Eliana Willis

Ransomware gangs been prevented from making over a billion dollars following ransomware attacks by free decryption tools made available by the No More Ransom scheme.  The project, founded by Europol, the National High Tech Crime Unit of the Netherlands’ police, Europol’s European Cybercrime Centre, Kaspersky, and McAfee, launched five years ago and has grown to involve 170 partners across law enforcement, cybersecurity companies, academia, and others.  The No More Ransom portal now offers 121 free ransomware decryption tools which can decrypt 151 ransomware families. They’ve helped more than six million ransomware victims recover their encrypted files for free – all without the need to give into the demands of cyber extortionists.  Available in 37 languages, ransomware victims around the world have used the portal to help against ransomware attacks. The website’s ‘Crypto Sheriff’ allows users to upload encrypted files to help identify which form of ransomware they’ve fallen victim to, then directs them to a free decryption tool if one is available.   So far, this has saved victims from paying just over €900 million – or just over a billion dollars – to cyber criminals, disrupting ransomware groups ability to profit from their campaigns.  “Together we will do everything in our power to disrupt criminals’ money-making schemes and return files to their rightful owners, without the latter having to pay loads of money,” says the mission statement on the No More Ransom website.  SEE: Cybersecurity: Let’s get tactical (ZDNet/TechRepublic special feature) | Download the free PDF version (TechRepublic)

To mark the five-year anniversary of No More Ransom, the website has been updated to be more user friendly, with updated information on ransomware as well as advice on how to prevent a ransomware infection – for both regular and business users, because as Europol notes, “Anyone can be a target – individuals and companies of all sizes”.  That advice includes regularly making backups of data, so that in case of a ransomware attack, the network can be restored in the least disruptive way possible with the most recent data available.   No More Ransom also suggests that software and operating systems are kept up to date with the latest security patches, to stop cyber criminals from exploiting known vulnerabilities to help carry out ransomware attacks.  It’s also suggested that corporate networks and remote desktop protocol (RDP) services are secured with multi-factor authentication, to provide an extra barrier to help stop cyber criminals from being able to access the network in the first place.  No More Ransom also recommends that despite the disruption caused by ransomware attacks, victims shouldn’t give in and pay. Not only because there’s no reason to trust that criminals will provide a legitimate decryption key, but paying just shows that ransomware works, encouraging further attacks.  “If the ransom is paid, it proves to the cyber criminals that ransomware is effective. As a result, cyber criminals will continue their activity and look for new ways to exploit systems that result in more infections and more money on their accounts,” says the No More Ransom advice.

MORE ON CYBERSECURITY More

Microsoft has posted an advisory and detailed instructions on how to protect Windows domain controllers and other Windows servers from the NTLM Relay Attack known as PetitPotam.

ZDNet Recommends

The PetitPotam take on the NTLM Relay attack was discovered last week by French security researcher Gilles Lionel, as first reported by The Record. The tool Lionel posted can “coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw function,” he explains.  In other words, the attack can make a remote Windows server authenticate with an attacker and share Microsoft NTLM authentication credentials and certificates.  Microsoft notes that PetitPotam “is a classic NTLM Relay Attack” that it describes in a 2009 security security advisory, which it says “can potentially be used in an attack on Windows domain controllers or other Windows servers.” It says customers may be vulnerable to PetitPotam if NTLM authentication is enabled on a domain and Active Directory Certificate Services (AD CS) is in use with Certificate Authority Web Enrollment or Certificate Enrollment Web Service.  To prevent NTLM Relay Attacks that meet these conditions, Microsoft advises domain admins to ensure that services that permit NTLM authentication must “make use of protections such as Extended Protection for Authentication (EPA) or signing features such as SMB signing.” “PetitPotam takes advantage of servers where Active Directory Certificate Services (AD CS) is not configured with protections for NTLM Relay Attacks,” Microsoft notes in ADV210003.  

Microsoft has provided more detailed mitigation instructions in a separate KB article, KB5005413. Microsoft’s “preferred mitigation” is disabling NTLM authentication on a Windows domain controller.  But it also has detailed and graphical instructions for alternative mitigations if it’s not possible to disable NTLM authentication on a domain. “They are listed in order of more secure to less secure,” it notes. More

(Image: StackCommerce)
There are so many threats to our personal data, even from companies we are supposed to be able to trust, it can sometimes seem like it’s impossible to stay safe. But it may be a whole lot easier to protect yourself than you imagined when you have the right tools. The Lifetime Mobile Privacy & Security Subscription Bundle may actually be all that you need.

see also

Best VPN services

Virtual private networks are essential to staying safe online — especially for remote workers and businesses. Here are your top choices in VPN service providers and how to get set up fast.

Read More

You get a lifetime subscription to KeepSolid VPN Unlimited, which will allow you to browse forever while protecting all of your online activity. It has a wide variety of features that will work together to keep hackers out of your sensitive personal data. You will enjoy military-grade encryption with no limits to your speed or bandwidth, and there is even a kill switch.The service has over 400 servers, so you can also access content regardless of geographic restrictions. It works on Windows, macOS, iOS, and Android, so you can use it on your computer, laptop, and mobile devices.KeepSolid VPN was named PC Mag’s Top VPN and Laptop Review Pro’s Best VPN for Laptop, so you know that the service will do exactly as it claims.The second part of the bundle is a Hushed Private Phone Line that includes 6,000 SMS messages or 1,000 voice minutes that automatically renew every year. This service provides you with a secure extra phone number that allows you to keep your real phone number hidden. Instead of having to commit to another expensive, long phone contract, you can use choose from hundreds of US or Canadian area codes to use for Craigslist, dating, work, and more. You can add more minutes or messages at any time and make calls using WiFi or mobile data.Hushed Private Phone Line is extremely popular. It has received more than 5,000 reviews on the App Store and has an average rating of 4.6 out of 5 stars.Now you can protect yourself while browsing, talking, and texting. Don’t pass up this chance to get The Lifetime Mobile Privacy & Security Subscription Bundle while it’s on sale for just $29.99.

ZDNet Recommends More

A man has been jailed for his role in a swatting incident leading to the death of a 60-year-old man.

The victim, Mark Herring, was a resident of Tennessee and owned the Twitter account @Tennessee, which happened to be a sought-after name.  As reported by the Washington Post, the coveted handle was the object of Shane Sonderman, who was just under 18 years old at the time.  Sonderman, together with co-conspirators, attempted to coerce Herring into giving it up by intimidating him and his family. These methods included harassing texts, cash-on-delivery food orders, and phone calls, the aim being to obtain the handle and then sell it on.  According to federal prosecutors, in April 2020, the harassment reached a new level when Herring’s address and contact information was posted to a Discord server used by a group dedicated to obtaining valuable Twitter and Instagram handles.  “C.B,” a minor in the United Kingdom, then used this information to report a murder at Herring’s home falsely. This is known as “swatting,” in which a fake report of a serious crime is illegally made to send armed law enforcement to a victim’s home address and has been commonly reported during gaming live streams. 

Following the swat, Herring had a heart attack and passed away. His daughter told NBC that she believed he had been “scared to death.”  While out on bond, Sonderman reportedly continued to harass others for their social media handles, leading to re-arrest. Sonderman was charged with conspiracy in Memphis federal court and will now spend five years in prison. Sonderman agreed to plead guilty in return for other charges, including wire fraud, to be dropped. He must also adhere to three years of supervised release. US prosecutors say that the 20-year-old was part of a series of events that triggered a “juvenile halfway across the globe calling for emergency responses to a non-emergency.” This is not the first time swatting has had tragic consequences. In 2019, a California man was sentenced to 20 years behind bars for making swatting calls leading to a Kansas man being fatally shot by law enforcement. 

Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0

ZDNet Recommends More

The head of WhatsApp says that “allies” of US officials are among those targeted by NSO Group spyware in 2019. 

Speaking to The Guardian, WhatsApp’s chief executive, Will Cathcart, said there are “parallels” between the 2019 attacks and a recent data leak allegedly implicating NSO Group clients in widespread cybersurveillance. Israeli vendor NSO Group has experienced bad press in recent weeks due to a damning report issued by Forbidden Stories, Amnesty International, and various media outlets worldwide. Forbidden Stories claimed that a leaked list of over 50,000 phone numbers allegedly revealed individuals either “of interest” or selected for targeting by clients. According to the non-profit’s Pegasus project, while an appearance on the list does not mean that someone was targeted or compromised by Pegasus, infection by the firm’s spyware was confirmed in “dozens” of cases.  Pegasus spyware has capabilities including remote access, both email and browser monitoring, location checks, information exfiltration, call recording, and the extraction of conversations across messaging applications including WhatsApp and Facebook. NSO Group markets its products for use in criminal and terrorism-related investigations. Alongside the alleged targeting of government officials, journalists, diplomats, political dissidents, lawyers, and activists were reportedly included in the leak. 

In 2019, WhatsApp filed a complaint against NSO Group, alleging that the company was responsible for the targeting of at least 100 human rights activists, journalists, and other figures of interest. A vulnerability in the WhatsApp video calling feature, since resolved, was allegedly exploited to load spyware on victim handsets without user interaction.  In the latest leak, a phone number belonging to the president of France, Emmanuel Macron, was said to be included in the records. Macron has now reportedly spoken to Israel’s Prime Minister, Naftali Bennett, to obtain assurances that the country is “properly investigating” the allegations laid at NSO Group’s door. However, NSO Group says that Macron was not a “target.” In contrast, last week, it was reported that India’s opposition leader, Rajiv Gandhi, was selected. In addition, it has been alleged that Pegasus has been used to covertly monitor the mobile devices of up to 1,000 citizens in the country over the past six years.  Morocco has reportedly filed a complaint against Amnesty International and Forbidden Stories, citing defamation over claims the government used Pegasus to target French reporters and lawyers. Amnesty International has stood by the validity of the data set.  Cathcart said the incident should be a “wake-up call” to all of us, adding that governments should take an active role in creating accountability for spyware vendors.  “NSO Group claims that a large number of governments are buying their software, that means those governments, even if their use of it is more controlled, those governments are funding this,” Cathcart told The Guardian. “Should they stop? Should there be a discussion about which governments were paying for this software?” In an update posted July 21, NSO Group said “enough is enough” and the company would no longer answer media inquiries related to the Forbidden Stories report, and it would “not play along with the vicious and slanderous campaign.” The spyware seller said the lists obtained were not related to NSO Group and the firm does not “have access to the data of our customers, yet they are obligated to provide us with such information under investigations.” “NSO will thoroughly investigate any credible proof of misuse of its technologies, as we always had, and will shut down the system where necessary,” the company added.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

South Sea Island in Fiji, looks nice, but the internet is not.
Image: Getty Images
Remember that TikTok deal involving Oracle and Walmart under President Trump? The one that had Oracle purchasing the social network’s US operations and flinging money into an education fund because Trump demanded a payment to the government? It’s probably best the deal fell through, but it now appears Australia also wants a crack at showing the world how to keep companies out of Chinese ownership. If we rewind to 2018, Australia used around AU$200 million of its foreign aid budget to lock Huawei out of building a subsea cable to the Solomon Islands and Papua New Guinea. Instead of Huawei, local telco Vocus eventually picked up a AU$137 million contract to build the cable. That might work for one-off projects, but for the Pacific arm of bankrupt telco Digicel — that is reportedly swimming in around $7 billion of debt with yearly revenue of $2.3 billion — which China Mobile is said to be circling, another model would be needed.  Enter Australia’s largest telco Telstra, who confirmed last week it was approached by the Australian government regarding a Digicel deal, with the government set to stump up “significant funding” for any transaction. Rather than the Trumpian demand for an upfront payment, Canberra has spun it around and decided it needs to put its money where its increasingly large mouth is. While Telstra was mute on the details, the ABC put the deal at around AU$2 billion, including Canberra lending Telstra AU$1.5 billion at reduced rates that would net Australia about AU$30 million annually in interest. Digicel Pacific has networks in Papua New Guinea, Fiji, Nauru, Samoa, Tonga, and Vanuatu.

There is a delicious irony in the government helping the telco it privatised last century to fund the purchase of another operator, but Canberra has few other options. Optus is owned by the Singaporean government, TPG has offshore Vodafone and Hutchison ownership entanglements, the likes of Vocus are too small, and creating something akin to an NBN South Pacific would be a disaster waiting to happen. Meanwhile, as Telstra CEO Andy Penn pointed out recently, Telstra is mostly owned by the pension funds of Australia. At the same time of Telstra lifting the veil on the Digicel deal, Australia joined a collection of nations to attribute the Exchange hack to China and its Ministry of State Security. One of the big questions about the action from the United States, NATO, European Union, United Kingdom, Australia, Canada, New Zealand, and Japan was why stop short of the sort of sanctions that have been applied to Russia recently? The quick answer is supply chain entanglement. The diminishing returns of Huawei show Chinese autarky has not reached a level where it is immune from Western restrictions, but conversely, if China played hardball and clamped down on manufacturing, while that would hurt itself, that would also really hurt the West.  We are currently at the stage where fighters are circling each other, not throwing punches. In terms of real-world impact, the attribution provided rhetorical strength to Australia’s claim that infrastructure in neighbouring countries needs to be kept out of Chinese telco hands. “This is a must do thing as we don’t want our neighbouring countries, especially the low developing countries’ critical infrastructure to be controlled by other countries that might have other intentions,” Monash University senior lecturer in criminology at the School of Social Sciences told ZDNet. “Critical infrastructure protection is now essential to national security. It is important that individual countries can understand that the service provider that they are using has no hidden agenda that is malicious.” While the Digicel Pacific footprint is now caught up in a geopolitical tug of war, spare a thought for those on the ground who have to live with decisions made in Bermuda, Beijing, and Canberra. In places where only 35% of people have internet access, some simply want better coverage. If Telstra does indeed win out, it should invest in its purchase and maintain its Australian reputation as having the best coverage.The problem now for governments like Australia, especially if they want to continue to engage in this sort of activity, is they will have to avoid being milked by companies looking to sell infrastructure that could be deemed critical. Because suddenly, the first step in selling subsea cables, a semiconductor fab, or a telco could mean getting a company in China to give you an outrageous price and seeing whether a nation calls your bluff. If that happens, things could turn silly quite easily. ZDNET’S MONDAY MORNING OPENER  The Monday Morning Opener is our opening salvo for the week in tech. Since we run a global site, this editorial publishes on Monday at 8:00am AEST in Sydney, Australia, which is 6:00pm Eastern Time on Sunday in the US. It is written by a member of ZDNet’s global editorial board, which is comprised of our lead editors across Asia, Australia, Europe, and North America.  PREVIOUSLY ON MONDAY MORNING OPENER: More

(Image: StackCommerce)
Global corporations have been ridiculously lazy in implementing the most powerful cybersecurity measures available, which puts all of our personal data at risk. That’s all the more reason to make sure your own personal security is as strong as possible, and a lifetime subscription to FastestVPN for up to 10 devices provides some of the most comprehensive protection on the market.

FastestVPN offers a smart, user-friendly service for all of your devices, including Android, iOS, Windows, Mac, your router, and even your Smart TV. It uses more than 200 high-speed servers around the world, all with military-grade 256-bit AES encryption. And you get unlimited switches between them, as well as unlimited bandwidth for the simultaneous use of your 10 devices.An ad blocker is included for your convenience, and FastestVPN’s strict no-logging policy ensures no one will have access to your personal data. Anti-malware software is included and an extra layer of protection is provided by a NAT firewall. There is even a kill switch to disconnect you from the internet if your VPN connection drops for any reason.While some VPNs may slow down your internet connection, as you might expect from its name, FastestVPN provides all of this protection at blazing fast speeds. You can also access any content you like, regardless of geographic restrictions. Simply access the service’s fastest server and you can download or stream even HD-quality video with absolute anonymity and zero buffering. USA Netflix support is included in your plan.Given the depth of features, it should come as no surprise that TenBestVPNs said:”FastestVPN is one of the most promising VPN services in the market.”You really don’t want to pass up this opportunity to get a lifetime subscription to FastestVPN for 10 devices, because it’s currently available at the heavily discounted price of $24.99.

ZDNet Recommends More