A saucerful of secrets

As long-time blog readers may know, I shifted my focus to North American threats some three years ago. Ever since, I’ve noticed major cultural differences in how security issues get tackled.

One way in which the difference is very clear is the use of secret questions as an added security measure.
While secret questions are not overly common in Europe, they’re very popular in the USA.

It goes without saying that out-of-band authentication used by many European banks is a much more secure approach than asking a secret qeustion next to a regular password. And banks are just one of many examples. Secret questions are everywhere now.

Enter the Facebook era. Rarely do I encounter a secret question that people wouldn’t likely have posted the answer to on Facebook. It’s worse with the services that allow users to reset their password based on answering the secret question(s) correctly.

This Friday,Valve announced Steam Guard, based on Intel’s Identity Protection Technology.
IPT provides an additional layer of authentication which previously would have required a seperate hardware device, a security token. This new technology can definitely mitigate the negative impact that secret questions may pose. Additionally this mechanism should be less of hassle for users.

The feature requires hardware CPU support, which is currently limited to the latest generation Intel Core and Intel Core vPro processors. This means that general adoption is still quite some years away. IPT won’t solve all our problems. One example would be sophisticated Banker malware which makes fraudulent transactions on the infected endpoint.

However, for the problems that IPT is looking to address it’s a much better solution than what’s currently out there, especially in North America.

I, for one, will be happy when I can tell the boss I need a new CPU for security purposes. 🙂

A saucerful of secrets

Your email address will not be published. Required fields are marked *



Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Lazarus covets COVID-19-related intelligence

As the COVID-19 crisis grinds on, some threat actors are trying to speed up vaccine development by any means available. We have found evidence that the Lazarus group is going after intelligence that could help these efforts by attacking entities related to COVID-19 research.

Sunburst: connecting the dots in the DNS requests

We matched private and public DNS data for the SUNBURST-malware root C2 domain with the CNAME records, to identify who was targeted for further exploitation. In total, we analyzed 1722 DNS records, leading to 1026 unique target name parts and 964 unique UIDs.

What did DeathStalker hide between two ferns?

While tracking DeathStalker’s Powersing-based activities in May 2020, we detected a previously unknown implant that leveraged DNS over HTTPS as a C2 channel, as well as parts of its delivery chain. We named this new malware “PowerPepper”.

Subscribe to our weekly e-mails

The hottest research right in your inbox