Russian Spies Rush to Exploit the Latest Flash Zero Day and More Security News This Week

There’s nothing like a hefty security freakout to start the week, and the Key Reinstallation AttackWi-Fi vulnerability—you know it as Krack—announced on Monday fit the bill. The bug is in the ubiquitous WPA2 Wi-Fi protocol, so while it fortunately doesn’t impact every single device that exists, it does affect a significant portion of them. And many will likely never receive protective patches, a longstanding and critical security problem that particularly affects the Internet of Things. The relative simplicity of the Krack bug itself also highlights the importance of making technical standards accessible to researchers for review and feedback.

Google announced a new tier of account security this week called Advanced Protection that uses physical authentication tokens, advanced scanning, and siloing to help defend particularly at-risk accounts (or anyone who wants to be very cautious). And after its disastrous corporate breach, Equifax is receiving a thorough public shaming. Researchers also discovered that for just $ 1,000 they can exploit mobile advertising networks to track people’s movements in both cyberspace and the real world. Not great!

US-Iranian relations are tense and could nudge Iran’s cyber operations. And crooks have a new favorite hustle called “cryptojacking” that can secretly use your devices to mine cryptocurrency when you visit infected websites. Highs and lows.

And there’s more. As always, we’ve rounded up all the news we didn’t break or cover in depth this week. Click on the headlines to read the full stories. And stay safe out there.

Flash Patched Its Recent Zero Day, So Russian Hackers Are Using It While They Can

Kaspersky Labs researchers announced a new Adobe Flash vulnerability on Monday, noting that unidentified hackers exploited the bug in an attack on October 10, using a compromised Microsoft Word document to deliver FinSpy malware. Adobe coordinated with Kaspersky to issue a patch on the day of the disclosure. In the wake of the patch, researchers at the security firm Proofpoint observed the hackers doubling down to exploit the flaw before potential targets widely adopt the fix. The group, which Proofpoint says is the Russia-backed collective Fancy Bear, launched an email spearphishing campaign that targeted state departments and aerospace companies. But researchers say the operation was sloppy, and that the group has followed this pattern in the past.

Microsoft Didn’t Disclose 2013 Breach of a Sensitive Vulnerability Database

Sophisticated hackers breached Microsoft’s internal vulnerability-tracking database more than four years ago, but the company didn’t publicly disclose the incident. Five former Microsoft employees told Reuters that the company was aware of the intrusion in 2013. The database would have contained critical vulnerabilities in Microsoft’s widely used software products, including Windows, and may have even included code for exploiting those flaws. Such information would be a gold mine for foreign government-backed hackers or third-party criminals alike, and could have facilitated breaches and espionage at the time.

Reuters’ sources said in separate interviews that Microsoft never connected the breach to any other attacks, and that the company didn’t disclose the incident, because doing so would have pushed attackers to exploit the vulnerabilities before they were patched. Microsoft presumably patched everything in the compromised database years ago, though. Reuters’ sources say that the Microsoft did at least improve its internal security in response to the hack. The incident was part of a rash of attacks that also hit Apple, Facebook, and Twitter. The group behind these hacks is still unidentified, but is known by different researchers as Morpho, Butterfly, and Wild Neutron, and is still active today.

UK Concludes That Iran, Not Russia or North Korea, Hacked Officials’ Email Accounts

Investigators in the United Kingdom concluded last week that Iranian government-backed hackers were behind a June email network intrusion that targeted numerous members of parliament and Prime Minister Theresa May. Every MP uses the network, but the hackers specifically looked for accounts protected by weak passwords or reused ones that had leaked online after other breaches. The parliamentary digital services team told the Guardian that it was making email security changes in response to the attack. The incident underscores Iran’s ongoing digital offensive initiatives. Though the country has been less focused on Western targets in the last few years, it is still an active threat around the world. Recently, US President Donald Trump has worked to undermine the Iran nuclear deal, but Theresa May and other European leaders say they want to preserve it.

Police Did Social Media Surveillance on New York Black Lives Matter Group

The Black Lives Matter Global Network chapter in the Rockland County, New York filed a federal lawsuit in August claiming that local Clarkstown police conducted illegal surveillance on it throughout 2015. Clarkstown police records from the Strategic Intelligence Unit describe social-media surveillance targeted at BLM members. The documents even show evidence that a lead detective told the Strategic Intelligence Unit supervisor to stop the surveillance, but this didn’t end the program. BLM is alleging that Clarkstown police engaged in racial profiling, and violated the group members’ rights to free speech and assembly.

Millions of Crucial Cryptography Keys Weakened By Trusted Generator

A flaw in how a popular code base generates cryptographic keys has ruined the security of millions of encryption schemes. The generator appeared in two security certification standards used my numerous governments and large corporations worldwide, meaning that the flawed keys are meant to protect particularly sensitive platforms and data. German chipmaker Infineon developed the software, which has included the key generating flaw since 2012 or possibly earlier. Attackers could exploit the bug to figure out the private part of a key from its public component. From there they could do things like manipulate digitally signed software, disable other network protections, or, of course, decrypt sensitive data. The situation affects Estonia’s much-touted secure digital ID system. Infineon, Microsoft, and Google warn that the flaw will undermine their Trusted Platform Module products until customers generate new, more robust keys. Estonia has announced plans to update the keys used for its national IDs.


Fed Rate Hike Prospects Focus The S&P 500 In Week 1 Of October 2017

The first week of October 2017 saw the S&P 500 reach daily new highs each day through Thursday, before slightly dipping by 2.74 points (0.1%) to close the week at 2,549.33.

Since we had it set up to cover Week 1 of October 2017, let’s take one last look at our chart showing the actual trajectory of the S&P 500 during 2017-Q3 against the backdrop of our alternative futures “spaghetti chart” forecasts that differ according to how our dividend futures-based model of how stock prices predict they would based on far forward in time investors are looking.

As best as we can tell, investors are still primarily focused on 2018-Q2, although with stock prices tracking along the upper edge of the echo effect-adjusted range indicated by the red zone shown on the chart, we believe investors are also focusing on the current quarter of 2017-Q4.

The reason why we think that has a lot to do with the week’s news events, where the expectations associated with future short-term interest rate hikes by the U.S. Federal Reserve now suggest two rate hikes in the foreseeable future: one in 2017-Q4 and a second in 2018-Q2. The following table shows the CME Group’s estimates of the probabilities that the Federal Funds Rate will be set as indicated at various future meetings of the Federal Reserve’s Open Market Committee (FOMC):

Probabilities for Target Federal Funds Rate at Selected Upcoming Fed Meeting Dates (CME FedWatch on September 15, 2017)
FOMC Meeting Date Current
75-100 bps 100-125 bps 125-150 bps 150-175 bps 175-200 bps 200-225 bps
0.0% 9.4% 89.2% 1.4% 0.0% 0.0%
0.0% 5.8% 58.3% 34.4% 1.5% 0.0%
0.0% 3.5% 37.2% 43.1% 15.1% 1.1%
0.0% 2.3% 26.2% 41.0% 24.2% 5.8%

And since we’re in the business of looking forward, the following chart updates our alternative futures chart to peer through the end of the fourth quarter of 2017.

The headlines of the week reinforce the apparent influence of the expectations of future Fed rate hikes on investor expectations.

Monday, October 2, 2017

Tuesday, October 3, 2017

Wednesday, October 4, 2017

Thursday, October 5, 2017

Friday, October 6, 2017

But wait, that’s not all that happened during the first week of October 2017! For a succinct list of the positives and negatives for the U.S. economy and markets during Week 1 of October 2017, check out Barry Ritholtz’s summary of the week’s major events.


Week in Review: Come to Our DX Summit + Risky Data Management

Grab your calendars and mark the dates: We kicked off preregistration for our second annual DX Summit this week. We’d love to have you join us to learn the strategies, technologies and thought leadership that deliver game-changing digital experiences — and we’re offering an incentive for early registration.

Continue reading…
Cloud Computing


All articles