More stories

  • in

    CISA: Here are 66 more security flaws actively being used by hackers – so get patching

    The US Cybersecurity and Infrastructure Security Agency (CISA) has told federal agencies to patch 66 new security bugs based on evidence of active exploitation. These new 66 bugs join a growing list of bugs in the Known Exploited Vulnerabilities Catalog that covers technology typically used in enterprises, such as network security appliances. 

    ZDNet Recommends

    Federal agencies have been given until April 15, 2022 to apply this batch of patches under the Binding Operational Directive aimed at reducing the significant risk of known exploited vulnerabilities. SEE: There’s a critical shortage of women in cybersecurity, and we need to do something about itThe 66 bugs include recent and older flaws in networking kit and security appliances from D-Link, Cisco, Netgear, Citrix, Kuiper, Palo Alto, Sophos, Zyxel, plus enterprise software from Oracle, OpenBSD, VMware and others, as well as multiple Windows bugs.Among the bugs are one affecting Watch Guard’s Firefox and XTM appliances (CVE-2022-26318), one impacting Mitel’s MiCollab, MiVoice Business Express Access Control Vulnerability (CVE-2022-26143), and the Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2022-21999). The Mitel bug was being exploited for the TP240PhoneHome DDoS attack, which was capable of an amplification ratio of 4,294,967,296 to 1. It was observed being exploited in February and March. CISA last month gave agencies two weeks to fix a whopping 95 bugs. Again some were newly exploited while others have had patches available for several years. So, it looks like admins at federal agencies will have yet another busy few weeks finding and then patching systems. As part of its Shields Up initiative, CISA and the White House are encouraging all US organizations to step up patch and check multi-factor authentication configurations due to an increased threat from cyberattacks being directed at them by Russia. More

  • in

    Sophos patches critical remote code execution vulnerability in Firewall

    Sophos has patched a remote code execution (RCE) vulnerability in the Firewall product line. Sophos Firewall is an enterprise cybersecurity solution that can adapt to different networks and environments. Firewall includes TLS and encrypted network traffic inspection, deep packet inspection, sandboxing, intrusion prevention systems (IPSs), and visibility features for detecting suspicious and malicious network activity.

    On March 25, the cybersecurity company disclosed the RCE, which was privately disclosed to Sophos via the firm’s bug bounty program by an external cybersecurity researcher. Sophos offers financial rewards of between $100 and $20,000 for reports. Tracked as CVE-2022-1040 and issued a CVSS score of 9.8 by Sophos as a CNA, the vulnerability impacts Sophos Firewall v18.5 MR3 (18.5.3) and older. According to Sophos’ security advisory, the critical vulnerability is an authentication bypass issue found in the user portal and Webadmin Sophos Firewall access points. While the vulnerability is now patched, Sophos has not provided further technical details. Sophos Firewall users will have received a hotfix, in most cases, to tackle the flaw. So if customers have enabled the automatic installation of hotfix updates, they do not need to take further action. However, if customers are still using older software versions, they may have to update their builds to a newer version to stay protected. There is also a general workaround to mitigate the risk of attacks made through the user portal and Webadmin. Users can disable WAN access to these platforms entirely, and Sophos recommends using a virtual private network (VPN) alongside Sophos Central to improve the security of remote connections. Earlier this month, Sophos resolved CVE-2022-0386 and CVE-2022-0652, two vulnerabilities in Sophos UTM threat management appliance. CVE-2022-0386 is a high-severity post-auth SQL injection vulnerability, whereas CVE-2022-0652 is an insecure access permissions bug. See alsoHave a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • in

    Huawei sees revenue dip 28%, pivots to tap green demand

    Huawei Technologies has reported a 28.56% dip in its revenue last year, which saw a sharp decline in its smartphone business. Embattled amidst ongoing US trade sanctions, the Chinese technology vendor is “readjusting” its business portfolio to tap digitalisation and carbon neutrality opportunities.Its 2021 revenue came in at 636.8 billion yuan ($100.01 billion), down from 891.4 billion yuan in 2020. Its net profits, however, climbed 75.9% to 113.7 billion ($17.86 billion), Huawei said Monday. Cash flow from operating activities grew to 59.7 billion yuan ($9.38 billion).At a media briefing, rotating chairman Guo Ping said its carrier business was “stable” while the enterprise business was seeing “steady growth”. Its consumer business had moved into “new domains”, he said. 

    Huawei CFO Meng Wanzhou, speaking in an official event for the first time since her return from Canada, said at the briefing that the company was “more capable of dealing with uncertainty” on the back of growing profits and cash flows, despite a drop in its 2021 revenue. The announcement confirmed forecast warnings Guo alluded to last December in his new year message to employees. He had pointed to an unpredictable business environment, “politicisation of technology”, and growing deglobalisation as “serious challenges” the company faced. In an email interview with ZDNet, Huawei executives pointed to “a big decline” in its smartphone business as the key factor behind the drop in overall revenue. Huawei’s president of device business Richard Yu said US sanctions would not stop the Chinese vendor from seeking innovation. Noting that these challenging times eventually would pass, Yu said Huawei would continue to drive customer experience around five key areas including smart home, smart mobility, and entertainment. The company in the past year had looked to diversify its product portfolio, as part of efforts to buffer dwindling smartphone sales amidst ongoing US trade bans. Last June, it released an update of its mobile operating system, HarmonyOS 2, across 100 of its devices in China, including smartphones, smart watches, and tablets. Huawei previously tapped Android as the OS for its smartphones, but was forced to look for alternative platforms when US trade sanctions meant Google had to pull back Huawei’s access to its mobile apps and platform. Pulling aside the drop in smartphone sales, Huawei told ZDNet its “+8” device business–comprising connected products–clocked a sales growth of more than 30% last year. This unit encompassed devices such as wearables and smart screens. The company spokesperson added that it also continued to introduce smartphones last year, including its fourth foldable offering Huawei P50 Pocket. According to Huawei, sales outside of China dropped across the board. It noted that overseas sales accounted for more than half of its carrier business revenue last year. Its increase in net profits was fuelled by the sale of its Honor and server businesses, though, Huawei told ZDNet profits were in part driven by “improved product portfolios” and greater efficiencies from its operations. The vendor reportedly sold its x86 server business, also due to the US trade sanctions, to Henan Information Industry Investment last November.When asked, Huawei declined to provide details, including actual net profits, around the sale of its Honor and server businesses. The company spokesperson, however, noted that its 2021 net profits excluding sales proceeds from the two businesses still were higher than that of 2020. Elaborating on its “improved product offerings”, the Chinese tech giant said it had pumped more investment into its software business and established “domain-specific subsidiaries”, such as its digital power business. Internal teams, including in coal mining and transport, also were integrated to streamline management chains and speed up response to customers’ needs. Huawei further noted that its enterprise business grew last year, with new business segments that included cloud and digital power registering more than 30% growth. While asked, the vendor said it did not separate revenue figures for its cloud and digital power businesses.According to Huawei’s cloud CEO Zhang Pingan, its cloud unit had a network of more than 2.3 million developers, 14,000 consulting partners, and 6,000 technology partners. Collectively, they supported more than 4,500 cloud products. Huawei currently operates 61 availability zones across 27 regions, comprising 170 markets. Its digital power business currently runs 12 research centres in various sites in China, Asia-Pacific, and Europe. Huawei’s rotating chairman Eric Xu said: “When we decided to expand new business domains, we had already fully assessed our ability to secure chip supplies. If we did not feel we could solve this problem, we wouldn’t have made such decisions in the first place.”Pivoting to move with carbon neutrality trendsThe company spokesperson told ZDNet that Huawei would continue to “readjust” its business portfolio in line with digitalisation and carbon neutrality developments, so it could meet customer requirements. “We will focus on connectivity, computing, devices, intelligent automotive components, cloud, and digital power, and work to create thriving OpenHarmony, openEuler, and MindSpore ecosystems,” he said, adding that it would work with partners to deliver these offerings to customers. The Chinese vendor also would invest in three key areas around system architecture optimisation, software performance improvement, and “theoretical exploration”. Specifically, it would seek out breakthroughs in technologies that it had difficulty accessing, the spokesperson said.Noting that it had been denied access to advanced process techniques due to the trade sanctions, Huawei said it would invest more heavily in refactoring basic scientific theory, architecture, and software. These included applying photonic and electronic synergy to communications systems, designing peer-to-peer architectures, and driving higher performance and scalability in software. Such new theories and technologies could include next-generation MIMO (multiple input/output) and wireless artificial intelligence (AI).In particular, it aimed to hit or exceed Shannon’s Limit, which referred to the highest rate of error-free data that could be theoretically transmitted over a communication channel, taking into consideration random transfer error and noise levels. Huawei CEO Ren Zhengfei noted that it was investing in 6G research and targeting patents in the next-generation cellular technology. “We must not wait until 6G becomes viable, as waiting would impose constraints on us due to a lack of patents,” Ren said. The company runs 86 technology labs worldwide as well as 23 research and development (R&D) facilities in Europe. It declined to reveal how many R&D centres it had globally. It said its R&D and product reengineering investment climbed by 30% year-on-year. Huawei said it spent 142.7 billion yuan ($22.41 billion) on R&D last year, which accounted for 22.4% of its overall revenue and pushed its 10-year expenditure to 845 billion yuan.  RELATED COVERAGE More

  • in

    Chrome and Edge hit with V8 type confusion vulnerability with in-the-wild exploit

    Image: slyellow/Shutterstock
    Google is urging users on Windows, macOS, and Linux to update Chrome builds to version 99.0.4844.84, following the discovery of a vulnerability that has an exploit in the wild. Due to the this, the browser maker is being tight lipped on details. “CVE-2022-1096: Type Confusion in V8. Reported by anonymous on 2022-03-23,” was as far as Google would explain the issue. V8 is Chrome’s JavaScript engine — it is also used server-side in Node.js, but has not yet said it is impacted. Google added that bug details would be restricted until a majority of users had updated the browser. “We will also retain restrictions if the bug exists in a third-party library that other projects similarly depend on, but haven’t yet fixed,” it said on Friday. A day later, Microsoft issued its own notice and said the issue was fixed in Edge version 99.0.1150.55 released the same day. At the start of the month, Google said it was seeing more Chrome zero-day flaws in the wild. Related Coverage More

  • in

    Kaspersky blacklisted by FCC alongside China Telecom and China Mobile

    Image: Getty Images
    The US Federal Communications Commission (FCC) has added Kaspersky to the country’s entity list, along with China Telecom and China Mobile. First reported by Bloomberg, the Kaspersky addition marks the first time a Russian company has been added to the list. Prior to the latest update to the entity list, the list comprised only of Chinese companies.Companies placed on the entity list are banned from buying parts and components from US companies without government approval.The FCC said it placed the three companies onto the list as it found they all posed national security risks. “I am pleased that our national security agencies agreed with my assessment that China Mobile and China Telecom appeared to meet the threshold necessary to add these entities to our list. Their addition, as well as Kaspersky Labs, will help secure our networks from threats posed by Chinese and Russian state-backed entities seeking to engage in espionage and otherwise harm America’s interests,” said Brandan Carr, FCC commissioner. In response to being placed on the entity list, Kaspersky, in a statement, accused the US agency of making that decision based on political grounds. “This decision is not based on any technical assessment of Kaspersky products — that the company continuously advocates for – but instead is being made on political grounds,” Kaspersky said. “Kaspersky will continue to assure its partners and customers on the quality and integrity of its products, and remains ready to cooperate with US government agencies to address the FCC’s and any other regulatory agency’s concerns.” Kaspersky’s response mirrors a similar complaint it made against Germany’s Federal Office for Information Security, which recently issued an advisory warning people to avoid using Kaspersky’s products and services. In Kaspersky’s complaint against the German regulator, the company said the advisory was made on political grounds too. Prior to being on the US entity list, the US government in 2017 had already banned the use of Kaspersky products and services by federal entities and contractors. For China Telecom and China Mobile, their additions to the entity list come as no surprise as the two telcos were already booted off the New York Stock Exchange by the US Treasury Department at the start of last year. The FCC in October also ordered the removal of China Telecom’s authority to operate in the US.Related Coverage More

  • in

    Domino's upgrades store network ahead of more online orders and drone-delivered pizzas

    Image: Domino’s
    Online orders accounted for nearly 80% of Domino’s total global sales during the 2022 half-year financial results — and the company only expects this number to grow further. Domino’s, which operates in 10 markets globally, has signed a deal with Macquarie Telecom to roll out NBN, VoIP, and SD-WAN with 4G back-up services to more than 720 Domino’s stores across Australia to accommodate for the expected continued growth online. “We want a telco infrastructure solution that’s going to be capable not just for now, with a large percentage of online sales … [but] will grow to the future, that will be reliable for up and downstream for data, and also smarter stores be it technology in-store or out of store that needs to return to base,” Domino’s group chief digital and experience officer Michael Gillespie told ZDNet.The upgrade has been rolled out at 400 sites within five months, with the remaining 320 sites expected to be completed in the next four months. The decision by Domino’s to upgrade its network is also ahead of potential plans by the pizza delivery company to bring drone deliveries to Australia. “We’re not just investing for a telco solution now; we’re looking at the future. We obviously know with a clearer picture where we’re heading … and we’re validating that what we’re doing is allowing a more convenient store over time,” Gillespie said.This year, the company said it will be relaunching trials in New Zealand in partnership with SkyDrop, formerly known as Flirtey. The pair first teamed up in 2016 and completed what they claimed was a world-first pizza drone delivery. “Working with Flirtey, and now SkyDrop, we realised we practically could deliver [using drones] but the actual volume we could deliver in size of order, compared to what the consumers were ordering and moving to in New Zealand, there was a discrepancy,” Gillespie said.”So, we needed to go back and say, okay, how can we work with them on a drone that can carry more and have a few other advances to get a higher commercial volume.”We’ve let SkyDrop do what they do best and now they’ve returned with us to say we’re going to get back into trialling in New Zealand. That’s an exciting message and shows that what we’re doing in this space really is a focus, but we’re not going to do it without the opportunity of validating, ‘Can we get to scale?’.” Gillespie believes that using drone deliveries would complement the company’s existing delivery services. “Sometimes there is a volume of orders that just surpasses what we can even hire to do at the moment. Also, there’s a distance for some customers that we can’t [get to]; we’re all about getting hot, fresh pizza, so can we go further and reach locations which just don’t make sense for the driver to drive to or for the customer because it’ll be a diminished product that is not satisfactory, so robotic delivery comes into that,” he said. Improving the company’s digital connectivity is also expected to underpin the company’s plans to introduce more technologies in-store, and upcoming revamp of its online ordering system that Gillespie described will be “slicker and faster”, featuring service enhancements relating to features such as its e-commerce shopping basket.Related Coverage More

  • in

    UK police arrest seven individuals suspected of being hacking group members

    UK law enforcement has made a spate of arrests in connection to an unnamed hacking group. 

    Detective Inspector Michael O’Sullivan, from the City of London Police, said in a statement that the law enforcement agencies and its partners have been conducting an investigation into a cybercriminal outfit, leading to seven arrests. Seven teenagers between the ages of 16 and 21 years old have been arrested.  According to O’Sullivan, they have been “arrested in connection with this investigation and have all been released under investigation.” The City of London Police did not formally name the hacking group or provide any further detail concerning the inquiry.   On Wednesday, the BBC reported that a 16-year-old teenager from Oxford, who used the “White” and “Breachbase” aliases online, was accused of being affiliated to the Lapsus$ hacking group. White has been tracked for over a year and was reportedly doxxed online after falling out with others involved in the underground, leading to the leak of his personal information.  Law enforcement has not commented on whether the teenager is among those arrested.  Lapsus$ has rapidly risen through the cybercriminal ranks in recent months, claiming high-profile organizations as victims.  See also: Who are the Lapsus$ hackers and what do they want? This week, Okta and its subprocessor Sitel admitted to a security breach in January following the leak of ‘evidence’ screenshots by Lapsus$. The incident has impacted up to 366 customers.  Microsoft also confirmed Lapsus$ compromise on Wednesday after the group was able to maliciously infiltrate a “limited” account. However, the Redmond giant has not confirmed the validity of a torrent released by the hacking group, allegedly containing source code from Bing, Bing Maps, and Cortona. In other security news this week, four Russian nationals have been indicted by US law enforcement for their alleged participation in cyberattacks against critical infrastructure, made by the DragonFly and Triton hacking groups.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • in

    These fake crypto wallets want to steal from iPhone and Android users

    Cyber criminals are attempting to stealing cryptocurrency from Android and iPhone users by luring them into downloading malicious apps posing as cryptocurrency wallet services. Cybersecurity researchers at ESET have identified over 40 copycat websites designed to look like those of popular cryptocurrency websites, but which actually trick users into downloading fake versions of the apps containing trojan malware. New cryptocurrency users appear to be targeted in particular. The websites are specifically designed to target mobile users and lure them into downloading the malware.  The attackers use online advertising, posted to legitimate cryptocurrency and blockchain related websites, to direct traffic to the malicious cryptocurrency wallet downloads. Those behind the attacks – who researchers note communicate in Chinese – also use messaging app Telegram to search for affiliates to help spread the malware, with some of these links also being shared in Facebook groups, complete with step-by-step video tutorials on how the fake wallets work and how to steal cryptocurrency from victims. Affiliates who help distribute the malware can be offered as much as 50% commission on the stolen contents of cryptocurrency wallets which are successfully compromised. The malware works differently depending on whether the victim is an iOS or Android user. On Android it appears to target new cryptocurrency users who do not yet have a legitimate wallet application installed because it’s not possible for the malware to overwrite any existing apps on the device because of Android security protocols.  However, on iOS it’s possible for the victim to have both a real app and the fake one installed, so more experienced cryptocurrency enthusiasts could potentially be targeted too, even though in both cases its somewhat cumbersome to download these fake wallets.SEE: How to keep your bank details and finances more secure onlineFor Android users, the fake cryptocurrency websites invite the user to ‘Download from Google Play’ although it actually downloads from the fake site’s server. Once downloaded the app needs to be manually installed by the user. While many of these apps came from third-party sites, ESET researchers say that 13 malicious apps related to the campaign were removed from the Google Play store itself in January.  It’s not possible for attackers to upload the malicious apps to Apple’s App Store, so instead they’re sending potential victims to third-party websites for the downloads. In order to make sure that the malicious apps are successfully installed, alerts and notifications are used to encourage the user to bypass iPhone’s default protections and install unverified apps. Whether it’s on Apple or Android, once installed the malware behaves like a fully working cryptocurrency wallet, undisguisable from the real apps.  By inserting malicious code into the app, the attackers can manipulate the content of the app as if it was their own – meaning they can drain the cryptocurrency from the wallet, without the user knowing. It’s believed that the cryptocurrency-stealing campaign remains active. To avoid falling victim to attacks, it’s recommended that users only download apps from trusted, official sources as these are most likely to be secure, legitimate apps. It’s also recommended that users install anti-virus software on their smartphone to help detect malicious apps and links.  “We would like to appeal to the cryptocurrency community, mainly newcomers, to stay vigilant and use only official mobile wallets and exchange apps, downloaded from official app stores that are explicitly linked to the official websites of such services, and to remind iOS device users of the dangers of accepting configuration profiles from anything but the most trustworthy of sources,” said Lukáš Štefanko, ESET researcher. For users who suspect they may have downloaded a malicious app, researchers urge them to immediately create a brand-new wallet with a trusted device and application and transfer all funds to it, so attackers can’t come back and steal it.  MORE ON CYBERSECURITY More