Your organization’s leadership is 12 times more likely to be the target of a security incident and nine times more likely to be the target of a data breach than they were last year. Find out how they can be protected.
Read the Datasheet
Gift Cardsharks: The Massive Threat Campaigns Circling Beneath the Surface
Learn about the attack group primarily targeting gift card retailers and the monetization techniques they use.
Get the Report
Threat Hunting Workshop Series
Join one of our security threat hunting workshops to get hands-on experience investigating and remediating threats.
Attend an Upcoming Workshop
Inside Magecart: New RiskIQ & Flashpoint Research Report
Learn about the groups and criminal underworld behind the front-page breaches.
Threat Hunting Guide: 3 Must-Haves for the Effective Modern Threat Hunter
The threat hunting landscape is constantly evolving. Learn the techniques, tactics, and tools needed to become a highly-effective threat hunter.
Mozilla, the world’s second most popular browser, announced an important cyber security decision last week to distrust a range of bad SSL certificates issued by Certificate Authorities (CAs) WoSign and Startcom, citing “technical and management failures”.
In a nutshell, the cyber security industry agreed several years ago that SHA-1 is becoming risky to use for SSL certificates, and set a deadline of January 1st, 2016 for the industry to stop issuing SSL certs that use it. WoSign, which has acquired full ownership of Startcom, continued to issue SHA-1 SSL certs to customers, made to look valid by back-dating them, i.e., faking the date of issuance. There are several potential impacts from issuing weak certificates discussed in our technical blog, but the main business impact will be alarming “Secure Connection Failed” browser warnings when people visit your website. These certificates also present the risk for Man in the Middle attacks on users’ sessions and more.
Why would two Chinese CAs backdate certificates with weak ciphers, and then repeatedly deny it? Is this a shady operation, or simply a mistake? Keep in mind that it took Apple and Mozilla essentially saying they would put WoSign and Startcom out of business for them to finally respond to the claims of wrongdoing (we’ll let you draw your own conclusions).
Once WoSign was forced to come clean, the answer provided isn’t much of answer. To read it, jump to “9. Issue S: Backdated SHA-1 Certs (January 2016)” inside the official PDF response (if you are comfortable opening a Chinese PDF). The number of mistakes and poor judgment calls made at WoSign disclosed in this advisory, make it look like Hanlon’s Razor has been in effect there for some time.
If your organization is using SSL certificates from either of these CAs, you could be a victim of this. In fact, RiskIQ’s current global index shows 762,649 websites using Certificates belonging to the 2 CAs. If you are a RiskIQ Enterprise Digital Footprint customer, log in and go to your Insights Dashboard to review usage of WoSign and Startcom SSL Certificates.
Fig-1 For specifics on analyzing certificates, visit our technical blog
If you are unsure if—or where—you are running WoSign or Startcom SSL Certificates, you are certainly not alone. As businesses expand into digital channels, the challenge of finding and managing an increasingly decentralized attack surface grows exponentially. To demonstrate this risk, RiskIQ performed a quantitative assessment of threats facing the top 35 banks and financial service firms as a result of decentralized web and mobile attack surface in April 2015. The data we collected confirms this challenge:
Fig-2 RiskIQ’s Enterprise Digital Footprint inventories all the SSL certs in your environment
Most organizations have challenges managing their ever-expanding digital footprint and resultant Internet-exposed attack surface and struggle to find risk issues like invalid and potentially exploitable SSL Certificates. RiskIQ’s Enterprise Digital Footprint was purpose built to solve this problem.
Get your #RSAC 2020 party started by joining RiskIQ at IGNITE, hosted by @FlashpointIntel! Register now: https://t.co/XhmW7kUCY8
Now you can see why we named it Magecart 🙃 it’s where it started in 2014. A group normally skimming data through Mage.php when a cart checkout is done, started pioneering a client-side JS skimmer.
The rest of the story can be read in our 2018 report: https://t.co/aGlU984pTU https://t.co/AwDlwdb36p
Based on data from @riskiq it appears this campaign by the Russian GRU to hack and breach Burisma in Ukraine started around 11-11-2019 (and possibly earlier) with the registration of the domain kub-gas[.]com cc @Ushadrons @file411 @IdeaGov #infosec #phishing #malware #disinfo
RiskIQ is excited to announce that growth expert Christophe Culine has joined our team as Chief Revenue Officer, leading our sales organization to great things in 2020 and beyond https://t.co/DYCAOfYeIa
RiskIQ's @ydklijnsma was on @DarknetDiaries to talk about the global phenomenon of #Magecart. Listen in on how credit card skimming on online purchases is happening—and happening often.