Eliana Willis

More stories

  • 113 Shares179 Views

    in Information Technology

    Nearly one million credit cards offered on underground forum

    Researchers with D3Lab have discovered the data of almost one million credit card holders being sold on an underground forum, according to a blog post released this week. In a sample of 980,930 files acquired by D3Lab analysts on Monday, the batch contained names, addresses, credit card numbers, expirations and CVVs. About 30,000 entries in the data set came from people living in Italy, based on identifications tied to the stolen cards. D3Lab analysts found the information on a carding database called All World Cards. 
    D3Lab
    All World Cards is a haven for online credit card thieves involved in things like magecart attacks, information stealing malware and point-of-sale attacks. D3Lab noted in their report that carding sites generally get most of their stolen credit cards from point-of-sale attacks at gas stations, supermarkets and some e-commerce sites. The report found that the people behind All World Cards have been marketing their site and services since June and may have purchased stolen credit card data and shared it for free “to entice other criminal actors to frequent their site.”The domain for allworld [.] Cards was created in May and the site now has 2,634,615 stolen credit cards, with more than 1 million coming from the US. 

    After examining the data, D3Lab researchers sent the information to the banks represented in the leak so that the cards could be cancelled and users could be notified. Half of the cards in the batch are still operational, according to D3Lab. With the help of a BIN database, the researchers managed to verify the stolen records and figure out the companies, issuers and other data on the victims. Of the 980,930 stolen cards, 98% had a valid BIN associated with an emitter, according to D3Lab, while nearly every card came from either Visa or Mastercard.More than 75% of the cards were debit cards and 24% were Gold, Business or Titanium cards. India was the most represented country in the batch, with 20% of cards coming from the country followed by Mexico and the US with 9%. About 4% came from Italy as well. Javvad Malik, security awareness advocate at KnowBe4, told ZDNet that the cards were stolen between 2018 and 2019, making it difficult to determine where the data came from or if it came from multiple sources. Carding has become a lucrative avenue for cybercriminals, explained PerimeterX senior director Uriel Maimon. Attackers use bots to test lists of recently stolen credit card and debit card details on merchant sites. The carders then use the proven credit card details to directly retrieve funds from associated accounts or to purchase gift cards which can easily be converted into high-value goods, such as cell phones, televisions and computers, Maimon explained. “These goods are then resold — often via ecommerce sites offering a degree of anonymity — for a profit. As these cards were stolen between 2018-2019, it stands to reason that most are no longer valid, especially if they’re publicly dumped and multiple actors will jump on them at the same time.” In December 2020, the FBI and Interpol seized four domains operated by Joker’s Stash, the internet’s largest marketplace for buying and selling stolen card data. The site announced it was officially shutting down in February. BleepingComputer noted that cybersecurity company Cyble imported the stolen data into their AmIBreached service, so people can check if their credit card information was involved.  More

  • 113 Shares139 Views

    in Networking

    Extreme Networks acquires Ipanema from Infovista for SD-WAN, SASE

    Extreme Networks has announced its intent to acquire Ipanema Technologies, the SD-WAN (software-defined wide area network) and SASE (secure-access service edge) division of Infovista. France-based Infovista, which had already had a major stake in the ground as a service assurance company, acquired Ipanema in 2015, well before SD-WAN went mainstream a couple of years ago. Extreme will purchase Ipanema for 60 million Euros (approximately $73 million) in an all-cash transaction. The deal is expected to close in October, pending regulatory approval. Since Infovista is privately held, revenue numbers for the Infovista division are not readily known. I know that pre-pandemic, Ipanema revenue was about 40 million Euros annually but had fallen to 30 million and was probably sliding to the 20 million level. If that’s the case, the 60 million Euro purchase price is a steal and fits the mold of other Extreme acquisitions, because it is a top-tier technology that’s effectively a stranded asset inside a larger organization where it doesn’t fit. Extreme makes another strategic acquisition to fuel its businessExtreme’s addition of the WiFi business at Motorola, Avaya’s network business, and Brocade’s Ethernet products, are other examples of how the company rolls. COO Norman Rice has a knack of finding these diamonds in the rough and has used acquisitions like these to fuel the resurgence of the company. The network vendor is now past $1 billion in revenue and has become a Gartner Magic Quadrant Leader, which is impressive given the company’s bumpy past. The purchase of Ipanema is yet another example of how the company will use a modest investment to fuel another wave of growth. Ipanema isn’t the most well-known SD-WAN company, but its technology is very good. However, Infovista was not willing to make investments in the areas of sales and marketing. The company was founded in 1999 as a WAN optimization vendor, which competed with the likes of Riverbed and Packeteer. I had many engagements with Ipanema customers, and they raved about how good the tech was. Evidence of this? The company was a perennial Gartner MQ Leader for years, and this solid foundation is what it used to build its SD-WAN portfolio. More recently, the company partnered with Equinix and CheckPoint to develop a full cloud-native SD-WAN and SASE platform. This new product shifts SD-WAN to an on-demand service that can be scaled up and down like other cloud services. Ipanema has solid SD-WAN and SASE technology With this big product investment, one might wonder why sell Ipanema? The answer is focus. In a media advisory, Infovista stated: “The planned transaction is part of Infovista’s strategic transformation as it sharpens its focus on delivering its cloud-native lifecycle automation platform.” SD-WAN and SASE do not fit into that strategy. From my dealings with Infovista, this is the right move, because they should focus on service providers. The company doesn’t understand how to sell to businesses or the importance of investing in sales and marketing. Despite having a strong product, they were getting drowned in an ocean of other companies that were far better in those areas. Thus Infovista fell behind.

    I expect Extreme to do big things with the Ipanema product. The investments that Infovista made in developing the cloud-native platform align nicely to Extreme’s cloud-first approach. In the short term, it’s strong enough for Extreme to sell as a standalone product, but the company does expect to have the technology integrated into its ExtremeCloud platform within a year. This also will enable Extreme to bring its AI capabilities to SD-WAN and SASE, which should add significant value to Ipanema customers. This also boosts Extreme’s total addressable market, because the combined SASE-plus-SD-WAN market could be as big as $20 billion in five years. Ipanema is well aligned with Extreme’s Infinite Enterprise VisionThe acquisition is also well aligned with Extreme’s strategy of the Infinite Enterprise, where connectivity needs to reach anywhere a worker is located. Before Ipanema, Extreme didn’t have the products to reach branch offices and home workers at scale. While there were other SD-WAN and/or SASE vendors Extreme could have purchased, I believe it was the strong cloud back end that made Ipanema so attractive. Its cloud-native software delivery platform now makes this possible and gives Extreme products that span WAN, LAN, data center, and campus–all of which can be managed via the cloud. Extreme will use Ipanema to establish a second technology innovation center in Europe. This will strengthen Extreme’s European footprint and bring into the company several service providers and managed service partners–including a couple of behemoths such as British Telecom and Orange, the enterprise division of France Telecom. More

  • 113 Shares159 Views

    in Information Technology

    McAfee adds over half a million subscribers in Q2

    Security company McAfee on Tuesday published second quarter financial results, adding more than half a million core Direct to Consumer subscribers in the quarter. Second quarter diluted earnings, including both continuing and discontinued operations, came to 21 cents per share. Net revenue was $467 million, reflecting growth of 22 percent year-over-year. Analysts were expecting earnings of 18 cents per share on revenue $433.99 million.”We are very pleased with our team’s execution this quarter,” said Peter Leav, McAfee’s President and Chief Executive Officer.  “Not only did McAfee deliver another solid quarter with revenue, DTC subscribers, profitability and cash flow from operations growing double-digits, but did so while simultaneously closing the transaction to sell the Enterprise Business…  We look forward to continuing our journey as a pure-play consumer business.”McAfee in Q2 completed the sale of its Enterprise Business for $4 billion in cash. Meanwhile, it added 556,000 DTC subscribers, bringing its total number of subscribers to 19.4 million. A year earlier, the company had 16.6 million core DTC subscribers. McAfee also in Q2 signed a multi-year extended agreement with Samsung to deliver consumer security solutions to Samsung device users.For the third quarter, McAfee expects revenue between $461 million and $467 million.

    Tech Earnings More

  • 175 Shares99 Views

    in Information Technology

    Microsoft's August 2021 Patch Tuesday: 44 flaws fixed, seven critical including Print Spooler vulnerability

    Microsoft has released 44 security fixes for August’s Patch Tuesday, with seven of the vulnerabilities being rated critical. There were three zero days included in the release and 37 were rated as important. 

    ZDNet Recommends

    Thirteen of the patches involved a remote code execution vulnerability while another eight revolved around information disclosure. The affected tools included .NET Core & Visual Studio, ASP.NET Core & Visual Studio, Azure, Windows Update, Windows Print Spooler Components, Windows Media, Windows Defender, Remote Desktop Client, Microsoft Dynamics, Microsoft Edge (Chromium-based), Microsoft Office, Microsoft Office Word, Microsoft Office SharePoint and more.One of the most prominent patches released in the latest batch covers the Windows Print Spooler Remote Code Execution vulnerability, which has been a major topic of discussion since it was discovered in June. Microsoft also faced backlash from the security community for bungling the release of patches meant to address the issue. The fixed zero day bugs include:The Windows Update Medic Service Elevation of Privilege vulnerability is the only one that has been exploited in the wild, according to Microsoft’s report, but they do not explain how, where, or by whom. Security expert Allan Liska said CVE-2021-36948 stood out to him because of its similarities to CVE-2020-17070, which was published in November 2020.

    “Obviously, it is bad that it is being exploited in the wild, but we saw almost the exact same vulnerability in November of 2020 but I can’t find any evidence that that was exploited in the wild,” Liska said. “So, I wonder if this is a new focus for threat actors.”Liska added that CVE-2021-26424 is a vulnerability to keep and eye on because its a Windows TCP/IP Remote Code Execution vulnerability impacting Windows 7 through 10 and Windows Server 2008 through 2019.”While this vulnerability is not listed as publicly disclosed or exploited in the wild, Microsoft did label this as ‘Exploitation More Likely’ meaning that exploitation is relatively trivial. Vulnerabilities in the TCP/IP stack can be tricky. There was a lot of concern earlier this year around CVE-2021-24074, a similar vulnerability, but that has not been exploited in the wild,” Liska explained. “On the other hand, last year’s CVE-2020-16898, another similar vulnerability, has been exploited in the wild.” The LSA spoofing vulnerability is related to an advisory Microsoft sent out late last month about how to protect Windows domain controllers and other Windows servers from the NTLM Relay Attack known as PetitPotam.Discovered in July by French researcher Gilles Lionel, the PetitPotam take on the NTLM Relay attack can “coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw function.” It was never found to have been exploited. The Zero Day Initiative noted that Adobe also released two patches addressing 29 CVEs in Adobe Connect and Magento. ZDI said it submitted eight of the bugs in the recent Microsoft report and explained that this is the smallest number of patches released by Microsoft since December 2019. They attributed the decline to resource constraints considering Microsoft devoted extensive time in July responding to events like PrintNightmare and PetitPotam.”Looking at the remaining Critical-rated updates, most are of the browse-and-own variety, meaning an attacker would need to convince a user to browse to a specially crafted website with an affected system,” ZDI said.”One exception would be CVE-2021-26432, which is a patch for the Windows Services for NFS ONCRPC XDR Driver. Microsoft provides no information on how the CVSS 9.8 rated vulnerability could be exploited, but it does note that it needs neither privileges or user interaction to be exploited.”The next Patch Tuesday is September 14.  More

  • 113 Shares169 Views

    in Networking

    Microsoft acquires Peer5 to supplement Teams' live video streaming

    Credit: Microsoft
    Microsoft has acquired Peer5, a WebRTC-based electronic content-delivery-network (eCDN) vendor, for an undisclosed amount. Microsoft announced the Peer5 purchase on August 10. Peer5’s technology will be used to enhance live video streaming in Microsoft Teams, Microsoft officials said. Peer5’s current product runs in browsers to optimize bandwidth usage for line-of-business applications, Microsoft officials said, and its mesh networks can automatically scale as the number of viewers increases. Peer5’s technology doesn’t require additional installation on user endpoints or any changes to physical network infrastructure, officials added. While the addition of the Peer5 solution will give Microsoft its own, first-party product in this space, Microsoft will continue to support other eCDN solutions from Microsoft certified partners, officials said. Current Peer5 customers will be able to continue using their existing Peer5 services, they said.Peer5 has been touting its “seamless integration” with Microsoft’s Teams, Stream and Yammer products on its site. It also has offered legacy support for IE and live and video-on-demand support for Office 365.  Peer5, founded in 2012, has offices in Palo Alto, Calif. and Tel Aviv. According to its web site, the company’s staff has experience in big-data analytics, virtualization and networking. The company is active in the WebRTC space and a member of the W3C steering committee. More

  • 125 Shares189 Views

    in Robotics

    3D capture for construction is like SimCity (but for real)

    Buildots
    Last year we floated the idea of moving construction workers (or at least a portion of on-site workers) to remote work arrangements. On the heels of recent announcements, competing firms Buildots and OpenSpace are pushing that scenario closer to reality with their 360° video capture solutions for construction. Construction accounts for 13% of the world’s GDP, but while other traditional industries, like manufacturing, have increased productivity over the years, productivity has remained almost stagnant in the building sector. According to the European Commission, construction productivity has only increased by 1% in the past two decades. And with operational profitability often being only 5%, there is little room for error. That’s one reason development dollars are pouring into the space. Automated documentation platforms, which stitch together captured images in a digital replica of physical spaces, are fast becoming key tools for inspection and project management, including in construction. The idea is that construction workers snap a small camera to their hardhat before walking the site. The images are organized and stitched together in the cloud, creating a living model of a job’s progress.Buildots, an AI construction tech company, recently announced a $30 million Series B round led by Lightspeed Ventures with the participation of previous investors. Buildots’ AI algorithms automatically validate images captured by hardhat-mounted 360° cameras, detecting gaps between the original design, scheduling, and the construction site’s reality.In what might read as something of a counterpunch, OpenSpace, which makes a similar platform, recently released OpenSpace Basic to qualified builders for free.”Over the past year, we’ve heard from builders that they wanted to have more access to the automated convenience of our standard video site capture product, which inspired us to create OpenSpace Basic,” says Jeevan Kalanithi, CEO and co-founder of OpenSpace. “OpenSpace Basic is a big jump forward from our earlier free products. We firmly believe that automated site documentation will be as ubiquitous on construction sites as a nail gun or ladder, so we want to make our platform available to as many builders as possible today.”The free debut of the technology tracks a larger trend of digitization on the job site.

    “Even prior to the current pandemic,” Kalanithi told us last year, “we were beginning to see wider adoption of digital tools on job sites, including those that enable remote work, like photo documentation. The situation we’re in now will likely lead to an acceleration in the adoption of these types of technologies, but this is the direction that the industry was heading in regardless.”Similar technologies have made their way into the construction industry from firms like HoloBuilder, Matterport, and Drone Deploy, part of a wave of 3D mapping firms that are applying the technology to an array of industries and sectors.”When it comes to digital transformation, construction has been a sleeping giant and COVID-19 served as an accelerator for the industry,” said Roy Danon, co-founder and CEO of Buildots. “We are now working with construction companies in over a dozen countries, and what we’re seeing is that the challenges Buildots is addressing are ubiquitous around the world. A global expansion at the rate we’ve experienced would have ordinarily been impossible in an industry like construction that has its roots in handshake deals and in-person relationships without the new covid reality of remote meetings and even deal signings.”  More

  • 100 Shares129 Views

    in Information Technology

    ExpressVPN vs. Surfshark vs. NordVPN: Which is best?

    When choosing a VPN, you’ve got an insane amount of choices. In our best of guide and speed test guide, we’ve narrowed down the list from the wide array of branded commercial options out there to about 10. But that is still a lot to dig through. Which do you choose? In this article, we’ve taken three of our top choices — ExpressVPN, Surfshark, and NordVPN — and compared their characteristics. This isn’t a one-size-fits-all competition. You’ll need to decide which factors matter most to you, and from that, you can choose which product you want to test out. Keep in mind that all three products offer trial periods. We strongly encourage you to take advantage of that period to see which performs best in all of the likely situations where you’ll be using a VPN. And with that, let’s dive in.

    Surfshark wins, ExpressVPN implodes

    Winner: SurfsharkVPN providers are always tinkering with their pricing, so these numbers are bound to change.That said, Surfshark is the least expensive, by quite a lot. Surfshark’s best deal is what they tout as $2.49 a month plan (you’ll really be paying $59.76 now for two years of service). Nord is asking for $3.67 (or a wallet hit of $89 on signup for two years of service).ExpressVPN’s best deal is what they tout as $6.67 a month (you’ll really be paying $99.95 now for 15 months of service). After that 15 months, you’ll be charged $99.95 every 12 months, so the per-month price is essentially going up about a buck and a half after that first year. If you want two years of service, you’ll be paying $59.76 for Surfshark, $89 for NordVPN, and $150 ($99 for the first 15 months, plus half of $99 for the next 12) for ExpressVPN.Surfshark definitively wins this round by allowing you to run an unlimited number of devices with its Surfshark VPN service, while Nord permits just six six simultaneous connections. And ExpressVPN gives you even less for it’s much more expensive price: just five simultaneous connections.At least all offer a 30-day money-back guarantee.

    NordVPN wins by a hair, Surfshark loses by a mile

    (Image: ZDNet/David Gewirtz)

    Winner: NordVPNIn our fastest VPN guide, we took a look at both our own in-house tests and how the Internet overall rated open VPNs. We compared VPN rankings in speed tests from 10 sites besides ZDNet. Of potentially more interest, we compared the standard deviation of those rankings, which helps us determine whether a given VPN has a consistent ranking all across the internet, or different reviewers got wildly different numbers.As the above slide shows, NordVPN not only had a better aggregate average ranking but a considerably lower standard deviation than either of the other two players. This means that pretty much wherever you are, your NordVPN performance should be pretty good. ExpressVPN gave NordVPN a run for its money. While ExpressVPN’s aggregate speed didn’t quite match Nord’s it was in the ballpark. Likewise, its standard deviation was a bit more wobbly, meaning it was a tad bit less consistent than Nord. But, honestly, either choice would be a win from a speed perspective.By contrast, Surfshark is both slower and considerably less predictable. While Nord and VPN are running pretty much neck and neck, the definitive loser here is Surfshark.

    ExpressVPN wins

    Winner: ExpressVPNAll three VPN players support the big four: iOS, Android, Mac, and Windows.ExpressVPN also supports Linux, routers, and Kindle Fire. It supports Xbox, Playstation, and the Nintendo Switch as well as browsers Chrome, Edge, and Firefox. When it comes to TV support, ExpressVPN lists Apple TV, Amazon FireTV, Samsung, Roku, Nvidia Shield, Chromecast, LG Smart TVs, Android TV, and others that require more of a manual setup process. Additionally, it offers setup instructions for Synology and QNAP NAS appliances.In addition to its big four clients, NordVPN lists Android TV, Linux, and Chrome and Firefox extensions on its download page, but has a support page for installing NordVPN on other platforms, including routers, Raspberry Pi, and NAS boxes including Synology, Western Digital My Cloud, and QNAP.Besides iOS, Android, Mac, and Windows, Surfshark also supports Linux, FireTV, Apple TV/iPhone, and what it calls “other TVs.” It supports Xbox and Playstation as well as browsers Chrome and Firefox.The fact is, all three products support a reasonably wide range of devices, but we have to give the win to ExpressVPN. You can keep digging down in the support pages and there are more and more devices with install tutorials, the deeper you dig.

    Three-way tie

    Winner: ExpressVPN, Surfshark, and NordVPNI always like to make sure this point is stressed in all my VPN coverage: if you’re counting on a VPN for your physical freedom or to protect your life, it’s important that you do a lot more research than just reading an article like this. With that said, let’s look at the overall security profile for these three vendors.NordVPN has got a lot of mileage out of its Panamanian corporate registration, claiming that Panama puts its records out of the legal reach of governments and lawyers. As I discussed in great depth in my analysis of NordSec, it’s possible that countries with Mutual Legal Assistance Treaties (MLAT) may well be able to pierce the corporate veil.Although I didn’t do as deep an in-depth analysis of ExpressVPN, the company has similar claims and limits as Nord. ExpressVPN lists its registry in the British Virgin Islands but is a company with developers based in many MLAT countries as well.Surfshark also has the same basic claims and limits as Nord. Surfshark lists its registry in the British Virgin Islands, but like Nord and ExpressVPN, it’s a company with developers based in many MLAT countries as well. Surfshark boasts a private DNS service among its advanced features so you can be protected even while using public Wi-Fi whether you’re in Australia, Hong Kong, the Netherlands, the USA, or anywhere in between. Surfshark also says it passed the German company Cure53’s security audit and offers uncrackable AES-256 bit encryption alongside its strict no-logs policy, but the German audit was limited to Surfshark’s browser extensions.All three vendors tout a no-logs policy. All three say they don’t capture VPN connection time stamps, used bandwidth, traffic logs, IP addresses, or browsing data but there are some nuances here. NordVPN says it doesn’t track used bandwidth, while ExpressVPN says it tracks the total amount of daily data transmitted each day. ExpressVPN also tracks the location of VPN servers you connect to. That’s not good, because it means they can tell where your connection originated from (or at least the country) and where you’re trying to connect to. All three offer warrant canaries. All three also capture email addresses and billing information. NordVPN says it doesn’t track used bandwidth, while ExpressVPN says it tracks total amount of daily data transmitted each day. ExpressVPN also tracks the location of VPN servers you connect to. That’s not good, because it means they can tell where your connection originated from (or at least the country) and where you’re trying to connect to.All three accept cryptocurrencies. This makes it safer to use apps such as PayPal and use your credit card without having fear of security breaches. ExpressVPN says it tracks the total amount of daily data transmitted each day. ExpressVPN also tracks the location of VPN servers you connect to. That’s not good, because it means they can tell where your connection originated from (or at least the country) and where you’re trying to connect to.So, which is more secure? Honestly, they’re very close. We probably wouldn’t feel comfortable putting our lives in the hands of any of these three companies (not that they’re doing anything wrong, but just because it’s a scary concept), but we’d certainly feel reasonably comfortable letting them protect our Wi-Fi surfing when out and about.

    NordVPN and Surfshark tie

    Winner: NordVPN and SurfsharkAll three vendors offer a kill switch, which we consider table stakes in terms of VPN special features.Both Nord and Express offer split tunneling, allowing you to channel some traffic through the VPN and the rest through your local connection without VPN interference.Surfshark offers a multi-hop connection, which is similar to NordVPN’s feature causing your IP address to change twice before reaching the destination VPN server.ExpressVPN says it’s running a private DNS, but any VPN provider is going to need to do domain name resolving. So while other vendors don’t list “Private DNS” as a feature, they all need to be running a DNS as a consequence of their role in packet forwarding.Surfshark and NordVPN support P2P, allowing you to torrent your favorite Linux distros (and possibly other digital sharing activities of dubious legality, which we categorically do not recommend). ExpressVPN makes no mention of P2P.NordVPN has a few interesting features not provided by either ExpressVPN or Surfshark. NordVPN also provides Onion Over VPN, which allows you to use both the Onion anonymizer and Nord’s VPN together. NordVPN also allows you to buy a dedicated IP address, which can help if you’re dealing with anonymous servers or gaming connections. NordVPN also offers business plans.NordVPN and Surfshark offer malware and adware filtering, although Surfshark’s AdBlock VPN feature appears to be somewhat more comprehensive. Surfshark also offers what it calls Camouflage Mode, which the company says can prevent your local ISP from knowing you’re surfing using a VPN. While NordVPN has a blog post on whitelisting, they don’t appear to have whitelisting as an actual client feature. By contrast, Suftshark uses its split-tunneling feature as a whitelister.ExpressVPN has an interesting blog post about how it prevents its apps from getting malware but doesn’t offer malware protection or adware filtering for traffic run over its VPN network. All three vendors come to the game with most of the features you’d expect. Nord has a few more business-focused features while Surfshark has some features that may afford a limited degree of additional personal privacy — but this would need in-depth testing to truly validate. ExpressVPN appears to just be phoning it in.It’s a tight contest, but we’re awarding wins to both Surfshark and NordVPN. ExpressVPN just gets a participation award.

    ExpressVPN vs. Surfshark vs. NordVPN: Your decision tree

    So, how do you choose between the three?

    Well, if you just count up the wins, Surfshark comes in first, then NordVPN, and then ExpressVPN. But the wins and losses aren’t particularly pronounced. Instead, we recommend you use this decision tree below. Before that, you might want to take a spin through The fastest VPN: NordVPN, Hotspot Shield, and ExpressVPN compared. We didn’t just test VPN provider performance in this in-depth analysis. We go out onto the internet, gather performance data from all across the Web, and let you know which provider is the best overall.So, now, let’s decide:If price is your top concern, Surfshark will save you about $30 over two years over NordVPN and nearly a hundred bucks over ExpressVPN.If predictably fast download performance is key, then NordVPN is more consistently fast in overall performance.If you need a VPN for a NAS appliance, then either NordVPN or ExpressVPN will do.If you want a VPN for your Xbox or PlayStation instead of a mobile device or mobile apps, choose Surfshark or ExpressVPN.If you want a VPN for something that’s not in the usual list, ExpressVPN is more likely to have a documented setup process.If you want a dedicated IP address or more business-oriented features, choose NordVPN.So, there you go. NordVPN and Surfshark have distinctly different personalities, but each do the job in their own way. It’s hard to get excited about ExpressVPN, except for its wide range of device support. NordVPN also seems the most predictable of the bunch.

    How do these choices fit your needs? Have you chosen a VPN provider already? What capabilities and characteristics helped you to make up your mind.You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV.

    ZDNet Recommends More

  • 125 Shares119 Views

    in Networking

    Hackers netting average of nearly $10,000 for stolen network access

    A new report from cybersecurity company Intsights has spotlighted the thriving market on the dark web for network access that nets cybercriminals thousands of dollars.

    ZDNet Recommends

    The best cyber insurance

    The cyber insurance industry is likely to go mainstream and is a simple cost of doing business. Here are a few options to consider.

    Read More

    Paul Prudhomme, cyber threat intelligence advisor at IntSights, examined network access sales on underground Russian and English-language forums before compiling a study on why criminals sell their network access and how criminals transfer their network access to buyers.  More than 37% of all victims in a sample of the data were based in North America while there was an average price of $9,640 and a median price of $3,000. The study notes that the kind of access being offered continues to be used in ransomware attacks across the world. Dark web forums are enabling a decentralized system where less-skilled cybercriminals can rely on each other for different tasks, allowing most ransomware operators to simply buy access from others, according to Prudhomme.  The network access on offer ranges from the credentials of system administrators to remote access into a network. With millions still working from home due to the COVID-19 pandemic, the sale of network access has increased significantly over the last 18 months. Remote access is generally through RDP and VPNs.  In dark web forums and marketplaces, cybercriminals share access to a slate of malware, malicious tools, illicit infrastructure, and compromised data, accounts, and payment card details. Many of the most sophisticated forums and marketplaces are in Russian but there are also many English, Spanish, Portuguese and German-language forums.  Cybercriminals rarely have a full team of attackers experienced in each stage of an attack, making dark web forums ideal as they either sell what they’ve already stolen or search for malware payloads, hosting infrastructure and access to compromised networks.

    “This factor is particularly applicable to compromises of specialized environments, such as those with operational technology (OT), industrial control systems (ICS), Supervisory Control and Data Acquisition (SCADA) systems, or other less common or less conventional technology that may be unfamiliar to many attackers,” Prudhomme explained.  At times, attackers realize they have broken into a network with no data that can be stolen or sold and decide to sell access to ransomware groups. The posts offering compromised network access include the victim, the form and level of access for sale, as well as the pricing and other transaction details. Sometimes the victims are identified by location, industry or sector and revenue information is often included.  The descriptions may also include the number and types of machines on it or the types of files and data that it contains. Often hackers will explicitly mention something as a potential ransomware target in ads.  Some access is sold as an auction while others are negotiated over time.  The most common features of these sales are RDP credentials and VPN credentials, both of which are being used considerably more due to the pandemic. Web shells are also used as persistence mechanisms that can be transferred.  “Elevated privileges are a common feature of these sales, but not a universal one. Many types of malware, including ransomware, need elevated privileges in order to run,” Prudhomme said.  “Higher privileges can also enable attackers to create their own accounts or take other measures to use as additional persistence mechanisms, providing redundancy for the access that they purchased. Domain administrator credentials are a common component of these sales, in conjunction with a form of remote access. Some forms of remote access for sale may also come with their own elevated privileges.” Included in the study is a quantitative and qualitative analysis of a sample of 46 sales of network access on underground forums covered in alerts provided to IntSights customers from September 2019 to May 2021. Among this selection, seven individuals accounted for more than half of the access points for sale, representing the larger trend of concentrated attacks by vendor-specific hackers.  Of the 46 samples, 40 named the location of victim organizations and nearly 40% were in the US or Canada.  Ten of the 46 victims were in the telecommunications industry while three other industries — financial services, healthcare and pharmaceuticals, and energy and industrials — tied for second place.  “Despite the relatively small number of retail and hospitality victims, the second-most expensive offering in this sample, with an asking price of approximately $66,000 USD worth of Bitcoin at the time, was for access to an organization supporting hundreds of retail and hospitality businesses,” Prudhomme explained.  “The victim was a third-party operator of customer loyalty and rewards programs. The seller highlighted the various ways in which a buyer could monetize this access, including: review and manipulation of source code; access to the accounts and points of loyalty program members; and spam and phishing attacks, including ransomware campaigns against loyalty program members via legitimate communication channels.”  Prudhomme noted that cybercriminals often go after airline frequent flier programs and similar customer loyalty programs because of the general lack of anti-fraud measures. While $9,640 was the average price, IntSights researchers said most prices hovered around $3,000. Just ten of the prices surpassed $10,000 and most were for access to telecommunications or technology companies. Many offers were in the hundreds and the lowest offer was $240 for access to a healthcare company in Colombia.  The peak seen in the study was $95,000 for access to a large telecommunications service provider in Asia with over $1 billion in revenue.  The researchers urge organizations to patch systems, enable MFA and take other measures to close off potential access points.  “The amount of time that it takes to sell network access may give security teams more time to detect a breach before a buyer monetizes it or does anything else with it that could cause significant harm,” the report said.  “The amount of time needed to find a buyer varies considerably, ranging from hours to months, but a time frame of days or weeks is more typical. If security teams discover an intruder who has had access for a significant period of time but has not yet begun to monetize it, e.g., by exfiltrating profitable files or deploying ransomware, then that delay could indicate that the initial intruder is still waiting for a buyer.” More