Authentic8 Blog Category: News

JavaScript Template Attacks: How Browsers Give Away the Store

Did you know? Attackers use  your locally installed browser base and JavaScript to draw up intricate exploit roadmaps for targeted attacks on your organization. Listen to our interview with security researcher Michael Schwarz to learn how JavaScript template attacks work and how to prevent them.

*

“Free” browsers boast features and extensions that supposedly enhance security and privacy online. The same settings or plugins, it turns out, can be used by adversaries to achieve precisely the opposite effect.

That’s just one of the eye-opening findings reported in the research paper JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits.

The paper was authored by security researchers Michael Schwarz, Florian Lackner and Daniel Gruss of Graz University in Austria. They describe how JavaScript template attacks help attackers prepare pinpointed zero-day or side-channel attacks against large organizations, by exploiting the ubiquitous data leaks in “free” browsers and their extensions.

The researchers found an abundance of environment-dependent properties in Firefox, Chrome, Edge, and mobile

Authentic8 Supports the Defense Entrepreneurs Forum

There is no organization more focused on creating permeability between the public and private sectors than the Defense Entrepreneurs Forum (DEF).

Authentic8 and DEF have many things in common, and none more than a shared commitment to supporting national defense through creative problem solving, productivity enhancement, and deliberate partnership. For that reason, we will be sponsoring the upcoming DEF 2019 Annual National Conference.

DEF & Authentic8

While Silo Cloud Browser by Authentic8 is designed to create a perfect isolation layer between users and the web, we as a company, like DEF, are dedicated to bringing diverse groups together and breaking down barriers. In essence, we both see that the path toward responsible collaboration is through connecting silos (pun intended).

We look forward to an enduring relationship with DEF as we commit to a more visible role in supporting its mission.

85% of Infected Websites Are NOT Blacklisted

Website attacks increased by 59% in 2018, according to the 2019 Website Security Report [PDF] recently published by Scottsdale, AZ-based SiteLock, a provider of business website security solutions. Most of the attacks were automated, the company reports, with 330 bots staging on average 62 attacks per day.

So far, so not surprising - just wait, there’s more. Let’s look next at a significant aspect of the SiteLock findings. It illustrates how much the attackers behind such malware campaigns can rely on the inherent vulnerability of traditional browsers.

When someone visits an infected site, the regular browser dutifully executes the malicious code from the web on the local machine. From there, ransomware, spyware or cryptojackers can spread through the user’s corporate or home network. Game over.

“Not so fast,” you may object. “Our IT security team has many ways to prevent such exploits. AV/EPP/ATP, CASB, VPN, SWG/URL Filters…” Which brings up that other finding in the report

81% of CIOs and CISOs Defer Critical Updates or Patches

New research indicates that eight out of ten CIOs and CISOs refrain from adopting an important security update or patch, due to concerns about the impact it might have on business operations.

*

More than half (52%) said they have done so on more than one occasion. What about in your organization?

The Global Resilience Gap study, commissioned by security software firm Tanium, polled 500 CIOs and CISOs in the United States, United Kingdom, Germany, France and Japan, in companies with 1,000+ employees. Its goal was to explore the challenges and trade-offs that IT operations and security leaders face in protecting their business from a growing number of cyber threats and disruptions.

Infographic: CIOs/CISOs Holding Off on Patches and Updates (Source: Tanium Report)

Source: Tanium

The Problem: “Lack of Visibility and Control”

The report identifies “[l]ack of visibility and control across networks” as the main cause behind such missed or delayed updates.

80% of respondents reported they found out that a critical update or patch they thought had been deployed had not

Meet Frankie Keyes, the Most Trusted Expert in Cybersecurity

Frankie… who? No April Fool’s joke: Francis (“Frankie”) Archibald Keyes, Esquire, a fictitious figure you likely have never heard of, enjoys significantly higher trust among IT professionals than most real-life cybersecurity vendors or experts, according to new survey results from this year’s RSA Conference in San Francisco.

Of those surveyed in our Cybersecurity Approval Poll at RSA, a total of 88% stated that they trusted the made-up Mr. Keyes “much more”, “slightly more” or “about the same” as “other cybersecurity vendors and experts.”

If these results don’t instill much confidence in the industry’s ability to protect its customers from data breaches, malware attacks, and online election meddling, that is the whole point.

Frankie Keyes, a self-proclaimed Mr. Fix-it played by a professional actor, served as the face of F.A.K.E. Security, a make-believe company (website, Twitter handle and all) made up by Authentic8.

Fake Security, Real Survey

F.A.K.E. Security had its own booth