How Secure is Your Mobile Worker?

How well do you know your mobile worker? Understanding the mobile worker’s perceptions and behaviors will offer a better view on the potential security implications your organization must manage. Cisco recently released a new global infographic and white paper, the Cisco Connected World International Mobile Security study. They explore the mobile worker’s view points concerning working remotely, connecting to corporate, and their sense of security. Some of the findings are worth reflecting on to help you set the course for your mobile security efforts.
There is no question that the movement to mobile personal devices in the workforce has been well recognized. A recent response to this trend includes almost half of employers offering to fund workers to buy their own devices. Allowing the “chose your own” device alternative will attract and retain talent and reduce costs (see recent IBSG BYOD research), but what are the security implications?
There are a few striking data points to call out:

• 63% of users download sensitive data on their devices. The frequency significantly increases in some countries which should alarm people doing business internationally if there are no precautions taken to secure the downloaded data. Imagine your financial data or product road maps being downloaded on an unprotected personal device.
• Most believe remote access is a privilege. Yet in some countries they believe it’s a right as a worker. This establishes high expectations for IT to support and secure the devices including, but not limited to, extensive help desk calls.
• Most users are diligent when a pop-up appears and will read through the details and determine what it really means. Yet, many workers from select countries generally tend to be less careful and accept warning pop-ups without reading the details which increases the risk that hidden malware will be downloaded. Hackers depend on this social mining effort.
• 60% of users admit to engaging in risky behavior on a device (for example, personal or company-owned) while connected to corporate resources. This suggests that more security enforcement technology would benefit the prevention of data breaches and/or loss.

So, who really owns the mobile security issue? Mobile workers do not take full responsibility for a safe device with 84% believing that their IT will protect them from threats no matter what device is used. Sometimes IT’s perspective on this dependency is expressed with disbelief. An example of this issue was observed at BlackHat from a security professional during a demonstration we presented a couple weeks ago.
During the demonstration, we were showing how a user who inadvertently clicked on a phony URL sent in an email. That click triggered to phone an alert to a hacker that an “innocent” user is accessing the phony Internet site. The user unknowingly offered login credentials to their bank account. The hacker begins to record the users’ keystrokes to use later for malicious purposes. A security professional from BlackHat chimes in during the demonstration with the comment, “Dumb User.” The demonstration later showed how the combined effort of Cisco ISE and SIEM (Lancope) with unique TrustSec enforcement can identify and control the malicious activity with a single policy (for example, by segmenting and restricting users traffic close to the edge—on a network switch). The surprise to the security experts watching the demonstration was the concept that the network switch provided this enforcement.
Bottom Line: Most mobile workers have good intentions but do rely on IT to step in.
It would be great hear from you on your impressions of these recent findings and whether you are a mobile worker or an IT professional.
Please refer to Cisco’s security response for the mobile workforce: Secure Access

Zeus Trojan steals funds and recruits Money Mules

Security firm Trusteer detected a new variant of Zeus Trojan that steals funds and recruits Money Mules proposing jobs ads to the victims using Man-in-the-Browser (MitB) techniques.

Zeus Trojan is becoming even more complex, its evolution is unpredictable due to the intense activity in the underground on its source code. Various forums in the underground offer customization service to adapt the behavior of Zeus trojan to new fraud scheme. Last version of the popular Banking Trojan detected by the Trusteer security firm is not only able to steal funds from its victims but it also tries to recruit them as ‘Mules’
Security firm Trusteer revealed that a group of criminals using the popular Zeus banking Trojan has started a recruiting campaign displaying ads for job scams once victim visits a popular job site, CareerBuilder [dot] com.
The investigation conducted by Trusteer focused also on employment websites that have long been a target for cybercriminals searching for the user’s credentials through malware distribution and mule recruitment.
The Zeus Trojan found by  Trusteer uses HTML injection to advertise a mule recruitment site when a victim visits CareerBuilder [dot] com. Mules are an essential component of the scam life cycle, in particular for cash-out money, in the past recruiting web site were used by criminal organizations to recruit these figures.

“Money mules are always a scarce resource and whenever criminals do recruit them, they keep a pretty good eye on them,” he said. “At the end of the day, you really can’t cash out unless you have a mule.” Commented Etay Maor, fraud prevention solution manager with Trusteer.

Typically the criminals create a job opening for “financial managers” with possibility to earn working at home, in reality those people that respond to the announcement serve as the money laundering component for cybercrime gang. Principal employment websites are aware of this illegal practice and have created dedicated security team including anti-fraud competences. The web site used for mule recruitment is marketandtarget [dot]com as reported  in the Zeus Trojan configuration file, site that is currently down.



On the other side malware authors have refined their techniques to avoid controls operated by site managers, the last variant of The Zeus Trojan in fact implements a Man-in-the-Browser (MitB) techniques to present the victim with an advertisement for a mule recruitment site every time he visits CareerBuilder [dot] com.

Man-in-the-Browser malware are commonly used by cybercrime to steal data from victims or to redirect them to compromised web sites such as the specific case we are analyzing.

The variant of Zeus trojan using HTML inject adds data fields or to present bogus messages to redirect  the victim to a fake job offering while he is visiting legitimate employment site CareerBuilder [dot] com, in this way the victim plays redirection as a legitimate operation of the access to a job opportunity.
The availability of the source of Zeus Trojan on the black market potentially opens to an infinite number of possibilities that we will meet in the near future and represents a success for the industry of malicious software.