New VMware Global threat report identifies lateral movement, island hopping as key cyberattack tactics

VMware Carbon Black releases its semiannual Global Incident Response Threat Report (GIRTR), and it reveals that attackers are continuing to evolve.

VMware Carbon Black has a vast incident response (IR) partner ecosystem, comprising more than 100 leading IR firms. These partners use Carbon Black technology in more than 1,000 response engagements per year. Aggregated data from these top IR firms shows that cooperation among attackers is increasing. That makes it more important than ever for the good guys to fight back.

“Because geopolitical tension is playing out in cyberspace, targets must boost defenses,” says Tom Kellermann, VMware Carbon Black head cybersecurity strategist. “Beyond politics, financial motivation is a top driver. That means organizations with decentralized systems protecting high-value assets, including money, intellectual property, and state secrets, continue to be at high risk.”  

The GIRTR includes eight key research highlights. Three demonstrate significant increases since the last report include financial gain was the primary motivation for 90 percent of attacks. This is a sharp increase from 61 percent in the first half of 2019. It’s also a shift from previous years, when intellectual property theft and stealing customer information topped the list; “island hopping” continues to rise, as forty-one percent of total attacks came from this advanced method, where attackers target enterprises via partners and vendors; and IR pros said they experienced destructive/integrity attacks in about 41 percent of attacks, a 10 percent increase compared to the past two quarters.

The majority of cyberattacks now include tactics like lateral movement, island hopping and destructive attacks, according to the November report. Advanced hacking capabilities and services for sale on the dark web compound the issue, as does an unprecedented collaboration among nation-states, according to the report.

This most recent GIRTR also highlights the rise in custom malware, which the report defines as “coded with a specific purpose in mind, a sign of more sophisticated and well-financed attacks, as opposed to commodity malware, which is widely available for purchase or for free on the dark web.” 

Custom malware was used in 41 percent of attacks, up from 33 percent in the first quarter of this year, according to the report.

“This increase should also worry enterprises because of the pass-along effect. These attackers are like Johnny Appleseed,” says Kellermann.

Kellermann explains why people who build custom attack code sell it on the dark web; buyers use that purchased code to attack a company with it; and once that happens, the custom code builder can now teleport into the attacked company’s environment because he or she has administrative access to that attack code.

As communities of attackers come together, so, too, must defenders. And that’s exactly what VMware Carbon Black and top IR professionals are doing. They’re “fighting back as a global community with actionable intelligence and holistic strategies to mitigate the ongoing cyber insurgency online.”

Intel completes sale of its smartphone modem business to iPhone maker Apple

Intel announced on Monday that it has completed the sale of the majority of its smartphone modem business to Apple. This transaction, valued at US$1 billion, was announced in July. 

As previously disclosed, this transaction enables Intel to focus on developing technology for 5G networks while retaining the option to develop modems for non-smartphone applications, such as PCs, internet of things devices and autonomous vehicles.

Intel and Apple have signed an agreement for Apple to acquire the majority of Intel’s smartphone modem business. Approximately 2,200 Intel employees will join Apple, along with intellectual property, equipment and leases. 

Combining the acquired patents for current and future wireless technology with Apple’s existing portfolio, Apple will hold over 17,000 wireless technology patents, ranging from protocols for cellular standards to modem architecture and modem operation. 

Intel will retain the option to develop modems for non-smartphone applications, such as PCs, internet of things devices and autonomous vehicles.

Nokia and Innventure come together to deliver disruptive satellite communication technology

Nokia and Innventure have established on Monday an alliance designed to accelerate commercialization of disruptive Nokia Bell Labs satellite communications technology and intellectual property in areas beyond Nokia core businesses. The collaboration with Innventure will be led by Nokia Technologies, the company's licensing arm.

Innventure and Nokia will focus initially on Adaptive Bandwidth Management (ABM) technology, which improves bandwidth utilization, security and resilience of satellite systems. The technology and inventions originate from Nokia Bell Labs. 

Over its more than 90-year history, many of the foundational technologies that underpin digital devices, systems and communications networks such as 5G have been invented by Nokia Bell Labs. Innventure will acquire rights to the ABM technology from Nokia and be responsible for further development and commercialization of this technology.

Innventure identifies, starts and manages early-stage new companies with disruptive technologies sourced from leading multinational pipeline partners. The firm evaluates these technologies through its proprietary DownSelect process to determine which technologies have substantial market opportunities. Nokia becomes Innventure’s third multinational technology partner to use Innventure’s unique commercialization platform. 

“We are thrilled to work with Nokia to bring the company’s transformative innovations to new markets, businesses and customers. Nokia has a strong pipeline of positively disruptive technologies,” said Mike Otworth, founder and CEO of Innventure. “We have already progressed our evaluation of the Adaptive Bandwidth Management technology to the point that we have secured global commercialization rights for Innventure.”

“Nokia continues to explore new ways to help others benefit from Nokia innovations, while creating value from our industry leading portfolio of technologies and innovation,” said Jenni Lukander, President of Nokia Technologies. “Innventure’s approach has strong potential to further develop selected Nokia innovations on a commercial level.”

New SpyCloud offering, Third Party Insight, helps to measure and mitigate supply chain breach risks

SpyCloud launched Tuesday their new Third Party Insight solution to help companies understand risk and remediate exposures to the potential threat of account takeover emanating from supply chain vendors. Businesses can use this tool to evaluate risks presented by vendors, partners or acquisition targets based on several factors that stem from the threat of account takeovers.

Third Party Insight provides SpyCloud customers with a risk ranking (specific to the threat of account takeover) for each third party they work with, plus specific data on executive credentials, potentially infected employees, and the rate of password reuse across exposed data. 

Companies can share this data with partners for free and work with them to remediate exposures, reducing the risk of a breach due to account takeovers in their supply chain.  

Some of the most infamous data breaches occurred after the compromise of a third-party account. Memorably, Target's systems were reportedly compromised in 2013 after an HVAC vendor's credentials were used to access Target's web services for vendors, eventually leading to the propagation of credit card-stealing malware on point of sale systems.

More recently in March 2019, Citrix, which provides virtual private network services to most of the Fortune 1000, fell victim to a breach that emanated from an account takeover attack. Criminals had access to emails, project files, employee information and more over a six-month period before the breach was detected. 

"Your employees are open doors to your network, your data and your intellectual property, but your third-party relationships extend that attack surface even further," explained David Endler, chief product officer and co-founder of SpyCloud. "Our new Third Party Insight solution gives businesses a way to evaluate supply chain risks and work cooperatively with their vendors to mitigate them, in turn strengthening their overall security posture while building goodwill with key partners and suppliers."

"In addition to helping assess how vendors and partners may increase your attack surface, Third Party Insight can also help you understand exposures you may inherit through mergers and acquisitions," said Ted Ross, CEO and co-founder of SpyCloud. "When news of an acquisition leaks to the press, the parties involved become ideal targets for criminals. We can now proactively improve the security posture of these parties ahead of these events."

Renesas expands access of IP solutions including 7nm process TCAM, advanced standard Ethernet TSN IPs

Renesas Electronics announced expanded access to its highly sought portfolio of intellectual property (IP) licenses that allow designers to meet a broad range of customer requirements in a rapidly changing industry. Starting today, customers will have access to IPs such as advanced 7nm (nanometer) SRAM and TCAM, and standard Ethernet time-sensitive networking (TSN) IP. 

Furthermore, Renesas is working on providing a system IP which includes PIM (processing in memory), which attracted attention as an AI accelerator, presented in a conference paper in June 2019. With these IPs, customers can jump start their advanced semiconductor device development projects, such as the development of next-generation artificial intelligence (AI) chips or ASICs for 5G networks.

The Renesas accelerator is based on the processing-in-memory (PIM) architecture, an increasingly popular approach for AI technology, in which multiply-and-accumulate operations are performed in the memory circuit as data is read out from that memory.

Customers developing custom chips or using FPGA devices for early development can leverage Renesas IP in their subsystem design or speed up software development, respectively, allowing them to focus resources on their speciality areas, speed up the development process, and bring highly competitive products to market. 

Customers who prefer to use existing software assets can take advantage of Renesas IP assets to achieve more efficient system development by reducing the resources required to develop, verify, and evaluate software and boards.

To support customers’ semiconductor development efforts, Renesas has also established a network of partner companies ready to support users' unique needs. This network includes design houses that perform contract semiconductor design and technology partners who will provide an array of software and middleware tools. 

This network will accelerate users' technology innovations and product development efforts by lowering the barriers to entry for semiconductor device and FPGA development. Renesas can also introduce experienced users to model-based design development environments that fully utilize leading-edge IP.

In September 2018, Renesas opened its extensive IP license portfolio, offering access to more than 40 licenses, including CPU cores, timer IP for motor applications, USB cores, and SRAM. In 2019, Renesas received over 100 enquiries and have started supplying IPs to many users. Renesas aims to exceed IP sales annual market growth rate of 10 percent, and will expand the provision of IP and support system while creating new, and expanding old, IP markets.