Infosec teams know all about cyberattacks on servers and desktop computers, and the optimal protective practices are both well-known and well-developed. But things get a lot more complicated when it comes to less “visible” devices — such as routers, printers, medical equipment, and video surveillance cameras. Yet they too are often connected to the organization’s general network along with servers and workstations. The question of which of these devices should be the top infosec priority, and what risk factors are key in each case, is the subject of the “Riskiest Connected Devices in 2024” report.

Its authors analyzed more than 19 million devices: work computers, servers, IoT devices, and specialized medical equipment. For each individual device, a risk level was calculated based on known and exploitable vulnerabilities, open ports accessible from the internet, and malicious traffic sent from or to the device. Also factored in were the importance of the device to its respective organization, and the potential critical consequences of compromise. Here are the devices that researchers found to be most often vulnerable and high-risk.

Wireless access points, routers, and firewalls

The top two places in the list of the riskiest devices in office networks — by a comfortable margin, went to network devices. Routers are typically accessible from the internet, and many of them have open management ports and services that are easy for threat actors to exploit: SSH, Telnet, SMB, plus highly specialized proprietary management services. In recent years, attackers have learned to exploit vulnerabilities in this class of equipment — especially in its administration interfaces. Much the same holds for firewalls — especially since these two functions are often combined in a single device for SMBs. Access points have insecure settings even more often than routers do, but the threat is somewhat mitigated by the fact that compromising them requires being in close proximity to the device. The initial attack vector is usually a guest Wi-Fi network, or a dedicated network for mobile devices.

Printers

Although printer exploitation by hackers isn’t that common, such cases are nearly always high-profile. The risk factors associated with printers are as follows:

They’re often connected directly to the office network and at the same time to the manufacturer’s central servers; that is — to the internet.
They often operate in a standard configuration with default passwords, allowing a potential attacker to view, delete, and add print jobs, among other things, without having to exploit any vulnerabilities.
They usually lack infosec tools, and often get added to firewall allowlists by network administrators to ensure accessibility from all computers in the organization.
Software updates are slow to appear, and installation by users is even slower — so dangerous vulnerabilities in printer software can remain exploitable for years.
The “printers” category includes not only network MFPs, but also highly specialized devices such as label and receipt printers. The latter are often directly connected to both POS terminals and privileged computers that process important financial information.
Printers are a favorite target of hacktivists and ransomware groups because a hack that prints off thousands of copies of a threatening letter can’t fail to make an impression.

VoIP devices and IP surveillance cameras

Like printers, devices in these categories are rarely updated, are very often accessible from the internet, have no built-in information security tools, and are regularly used with default, insecure settings.

Besides the risks of device compromise and hackers’ lateral movement across the network that are common to all technology, unique risks here are posed by the prospect of attackers spying on protected assets and facilities, eavesdropping on VoIP calls, or using VoIP telephony for fraudulent purposes impersonating the attacked organization. Exploiting vulnerabilities isn’t even necessary; a misconfiguration or default password will suffice.

Automatic drug dispensers and infusion pumps

The No. 1 niche devices in the hit parade are automated drug dispensers and digital infusion pumps, the compromising of which could seriously disrupt hospitals and threaten lives. According to the researchers, high-risk cases occur when such devices aren’t protected from external connections: in late 2022, 183 publicly accessible management interfaces for such devices were discovered; and by late 2023, that number had grown to 225. For a critical incident affecting patient care to arise, deep compromise of the target device is often not necessary — a denial of service or disconnection from the telecommunications network would be quite enough. Real attacks on healthcare facilities by the ransomware group LockBit have provoked such situations. Another risk is the malicious altering of drug dosage, which is made possible by both numerous device vulnerabilities and insecure settings. In some institutions, even a patient can do the altering simply by connecting to the hospital’s Wi-Fi.

How to protect vulnerable equipment in your organization

Disable all unnecessary services on the equipment and restrict access to necessary ones. Control panels and service portals should only be accessible from administrative computers on the internal subnet. This rule is critical for network hardware and any equipment accessible from the internet.
Segment the network by creating a separation between the office, production, and administrative networks. Ensure that IoT devices and other isolated resources can’t be accessed from the internet or the office network available to all employees.
Use strong and unique passwords for each administrator, with multi-factor authentication (MFA) where possible. Use unique passwords for each user, and be sure to apply MFA for access to critical resources and equipment.
If the device lacks support for sufficiently strong authentication and MFA, you can isolate it in a separate subnet, and introduce MFA access control at the network equipment level.
Prioritize rapid firmware and software updates for network equipment.
Study the network and security settings of the equipment in detail. Change default settings if they aren’t secure enough. Disable built-in default accounts and password-less access.
Study the router manual, if available, for ways to improve security (hardening); if not available, seek recommendations from reputable international organizations.
When purchasing printers, multi-function peripherals (MFPs), and similar devices, explore the standard features for improving printer security. Some corporate models offer an encrypted secure print function; some are capable of updating their firmware automatically; and some are able to export events to a SIEM system for comprehensive infosec monitoring.
Implement an all-in security system in your organization, including EDR, and comprehensive SIEM-based network monitoring.

Kaspersky official blog – ​Read More

Small Bluetooth tags for finding lost items are a godsend for frequent travelers and simply forgetful people. The coin-sized devices contain a battery and a Bluetooth Low Energy (BLE) transmitter, and a smartphone app allows you to determine the beacon’s location to within a few centimeters. If the lost keys with the tag are far away from the owner and their smartphone, other people’s smartphones can help find them: both Apple and Google have deployed a global network in which every smartphone reports the location of nearby beacons to a server, and their proprietary apps (Find My for iOS, and Find my Device for Android) can locate the lost item. There just needs to be at least one smartphone nearby that has both Bluetooth switched on and an internet connection.

Although the most popular beacon is Apple’s AirTag, there are several other accessories that work on the same principle and that are sometimes compatible with each other (Chipolo, eufy, Filo, Samsung SmartTag, Tile, and others). Sometimes tracking functions are built directly into frequently lost accessories, such as Bluetooth headsets and headphones.

The possibility of remote tracking was quickly appreciated not only by the forgetful but also by scammers and stalkers. By planting an AirTag on a victim — for example, slipping it into a purse pocket or under a car license plate — one can track a person’s movements without their knowledge. Thieves use this technology to steal expensive cars, and stalkers and jealous partners use it for surveillance and harassment. So how can you protect yourself from such a thing?

First generation of AirTag protection

As soon as the first reports of AirTags being used for tracking appeared, Apple implemented several protective measures to reduce the likelihood of stalking. First, AirTag was equipped with a speaker. If the Bluetooth tag is far away from the smartphone it’s linked to, it intermittently emits a loud beep. Second, iOS 14.5 introduced a feature that alerts a smartphone owner if a someone else’s AirTag is detected nearby for an extended period of time and regardless of the smartphone’s location. If this happens, you can turn on the sound on this beacon to physically locate it, and also check the serial number of the AirTag. Sometimes, it can all be quite innocent, for example if it’s a tag hanging on the keys of a relative or friend you’re traveling with, or a beacon parents have put in their child’s backpack. In this case, the warning about the foreign AirTag can be disabled temporarily or permanently.

Unfortunately, these measures were not enough. They didn’t help Android owners in any way, and attackers learned to bypass the “beep” protection by manually disabling or damaging the speaker, or buying “silent” AirTags on online markets.

How to protect yourself from AirTag and other Bluetooth trackers in 2024

This year, manufacturers have developed cross-platform compatibility — the ability to detect BLE beacons regardless of which smartphone they’re linked to and what kind of smartphone the tracking victim has. To achieve this, Apple and Google joined forces and implemented this functionality in both iOS 17.5 and Android (the update is available for all versions starting with Android 6). Now, warnings that someone else’s tracker is being consistently detected nearby is available on either of these platforms, and the victim can see the tracker’s ID, turn on its speaker, and even get instructions on how to disable the beacon. The tech giants proposed the DULT (detecting unwanted location trackers) standard, which may become an industry standard in the future. For now, some tag manufacturers — Chipolo, eufy, Jio, Motorola, and Pebblebee — have said they will support the current specification.

What to do if you find an unknown Bluetooth tag on your belongings?

There are no hard and fast rules for this situation, as much depends on individual circumstances.

Upon receiving a warning on your smartphone, the first step is to locate the tracker and carefully examine it. You can use the “precision finding” feature, for example by following this guide. The tag could be hidden anywhere — in the folds or pockets of your bag, in your wallet, under the wheel arch of your car, stuck to the bumper or license plate frame, and so on. If you’re unsure whether it’s the same tracker flagged by the app, check the serial number. Some models have it printed on the casing, while others can be checked by placing them next to the smartphone’s NFC reader.

Locating the tracker helps rule out innocent scenarios: perhaps you accidentally picked up someone else’s headset instead of yours, or a colleague left their keys in your car. In such cases, simply return the lost item to its owner. Another possible legitimate tracking scenario is a tag attached to rented equipment, especially cars and expensive electronics. In this case, discuss the tracking with the rental provider and decide whether it’s acceptable to you. Normally, such property protection measures should be outlined in the rental agreement.

The situation is more complex when it comes to malicious tracking.

For victims of domestic violence, married couples going through a difficult divorce, or given other circumstances where exposing tracking might provoke aggression from the perpetrator, it’s recommended to remain discreet. Report the tracking to law enforcement, but avoid revealing this fact to the stalker. It’s important that the tag doesn’t “light up” at the police station. To achieve this, you can either remove the battery or arrange a meeting with the authorities at a safe location.

If there’s no risk of violence, you can simply hand the tag over to the police. Throwing it away or deactivating it is not enough, as the perpetrators could just start all over again.

For comprehensive protection of your privacy, use our most advanced security solution — Kaspersky Premium, which not only neutralizes viruses but also provides the world’s best protection against phishing, detects intrusions into your Wi-Fi networks, protects your personal data and payment information online, alerts you to password leaks and identity theft, and offers many more features to ensure your complete security.

We’ve prepared a detailed step-by-step guide to help you choose the optimal subscription and quickly set everything up from scratch, or switch from other vendors to our applications — which have received more awards than any other security solutions in the world.

Kaspersky official blog – ​Read More

The increasing use of both multi-factor authentication (MFA) and cloud services in organizations has forced cybercriminals to update their tools and tactics. On the one hand, they no longer need to penetrate a company’s internal network or use malware to steal information and conduct fraudulent schemes. It’s enough to gain access to cloud services — such as Microsoft 365 email or MOVEit file storage — through legitimate accounts. On the other hand, stolen or brute-forced credentials are no longer sufficient — MFA must be somehow bypassed. A recent large-scale series of cyberattacks on major organizations, which affected over 40,000 victims, shows that attackers have adapted to the new reality. They’re using targeted phishing techniques and adversary-in-the-middle tools on a broad scale to target companies.

What is adversary-in-the-middle

An adversary-in-the-middle (AitM) attack is a variation of the well-known man-in-the-middle attack: the attacker gets access to the communications between legitimate parties (client and server), intercepts client requests, forwards them to the server, and then intercepts the server responses and forwards those to the client. What makes an AitM special is that the attacker doesn’t just eavesdrop on communications, but actively interferes with them — modifying the messages to their advantage.

Advanced AitM attacks may involve compromising the organization’s ISP or Wi-Fi network. Attackers then manipulate network protocols (ARP poisoning, DNS spoofing) and display fake web pages or files when the user accesses legitimate resources. But in the case of spearphishing, such tricks are unnecessary. It’s enough to lure the user to a malicious web server, which will simultaneously communicate with both the victim and the legitimate cloud-service servers using a reverse proxy. The attack generally goes like this:

The user receives a phishing message and clicks the link.
Through a chain of masking redirects, the user’s browser opens a page of a malicious site that looks like the cloud service’s login portal. To display this page, the attackers’ reverse-proxy contacts the legitimate server and transfers the entire login-page content to the user’s browser, making any changes necessary for the attackers.
The user sees the familiar interface and enters their username and password.
The malicious server relays the username and password to the legitimate server, imitating the user’s login. The username and password are also stored in the attackers’ database.
The legitimate server verifies the password and, if correct, requests a one-time code, which is sent to the user or generated in their app, as per the usual MFA procedure.
The malicious server displays a page prompting the user to enter the one-time code.
The user enters the one-time code from the authenticator app or text message.
The malicious server sends the code to the legitimate server, which verifies it and, if correct, lets the user into the system.
The legitimate server sends session cookies needed for normal system operation to the “browser” (which is actually the malicious server).
The malicious server forwards the cookies to the attackers, who can then use them to imitate the browser of a user already logged into the system. The attackers don’t need to enter passwords or MFA codes anymore — it’s all been done already!
The malicious server redirects the user to another site or to the regular login page of the legitimate service.

Additional features of modern AitM attacks

Attackers have streamlined the basic attack scenario described above. There are ready-made phishing kits available — usually including reverse proxies like Evilginx or Muraena, which enable “out-of-the-box” attacks with templates for modifying login pages of popular cloud services and well-oiled MFA-code theft scripts.

However, to successfully compromise large organizations, “off-the-shelf” attacks need to be tailored. Well-resourced attackers can target many organizations at once. In the attack mentioned above, about 500 large companies — all law firms — were targeted within three months. Each received a custom domain within the attackers’ infrastructure, so the victims (executives of these organizations) were directed to domains with familiar and correct names in the initial part of the URL.

The arms race continues. For example, many companies and cloud services are transitioning to phishing-resistant MFA methods such as hardware USB tokens and passwordless logins (passkeys). These authentication methods are generally resistant to AitM attacks, but most cloud systems allow a backup-plan login using older verification methods such as “paper envelope” one-time codes or one-time codes delivered in text messages. This is intended for cases where the user loses or breaks the second factor physical device. Attackers can exploit this feature: the malicious server shows the victim modified authentication pages of the legitimate server, erasing the more reliable authentication methods. This type of attack has been named Passkey Redaction.

How to protect against AitM attacks

Protection against spearphishing attacks aimed at gaining access to cloud accounts requires coordinated measures from corporate security services, cloud providers, and the users themselves:

Use phishing-resistant MFA tools such as hardware USB tokens. Ideally, these should be used by all employees, but at the very least by management and those responsible for critical business operations and IT.
Work with SSO solution providers and cloud services to disable backup-plan authentication methods and take technical measures to make it difficult to steal authentication-token cookies.
Educate employees to pay attention to changes in login pages and avoid entering credentials if “authentication disappears” unexpectedly, or the site name seems unfamiliar. Regularly conduct cybersecurity training tailored to employees’ responsibilities and experience.
Explore and properly configure the cloud provider’s security tools. Ensure that employee activity logging is sufficiently detailed and that the security team receives these logs promptly. Ideally, they should go directly to the SIEM system.
Ensure that all computers and smartphones used to access corporate accounts have an EDR agent
Install a reliable protective solution with antiphishing capabilities on the corporate email server.

Kaspersky official blog – ​Read More

Evil twins — malicious Wi-Fi hotspots that intercept user data — are back in vogue. While the threat itself is nothing new (we’ve covered it before), fake Wi-Fi incidents have recently reached new heights — literally. In a particularly interesting case from Australia, a passenger was arrested for setting up evil twins both at the airport and on board the plane during the flight.

There’s a good reason these days why passengers are more likely to use in-flight Wi-Fi: airlines are increasingly offering entertainment streamed directly to your devices rather than on the seatback screens.

Here’s how it works: after takeoff, you enable Wi-Fi on your phone, laptop or tablet, connect to the access point, open your browser, and voilà — you’re on the airline’s media portal. From there you can choose from a selection of movies, music, games, and more. And sometimes this same portal offers internet access —usually for an additional fee.

While streaming entertainment saves airlines money on installing and maintaining seatback screens, it requires more vigilance from passengers — who probably don’t expect to be targeted mid-flight. In the case mentioned above, the perpetrator carried on board a laptop and a mobile Wi-Fi hotspot with the same network name as the legitimate airline Wi-Fi.

Unsuspecting passengers, connecting to what they thought was the official network simply because its signal was stronger (the weaker, genuine one with the same name generally isn’t shown) — were then directed to a fake authentication page. This page requested an email address — and password! — or social network credentials, supposedly to sign in to the airline’s online services. According to police, the criminal intended to use this data to hijack accounts and access personal information.

The insidiousness of this kind of attack lies in the victims’ limited options: stuck on board a plane, connected to what they believe is legitimate Wi-Fi, they have just two options: (i) provide the requested information, or (ii) forgo any and all in-flight entertainment — because neither cellular networks nor other Wi-Fi access points are available during the flight. Therefore, the chances of a successful attack are… sky-high.

How to use in-flight Wi-Fi safely

Our traditional advice about using free Wi-Fi boils down to two simple tips: use 4G/5G cellular access instead of public Wi-Fi hotspots wherever possible, and when that’s not an option — protect your connection with a reliable VPN. But these don’t… quite fly at cruising altitude: cellular data is out of reach; you have to disable your VPN to connect to the in-flight portal; and even if you pay for in-flight internet access, the VPN is likely to be patchy or not work at all.

So, here’s some tailored advice for staying safe when using in-flight Wi-Fi:

Don’t connect to in-flight Wi-Fi just out of curiosity to see what’s on offer.
Come prepared. Download movies and music to your devices beforehand so as not to rely on the airline’s entertainment options. That done, you probably won’t need in-flight Wi-Fi at all.
If you still do need Wi-Fi, review the instructions in your seat pocket carefully. It should list the official Wi-Fi name and connection process.
Be wary of discrepancies. If something about the Wi-Fi connection seems off compared to the instructions, or if you’re asked to enter detailed personal information like email, passwords, passport details, or payment information, disconnect immediately and alert a flight attendant. Confirm with them whether this information is actually required to use the Wi-Fi. Show them the device screen so that they can verify the legitimacy of the connection interface.
Avoid downloading anything during the flight. Connecting to the plane’s network should never require installing apps, plugins, or certificates. If asked to install anything of the sort — disconnect immediately by enabling airplane mode.
If you connect to Wi-Fi to use the in-flight internet, try enabling your VPN as soon as the connection is established. If the VPN can’t be turned on, minimize your online activity, and never log in to sensitive services such as online banking, government websites, or email.
Keep the number of devices you connect to the in-flight Wi-Fi to a minimum — preferably no more than one.
If you do connect, before landing, make sure to go to the Wi-Fi settings and “forget” the airline network. You can then put your device in airplane mode, as required by the aviation regulations.

Kaspersky official blog – ​Read More