Eliana Willis

More stories

  • 125 Shares169 Views

    in Information Technology

    Black Hat: Enterprise players face 'one-two-punch' extortion in ransomware attacks

    BLACK HAT USA: The adoption of double-extortion attacks against companies in ransomware campaigns is a rising trend in the space, researchers warn.

    Ransomware variants are typically programs that aim to prevent users from accessing systems and any data stored on infected devices or networks. After locking victims out, files and drives will often be encrypted — and in some cases, backups, too — in order to extort a payment from the user. Today, well-known ransomware families include WannaCry, Cryptolocker, NotPetya, Gandcrab, and Locky. Ransomware now seems to make the headlines month-on-month. Recently, the cases of Colonial Pipeline and Kaseya highlighted just how disruptive a successful attack can be to a business, as well as its customers — and according to Cisco Talos, it’s likely to only become worse in the future. In 1989, the AIDS Trojan — arguably one of the earliest forms of ransomware — was spread through floppy disks. Now, automated tools are used to brute-forcing internet-facing systems and load ransomware; ransomware is deployed in supply-chain attacks, and cryptocurrencies allow criminals to more easily secure blackmail payments without a reliable paper trail.As a global issue and one that law enforcement struggles to grapple with, ransomware operators may be less likely to be apprehended than in more traditional forms of crime — and as big business, these cybercriminals are now going after large companies in the quest for the highest financial gain possible. At Black Hat USA, Edmund Brumaghin, research engineer at Cisco Secure said the so-called trend of “big game hunting” has further evolved the tactics employed by ransomware operators. 

    Now big game hunting has gone “mainstream,” Brumaghin says that cyberattackers are not deploying ransomware immediately on a target system. Instead, such as in the example of typical SamSam attacks, threat actors now, more often, will obtain an initial access point through an endpoint and then move laterally across a network, pivoting to gain access to as many systems as possible. 
    Cisco Talos
    “Once they had maximized the percentage of the environment that was under their control, then they would deploy the ransomware simultaneously,” Brumaghin commented. “It’s one of those types of attacks where they know that organizations may be forced to pay out because of instead of a single endpoint being infected, now, 70 or 80 percent of server-side infrastructure is being impacted operationally at the same time.” After a victim has lost control of their systems, they are then faced with another problem: the emerging trend of double-extortion. While an attacker is lurking on a network, they may also rifle through files and exfiltrate sensitive, corporate data — including customer or client information and intellectual property — and they will then threaten their victims with its sale or a public leak. “Not only are you saying you only have X amount of time to pay the ransom demand and regain access to your server, if you don’t pay by a certain time, we’re going to start releasing all of this sensitive information on the internet to the general public,” Brumaghin noted.This tactic, which the researcher says “adds another level of extortion in ransomware attacks,” has become so popular in recent years that ransomware operators often create ‘leak’ sites, in both the dark and clear web, as portals for data dumps and in order to communicate with victims. According to the researcher, this is a “one-two-punch” method that is made worse now that ransomware groups will also employ Initial Access Brokers (IABs) to cut out some of the legwork required in launching a cyberattack.IABs can be found on dark web forums and contacted privately. These traders sell initial access to a compromised system — such as through a VPN vulnerability or stolen credentials — and so attackers can bypass the initial stages of infection if they are willing to pay for access to a target network, saving both time and effort. “It makes a lot of sense from a threat actor’s perspective,” Brumaghin said. “When you consider some of the ransom demands we’re seeing, in a lot of cases, it makes sense to them instead of trying to go through all the effort [..] they can simply rely on initial access brokers to give them access that has already been achieved.”Finally, Cisco’s security team has also noted an uptick in ransomware ‘cartels’: groups that sharing information and working together to identify the techniques and tactics that are most likely to result in revenue generation. Brumaghin commented: “We’re seeing a ton of new threat actors begin to adopt this business model and we continue to see new ones emerge, so it’s something organizations really need to be aware of.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 175 Shares149 Views

    in Information Technology

    CISA to partner with Amazon, Google, Microsoft, Verizon, AT&T and more for cyberdefense initiative

    CISA director Jen Easterly announced a new cyberdefense collaborative that will see government bodies partner with Google, Microsoft, Verizon and more on protective cybersecurity measures.Easterly unveiled the initiative in an interview with the Wall Street Journal before speaking about it further at the Black Hat convention on Thursday. The newly-appointed head of CISA told the newspaper that the Joint Cyber Defense Collaborative (JCDC) will “uniquely bring people together in peacetime, so that we can plan for how we’re going to respond in wartime.”Easterly explained on Twitter that the JCDC will “share insight to shape our understanding of cyber defense challenges and opportunities, design whole-of-nation cyber defense plans to address risks, support joint exercises to improve cyber defense operations and implement coordinated defensive cyber operations.”On its website, the JCDC described its mission as leading “the development of the Nation’s cyber defense plans” as it seeks to “prevent and reduce the impacts of cyber intrusions.”They explain that the $740 billion National Defense Authorization Act (NDAA) of 2021 passed on January 1 gave them “new authority” to bring together both public and private institutions to coordinate responses to cyberattacks. Representatives from DHS, the Justice Department, United States Cyber Command, NSA, FBI as well as the Office of the Director of National Intelligence will be involved in the initiative.

    Private sector companies involved in the effort include Google, Verizon, Microsoft, AT&T, Amazon Web Services, FireEye, Lumen, Crowdstrike and Palo Alto. Google Cloud CISO Phil Venables told ZDNet it is essential that the public and private sectors work together to defend against evolving threats and shore up modern IT capabilities that will protect federal, state and local governments. “We look forward to working with CISA under the Joint Cyber Defense Collaborative and offering our security resources to build a stronger and more resilient cyber defense posture,” Venables said. Shawn Henry, president of CrowdStrike Services and CSO, added that the JCDC will “create an inclusive, collaborative environment to develop proactive cyber defense strategies.””Continued collaboration between industry and government is critical to thwart today’s sophisticated attacks, and CISA’s initiative to bring the most relevant stakeholders together to defend national security is admirable. CrowdStrike is looking forward to partnering on this critical endeavor,” Henry said. An image of the partnership shared by CISA director Jen Easterly
    Jen Easterly/Twitter
    “The JCDC leads the development of the Nation’s cyber defense plans by working across the public and private sectors to unify deliberate and crisis action planning, while coordinating the integrated execution of these plans,” the collective explained.”The plans will promote national resilience by coordinating actions to identify, protect against, detect, and respond to malicious cyber activity targeting U.S. critical infrastructure or national interests.”JCDC will also coordinate with state level officials and other owners and operators of critical information systems. They added that “comprehensive, whole-of-nation planning” will be needed to address the wave of cybersecurity incidents facing organizations. In addition to defensive measures, the JCDC said it would also plan for “adaptive” cyber defense to deal with “adversary activity conducted in response to US offensive cyber operations.”The JCDC is one of many actions being taken by the Biden Administration to address ransomware attacks and many other headline-grabbing attacks in recent months. In addition to the new mandatory guidelines facing critical infrastructure owners, the JCDC will coordinate with them to “support the development of long-term plans to manage cyber risk and increase resilience of critical infrastructure.”During her speech at Black Hat, Easterly thanked US Senator Angus King, Congressman Mike Gallagher and the other leaders of Congress’ Cyberspace Solarium Commission for their help in setting up the JCDC. Easterly was confirmed by Congress on July 12 following a decorated career in the military. She spent more than 20 years working on the US Army’s intelligence and cyber operations and is credited with helping design and create United States Cyber Command.  More

  • 88 Shares119 Views

    in Robotics

    Network effect: Strong robot gets 5G upgrade

    Sarcos
    As 5G rollouts quicken, we’re seeing the first hints of the new capabilities the network will bring to robots. The latest example comes by way of a just-announced collaboration between Sarcos Robotics, which makes robots that augment humans to enhance productivity and safety, and T-Mobile.The agreement will integrate T-Mobile 5G into the Sarcos Guardian XT highly dexterous mobile industrial robot. “We are proud to collaborate with T-Mobile and we’ve made great progress leveraging their 5G network to enable the remote viewing management system,” said Scott Hopper, Executive Vice President of Corporate and Business Development, Sarcos Robotics. “This is a significant first step and we’re eager to continue the development toward full 5G wireless connectivity that will unlock a variety of new capabilities, including remote teleoperation, as we prepare for commercial availability.”This is part of an evolving story about Sarcos’ plans for teleoperated systems. Last month I covered the rollout of the company’s SenSuit controller garment, which enables users to control the Guardian XT, which looks like a robot version of a human torso and arms, to accomplish precision tasks and perform work in unstructured environments, spaces that could soon include construction and mining. The SenSuit controller incorporates a headset and utilizes natural human movement as control inputs.But when it comes to delicate industrial tasks and operating a massively powerful robot remotely, the network is key. That’s where 5G comes in, and it’s a good illustration of where robotics is headed. The new collaboration begins with the integration of 5G to develop a remote viewing system powered by T-Mobile’s high bandwidth, low latency 5G network. In the next phase, the companies will include full 5G wireless integration to allow for seamless and near-instantaneous control of the XT.”The Sarcos Guardian XT robot requires a highly reliable, low latency 5G network that its human operators can count on,” said John Saw, EVP of Advanced & Emerging Technologies at T-Mobile. “5G was designed from the ground up for industrial applications such as this and we cannot wait to further collaborate with Sarcos as they develop the next big thing in industrial robotics.”Sarcos, which we’ve been tracking closely, is on a bit of a tear lately. The company recently announced that it will become publicly listed through a merger transaction with Rotor Acquisition Corp., a publicly-traded special purpose acquisition company. More

  • 163 Shares169 Views

    in Information Technology

    More than 12,500 vulnerabilities disclosed in first half of 2021: Risk Based Security

    Risk Based Security has released two new reports covering data breaches and vulnerabilities in the first half of 2021, finding that there was a decline in the overall number of reported breaches but an increase in the amount of vulnerabilities disclosed. The company’s data breach report found that there were 1,767 publicly reported breaches in the first six months of 2021, a 24% decline compared to the same period last year. The number of reported breaches grew in the US by 1.5% while 18.8 billion records were exposed year to date, a 32% decline compared to the 27.8 billion records leaked in the first half of 2020. Inga Goddijn, executive vice president at Risk Based Security said the methods used by attackers to monetize their efforts has diversified and at the same time, preventable errors are outpacing hackers when it comes to the amount of data exposed. “The amount of data compromised remains stubbornly high and with another sizable Q2 breach yet to be confirmed, it is possible that the number will climb over 19 billion in the near future,” Goddijn said. The numbers are slightly misleading though, the report notes, because the breach of Forex trading service FBS Markets accounts for about 85% of the records exposed through June 30th. The researchers added that 352 data breaches involved a ransomware attack.

    The number of email addresses leaked held steady at 40% of all breaches while passwords were leaked in 33% of breaches. Healthcare organizations led the way with the most breaches in 2021 so far at 238. Finance and insurance companies suffered 194 breaches while manufacturing saw 169 and educational institutions dealt with 138.  The other report found from Risk Based Security’s VulnDB(R) team aggregated 12,723 vulnerabilities that were disclosed during the first half of 2021. They found that for the first half of 2021, the number of vulnerabilities disclosed grew by 2.8% compared to 2020.”Of the vulnerabilities disclosed during the first half of 2021, 32.1% do not have a CVE ID, and an additional 7%, while having a CVE ID assigned, are in RESERVED status which means that no actionable information about the vulnerability is yet available in CVE/NVD,” the report added. “In the first half of 2021, Risk Based Security’s VulnDB team aggregated an average of 80 new vulnerabilities per day. Risk Based Security also updated an average of 200 existing vulnerability entries per day as new solution information, references, and additional metadata became available.”Of the vulnerabilities disclosed so far in 2021, 1,425 are remotely exploitable and have a public exploit as well as a mitigating solution. Nearly 900 vulnerabilities that are remotely exploitable do not have a mitigating solution at all.One issue spotlighted by the report is the trend of organizations failing to report breaches.The COVID-19 pandemic shifted focus away from cybersecurity and there has now been a 24% decline in the number of publicly disclosed breaches when comparing data from the first half of 2020 to the first half of 2021. Despite the decline in disclosed breaches, the number of sensitive files exposed continues to grow. Between January 2021 and June 2021, more than 18 billion sensitive or confidential records were exposed, the second highest ever recorded by Risk Based Security. Of the data lost in breaches, 61% involved the exposure of names, 38% exposed social security numbers, 25% contained addresses and 22% had financial information. The reports also ranked the top ten products by vulnerability disclosures in Q2 of 2021. Debian Linux led the way with 628 followed by Fedora at 584, openSuSE Leap at 526 and 443 for Ubuntu. The top ten vendors by vulnerability disclosures in Q2 2021 included Microsoft at 627, SUSE at 590, Fedora at 584, IBM at 547 and both Oracle and Google above 500. Cisco, Canonical and Red Hat rounded out the list with more than 400 vulnerability disclosures in Q2 2021.  More

  • 88 Shares159 Views

    in Information Technology

    Microsoft tests Super-Duper Secure Mode for Edge

    (Image: Shutterstock)
    Microsoft’s Edge Vulnerability Research (VR) team is testing a new feature they’ve christened, “Super Duper Secure Mode” (SDSM). Super-Duper Secure Mode is all about making Edge more secure without negatively impacting performance.

    see also

    The best browsers for privacy

    If you’re like most people, you’re probably using Google Chrome as your default browser. It’s hard to fault Google’s record on security and patching but privacy is another matter for the online ad giant.

    Read More

    SDSM works by removing Just-In-Time compilation from the V8 processing pipeline, which will reduce the attack surface that can be used to hack into Edge’s systems, as Bleeping Computer (where I first saw the SDSM information) explains. In addition to disabling the JIT, SDSM enables “new security mitigations” to make Edge a more secure browser. “JavaScript plays a key role in any browser story. JITs exist for a reason, and that is to optimize JavaScript performance,” the Microsoft browser researchers noted in their August 4 blog post about SDSM. However, so far, the researchers said they don’t see much of a change in performance with JIT disabled; most of their tests remained unchanged. By disabling the JIT, roughly half of the V8 bugs that must be fixed would be removed. This would mean less frequent security updates and fewer emergency patches for users, the researchers noted. SDSM is still considered to be in the experimental stage. Still, Edge preview testers — in the Canary, Dev and Beta rings — can enable it now with a flag by going to edge://flags/#edge-enable-super-duper-secure-mode and turning on the new feature. More

  • 88 Shares159 Views

    in Networking

    Navigating online harassment: How to take control

    In the United States, gaming is a $35.5 billion industry, with an estimated 211 million people playing online games — which adds up to 67% of the population. 

    In addition to the general allure of gameplay and competition, online gaming platforms also establish connections between people, allowing gamers to strike up conversations with friends or complete strangers and to build what can sometimes turn out to be long-lasting relationships. However, the ability to easily connect socially through a simple internet connection also means there’s a platform for negative social interactions, leading to instances of online harassment.  A 2019 study by the Anti-Defamation League (ADL) revealed 74% of gamers had experienced some form of online harassment, and 65% of people playing games online have experienced “severe” online harassment, which is defined as including sustained harassment, physical threats and even stalking.What does online harassment look like?Online harassment can include a variety of damaging behaviors such as threats, hateful messages, defamation, and distributed denial-of-service (DDoS) attacks. Typically, the end goal of the harasser is to drive the victim off of the gaming platform or to harm them in some way through a series of threats, by broadcasting personal information online (also known as doxxing), or otherwise threatening their personal safety — not just virtually, but in real life.According to the ADL study, 29% of online gamers reported being victims of doxxing. This form of online harassment entails divulging personal information about someone without their consent, such as a home address, telephone number or a gamer’s real name. In some cases, this can lead to additional harassment from others who come across that information.Once this information is online, the harassment can then escalate to swatting. Swatting occurs when an ill-intentioned gamer reaches out to emergency services and law enforcement agencies and asks that they respond to a fake emergency at the victim’s house. When law enforcement enters what they believe to be a dangerous situation, such as the fallout of a shooting or a hostage situation, people can get hurt in the confusion.When harassment transcends the boundaries of the internet, there are far-reaching consequences. To prevent online harassment from escalating and to keep online gaming fun for the entire gaming community, gamers need to report instances of online harassment early to the gaming company or service provider of the gaming platform. Companies need to know about the incident in order for them to step in and remedy the situation. People found guilty of harassment are commonly banned from the game, making the game more safe and more fun for other players. How are companies addressing harassment?

    Most large tech and gaming companies are aware of the possibility (if not prevalence) of online harassment happening on their platforms. And many of these companies have put measures in place to help players report online harassment or digital abuse. Console gaming tycoons Xbox (owned by Microsoft) and Playstation (Sony) each have a clearly defined code of conduct outlining the boundaries of behavior accepted on the platforms. Microsoft’s Community Standards and Sony’s Community Code of Conduct leave very little room for misunderstanding where the boundaries of acceptable and unacceptable online behaviors lie.On top of these overarching guidelines, Xbox and Playstation have created clear, step-by-step procedures for how to block players, file complaints and report incidents of online harassment. Of course, the options of blocking other players or filing reports of online harassment are not limited to the world of console gaming. Just about every online gaming platform has similar options available to players. For example, the online gaming platform Steam has posted rules and guidelines and a Steam Online Conduct guide, both of which clearly outline what is considered inappropriate behavior that will not be tolerated. Steam users are also encouraged to file a complaint should they experience harassment or come across inappropriate content.Harassment and defamation are not the only things gamers need to report. Gaming platforms encourage people to report a wide range of incidents. Some of these include (but are not limited to) cheating, posting spam, posting inappropriate or offensive content, or using inappropriate profile pictures and player names.What are the steps to take when targeted?In most cases dealing with online harassment isn’t a matter of toughing it out. Being proactive means, you’re more likely to get the behavior to stop. Luckily, there are several steps you or your child can take to deal with online harassment. Let’s look at a few:Step 1: Document and gather evidence. Gathering evidence in the form of digital records is incredibly important if you are being harassed. The evidence is crucial for when you need to take criminal or legal action against your aggressor. Since online harassment can cross into real life, you need to have proof of everything that has happened in the digital world. Document all of your interactions with the person harassing you. This means taking and printing screenshots and getting timestamps whenever you can. (Tip: Screenshots often save with a file name that doubles as a timestamp.)Step 2: Tell them to stop, but don’t initiate a dialogue with the harasser. This is an important step to take when you’re dealing with online harassment. As a one-time action, tell the person they need to stop harassing you. Engaging with the harasser can lead to escalation.Step 3: Try not to take it personally. Regardless of the level of harassment, remember that someone else is behaving badly, and their words and actions are not a reflection of you. Try to distance yourself from the scenario emotionally. In a nutshell, don’t let them push your buttons. By refusing to engage, you are taking away their power over you.Step 4: Block and report them. Most games provide players with the option to block and/or report other players. You can ensure you won’t be paired up with them again by blocking a player, and hopefully, the harassment will end there. If the harassment is more serious in nature, you should report the player as well. Filing a formal complaint might mean the aggressor is completely banned from the game as a consequence.Step 5: Speak to the other players. It takes a tribe. Speak to the other players in your game about the player targeting you. Chances are, some of them will have had similar experiences. The chances of having an aggressor banned from the game are much higher if multiple complaints are filed against them.Step 6: Reach out to the game moderators. Game moderators can act as both the police and peacekeepers. If your game has a moderator, you can reach out to them and make them aware that another player is harassing you.Step 6: Know your legal rights. Stay prepared by knowing your rights if you encounter online harassment. Carla Franklin, a cyber abuse expert, survivor and advocate for victims, offers this tip on her website: “Even if you have a lawyer or the police involved in your situation, you are your own best advocate and know your case better than anyone.” We’ve provided a list of resources below. Step 7: Contact the police. If the person who is harassing you makes threats or does something that is considered illegal in the real world, you should contact the police. If another player threatens your life or causes you harm, it is time to get law enforcement involved.Step 8: Step up your internet security. Some people may be more tech-savvy than others in gaining information on you and your online activities. They may go so far as to try to access your email or social media accounts. But you can make it harder for others to engage in doxxing by tightening up your online security. It is incredibly important to have two-factor authentication and a very strong password for each account. Have a good look at how much information you have posted about yourself and your whereabouts online. It may not seem important to you at the time you post something, but for an aggressor who is gathering sensitive and personal information about you, your social media accounts can be a goldmine.Step 9: Reach out for support. As with any other traumatic experience in life, you should reach out to your support network and possibly even a licensed mental health professional for help. Being the target of online harassment is something you shouldn’t have to deal with by yourself. Samantha Silverberg, the co-founder of the Online SOS Network, told Psychology Today, “People don’t realize how big of an issue it is from a mental health perspective. It’s really hard to quantify what’s happening.” Online harassment can have a massive impact on an individual’s mental health, so getting help and reaching out for support is incredibly important in many cases.Step 10: Look out for others. Anyone is at risk of becoming a victim of online harassment. Don’t be a bystander if you see someone harassing another player. The gaming community is meant to be a safe space for everyone, and identifying and dealing with a troll often needs to be a collective effort. Emily May, the co-founder and executive director of Hollaback! and HeartMob, which supports people who are being harassed online, reported to Vice, “We have to depend on one another and work together to change the culture that makes online harassment acceptable.” What resources are there?Because online harassment is such a big issue, there has been an increase in people and groups advocating for the victims of online harassment. These individuals, support groups, and nonprofit organizations aim to end all online harassment and have made many available resources on the topic. Here are a few resources you can turn to if you, or someone you know, is being harassed online:HeartMob: A nonprofit organization powered by activists that aim to end online harassment. The platform provides real-time support for anyone who experiences online harassment and has made available a long list of resources, including helpful guides and more information on the topic of harassment.Crash Override Network: A crisis helpline, advocacy group and resource center for people who are experiencing online abuse. The group has made various resources available, including educational materials, referrals, guides and interactive tools, which people can use to inform and educate themselves on online harassment.   Cyber Smile Foundation: A nonprofit organization working towards ending online harassment and cyberbullying and promoting kindness, diversity and inclusion online. They offer several articles and guides aimed specifically at the gaming community. International Game Developers Association (IGDA): A nonprofit organization with extensive resources covering how to respond to online harassment. Online SOS: A platform providing information and tools to help empower people dealing with online harassment. The nonprofit also offers services such as crisis coaching and referrals to experts.Feminist Frequency: A nonprofit educational organization that has put together an extensive guide on how to protect yourself from online harassment.  Data & Society Research Institute: This nonprofit research organization has compiled a detailed report on America’s online harassment, digital abuse, and cyberstalking.  The bottom lineThe majority of people looking at online gaming as a source of entertainment want to join a community of people who have one thing in common: a love for games. Unfortunately, not everyone is doing their part to create a safe and positive online gaming culture.Two-thirds of online gamers in the U.S. have experienced some form of online harassment, and often the harassment does not simply end when a player logs off. Luckily, there are many steps a victim of online harassment can take to empower and protect themselves. There are also many resources available to educate yourself further on the topic of online harassment. Take control of your gaming experience and do your part to spot and report online harassment early to help ensure a safe and fun gaming community for everyone.

    ZDNet Recommends More

  • 113 Shares189 Views

    in Information Technology

    Google's new Nest lineup includes a Doorbell and Cams

    The new Google Nest Cam lineup. 
    Google
    Google on Thursday unveiled several new security cameras that are part of its Nest smart home lineup. There’s a new video doorbell, a floodlight camera to help you monitor your driveway or a dark side of your home, and two new Nest Cams — one that’s battery-powered and designed for use anywhere — and another that’s designed to monitor inside your home.  More

  • 175 Shares159 Views

    in Networking

    Starlink is better than its satellite competition but not as fast as landline internet

    When it comes to internet speed tests, Ookla’s Speedtest is the gold standard. So when Ookla examined its data for Starlink and its satellite internet rivals, HughesNet and Viasat, the numbers it comes up with are meaningful. 

    ZDNet Recommends

    The best internet service providers

    When you’re comparing internet providers for your business, don’t just look at speed and price. More than anything else, you want the most reliable connection to keep your business running.

    Read More

    To no great surprise, Ookla found Starlink beats HughesNet and Viasat handly. The company found that “Starlink was the only satellite internet provider in the United States with fixed-broadband-like latency figures, and median download speeds fast enough to handle most of the needs of modern online life at 97.23 Megabits per second (Mbps) during Q2 2021. HughesNet was a distant second at 19.73 Mbps and Viasat third at 18.13 Mbps.”As for latency, the time between when you start an activity over the internet and when you get a response back, it’s not even a competition. Starlink’s median latency, 45 milliseconds (ms) is close to fixed broadband’s 14 ms. Low latency is vital for voice and video calling, gaming, and live content streaming. By comparison, Viasat, 630 ms, and HughesNet, 724 ms, are almost unusable for these purposes. Why was there such a huge difference? It’s simple physics. Unless we ever get quantum networking, we can’t network faster than the speed of light. Starlink uses low earth orbit (LEO) satellite constellations, flying above us at a relatively close 550 to 1,200 kilometers (km), while HughesNet and Viasat have far higher geosynchronous orbits of about 35,000km.Of course, even Starlink isn’t as fast as cable or fiber-based internet. According to Ookla, the median fixed-broadband in the US is 115.22Mbps with a latency of 15ms. But, Starlink was never meant to compete with Earth-bound internet in cities and suburbs. It’s meant to offer an alternative to people living in the country. There I know people who are still using — yes, I’m serious — dial-up modems and slow-as-dirt DSL connections with speeds that go all the way down to Kilobits per second (Kbps). For these users, Starlink is clearly the better choice. But, Starlink is still being rolled out. This means some places at some times get much better performance than others. Ookla found at the top were users in Morgan county, Alabama at 168.30 Mbps, while lagging more than 100 Mbps behind were the residents of Madison County, Indiana.Generally speaking, due to how the Starlink satellite constellations are currently set up, the farther North you live, the better your connection. But, as Morgan county shows, that’s not a hard and fast rule. For example, in Canada Starlink’s median download speed of 86.92 Mbps exceeded the country’s median fixed broadband speed of 84.24 Mbps. 

    In other countries, such as France, Germany, and the United Kingdom Starlink’s speed vastly beats terrestrial internet speeds. In France, Starlink’s download speed 139.39 Mbps, easily outran the country-wide fixed broadband average speed of 70.81 Mbp. With Germany, the difference is even larger. A German internet user can expect to see a Starlink speed of 107.98 Mbps while its Earth-bound competitors come in at 58.17 Mbps. While in the UK, and not just in those areas of Scotland far away from the usual internet providers, Starlink’s 108.30 Mbps beats fixed broadband, 50.14 Mbps, hollow. Of course, in all cases, Starlink’s latency will be slower than its territorial competitors. You can’t beat physics. You might be wondering how HughesNet and Viasat can stay in business. The reason for that is simple. They’re the only internet game in town in many countries. For instance, in Brazil, Viasat’s 60.30 Mbps download speed is comparable to fixed broadband’s 61.38 Mbps. If you live in the campos, the countryside, you can get Viasat, where you may not have a practical alternative. But, while Starlink may sound wonderful, its manufacturing lines are still lagging far behind demand. I, for instance, have yet to see my Starlink Terminal and I ordered it almost six months ago. In theory, Starlink will be available around the world by September. In practice, I’m not counting on it. Is Starlink for everyone? No. But, if you live beyond the reach of conventional high-speed internet or areas with poor general internet service, you’ll want to try to get it. Once in hand, it’s clearly the best satellite internet service.Related Stories: More