highlights

May 29 2021

Croatia’s P2P Lending Marketplace Robo.cash Is Preparing for $5M Bond Placement in Singapore

Croatia’s Robo.cash, a peer-to-peer lending marketplace, reveals that its parent holding company, the Robocash Group, is getting ready for a $5 million bond placement in the coming days.

As noted in an update, dated May 27, 2021, by Robo.cash, the Group intends to issue bonds via the global private debt investment platform Kilde (based in Singapore). The company will be providing securities with the “maturity period of 3 months and a monthly coupon payment frequency.”

As mentioned in the announcement, the proceeds of the issuance will be directed towards helping with the expansion of the Group’s business operations in emerging markets.

Robo.cash further revealed:

“We are prepared to start an online-lending service in Sri-Lanka in the near future, and by the end of 2021, we aim to launch our first online bank in Southeast Asia.”

As confirmed in the announcement, this bond placement in Singapore will be “the first for Robocash Group” and after this initial step, the firm might “consider another issuance in a bigger amount.”

As clarified in the update, the Robocash Group bonds will be “available for purchase to institutional and accredited investors only.” If you’re interested in taking advantage of this opportunity, then you can review the list of requirements to see if you qualify. For questions/queries, contact [email protected]

On May 22, 2021, the Deputy CFO Robocash Group Grigorii Shikunov took part in a webcast for investors in which the company shared key insights about their platform.

As noted in the update:

“Q1 of 2021 showed excellent results for Robo.cash. The platform passed new milestones, including a brand-new website design and integrating a new loan originator, and set 3 new records. The amount of new users grew by 145% QoQ, while the net deposits increased by 50% QoQ.”

Some other highlights shared by the company:

Revenue for the Q1 “increased by 49% QoQ and reached 58.5 M USD.”
The net profit in Q1 2021 “reached 7.6 M USD.”
Total assets complete the solid Q1 “growing by 15% and reaching 112.9 M USD.”

Earlier this month, the Robo.cash team announced that new types of loans would be available in the Philippines.

Robo.cash noted that investors may expect “net annual returns of up to 12%” and like all other loan originators on Robo.cash, UnaPay offers “a full 30-day buyback guarantee on all its products.”

The announcement also mentioned:

“UnaPay provides Buy Now, Pay Later plans for purchasing goods on the Lazada eCommerce platform. The loan amount can go as high as EUR 530, with the repayment period ranging from 30 days to 6 months. In addition to the BNPL service, UnaPay offers salary-linked installment loans of up to EUR 870 paid within a maximum of 12 months.”

UnaPay was established in the Philippines in December of last year and it’s run by Digido Finance Corp. The firm is a “duly registered corporation with a Certificate of Authority to Operate as a Financing Company issued by SEC.” For the time of its operation, Digido Finance Corp. has “issued over 750,000 EUR worth of loans.”

Source

May 24 2021

The President’s Executive Order on Cybersecurity is a Massive Shift for Security

The latest ransomware attack on Colonial Pipeline highlights the worst secret in cybersecurity; our nation’s critical infrastructure is not prepared to stand up against the modern cyber threats. Systems like these have been the target for attacks from domestic and foreign cybercriminals for years. These groups are armed with the latest and most effective zero-day exploit attacks that traditional signature-based defenses simply cannot defend against. And the attacks maintain the upper hand against these outdated security systems that meet bare minimum security requirements.

But on May 21, 2021, President Joe Biden announced the most substantial executive order on cybersecurity, focusing on improving the Federal Government’s efforts to defend itself from future cyberattacks. While most of the rules stated in the executive order direct Federal systems, it also raises the bar of security expectations from vendors regarding support of these new security guidelines, focusing on prevention, detection, response, and investigation. While this language is not unique to many that have adopted the latest in security architecture, it advances the Federal Government’s mission. It supports the ‘lead by example’ vocabulary included in the order.

“The Federal Government must lead by example. All Federal Information Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order.”

A vital component of the executive order appears in Section 3, focusing on modernizing the Federal Government’s Cybersecurity around Zero Trust architecture and minimizing the barriers of cybersecurity data sharing for identifying and managing risks. Zero Trust architecture addresses this with its foundation of “never trust, always verify”, designed to secure modern workspaces against comprehensive threats through network segmentation, device attestation, and identity verification. Zero Trust is advanced access control that requires verification from every user trying to gain access to data, no matter their location or device being used. This architecture defines that all data, endpoints, and services are considered resources, and access is defined by a policy that takes into consideration the requesting endpoint, behavioral attributes, and the security state of the requestor’s identity.

As Federal agencies adapt and enable users to work outside established security perimeters and access data through mobile endpoints, they must also address the inherent risks involved. And over the last year, agencies have followed the National Institute of Standards and Technology (NIST)’s SP 1800-22 Mobile Device Security: Bring Your Own Device (BYOD) to enable their employees to work in remote and distributed functions. But in order to truly secure the data accessed on personal mobile devices, Zero Trust must be implemented, and with it, mobile device integrity must be insured. This executive order addresses the gaps that exist, like with mobile implementations into advanced EDR, XDR, and Zero Trust security architectures, for a cohesive and progressive security strategy.

“Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterprise or personally owned). Authentication and authorization (both subject and device) are discrete functions performed before a session to an enterprise resource is established.” – NIST Zero Trust Architecture, SP 800-207, August 2020

While Zero Trust architectures already do exist within areas of Federal systems, the standards set out by the executive order show that the Federal Government is taking a progressive and aggressive approach to shoring up the security of its digital infrastructure. And with the modernization of Federal systems comes the added goal of driving the public sector to match the security improvements, leading to a cohesive national push towards prevention against the next attack. By using the standards set by NIST’s SP 800-207: Zero Trust Architecture, both public and private sectors are provided the strategic roadmap needed to move from a static-network-based security perimeter to an advanced security model that addresses modern threats.

“The private sector must adapt to the continuously changing threat environment, ensure its products are built and operate securely, and partner with the Federal Government to foster a more secure cyberspace.”

One of the biggest challenges for critical infrastructure and Federal agencies has been migrating from legacy security solutions to an architecture that supports a constantly evolving threat. As the latest attack on the Colonial Pipeline has shown, meeting the minimum standards is not enough to stand up against the advanced capabilities of the modern cybercriminal. For the Federal Government to avoid being the victim themselves, they must evolve their own security to match and exceed the capabilities. With this executive order, though, the President is setting a precedent that the old, legacy approaches to security must be addressed, paving the way for a modern approach to threat prevention.

“[This executive order] shall require agencies employing software developed and procured prior to the date of this order (legacy software) either to comply with any requirements issued pursuant to subsection (k) of this section or to provide a plan outlining actions to remediate or meet those requirements, and shall further require agencies seeking renewals of software contracts, including legacy software, to comply with any requirements issued pursuant to subsection (k) of this section, unless an extension or waiver is granted in accordance with subsection (l) or (m) of this section.”

While other executive orders have emerged from past Presidents, never before has one been so focused on implementing what is seen as industry standard outside the Federal space. Following the release of the executive order, Defense Information Systems Agency (DISA) released their report Department of Defense (DOD) Zero Trust Reference Architecture, laying the framework for the next generation of cybersecurity architecture. Evolving from legacy approaches to security, DISA’s findings are based on Zero Trust principles, addressing not only the threat of today but tomorrow.

“Zero Trust implements continuous multi-factor authentication, micro-segmentation, encryption, endpoint security, analytics, and robust auditing to DAAS seven pillars to deliver cyber resiliency. As the Department evolves to become a more agile, more mobile, cloud-instantiated workforce, collaborating with multiple federal and non-governmental organizations (NGO) entities for a variety of missions, a hardened perimeter defense can no longer suffice as an effective means of enterprise security.”

Just as the private sector has evolved with the modern workforce, DISA recognizes the need to protect the resources within the security perimeter and data that travels outside it. As the lines have blurred between the mobile and traditional endpoint in the workforce, with mobile devices taking the lead as the most commonly accessed device, DISA significantly advances the notion of complete endpoint coverage for security. With advanced mobile threat defense solutions implemented into security architectures, agencies can deliver comprehensive Mobile Endpoint Protection (MEP) to their unclassified mobile offerings and shoring up the President’s Zero Trust initiatives.

“Zero trust is a response to enterprise network trends that include remote users, bring your own device (BYOD), and cloud- based assets that are not located within an enterprise-owned network boundary. Zero trust focuses on protecting resources (assets, services, workflows, network accounts, etc.), not network segments, as the network location is no longer seen as the prime component to the security posture of the resource.”

Just as the threats against our infrastructure have evolved, so has the modern workplace for private and public sectors. But to keep up with both, the approach to critical security systems must advance beyond the legacy, signature approaches and into cohesive security architectures that secure all data-accessing systems, from BYOD to traditional endpoints.

Ultimately these two releases, one spurred by a cybersecurity attack and the other developed as an evolving component of the Federal security strategy, reflect positive shifts in cybersecurity mindsets within the public sector. It is time for the cybersecurity strategy of the country to evolve and not just meet the minimum requirements. To prevent future attacks, the mindset must change and evolve to match the threats. While the Colonial Pipeline incident may not have surprised many in the space, the lessons can direct the future of cybersecurity for the nation.

About Zimperium

Zimperium, the global leader in mobile security, offers the only real-time, on-device, machine learning-based protection against Android, iOS, and Chromebook threats. Powered by z9, Zimperium provides protection against device, network, phishing, and malicious app attacks. For more information, visit www.zimperium.com.

The President’s Executive Order on Cybersecurity is a Massive Shift for Security

Source

May 19 2021

Pipeline Ransomware Incident Highlights Gaps in Minimum Security Requirements

The Colonial Pipeline ransomware attack has been in the news for the past week, bringing the conversation surrounding the security of our critical infrastructure front and center. While the cybercriminals behind the attack may not have intended to have such a devastating impact, the damage is done, leading to massive gasoline shortages impacting the American east coast.

Malicious attacks are big business for cybercriminals, and attacks like this one show it’s not a matter of if but when. And with many organizations still playing catchup to the massive shift in the modern workforce over the last year, the number of enterprises barely meeting even minimum security requirements continues to rise. Convenience has been prioritized over security, and the rise of mobile devices and other endpoints left unprotected while connected to corporate data should be alarming. Even though top incident response organizations are still analyzing the Colonial Pipeline incident, there are some lessons we can all take from it right now to shore up security architectures against this and other forms of aggressive attacks.

Ransomware is not a new threat to the computers of the world, from the first known example of this vector of exploitation taking place in 1989 via the PC Cyborg Trojan. And for over 30 years, the method has been updated, improved, and made even more dangerous to computers everywhere. Even as variations such as WannaCry, Ryuk, CryptoLocker, and others continue to hit the news, the collective gasp of surprise when another significant attack happens is deafening. Targeting everything from hospitals, banks, small to larger enterprises, consumers, and everything between, it is an easy, impactful form of attack that continues to highlight the weaknesses in security architectures. And delivery could be as simple as a dropped USB drive, malicious emails, or even a mobile device accessing the corporate network.

When it comes to cyberattacks, perpetrators will be persistent when looking for the path of least resistance to get into the targeted victim network. And once in, it is only a matter of time until they are navigating through the enterprise network with little to no resistance. While organizations of all sizes invest in advanced security architectures, many of them fail to address glaring gaps in the attack surface, ultimately leaving their data, systems, and operations at risk.

As the last year has pushed most employees out of offices and away from the existing security architectures to keep the endpoints safe, we have also seen a rise in the reliance on BYOD policies to support the new, distributed workforce. From personal laptops to mobile endpoints, these devices connect into enterprise networks with more frequency and data access than ever before. But 60% of these endpoints connecting are mobile devices that are often left unmanaged, unsecured, and open to attack as IT and security leaders balance convenience and security investments.

Enterprises that are deploying management tools to these endpoints aren’t even addressing the security risks to these endpoints. And email, text, and third-party messaging apps have made it even easier for attackers to spread dangerous links and files. All it takes is one user clicking one malicious link or file to expose the entire enterprise to an attacker.

Security is often approached with a check-the-box mentality as organizations continue to grow and scale, and for a good reason. Different enterprises have different compliance needs based on their industries, and those governing agencies provide minimum security frameworks to meet said compliance. But minimum requirements are just that: minimum. These compliance guides rarely address the needs of infrastructure scale, BYOD, mobile device access, and other newer technologies that are becoming critical to success, leaving enterprises following the bare minimum compliance requirements at increased risk.

It is no secret that security is an often overlooked component of business operations, but it is time for that to change. As organizations continue to grow and adapt to the modern needs of the distributed workforce, they must also advance their security solutions to protect their data and assets no matter where they are located. It’s time to secure all the endpoints, not just the traditional ones. Without a comprehensive approach to security and ensuring all the endpoints, from operational technology to mobile phones, enterprises will continue to be attacked in the hands of every employee accessing the data.

About Zimperium

Pipeline Ransomware Incident Highlights Gaps in Minimum Security Requirements

Source

May 18 2021

Sideloaded Applications: The Risk of Fewer Restrictions

Would you trust an application on your device from a third-party app store? Would you trust that same app store on the endpoints connected to your corporate infrastructure?

The premise of a third-party app store is relatively innocent on the surface, with hundreds of repositories set up to enable mobile device users to get the apps they want without some of the hurdles that may stand in their way. And beyond that, some app developers even provide direct-download options that take advantage of Sideload capabilities to bypass app store controls altogether. In the traditional endpoint space, none of these alternatives or means of access feel out of the ordinary for a conventional user.

But for mobile endpoints, it’s a different story. What happens if those apps aren’t being vetted by the official app store?

Google Android and Apple iOS devices all come pre-installed with their own app stores, filled to the brim with everything a user could want. Protected under an umbrella of processes from security scans to approvals, these applications must meet guidelines to be accepted into and available to the users of these devices. The user has increased confidence in the application itself with the trusting nod from Apple and Google (OEMs).

But outside these OEM app stores, there exist alternative means that don’t have these layers of confidence built-in. While some third-party app stores are OEM alternatives from the likes of Samsung and Huawei, most of them exist as massive app repositories for mobile endpoint users to bypass existing rules, controls, or fees to deliver their app to the masses. Available on both iOS and Android devices, these alternative app stores often act as a black market with very similar traits; the available app could be the same, or an elaborate copy and decoy, and the only way to tell is to take it apart. But as most mobile users won’t be breaking down the code of the app they just installed, these alternatives have become ripe with malicious code.

Simply put, unofficial app stores cannot be trusted. They put users, enterprises, and all the data they access at risk.

Another rising trend in the mobile application world is to offer a download directly from the developer’s website, circumventing any controls, restrictions, and management that comes with OEM-based stores. Providing instructions to users on sideloading, these direct methods have been used to deliver applications to mobile endpoints after they have been banned due to security or privacy concerns, refusing to accept established terms of service, or regional restrictions.

While most third-party app stores run through browser-accessed repositories, some have formalized their process with their own on-device app. Both approaches require a user to enable the installation of apps from unknown sources, including the browser, bypassing the standard safety checks found in OEM app stores. These unmanaged, unprotected store applications open mobile devices up to risks and vulnerabilities and sometimes are used to deliver malware directly to the user’s phone.

Circumventing the established protocols for code verification, app management, and security leave users at risk of vulnerabilities that might not have been caught during development. And while many of these developers are putting in the hard work to deliver genuine products, side-loaded applications are outside the purview of app store updates, requiring users to update manually.

Is it worth the risk?

OEM are consumer-friendly repositories with layers of local control to keep apps up to date to the latest versions and provide users with the information they need. And while many organizations rely on mobile device management for their environment, these tools lack security controls and capabilities that can keep mobile endpoints secure from all apps, no matter their origin.

In the end, the only way an IT and security team can be confident of the mobile applications connecting to their network are secure is with mobile threat defense (MTD). Securing these highly accessible devices from the risks and vulnerabilities in both OEM and third-party app stores and protecting against other common attack vectors raises the security confidence of a team while minimizing the attack surface. While users control the device in hand, the IT and security teams will have granular control to secure enterprise data.

“MTD products not only prevent attacks but also detect and remediate them. MTD focuses on identifying and thwarting malicious threats, rather than relying on device management configuration to protect against simple user mistakes.” – Gartner

While enterprises continue to adapt and expand their data accessibility with mobile devices, they need to approach the security of these endpoints with the same mindset as traditional devices. With more means of connectivity, communication, and portability, the enterprise attack vector is already stretched thin without the risk of third-party app stores. Enabling teams to stay ahead of attacks, scan and remediate risk applications, and close these security gaps keeps enterprises mobile and secure.

About Zimperium

Zimperium, the global leader in mobile security, offers the only real-time, on-device, machine learning-based protection against Android, iOS, and Chromebooks threats. Powered by z9, Zimperium provides protection against device, network, phishing and malicious app attacks. For more information, visit www.zimperium.com.

Sideloaded Applications: The Risk of Fewer Restrictions

Source

May 05 2021

Flubot vs. Zimperium

Over the past few weeks, reports of the newest aggressive malware family to impact Android devices have made the rounds. Flubot, the credential and banking malware family, uses SMS phishing techniques to propagate to its victims, purporting to be various vendors and delivery services. The group behind this aggressive malware takes advantage of a common but effective social engineering technique.

The Zimperium zLabs team has analyzed over 300 variants of Flubot and the URLs used to distribute them, finding that the aggressive credential stealer comes with unique features that make it stand out from many other examples of mobile malware seen in the past. The Android malware has been so effective, the UK’s National Cyber Security Centre has issued a cybersecurity warning, providing instructions for removal and reporting of any attempts.

The modern bank robbery is not happening through the front door of a building but with the path of least resistance – banking credentials. Flubot’s credential theft effectiveness comes in the form of its delivery and execution. The victim’s phone receives an SMS, instructing them to click a link to track their “package” via one of the known global shippers. The victim is redirected to a fake or compromised website where the malicious APK is downloaded and installed via side loading. The user wants to track their package and installs the application via side-loading onto the Android device – even walking the victim through the process if unfamiliar.

After installation, a window appears asking for the victim to “Accessibility Services” (a restricted capability allowing monitoring and interaction with all apps/screen content) for the application, enabling the now-installed application to take control without the user even knowing. Once the application has this permission, it uses it to get others such as READ_SMS, RECEIVE_SMS, and READ_CONTACTS. The app registers itself as the main SMS client, which will be later used to steal 2FA credentials.

A key component of credential-stealing malware is an effective command and control (CNC) capability, giving the attacked the ability to grab what they want and not be flooded with untargeted data. In the case of Flubot, the CNC backend is not hardcoded into the malware itself. Instead, it uses a Domain generation algorithm (DGA) – common in advanced desktop malware to generate the CNC URL server address. This enables Flubot to continue to evade its victim’s mobile endpoints if a security team was to block one single address.

Its effectiveness on mobile endpoints is made more so by Flubot’s capability to automate actions. After disabling Google Play Protect, the Android malware then asks to be set as the default SMS and notification tool, enabling it to continue spreading to more victims by collecting contact lists and preventing the victim from seeing the actions. From the moment the malicious application is installed, it also begins monitoring all the applications installed in the device. When a targeted application is opened, Flubot performs an overlay attack to collect user credentials and send this data back to the CNC. At the same time, Flubot uses SMS permissions to read second-factor authentication codes.

One final and very effective trick Flubot pulls on victims is collecting credit card information via a fake Google Play credit card re-verification popup. This is again performed as an overlay attack, looking just like the real popup notification. The unsuspecting victim is encouraged to fill in the necessary details without a second thought.

Flubot vs. Zimperium

Zimperium zIPS customers are protected against 100% of the Flubot variants analyzed with our zero-day, on-device z9 Mobile Threat Defense machine learning engine.

As a standard protocol, the Zimperium zLabs team checks new malware samples against not only the current machine learning model but past ones as well. In the case of Flubot, Zimperium zIPS customers were protected against this aggressive credential stealing Android malware since the first variant was first reported in February 2020.

The screenshot above highlights how Flubot samples are detected with extreme accuracy by different releases of our on-device malware classifier. In the Figure, classifiers up to 3 months back in time are displayed, but samples were detected by classifiers going back over one year.

Zimperium’s z9 malware engine is also able to correctly identify the family of malware (“banker” in this case) on device, allowing customers to create policies around specific malware types, and provide supporting forensics.

The URLs used to deliver the APK consisted 80% of compromised domains (a legitimate website whose hosting server is compromised and a malicious site is stored on it), rendering most traditional phishing prevention techniques obsolete. All reported URLs were analyzed using Zimperium’s z9 ML-based phishing engine. In this case, z9 proactively blocked over 98% of the URLs, preventing the attack chain from its inception. This adds to the layer of protection and security coverage for our customers.

To ensure your Android users are protected from this latest malware, we recommend a quick risk assessment. Inside zConsole, admins can review which apps are side-loaded onto the device that could be increasing the attack surface and leaving data and users at risk.

Remediating a Flubot Infection on Android

Non-Zimperium Customers: If you have fallen victim to the Flubot malware on your Android device, immediate action is necessary to avoid more risks. First, disconnect the device from all connections, including cellular and WiFi, by putting the device into airplane mode. Next, the most effective way to remove the Android malware is through a factory reset. This will wipe the mobile device and load a fresh, clean version of the operating system. Do not restore from backup if it was created after the malware installation. Installing all your user applications fresh from Google Play ensures that you are downloading safe, approved, and secure apps. Finally, reset all your banking passwords, enable 2FA if possible, and notify your banks to increase monitoring on your account.

Not a Zimperium customer? Contact us today for a free mobile risk assessment.

About Zimperium

Zimperium, the global leader in mobile security, offers the only real-time, on-device, machine learning-based protection against Android, iOS and Chromebooks threats. Powered by z9, Zimperium provides protection against device, network, phishing, and malicious app attacks. For more information or to schedule a demo, contact us today.

Flubot vs. Zimperium

Source