You’ve probably read in many places online that cybercriminals are heavily exploiting the current coronavirus (COVID-19) pandemic to trick users into infecting themselves with malware or steal their personal information. However, in a report published today, Microsoft says that they haven’t seen any noticeable spike in malware activity due to the COVID-19 pandemic. The company […] More

The US Cybersecurity and Infrastructure Security Agency (CISA) has taken the unusual step of removing a bug from its catalog of vulnerabilities that are known to be exploited, and which federal civilian agencies are required to patch within a certain timeframe.  CISA said it is “temporarily removing”  Microsoft’s May 2022 fix for the security bug CVE-2022-26925 from its Known Exploited Vulnerability Catalog. It said after admins apply Microsoft’s May 10, 2022 rollup security fixes to Windows Servers that are used as domain controllers, there is a risk of authentication failures. CISA removed the vulnerability from its must-patch list on Friday. “Microsoft notified CISA of this issue, which is related to how the mapping of certificates to machine accounts is being handled by the domain controller,” it said.”After installing May 10, 2022 rollup update on domain controllers, organizations might experience authentication failures on the server or client for services, such as Network Policy Server (NPS), Routing and Remote access Service (RRAS), Radius, Extensible Authentication Protocol (EAP), and Protected Extensible Authentication Protocol (PEAP),” CISA explained. This issue only affects the update on Windows Servers used as domain controllers. CISA is still strongly encouraging admins to apply Microsoft’s May updates on client Windows devices and non-domain controller Windows Servers.  Microsoft describes CVE-2022-26925 as a Local Security Authority (LSA) Spoofing vulnerability. LSA allows applications to authenticate and log users on to a local system. Details of the bug have been publicly disclosed and exploits exist for it, according to Microsoft.  “An unauthenticated attacker could call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. This security update detects anonymous connection attempts in LSARPC and disallows it,” Microsoft says. The bug would have a severity score of 9.8 when it is chained with NTLM Relay Attacks on Active Directory Certificate Services (AD CS), Microsoft adds. The company noted the May 10, 2022 update addresses the vulnerability on all servers but urged admins to prioritize the update of domain controllers.CISA referred admins to Microsoft’s document KB5014754, which detail “certificate-based authentication changes on Windows domain controllers” concerning the May 10 updates for CVE-2022-26931 and CVE-2022-26923. These were an elevation of privilege vulnerability that can happen when the Kerberos Distribution Center (KDC) is servicing a certificate-based authentication request, according to Microsoft. “Before the May 10, 2022 security update, certificate-based authentication would not account for a dollar sign ($) at the end of a machine name. This allowed related certificates to be emulated (spoofed) in various ways,” Microsoft says.  More

Fuelled by the COVID-19 pandemic, 67% of personal investors in Singapore say they have expanded their cryptocurrency portfolio, which is more likely to include Ethereum. Some 33% in the country, though, have yet to invest in cryptocurrency, with more than half citing a lack of knowledge as the key reason. Amongst those who held cryptocurrencies, 78% said they owned Ethereum while 69% had Bitcoin and 40% carried Cardano, according a survey released Monday that polled 4,348 respondents in Singapore, including 2,862 who said their investment portfolio currently included cryptocurrencies. The study was conducted by cryptocurrency platform Gemini, financial platform Seedly, and cryptocurrency price-monitoring site CoinMarketCap.  Respondents were aged between 18 and 65, with an average household income of SG$$51,968 ($38,467). Half of those who owned cryptocurrencies 25 to 34 years old, while 19.8% were 35 and above.  

Some 67% of respondents who owned personal investment products said they had cryptocurrency in their portfolio. Amongst the remaining 33% who did not, 69% pointed to a lack of knowledge and understanding of digital assets as a barrier. Another 52% cited the market’s volatility as an obstacle, while 29% said they were uncertain how to invest in cryptocurrencies. However, 34% said they planned to purchase their first cryptocurrency in the next year. Some 76.2% would do so if the price was attractive, while 58.6% would buy cryptocurrency if it provided better investor protection.The majority of those who had invested in cryptocurrency, at 81%, said they did so as a long-term investment. Another 58% said they traded cryptocurrencies for profits and 43% tapped such deposits for interest gains. Across all respondents, 59% expressed interest in cryptocurrency investment as a form of decentralised finance, while 41% were keen on its potential for hedging against inflation. 

Some 64% of those who owned cryptocurrencies had at least 5% in their investment portfolio. This portfolio mix increased to more than half amongst 20% of cryptocurrency holders aged between 18 and 24. Another half of respondents between 35 and 44 years owned cryptocurrencies worth at least SG$10,000 ($7,402).In choosing a cryptocurrency exchange, 55% prioritised security while 23% said a regulated exchange or platform were their deciding factors. Another 20% assessed such decisions based on the platform’s service fees. Gemini’s Asia-Pacific managing director Jeremy Ng said: “Similar to the growing momentum in the cryptocurrency industry across the world, we are seeing a growing level of investor interest in Singapore, which is encouraging. This study has underscored that barriers to entry for potential investors still remain. Engagement with, and education of, both the crypto-curious and current investors will be key to tackling the knowledge gap and ensuring that cryptocurrency is accessible to everyone in Singapore.”Seedly’s co-founder and CEO Kenneth Lou also pointed to growing demand for financial literacy in such investments, as cryptocurrency increasingly was “a recognised investment channel”. Australian cryptocurrency exchange, Independent Reserve, early this month said it received an “in-principle approval” letter from Singapore’s industry regulator Monetary Authority of Singapore (MAS) to operate as a licensed provider of digital payment token services, which included cryptocurrencies. Independent Reserve, which established its Singapore operations last year, said it was required to implement controls to ensure “proper due diligence, suitable solicitation, and adequate risk disclosure” to secure the licence as a virtual asset service provider. The exchange has more than 200,000 customers in Singapore, Australia, and New Zealand, and processes Ethereum and Bitcoin amongst other cryptocurrencies on its trading platform. MAS in 2019 said it was assessing plans to allow payment token derivatives, such as Bitcoin and Ethereum, to be traded on local exchanges and for such activities to be regulated. The move was aimed to address international investor interest in cryptocurrencies, it said.The Singapore regulator then had cautioned that payment tokens and their derivatives were not suitable for most retail investors as these tokens typically offered little or no intrinsic value, were difficult to value, and were subjected to high price volatility. It advised retail investors to “exercise extreme caution” when trading in payment tokens and their derivatives.In a written response to parliament in April 2021, Singapore’s Senior Minister and Minister-in-charge of MAS Tharman Shanmugaratnam reiterated that cryptocurrencies were highly volatile because their value typically was not tied to economic fundamentals and, hence, were “highly risky as investment products”. Tharman noted that the risks differed when cryptocurrencies were used for payment purposes, as opposed to securities tokens, and the government’s regulatory approach would be applied accordingly. In another written response to parliament in July 2021, Tharman said MAS was in the “final stages of review” for several licence applications to operate as digital payment token service providers. Assessment criteria included the applicant’s understanding of risks relating to money laundering and financing of terrorism, he said. MAS in 2018 warned eight cryptocurrency exchanges against engaging in unauthorised trading, specifically, those involving securities or futures contracts. It also had repeatedly cautioned the public about the risks of cryptocurrencies and to understand the environment before investing in digital tokens, stressing that these were not recognised as legal tender and functioned in an unregulated environment.RELATED COVERAGE More

President Joe Biden signed a memorandum on Wednesday addressing cybersecurity for critical infrastructure, ordering CISA and NIST to create benchmarks for organizations managing critical infrastructure.The move builds on, and formalizes, an effort started in April around securing industrial control systems, which are now facing a barrage of attacks from both cybercriminals and state-backed entities. In a press briefing, a senior administration official explained that federal cybersecurity regulation in the US is sectoral, noting that the country has “a patchwork of sector-specific statutes that have been adopted piecemeal, typically in response to discrete security threats in particular sectors that gained public attention.” The official added that there is no strategic, coordinated requirement for the cybersecurity of critical infrastructure.  “To the extent, as I noted, there are mandatory cybersecurity requirements. They’re either sector specific — finance and chemical; they’re mandated under state or local law, like electricity ones; or they’re limited and piecemeal — water and bulk electricity are two that we’ve put a lot of work into studying in the last few weeks,” the official said. “So, our current posture is woefully insufficient given the evolving threat we face today. We really kicked the can down the road for a long time. The administration is committed to leveraging every authority we have, though limited, and we’re also open to new approaches, both voluntary and mandatory. Responsible critical infrastructure owners and operators should be following voluntary guidance as well as mandatory requirements in order to ensure that the critical services the American people rely on are protected from cyber threats.”The memorandum formalizes the Industrial Control Systems Cybersecurity Initiative, which the White House said was a “voluntary, collaborative effort between the federal government and the critical infrastructure community to significantly improve the cybersecurity of these critical systems.”

The first part of the initiative started with the electricity subsector, according to a statement from the White House. The pilot will now start a second round on natural gas pipelines. Water systems, as well as wastewater sector systems and the chemical sector will be next. The senior administration officials said the effort has already led to over 150 electricity utilities representing almost 90 million residential customers deploying or agreeing to deploy control system cybersecurity technologies.”These are the technologies that, had they been in place, would have blocked what occurred at Colonial Pipeline in that they connect the operational technology side of the network to the IT side of the network. The action plan for natural gas pipelines is underway, and additional initiatives for other sectors will follow later this year,” the official said. The White House acknowledged that each organization has different cybersecurity needs but it ordered CISA and NIST to work together on creating cybersecurity baselines “that are consistent across all critical infrastructure sectors,” and “security controls for select critical infrastructure that is dependent on control systems.”DHS has until September 22 to release the preliminary guidelines and one year to issue the final draft of the rules. The sector-specific rules will also be released within one year. “These performance goals should serve as clear guidance to owners and operators about cybersecurity practices and postures that the American people can trust and should expect for such essential services,” the memorandum said.  “That effort may also include an examination of whether additional legal authorities would be beneficial to enhancing the cybersecurity of critical infrastructure, which is vital to the American people and the security of our Nation.”A report by cybersecurity researchers at Trend Micro earlier this month warned that ransomware is “a concerning and rapidly evolving threat to industrial control systems endpoints globally” with a significant rise in activity during the past year. Of all countries covered in the report, the US has the most instances of ransomware affecting industrial control systems. The White House said almost 90 percent of critical infrastructure in the US is owned and operated by the private sector.Recent attacks on Colonial Pipeline and meat processor JBS prompted the federal government to get serious about forcing cybersecurity measures on private companies running critical systems. The White House specifically mentioned both ransomware attacks as reasons why more stringent measures were needed.DHS unveiled a new security directive a week ago that forces owners and operators of important pipelines to put tougher cybersecurity protections in place. The memorandum comes one day after Biden caused a minor stir with his comments about the ability of a cyber conflict to turn into a physical war. “You know, we’ve seen how cyber threats, including ransomware attacks, increasingly are able to cause damage and disruption to the real world,” Biden told reporters on Tuesday. “I can’t guarantee this, and you’re as informed as I am, but I think it’s more likely we’re going to end up — well, if we end up in a war, a real shooting war with a major power, it’s going to be as a consequence of a cyber breach of great consequence. And it’s increasing exponentially — the capabilities.” More

Gov.uk Generative AI is growing exponentially, with new developments daily. As a result, safeguards and policies regarding the technology are more necessary than ever. World leaders will gather soon at the AI Seoul Summit to discuss just that.  Also: Despite DALL-E military pitch, OpenAI maintains its tools won’t be used to develop weapons On Friday, […] More