone to use. Learn more about GCA McScrapy at github.com/GlobalCyberAlliance/.

GCA DMARC Risk Scanner: Holding Partners Accountable

 The Domain-based Message Authentication, Reporting & Conformance (DMARC) security protocol enables organizations to protect their email domains from being used by spammers and phishers to trick employees, customers and trading partners.

The GCA DMARC Risk Scanner can be used to scan hundreds of domains at one time to determine the level of DMARC and Sender Policy Framework (SPF) protections used by an organization’s partners, including the third parties with whom it works, its supply chain, and its trading partners.  This enables an organization to better understand, and act upon, the risk imposed on it by its partners who have not employed DMARC.

Without DMARC implemented, scammers and criminals can easily “spoof” an email domain to steal money, trade secrets or even jeopardize national security. DMARC weeds out fake emails (known as direct domain spoofing) deployed by spammers and phishers targeting the inboxes of workers in all sectors of society.  According to the 2017 Symantec ISTR report, 1 in 131 emails contained malware, the highest rate in 5 years.

Like all GCA tools, the GCA DMARC Risk Scanner is freely available at github.com/GlobalCyberAlliance/. Learn more about DMARC at dmarc.globalcyberalliance.org.

About the Global Cyber Alliance

The Global Cyber Alliance (GCA) is an international, cross-sector effort dedicated to eradicating cyber risk and improving our connected world. We achieve our mission by uniting global communities, implementing concrete solutions, and measuring the effect. GCA, a 501(c)3, was founded in September 2015 by the Manhattan District Attorney’s Office, the City of London Police and the Center for Internet Security. Learn more at globalcyberalliance.org.

 

 

Only One of 26 Email Addresses Managed by Executive Office of the President Uses DMARC Security Protocol to Block Phishing


WASHINGTON, April 4, 2018 – More than 95 percent of email domains managed by the Executive Office of the President (EOP) are in danger of being used in a large-scale phishing attack. Only the Max.gov email domain has fully implemented the top defense against email phishing and spoofing, according to research released today by the Global Cyber Alliance (GCA). Seven of the domains have implemented the Domain Message Authentication Reporting & Conformance (DMARC) protocol at the lowest level “none” which monitors email but does not prevent delivery of spoofed emails. Further, GCA found that 18 of the 26 email domains under management haven’t started the deployment of DMARC.

Without DMARC implemented, scammers and criminals can easily “hijack” an email domain to steal money, trade secrets or even jeopardize national security. DMARC weeds out fake emails (known as direct domain spoofing) deployed by spammers and phishers targeting the inboxes of workers in all sectors of society.  According to the 2017 Symantec ISTR report, 1 in 131 emails contained malware, the highest rate in 5 years.

“Email domains managed by the EOP are crown jewels that criminals and foreign adversaries covet,” said Philip Reitinger, president and CEO of the Global Cyber Alliance. “The lack of full DMARC deployment across nearly every EOP email address poses a national security risk that must be fixed.  The good news is that four new domains have implemented DMARC at the lowest level, which I hope indicates that DMARC deployment is moving forward.  The EOP domains that have recently deployed DMARC at its lowest setting includes WhiteHouse.gov and EOP.gov, two of the most significant government domains.  I hope that the government will move rapidly to block phishing attempts across all EOP domains.”

Domains under the control of the EOP include Budget.gov, OMB.gov, WhiteHouse.gov, USTR.gov, OSTP.gov and EOP.gov – all well-known email domains that are valuable for phishers looking to trick government employees, government contractors, and U.S. citizens.

The weak DMARC deployment by the EOP is surprising after the U.S. Department of Homeland Security mandated that all federal agencies implement DMARC last year. Security experts praised DHS and Senator Ron Wyden, who called for agencies to implement DMARC, for pushing government agencies to quickly implement DMARC at the highest level possible.

Using GCA’s DMARC tools, the researchers scanned the 26 EOP email domains:

 

  DMARC Count Effect at this level of implementation
Domains Tested 26 (The email domains of the Executive Office of the President)
Reject 1 The highest level of DMARC protection. If reject is in place, incoming messages that fail authentication get blocked.
Quarantine 0 The second highest level of DMARC protection. With quarantine in place, emails that don’t meet the policy are sent to the spam or junk folder.
None 7 None means that the DMARC policy is in place, but the only thing that’s happening is monitoring. No action is being taken to block spoofed emails.
No Policy 18 No policy means that DMARC is not in place.

GCA has published five reviews of DMARC implementation – two looking at organizations in cybersecurity, one looking at banks, one examining public and private hospitals, and most recently a look at the top tax software providers. When Agari looked at Fortune 500 companies last August, they found 8 percent protected their companies’ domains with DMARC.

For more details about DMARC or to check if an organization is using DMARC, visit: dmarcguide.globalcyberalliance.org.

 

About the Global Cyber Alliance

The Global Cyber Alliance (GCA) is an international, cross-sector effort dedicated to eradicating cyber risk and improving our connected world. We achieve our mission by to uniting global communities, implementing concrete solutions, and measuring the effect. GCA, a 501(c)3, was founded in September 2015 by the Manhattan District Attorney’s Office, the City of London Police and the Center for Internet Security. Learn more at globalcyberalliance.org

New York, NY, March 29, 2018 – Mayor De Blasio launched NYC Secure, a cybersecurity initiative to protect New Yorkers from malicious cyber activity including when they access the NYC public WiFi. Part of the NYC Secure effort is the adoption of the Quad9 cybersecurity platform across all New York City guest and public WiFi access locations. Quad9 provides an automated security solution by leveraging the domain name system, known as the DNS, to block known malicious and bad websites through the use of more than 18 threat intelligence feeds. Not only does Quad9 provide a robust layer of security, it is highly privacy-preserving as no personally identifiable information is collected or stored. Quad9 is a free, easy to use service available to any organization, corporation, or individual.

By using Quad9 the city is also leveraging an investment made by NYC. Quad9 was created, in part, by the Global Cyber Alliance (GCA), a non-profit that was founded by Manhattan District Attorney Cy Vance, Jr., the City of London Police, and the Center for Internet Security, with a seed investment of asset forfeiture funds provided by the Manhattan District Attorney.

“This is a tremendous step in protecting citizens against all manner of cyber risk,” said Mary Kavaney, Chief Operating Officer of the Global Cyber Alliance (GCA). “The city in delivering free WiFi as a public service is taking a significant step to ensure that the service is provided with security built in while at the same time protecting New Yorkers’ privacy. While it’s impossible to protect against every threat, using Quad9 to protect against known malicious sites is a huge benefit to users of the service. On behalf of GCA, we commend New York City for taking this step.”

“Quad9 was built with the public in mind. It is a free service that provides security and protects the privacy of its users,” said John Todd, Executive Director of Quad9. “We’re very encouraged to see New York City embracing Quad9 and using it for public good, and we hope New York’s leadership in implementing this free service is a model for other cities to use to protect their citizens and networks.”

“NYC Secure delivers a world-class cybersecurity upgrade to New Yorkers and all who use our City’s expanding public WiFi network,” said Manhattan District Attorney Cyrus R. Vance, Jr. “In 2015, I joined with the City of London Police and Center for Internet Security to found the non-profit Global Cyber Alliance (GCA), which co-developed the Quad9 technology being adopted today. We are delighted to see the work of GCA and its partners integrated into groundbreaking programs like NYC Secure, which will expand the reach of safe-browsing technology and protect millions of residents and visitors alike. I commend Mayor de Blasio and his administration for its proactive and collaborative approach to combat the rising tide of cybercrime.”

“I applaud Mayor De Blasio for including Quad9 in his NYC Secure initiative which establishes New York City as a leader in helping to protect its citizens from malicious websites,” said John Gilligan, Executive Chairman, Center for Internet Security.

“The strength of the Global Cyber Alliance and the tools it has developed, such as Quad9, lie in the global partnerships that support it.  By harnessing talent and commitment from the within industry and the public sector, we take a step closer to tackling cyber crime,” said Ian Dyson, Commissioner, City of London Police.

Quad9 was conceived of by GCA and built in collaboration with IBM and Packet Clearing House (PCH). Since its launch in November of 2017, Quad9 usage has increased more than 27-fold and is used in more than 150 countries around the world, resolving billions of queries every day. Each day, approximately 2 million domain lookups are blocked, protecting the end user from connecting to a malicious destination. These blocked lookups represent attempts to reach phishing, ransomware, botnet command and control servers, and other forms of harmful or fraudulent systems.
To start using Quad9 today, simply change your DNS settings in your device or router to point to 9.9.9.9. Learn more about Quad9, including how to set it up on either a Mac OS or Windows system at www.Quad9.net.

About Quad9

Quad9 is a free, recursive, anycast DNS platform that provides end users robust security protections, high-performance, and privacy. Quad9 is an independent non-profit formed from a collaboration of IBM, PCH and GCA. Learn more at www.Quad9.net.

About Global Cyber Alliance

The Global Cyber Alliance (GCA) is an international, cross-sector effort dedicated to eradicating cyber risk and improving our connected world. We achieve our mission by to uniting global communities, implementing concrete solutions, and measuring the effect. Learn more at globalcyberalliance.org.

Half of Top 8 Tax Software Providers Leave Consumers Vulnerable to Email-Borne Attacks That Can Lead to Identity and Bank Account Theft

Customers of H&R Block, TaxAct, Turbo Tax and Free Tax USA Most Susceptible


WASHINGTON, March 14, 2018 — Only half of the top tax software providers are using the most basic of email protections to secure communications with customers, according to new research from the Global Cyber Alliance. Tens of millions of Americans will use tax software to prepare their federal and state taxes, yet some of the industry’s biggest names — H&R Block, TaxAct, Turbo Tax and Free Tax USA — are not preventing their email domains from being hijacked to trick consumers into sharing sensitive data that could include social security numbers, bank account numbers and dates of birth.

In an examination of the top 8 tax software providers, only Liberty Tax Online is using the highest level of email-authentication security — the Domain-based Message Authentication, Reporting & Conformance (DMARC) protocol — to prevent delivery of spoofed email. Three others — Credit Karma, Jackson Hewitt and Tax Slayer — are using the second-highest level of DMARC protection that marks spoofed email as spam. TurboTax and Free Tax USA have begun to deploy DMARC, but it is not yet set up to protect consumers from email that pretends to be from the tax providers. H&R Block and TaxAct USA have not initiated any DMARC deployment.

DMARC weeds out fake emails (known as direct domain spoofing) deployed by spammers and phishers targeting the inboxes of any person with an email address.  According to the 2017 Symantec ISTR report, 1 in 131 emails contained malware, the highest rate in 5 years.

The IRS warned tax providers in 2017 that they were “increasingly the targets of national and international cybercriminal rings.”  With the incidents of phishing continuing to rise, individual consumers are also at risk of being attacked through email which appears to come from their tax software providers.

“Consumers are accustomed to inputting the most sensitive and personal information, from social security numbers to financial information and health care expenses, into tax preparation software,” said Philip Reitinger, President and CEO of the Global Cyber Alliance. “The very nature of a consumer’s relationship with a tax provider makes it seem legitimate to receive emails that may ask for additional personal information, putting consumers at great risk from phishing scams that appear to involve tax providers. Companies need to provide the maximum protections.  There appears to be a hole in the protections provided by some of the leading tax software providers – a hole that could be fixed by deployment of DMARC at its strongest level.”

Without DMARC protection, hackers can create emails that appear to be from a trusted source but contain malicious links or ask for additional information that could be provided by unsuspecting consumers. 

The Data

Using GCA’s DMARC tools, the researchers could determine how far organizations were in the process of implementing DMARC.

 

  DMARC Count Effect at this level of implementation
Domains Tested 8 Based on PC Magazine Rankings of the Top 8 Tax Software Providers
Reject Liberty Tax The highest level of DMARC protection. If reject is in place, incoming messages that fail authentication get blocked.
Quarantine

Credit Karma

Jackson Hewitt

Tax Slayer

The second highest level of DMARC protection. With quarantine in place, emails that don’t meet the policy are sent to the spam or junk folder.
None

Free Tax USA

Turbo Tax

None means that the DMARC policy is in place, but the only thing that’s happening is monitoring. No action is being taken to block spoofed emails.
No Policy

H&R Block

TaxAct

No policy means that DMARC is not in place.

 

Steps Consumers Can Take to Protect Themselves

Consumers need to remain vigilant to prevent being scammed through email:

  1. Always scroll over the sender’s email address to ensure that the address is legitimate. Often, the address looks correct until you scroll over it with your mouse to reveal a totally different address.
  2. Do not click on embedded links in emails. Type the address into your browser’s address bar if you want to go to a site.
  3. Do not email personal or sensitive information. Your tax software provider will always require you to input the information in secure fashion by logging into your account.
  4. Do not call any customer service phone numbers you see in an email. Go to the vendor’s official site and login and double check the customer service phone numbers.
  5. Install a DNS security solution that will help to block malicious website links should a phishing email make it to your inbox. One such solution – Quad9 – is free and can be installed in minutes. Learn more at Quad9.net.

 

GCA has published four reviews of DMARC implementation – two looking at organizations in cybersecurity, one looking at banks, and another examining public and private hospitals.

For more details about DMARC or to check if an organization is using DMARC, visit dmarcguide.globalcyberalliance.org.

 

About the Global Cyber Alliance

The Global Cyber Alliance (GCA) is an international, cross-sector effort dedicated to confronting cyber risk and improving our connected world. It is a catalyst to bring communities of interest and affiliations together in an environment that sparks innovation with concrete, measurable achievements. While most efforts at addressing cyber risk have been industry, sector, or geographically specific, GCA partners across borders and sectors. GCA’s mantra “Do Something. Measure It.” is a direct reflection of its mission to eradicate systemic cyber risks.

GCA, a 501(c)3, was founded in September 2015 by the Manhattan District Attorney’s Office, the City of London Police and the Center for Internet Security. Learn more at globalcyberalliance.org.