Eliana Willis

More stories

  • 100 Shares189 Views

    in Information Technology

    Google releases new open-source security software program: Scorecards

    Some naive people may still think they’re not using open-source software. They’re wrong. Everyone does. According to the Synopsys Cybersecurity Research Center (CyRC) 2021 “Open Source Security and Risk Analysis” (OSSRA) report, 95% of all commercial programs contain open-source software. By CyRC’s count, the vast majority of that code contains outdated or insecure code. But how can you tell which libraries and other components are safe without doing a deep code dive? Google and the Open Source Security Foundation (OSSF) have a quick and easy answer: The OpenSSF Security Scorecards.

    Open Source

    These Scorecards are based on a set of automated pass/fail checks to provide a quick review of many open-source software projects. The Scorecards project is an automated security tool that produces a “risk score” for open-source programs. That’s important because only some organizations have systems and processes in place to check new open-source dependencies for security problems. Even at Google, though, with all its resources, this process is often tedious, manual, and error-prone. Worse still, many of these projects and developers are resource-constrained. The result? Security often ends up a low priority on the task list. This leads to critical projects not following good security best practices and becoming vulnerable to exploits.  The Scorecards project hopes to make security checks easier to make security easier to achieve with the release of Scorecards v2.  This includes new security checks, scaled up the number of projects being scored, and made this data easily accessible for analysis.For developers, Scorecards help reduce the toil and manual effort required to continually evaluate changing packages when maintaining a project’s supply chain. Consumers can automatically access the risks to make informed decisions about accepting the program, look for an alternative solution, or work with the maintainers to make improvements. Here’s what new:  Identifying Risks: Since last fall, Scorecards’ coverage has grown; the project has added several new checks, following Google’s Know, Prevent, Fix framework. Spotting malicious contributors:  Contributors with malicious intent or compromised accounts can introduce potential backdoors into code. Code reviews help mitigate such attacks. With the new Branch-Protection check, developers can verify that the project enforces mandatory code review from another developer before code is committed. Currently, this check can only be run by a repository admin due to GitHub API limitations. For a third-party repository, use the less informative Code-Review check instead. Vulnerable Code: Even with developers and peer review’s best efforts, bad code can still enter a codebase and remain undetected. That’s why it’s important to enable continuous fuzzing and static code testing to catch bugs early in the development lifecycle. The project now checks to see if a project uses fuzzing and SAST tools as part of its continuous integration/continuous deployment (CI/CD) pipeline.Build system compromise: A common CI/CD solution used by GitHub projects is GitHub Actions. A danger with these action workflows is that they may handle untrusted user input. Meaning, an attacker can craft a malicious pull request to gain access to the privileged GitHub token, and with it the ability to push malicious code to the repo without review. To mitigate this risk, Scorecard’s Token-Permissions prevention check now verifies that the GitHub workflows follow the principle of least privilege by making GitHub tokens read-only by default. Bad dependencies: A program is only as secure as its weakest dependency. This may sound obvious, but the first step to knowing our dependencies is simply to declare them… and have your dependencies declare them too. Armed with this provenance information, you can assess the risks to your programs and mitigate those risks.  That’s the good news. The bad news is there are several widely used anti-patterns that break this provenance principle. The first of these anti-patterns are checked-in binaries — as there’s no way to easily verify or check the contents of the binary in the project. Thanks in particular to the continued use of proprietary drivers, this may be an unavoidable evil. Still, Scorecards provides a Binary-Artifacts check for testing this.Another anti-pattern is the use of curl or bash in scripts, which dynamically pulls dependencies. Cryptographic hashes let us pin our dependencies to a known value. If this value ever changes, the build system detects it and refuses to build. Pinning dependencies is useful everywhere we have dependencies: Not just during compilation, but also in Dockerfiles, CI/CD workflows, etc. Scorecards checks for these anti-patterns with the Frozen-Deps check. This check is helpful for mitigating against malicious dependency attacks such as the recent CodeCov attack.Even with hash-pinning, hashes need to be updated once in a while when dependencies patch vulnerabilities. Tools like dependabot or renovatebot can review and update the hashes. The Scorecards Automated-Dependency-Update check verifies that developers rely on such tools to update their dependencies.It is important to know vulnerabilities in a project before using it as a dependency. Scorecards can provide this information via the new Vulnerabilities check, without subscribing to a vulnerability alert system. That’s what new. Here is what the Scorecards project has done so far.  It now has evaluated security for over 50,000 open source projects. To scale this project, its architecture has been massively redesigned. It now uses a Pub/Sub model. This gives it improved horizontal scalability and higher throughput. This fully automated tool periodically evaluates critical open source projects and exposes the Scorecards check information through weekly updated public BigQuery dataset 

    To access this data, you can use the bq command-line tool. The following example shows how to export data for the Kubernetes project. For your purposes, substitute the Kubernetes repo url with the one for the program you need to check:$ bq query –nouse_legacy_sql ‘SELECT Repo, Date, Checks FROM openssf.scorecardcron.scorecard_latest WHERE Repo=”github.com/kubernetes/kubernetes”‘You can also see the latest data on all Scorecards analyzed projects. This data is also available in the new Google Open Source Insights project and the OpenSSF Security Metrics project. The raw data can also be examined via data analysis and visualization tools such as Google Data Studio. With the data in CSV format, you can examine it with whatever your favorite data analysis and visualization tool may be.  One thing is clear from all this data. There’s a lot of security gaps still to fill even in widely used packages such as Kubernetes. For example, many projects are not continuously fuzzed, don’t define a security policy for reporting vulnerabilities, and don’t pin dependencies. According to Google, and frankly, anyone who cares about security: “We all need to come together as an industry to drive awareness of these widespread security risks, and to make improvements that will benefit everyone.” As helpful as Scorecards v2 is, much more work remains to be done. The project now has 23 developers, more would be welcomed.  If you would like to join the fun, check out these good first-timer issues. These are all accessible via GitHub.If you would like us to help you run Scorecards on specific projects, please submit a GitHub pull request to add them. Last but not least, Google’s developers said, “We have a lot of ideas and many more checks we’d like to add, but we want to hear from you. Tell us which checks you would like to see in the next version of Scorecards.” Looking ahead, the team plans to add:If I were you, I’d start using Scorecards immediately. This project can already make your work much safer and it promises to do even more to improve not only security for your programs but the programs it covers.Related Stories: More

  • 163 Shares199 Views

    in Information Technology

    NSA, FBI warn of ongoing brute force hacking campaign tied to Russian military

    A brute force password-hacking campaign led by Russian military intelligence tied to the group Fancy Bear has been targeting US and European organizations since mid-2019, said a joint advisory by the National Security Agency, the FBI, the Department of Homeland Security and the UK’s GCHQ on Thursday.

    National security officials said the exploitation is almost certainly ongoing and is part of a broader effort by Russia’s GRU and 85th GTsSS to obtain information on a wide range of sensitive targets.The attackers are using brute force techniques — in which repeated login attempts are used to uncover usernames, passwords and valid account credentials — to infiltrate the networks of government and private sector organizations including military defense contractors, energy and logistics companies, law firms, think tanks, media outlets and universities. While the brute force tactic is nothing new, the Russian hackers uniquely leveraged Kubernetes software containers to scale the brute force attempts, the advisory said. The attackers also attempted to evade detection by routing the Kubernetes brute force attacks through TOR and commercial VPN services.According to the advisory, GRU hackers are using compromised account credentials in conjunction with known software vulnerabilities, including exploits for Microsoft Exchange servers like CVE-2020-0688 and CVE-2020-17144, in order to gain access to internal servers. Once the attackers gain remote access, they’re combining a number of techniques to move laterally within the network and to access protected data, including email.”NSA encourages Department of Defense (DoD), National Security Systems (NSS), and Defense Industrial Base (DIB) system administrators to immediately review the indicators of compromise (IOCs) included in the advisory and to apply the recommended mitigations,” the advisory said. “The most effective mitigation is the use of multi-factor authentication, which is not guessable during brute force access attempts.”  More

  • 163 Shares169 Views

    in Information Technology

    Lorenz ransomware attack victims can now recover files with this free decryption tool

    Cybersecurity researchers have released a decryption tool which allows victims of Lorenz ransomware to decrypt their files for free – and crucially, without the need to pay a ransom demand to cyber criminals. This is particularly important for Lorenz, as bug in the ransomware’s code means that even if victims paid for the decryption key, some of the encrypted files can’t be recovered. But following analysis of the malware, researchers at Dutch cybersecurity company Tesorion found that were able to engineer a decryption tool for Lorenz ransomware – and now it’s available for free via No More Ransom. No More Ransom is a joint project by law enforcement agencies including Europol’s European Cybercrime Centre, along with partners across Europe in cybersecurity and academics, which aims to disrupt the business of ransomware gangs by providing decryption keys which allow victims to retrieve their files without paying a ransom. The decryption key for Lorenz ransomware is the 120th decryptor to be made available on No More Ransom since the project began in 2016. Lorenz ransomware first emerged in April this year and those behind it have targeted organisations around the world.   SEE: Cybersecurity: Let’s get tactical (ZDNet/TechRepublic special feature) | Download the free PDF version (TechRepublic)

    The cyber criminals behind Lorenz steal data before encrypting it and attempt to use this as additional leverage in the attack by threatening to publish the stolen information if the ransom isn’t paid. This double extortion technique has become common among the most successful ransomware operations. Typically, the cyber criminals behind Lorenz demand a ransom of between $500,000 and $700,000 in Bitcoin in exchange for the decryption key – but thanks to cybersecurity researchers at Tesorion and the No More Ransom initiative, those who fall victim to Lorenz can retrieve their files for free. However, the best way for organisations to prevent disruption from a ransomware attack is to avoid falling victim to one in the first place by having a sound cybersecurity strategy. Recommendations on how to achieve this from No More Ransom include regularly updating backups and storing them offline, so in the event of a ransomware attack, the data won’t be destroyed by cyber criminals. It’s also recommended that that organisations use robust antivirus software and that all software and operating systems across the network are up to date with the latest updates and security patches so that cyber criminals can’t exploit known vulnerabilities to gain access to the network to install ransomware. MORE ON CYBERSECURITY More

  • 113 Shares99 Views

    in Networking

    Surfshark VPN review: It's cheap, but is it good?

    If you’re in the market for a VPN — and you should be, if you don’t have that box ticked already — Surfshark is one of your top options. For some reason, Surfshark seems to have made a name for itself for being cheap.  Well, it is cheap — if you get the 24 month deal for $59.76. But Surfshark is better than cheap: it’s value for money.  

    Surfshark

    Locations: 108Countries: 65Simultaneous connections: UnlimitedKill switch: yesLogging: noPrice: $12.95/month, or 24 months for $59.76Trial: 30-day refund guaranteeSupported platforms: iOS, Android, macOS, Windows, Linux, game consoles, smart TVs, routers

    View Now at Surfshark

    Curious how many servers Surfshark has and how many countries it supports? Surfshark currently has over 3200 servers in 65+ countries, as per its own account, and the number is continuously growing. There are 195 countries in the world today, so 65 may seem small in comparison. But Surfshark has good population coverage — chances are the countries you are interested in are the list of supported ones.  Surfshark has multiple servers on each of the locations, which means better service quality. Plus, a neat feature Surfshark offers is that you can also select a specific city in many of those locations. You can find a complete list of locations here. How many devices can Surfshark support? If there’s one feature that sets Surfshark apart, this is probably it: unlimited device support. You can use Surfshark on as many devices as you please with just one account. This may be worth a bit of analysis, so here it goes. Surfshark has wide-ranging support for devices and operating systems, including game consoles and routers. This, coupled with unrestricted use on any number of devices, means that you can buy once, use it anywhere. 

    In practice, for most people, that won’t mean more than 5-10 devices. But the peace of mind and ease of use this provides is a key selling point, in our opinion. Why don’t other VPN providers do it, too, then? Good question. Perhaps it’s because they fear this could hurt their sales if people start sharing their accounts or their servers if people start connecting from all of their devices at once. These are legitimate fears, but they probably don’t play out very often in practice — otherwise, Surfshark would not be in business.
    Surfshark
    By definition, getting a VPN means you are at least partially concerned about privacy and anonymity. So sharing your account does not make much sense in that case, and we don’t imagine many VPN users do this. As about connecting from all of your devices at once, using your VPN..well, you don’t always need to have your VPN on, do you? And even if you do, it’s probably not very common to switch from one device to the other and also use the same server across devices. An exception to the above may be scenarios in which an account is shared among family members, which Surfshark actually promotes. Who knows, perhaps Surfshark is counting on complicated family relationships. If you feel like sharing your VPN with your family, however, Surfshark lets you do that. Where can you use Surfshark? Surfshark boasts wide coverage of operating systems and devices. It works on Windows PC, Mac, Android, Android TV, iOS, and Linux. We’ll be honest — we have not tried Surfshark it on every single one of those operating systems and devices. Where we did try it, however, what we got was more or less in line with our expectations. Things are pretty much straightforward when using Surfshark on Windows 10 and Android. However, if your main operating system is Linux, as is the case for us, using Surfshark is a bit trickier. But it’s still workable — we promise. Even though Linux distributions such as Mint have introduced a software manager which streamlines application installation, Surfshark won’t play nice with it. We don’t mind having to use the command prompt to install Surfshark, but having to run it via the command prompt too is a deal-breaker.
    Surfshark
    Fret not, however — browser extensions to the rescue. The inconvenience of having to fire up Surfshark via the command line on Linux actually forced us to work our way through Surfshark’s support for browser extensions.  In addition to desktop and mobile applications, Surfshark also comes in the form of browser plugins for the popular Chrome and Firefox browsers. As of March 2021, Google Chrome accounted for about 67% of the global desktop internet browser market share, while Firefox had about 8%. Whether that’s healthy is a different discussion. What this means for our purposes, however, is that installing Surfshark on Chrome as a plugin may be the most convenient way to use your VPN when browsing. Keep in mind, though; you may be trading some options for convenience. Installing and using Surfshark on Chrome Installing the Surfshark extension for Chrome is really no different than installing any other Chrome extension. the first thing you need to do is to find the Surfshark extension at the Chrome web store. You will find it here. Then Click Add to Chrome. A pop-up window will ask you to confirm the installation. Press Add extension, and that’s it. The Surfshark logo will now appear on your toolbar at the top right-hand corner of your browser. Installing Surfshark on Chrome is really easy, and using it is just as easy.  Start by clicking on the Surfshark icon at the top right of your browser. When you do that, a popup appears, prompting for your credentials. To be able to use Surfshark, you need to have signed up for an account first.
    Surfshark
    Surfshark’s Chrome extension has a clean and easy to use interface, and streaming is a breeze. We imagine most people will hit the Connect button right away, and it will work, but let’s take some time to go through the options first.  Before we do that, however, a word of caution, some features, most prominently the Whitelister and the KillSwitch, do not appear to be supported in the Chrome extension. The Whitelister lets you manually choose what apps and websites your VPN are active on. The KillSwitch automatically disconnects you from the internet if your VPN connection abruptly drops. If those are important to you, you should use the Surfshark application on your platform of choice instead of the browser extension. Surfshark settings and features: What works and what doesn’t Clicking the cog icon at the left opens up the Settings menu. General Settings lets users choose their language and appearance settings. In addition, you can choose whether you want Surfshark to connect on browser launch to prevent sites using WebRTC from being able to discover your IP and location and to block ads, trackers, and malware via the CleanWeb function.  There are also options for configuring your Account setting, which is pretty straightforward, and for getting Help — more on that later. But first, a word on some Surfshark features and settings that work, and some that don’t. WebRTC, short for Web Real Time Communications, is an open-source W3C standard API that enables browsers to do things such as voice and video calling without the use of plugins, and geo-location, apparently. It was introduced about 10 years ago and became a standard recently.  We are not sure how much adoption WebRTC has, how well its geo-location capabilities work, or how well Surfshark’s ability to prevent its work, either. If we extrapolate based on how well Connect on browser launch and CleanWeb work, we would not be too optimistic.
    Surfshark
    Connect on browser launch, and CleanWeb has simply never worked for us. CleanWeb does not seem to block any ads for us, really. As for connecting on browser launch — nope, you still have to do it manually. Does that really matter though? We can live without CleanWeb, to be honest. There is ample choice for ad blockers these days — even though one should always exercise caution — and we’ve already been using one. So for us, the fact that CleanWeb does not work is not a big deal. But it makes Surfshark look bad for no good reason really.  We figure the reason to include CleanWeb was to make Surfshark a one-stop shop for secure and ad-free browsing. That would be nice for people who have never heard of ad blockers. Perhaps this is a Chrome extension-specific or Linux-specific thing. But is it better to offer a built-in ad blocker that does not work or not to have one at all? Streaming on Surfshark Connect on browser launch not working is not a big deal either. Why do you ask? Because connecting is super easy. Did we mention — all you need to do is open the extension by clicking on its icon and then click the Connect button? That’s it.  Surfshark will connect to the fastest location available, and you can continue browsing. Your connection will now go through Surfshark’s server, and your location will appear like the one you have connected to. Surfshark shows both your assigned location and your assigned IP address. Now, for the million-dollar question: how does streaming work on Surfshark?  Most people interested in using a VPN service for streaming want to do this in order to bypass regional restrictions. An example of this would be Netflix only making certain shows available in certain parts of the world. 
    Surfshark
    By using a VPN service to connect, your connection appears as coming from the part of the world you are interested in, and you can bypass those restrictions. Let’s see how this works on Surfshark. It all comes down to making a choice of a location to connect from. At Surfshark’s main screen, all locations are listed alphabetically, so you can browse through them. In addition, a search box lets you type the location you are looking for, and auto-complete makes sure you get what you’re looking for quickly and easily. That really is all there is to it. After your connection has been established, you can browse the streaming content you are interested in and watch it without any issues. You can access all Netflix libraries with Surfshark, as well as every other streaming service we tried. Surfshark server capabilities Surfshark gives a couple of handy options to use when choosing a location to connect to. If you don’t particularly mind where you’re connecting from, you can let Surfshark choose for you the location that is the fastest or the one that is the closest to you. To do that, you just push the respective buttons. If you have a location that you use a lot, you can star it to mark it as favorite, and it will be pinned on top of the list. Typically the performance of each location fluctuates, depending on its workload at each point in time. Surfshark lets you get an idea about the workload each server has at a certain point in time by visualizing it. This is what the circles next to each location represent: an empty one means no workload, a full one means that the server at that location is running at its capacity.
    Surfshark
    Surfshark also offers a Static IP location and MultiHop location. Static IP means the location will always have the same IP address and won’t change even if you reconnect. MultiHop locations will connect via two countries, adding an extra layer of privacy and security. What Surfshark does not offer in its Chrome extension is the ability to choose an encryption standard. Surfshark supports IKEv2, OpenVPN, Shadowsocks, and WireGuard®. Those are touted as the best, fastest choice for mobile, a reliable open-source classic, a top choice in restrictive countries, and a sleek, modern, and secure option, respectively. If you have a preference on which standard to use, you will have to use Surfshark’s application to be able to choose. Customer support at Surfshark Another important aspect of every service is what happens if you need help and support. What do you do if you run into an issue with Surfshark? Honestly, in all the time we’ve been using Surfshark, we never had any issues. But we thought we’d come up with something, just to see whether Surfshark’s support would be able to deal with it. Here’s how it went. We came up with the question, “How do I watch Greek Netflix shows using Surfshark”? It’s a burning question you are dying to know the answer to; we know.  We navigated Surfshark’s Chrome extension, choosing the Help tab in Settings. From there, users can choose to Browse Surfshark’s Guides, or Get help now, which means being directed to chat with someone from Surfshark’s support team.
    Surfshark
    In fact, even the latter option prompts users to first search Surfshark’s guides in the hope that they may find their answer there. That’s a good policy. Surfshark’s search functionality is good but not perfect. It offers auto-complete, which helps a lot.  When searching for “Netflix Greece”, for example, we got some results. Some were relevant, some less so, and we had to search further to find a guide that includes a reference to Surfshark’s server in Greece. We headed to the chatbox either way, curious to see how our support request would be handled.
    Surfshark
    It was a great experience. The chatbox itself was easy to use, and there was zero waiting time. The support member who served our request was friendly, fast, concise, polite, and concise. We got our reply, thanked them, and left. That’s a top rating for support from us. If you ever need it, that is. Privacy There was one more thing worth highlighting while exploring Surfshark’s Help tab: its Privacy policy and Terms of service are both listed. We understand perfectly well these are not the types of documents most people read, but there’s a reason we make a point of that. First off, Surfshark makes it easier for you actually to read those documents. Each section in Surfshark’s Privacy policy and Terms of service starts with a neat summary of what the section is about. Even though a VPN service is among those whose Privacy policy and Terms of service are better read in full, we wish more services did what Surfshark does.
    Surfshark
    Why, do you ask, should you bother about Privacy policy and Terms of service? Well, if privacy and anonymity are your main motivation for using a VPN, these are kind of important. This is the part we like most about Surfshark’s Privacy policy: “We’re based in the British Virgin Islands, which allows us to keep our VPN logs-free. We don’t collect any information that could lead us to know who you are or what you’re up to online”. That works for us. And we find it more important than which encryption standard is used, for example. We also checked whether Surfshark could potentially reveal its connection as being untrustworthy to be on the safe side. We tried both DNSLeak.com and dnsleaktest.com, and Surfshark passed with flying colors. Speed Another thing that works for us is Surfshark’s speed. To be honest, we never did any detailed benchmarking on that because we did not have to. We liked the overall package and signed up for the 30-day free trial. It went fine, and we never observed any noticeable lag, so we went for it. Others did, however, and it turns out Surfshark is pretty fast compared to the competition. Connecting to any location is fast. And for all intents and purposes, browsing and streaming using Surfshark VPN works as well as it does without it. The one scenario we are not sure about is gaming, as this is not something we do. If you care about ping speeds, we suggest you test how well this works for you. Ping speed is an indication of how quickly a response gets back after a network request is sent from your computer. The lag limitations here are due to actual physics. If you’re sending a packet across the planet, it will take longer to hear back than if you’re sending a packet across town.

    What are the pros and cons Surfshark? Pros: Ease of useSupports unlimited devicesSpeedSupportPriceCons: Browser extensions do not offer a full range of options.Some features like CleanWeb and KillSwitch do not work at all on browser extensions.Requires 24-month subscription to unlock low price. The bottom line Although Surfshark is not the first VPN service we use, it’s the first one we actually paid for. Prior to Surfshark, we were using the VPN service provided by the Opera browser. Most of the time, that worked, but eventually, we wanted something with better and more consistent quality of service — and more options. We looked around a bit, tried some options, and decided to go with Surfshark. We have not regretted that, as it serves our needs well and offers good value for money. Its main drawback is that the browser extensions do not offer the full range of options that full-blown apps do, with the pinnacle of this being some features like CleanWeb and KillSwitch not working at all. Plus, if you don’t want to commit, then Surfshark is not so cheap anymore, as its super low price applies only to the 24-month subscription. If this is something you can live with, and you want a VPN service that is easy to use, works on all platforms, is cheap and has good support, then we can recommend Surfshark.

    ZDNet Recommends More

  • 125 Shares199 Views

    in Information Technology

    Microsoft reveals authentication failures, system hijack vulnerabilities in Netgear routers

    Microsoft has disclosed a series of vulnerabilities in Netgear routers which could lead to data leaks and full system compromise.

    On June 30, Jonathan Bar Or, a member of Microsoft’s 365 Defender Research Team, revealed the vulnerabilities, which were patched prior to public disclosure.  Bar Or said that the trio of bugs impacted DGN-2200v1 series routers — running firmware prior to v1.0.0.60 — which “opened the gates for attackers to roam untethered through an entire organization.” Microsoft’s security team discovered the vulnerabilities after noting strange behavior in the router’s management port. While communication was protected with TLS encryption, it was still flagged as an anomaly when machine learning models were applied.  Upon further investigation of the router firmware, the security researchers found three HTTPd authentication flaws.  The first allowed the team access to any page on a device — including those that should require authentication, such as router management pages — by appending GET variables in requests within substrings, allowing a full authentication bypass.  The second security flaw permitted side-channel attacks, and this was found in how the router verified users via HTTP headers. If exploited, attackers could extract stored credentials. 

    Finally, the third vulnerability utilized the prior authentication bypass bug to extract the router’s configuration restore file which was encrypted using a constant key, “NtgrBak,” allowing remote attackers to decrypt and extract stored secrets.  Netgear was made aware of the security issues privately through the Microsoft Security Vulnerability Research (MSVR) program.  The firmware vulnerabilities have been patched by Netgear, which issued a security advisory in December detailing the security flaws. The bugs have been assigned as PSV-2020-0363, PSV-2020-0364, and PSV-2020-0365 and have been issued CVSS severity scores of between 7.1 and 9.4, rating them critical.  Netgear recommends that customers install the latest firmware available for their routers by visiting Netgear Support, typing their model number into the search box, and downloading the newest firmware version. Alternatively, updates can be accessed via Netgear apps.  “The rising number of firmware attacks and ransomware attacks via VPN devices and other internet-facing systems are examples of attacks initiated outside and below the operating system layer,” Microsoft says. “As these types of attacks become more common, users must look to secure even the single-purpose software that run their hardware — like routers.”

    Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 63 Shares169 Views

    in Robotics

    Drone-based water sampling goes deep

    Water sampling and analysis methods today are logistically complex, labor-intensive, time-consuming, and costly. Could drones, which are relatively cheap provide part of the solution? After two years of research and development, a company called Reign Maker believes the answer is yes as it roles out the world’s first drone-based water sampling and data collection system, designed to increase sampling rates and accuracy while reducing reliance on field personnel and equipment, such as boats and boots.The solution is called Nixie, and the company claims it can increase sample rates by 75% while reducing costs by 90%. 

    [embedded content]

    “The New York City Department of Environmental Protection alone collects 14,000 water quality samples a year, collecting 30 samples a day using boats, captains, and a crew of three at an average cost of $100 per sample,” says founder and CEO Jessica Chosid. “With Nixie, a crew of two can collect 120 samples in the same seven-hour shift, at a cost as low as $10 per dip.”The drone collects samples by lowering EPA certified bottles exactly two feet under the water’s surface in currents up to 5 knots. The approach is important because it eliminates a common problem with manual sampling, which is that sediment and debris are often stirred up by technicians, reducing sampling accuracy. Nixie registers the GPS location and timestamps every sample it collects, allowing water managers to closely track changes in water chemistry by time and location.Applications include public-private utilities, oil & gas, environmental monitoring, mining, agriculture, and disaster and spill mitigation.The system currently supports DJI M600 and M300 RTK enterprise drone platforms, which it says have proven safety, reliability, versatility, and ease of use. DJI is currently on the U.S. Entity list.

    Drones of various kinds are being used more frequently for environmental and infrastructure monitoring. Singapore, for example, recently sent out drones to watch over its reservoirs and monitor water quality. Ocean-going sailing drones have also been deployed in aid of environmental monitoring. Nixie commercializes the approach with a new technology suite designed to be used in a number of sectors.”With Nixie, we are committed to changing how water is analyzed worldwide, one sample at a time,” said Jessica Chosid, Founder and CEO of Reign Maker. “Our mission is to remotely collect, digitize, and transform commercial,  industrial, and agricultural water management across the supply chain.” More

  • 188 Shares199 Views

    in Information Technology

    This major ransomware attack was foiled at the last minute. Here's how they spotted it

    A ransomware gang installed remote desktop software on over 100 machines across a network, and their plans to encrypt the network were only foiled at the last minute when cybersecurity experts were called into a company after suspicious software was found on its network. The efforts made by criminals to lay the foundations for a ransomware attack, which resulted in legitimate remote access software being installed on 130 endpoints, were discovered when security company Sophos was brought in to investigate the unnamed company after Cobalt Strike was detected on its network. 

    Cobalt Strike is a legitimate penetration testing tool, but it’s commonly used by cyber criminals in the early stages of a ransomware attack. One of the reasons it is used by cyber criminals is that is it partially runs in-memory, making it difficult to detect. SEE: Cybersecurity: Let’s get tactical (ZDNet/TechRepublic special feature) | Download the free PDF version (TechRepublic) The goal of the gang was to encrypt as much of the network as possible with REvil ransomware, but because the cyber criminals were detected before they could finalise their preparations, the attack wasn’t successful – although they managed to encrypt data on some unprotected devices and deleted online backups after they noticed they’d been spotted by investigators.  A ransom note left by REvil on one of the few devices that was encrypted revealed a demand of $2.5 million in bitcoin for a decryption key – although this wasn’t paid. But the attackers had managed to gain enough control of the network in the runup to install software on over 100 machines – and the company that was being targeted didn’t notice.

    “As a result of the pandemic, it’s not unusual to find remote access applications installed on employee devices,” said Paul Jacobs, incident response lead at Sophos. “When we saw Screen Connect on 130 endpoints, we assumed it was there intentionally, to support people working from home. It turned out the company knew nothing about it – the attackers had installed the software to ensure they could maintain access to the network and compromised devices.” This was just one of several methods that cyber criminals used to maintain their hold on the network, including creating their own admin accounts. But how did cyber criminals get onto the network in the first place in order to use Colbalt Strike, set up remote access accounts and gain admin privileges? “From what we have seen in our investigations, there is a variety of methods used, most commonly it is users being phished often weeks or months earlier, then there is the exploitation over firewall and VPN vulnerabilities or brute forcing RDP if it is exposed to the internet,” Peter Mackenzie, manager of Sophos Rapid Response told ZDNet.

    In this instance, the attempted ransomware attack wasn’t successful, but ransomware is so prolific at the moment, organisations are regularly falling victim. REvil, the ransomware used in the incident investigated by Sophos, was deployed in the successful ransomware attack against JBS, with the cyber criminals behind it making off with $11 million in bitcoin. SEE: Security Awareness and Training policy (TechRepublic Premium) However, there are steps that all organisations can take to avoid cyber criminals from being able to gain access to the network in the first place. “Firstly, ensure every single computer on your network has security software installed and managed centrally. Attackers love unprotected machines. Next, make sure they are getting patches regularly and remember if a computer hasn’t rebooted for a year, then it likely hasn’t applied any patches either,” said Mackenzie. But while using technology correctly can help protect against cyberattacks, it’s also useful to have eyes on the network. People who have a good understanding of what’s on the network can detect and react to any potentially suspicious activity – such as the use of Colbalt Strike, which resulted in the ransomware attack detailed in this case being discovered before significant damage was done. “For the best cybersecurity, you need people watching what is happening and reacting to it live, that is what can make the biggest difference,” said Mackenzie.

    MORE ON CYBERSECURITY More

  • 88 Shares119 Views

    in Information Technology

    Colombia police collar suspected Gozi Trojan distributor

    Law enforcement in Colombia has arrested an alleged cybercriminal who apparently acted as a distributor for the Gozi Trojan. 

    As reported by the Associated Press, Mihai Ionut Paunescu, also known as “Virus,” was one of three major suspects considered to be responsible for the spread of the virus that impacted over a million PCs between 2007 and 2012. He was recently arrested at Bogotá El Dorado international airport and faces extradition to the United States on charges of running a bulletproof hosting service. Paunescu was arrested in his home country in 2012, but the Romanian national was previously able to avoid extradition. Bulletproof hosting is commonly used by cybercriminals for backend infrastructure in the distribution of spam, malware, exploit kits, and to host stolen data. These murky online services are known for turning a blind eye to the activities of their customers. Paunescu faces allegations of computer intrusion and financial fraud at the Southern District Court of New York, according to Colombian state officials (translated).  First discovered in 2007, the Gozi banking Trojan was spread through weaponized .PDF documents attached to emails. Once downloaded, the malware would lurk in the background and harvest bank account information and account details, which were then sent to the Trojan’s command-and-control (C2) server for operators to use in accessing accounts and conducting fraudulent transactions. 

    Threat actors were able to ‘rent’ out the malware and its underlying infrastructure for $500 a week in what was an early form of today’s Malware-as-a-Service (MaaS) criminal setups. Gozi’s source code was leaked in 2010, leading to the creation of variants still in active use today.  In 2016, the Russian creator of Gozi, Nikita “76” Kuzmin, was sentenced in US court to 37 months behind bars and was ordered to pay close to $7 million in restitution after pleading guilty to various computer intrusion and fraud charges.  Another participant in the criminal ring, Latvian Deniss “Miami” Calovskis, was also sentenced in the same year. He served 21 months for writing web injects and contributing to Gozi’s code.  The FBI estimates that the malware caused victims losses amounting to tens of millions of dollars. NASA was one of the most high-profile victims.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More