Category Archives: risk assessment

Researchers Uncover Highly Exploitable WinRAR Bug That Puts 500 Million Users at Risk

More than 100 unique exploits of a WinRAR bug have been identified since security researchers discovered a 19-year-old vulnerability in the file compression system.

Antivirus products may not immediately recognize persistent malware installed via the code execution flaw in the Windows-based utility, which was initially uncovered by Check Point. In a recent blog post, McAfee researchers noted that attackers are mostly targeting U.S. users, hoping to reach them before they install a patch that was released late last month.

WinRAR Bug Puts 500 Million Users at Risk

With a series of screenshots, McAfee illustrated a typical exploit that leveraged an illegal version of “thank u, next,” the hit song by pop singer Ariana Grande. Threat actors set up a payload containing malware in the Startup folder while a version of WinRAR containing the flaw extracted the MP3 file to a download folder.

User Account Control does not apply in this case, the researchers added, which means a user wouldn’t get a signal that the payload was installed. Once the system reboots, the malware starts running.

WinRAR is a popular tool with an estimated 500 million users, which means the scope for threat actors to pursue exploits is particularly large. It’s also common to see bootlegs such as the Ariana Grande song widely available on underground forums and torrent sites, which can provide plenty of opportunity to take advantage of the flaw.

No, Thank You: How to Avoid the WinRAR Bug

While the best recourse for most users is to simply avoid suspicious downloads and apply the patched version, WinRAR 5.70, that may not be enough to protect entire organizations. According to IBM experts, there is often a disconnect between IT security teams and operations teams when it comes to information related to critical software patches.

With the right patch posture reporting tools, security professionals can conduct a comprehensive assessment of devices that may be vulnerable to something like the WinRAR bug, then filter and sort data based on the most appropriate remediation priority. Given how quickly threat actors are trying to capitalize on this flaw, there’s no time to lose.

The post Researchers Uncover Highly Exploitable WinRAR Bug That Puts 500 Million Users at Risk appeared first on Security Intelligence.

Tackling 3rd Party Risk Assessments Through a 3rd Party

In the enterprise, sometimes absurd is the order of the day.

Earlier this week I ended up in a conversation with a colleague about 3rd party risk. We started talking about the kinds of challenges his organization faced, and as the leader of the 3rd party risk program what he's up against. As it turns out when the organization set out to tackle 3rd party risk a slight mis-calculation was made. Long story short, his group has over 100+ vendors to manage in terms of 3rd party risk. That's 100+ vendors that interact with the network, the data, the applications, the people, and the facilities his enterprise has.

His team is staffed by a whopping 3 people, including him. To put this into perspective, and given that there are 250 business days a year, it means his team needs to complete 50 reviews per analyst. With 250 total days to work with, that means that they can spend a maximum of 5 days per 3rd party. Of course, we're not counting vacation days, sick days, or snow days. We're also not counting travel to/from sites to actually do investigative work, or the time it takes to do an analysis, debrief, or any of that.

This started to unravel in my mind, pretty quickly. I pressed my colleague for an answer to how he could possibly achieve any measure of compliance and completeness, to which he answered: "We outsource the evidence gathering to a 3rd party".

My head exploded.

I'm not saying it doesn't make sense, or that there are very many real alternatives - but you have to know how crazy this sounds. They've outsourced the fact-finding portion of 3rd party risk assessments to a 3rd party. BOOM

The truth is that there is a lot that he was doing behind the scenes here which made this a little easier to swallow. For example, a standard questionnaire was developed based on a framework they developed and approved internally which minimized the amount of 'thinking' a 3rd party assessor had to do. Each category of required controls had a gradient on which the 3rd party being assessed was graded, and there was really very little room for interpretation. Mostly.

If you think about it, I'm confident that there are many, many enterprises out there with this minor challenge. Every enterprise does business with at least dozens, on average with hundreds of 3rd parties to varying degrees. From your outsourced payroll provider, to the company that shreds your documents once a week, to the company who sends the administrative assistant who sits at their desk and answers calls and surfs Facebook all day. Every enterprise has a vast number of 3rd parties which need to be assessed - and risks identified.

While I'm definitely not crazy enough to think companies should only handle this with internal, trusted employees, I'm not completely convinced hiring out to a 3rd party is that fantastic of an idea either. There is so much to consider. For example, if that 3rd party assessor misses something, are they liable, or does that fall to your company? Ultimately in the court of public opinion - this is a trick question. The answer is always you.

I suppose the long and short of it is that enterprises have little choice but to use a 3rd party to help them manage 3rd party risk. But then the only question is - do they assess that 3rd party which will be doing the 3rd party risk assessments for unnecessary risk? It's enough to make your head spin, I know it gave me a headache just thinking about it.

What do you think the mature 3rd party risk assessment looks like? Do you have leading practices you could share? Contact me as I'd like to share them with our peers, and others who are struggling with this task right now.