Eliana Willis

More stories

  • 125 Shares169 Views

    in Information Technology

    Chinese hacking group impersonates Afghan president to infiltrate government agencies

    A Chinese-speaking hacking group is performing ongoing cyberattacks against the Afghan government by impersonating its president. 

    On Thursday, Check Point Research (CPR) said that the Office of the President of Afghanistan, representing President Ashraf Ghani, is being used as a lure in spear phishing emails designed to infiltrate government agencies in the country, of which a successful attack has led to the compromise of the Afghan National Security Council (NSC).It is thought that an advanced persistent threat (APT) group called IndigoZebra is responsible. The Chinese-speaking cyberattackers have targeted former Soviet Republics previously, as noted by Kaspersky.  Dupe email samples seen by the cybersecurity firm pretend to be from the president’s office and ask for an urgent review of modifications to a document relating to an upcoming press conference. The researchers say that these emails are sent from the compromised email inboxes of past, high-profile victims. 
    CPR
    The file is a password-protected .RAR archive named NSC Press conference.rar. If a victim opens the file, they receive a Windows executable (NSC Press conference.exe), which deploys a malware dropper and the “xCaon” backdoor which maintains persistence by setting a registry key. The backdoor is able to download and upload files, run commands issued through a command-and-control (C2) server, and steal data. Dropbox is being abused as a form of C2 server in the latest version of this backdoor, dubbed “BoxCaon” by CPR.

    Every victim secured by the threat actors is assigned a unique and pre-configured folder, named after a victim’s MAC address, which contains instructions for the malware and also acts as a storage bucket for exfiltrated data.  CPR says that by using the Dropbox API, this “masks their malicious activities, as no communication to abnormal websites takes place.” IndigoZebra will also deploy a NetBIOS scanner tool adopted by another Chinese APT, APT10/Stone Panda, and may maliciously execute network utility tools for reconnaissance in the quest for further targets.   Malware utilized by the group also includes Meterpreter, Poison Ivy, xDown, and the xCaon backdoor. CPR says that the APT in question is also likely responsible for attacks dating back to 2014, in which political entities in Kyrgyzstan and Uzbekistan were targeted.  “While the IndigoZebra actor was initially observed targeting former Soviet republics such as Uzbekistan and Kyrgyzstan, we have now witnessed that its campaigns do not dial down, but on the contrary — they expand to the new targets in the region, with a new toolset,” the researchers commented.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 163 Shares199 Views

    in Information Technology

    Robinhood ordered to pay $70 million over ‘harm’ caused to ‘millions' of traders

    The US Financial Industry Regulatory Authority (FINRA) has fined Robinhood close to $70 million for allegedly causing “significant harm” to “millions of customers.”

    On June 30, the regulator said that Robinhood, a commission-free stock trading app that promises to “democratize finance for all,” must pay a fine of $57 million and an additional $12.6 million in restitution, plus interest, to thousands of customers. According to FINRA, the penalty is the largest imposed on a company to date.  Robinhood has been accused of systematic failures including major outages in March 2020, as well as the impact on millions of customers who “received false or misleading information” from the company.  In addition, Robinhood allegedly allowed thousands of customers to trade options when it was not “appropriate” for them to do so — relying on an algorithm and bots to make this decision, rather than performing due diligence to determine eligibility.  FINRA says that these actions caused “widespread and significant harm.” In relation to the claim that users received false information, the regulator cited “negligent” communication sent to clients since 2016 — including whether or not users could place trades on margin, how much positive or negative buying power customers had, and what the risk of loss was in relation to some options trades and margin calls. 

    A tragic case was that of a user who took his own life in June last year after becoming confused concerning margins and securities purchases. The 20-year-old user’s account incorrectly showed a negative balance of $730,000. “Due to Robinhood’s misstatements, thousands of other customers suffered more than $7 million in total losses,” FINRA says. “As part of this settlement, Robinhood is required to pay more than $7 million in restitution to these customers.” Customers impacted by technical outages are eligible for over $5 million in damages.  Additionally, Robinhood has been held to account for allegedly failing to submit reports properly to FINRA between 2018 and 2020.  “Robinhood failed to report to FINRA tens of thousands of written customer complaints that it was required to report,” the regulator claims. “Robinhood’s reporting failures were primarily the result of a firm-wide policy that exempted certain broad categories of complaints from reporting, even though those categories fell within the scope of FINRA’s reporting requirements.” Robinhood has neither admitted nor denied the charges. FINRA’s penalty is the latest blow to the organization, which is already under scrutiny over the GameStop fiasco, in which Robinhood was accused of helping hedge funds by preventing users from trading in the stock during January. In a blog post on Wednesday, the trading app said that “we continue to grow and enhance our legal, compliance, and risk functions and programs, and have hired dozens of experienced professionals in the past year alone.” The company says that customer support services have been expanded — including those for clients able to perform options and margin calls — as well as increased phone support and new education resources. The root cause of the March 2020 outages is also being addressed.  “Our customers are at the forefront of every decision we make and we’re committed to making continuous improvements so that investing can be accessible to all,” the company added. Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 175 Shares189 Views

    in Information Technology

    eSafety says tweeting commisioner will not qualify as a formal Online Safety Act request

    Australian eSafety Commissioner Julie Inman Grant is set to receive sweeping new powers in early 2022 as part of the Online Safety Act that passed Parliament last month. Among other things, the new Act extends the Commissioner’s cyber takedown function to adults, giving the commissioner the power to issue takedown notices directly to the services hosting the content and end users responsible for the abusive content.The new powers have been labelled as overbearing. As one Twitter user put it, the Commissioner is imminently receiving the “master on/off switch to the internet”. Of concern to many is that it is not yet known what the test or criteria will be for determining if content warrants removal. There is much to take into account, especially when much of “Australian culture” includes the use of a curse word as a term of endearment; that tone, for example, can be hard to ascertain from a character-limited post.  The Act will formalise a voluntary scheme that eSafety has in place. The agency has received 3,600 adult cyber abuse-related requests since it began taking them informally in 2017. Only 72 of them, however, were considered by eSafety to be reaching its existing threshold for “real harm”. One of them, Inman Grant told the Senate in May, was “horrific”, and a few of them involved domestic violence and stalking.  This week, Inman Grant found herself amid a Twitter dispute when she stepped in to offer advice to an individual who explicitly tagged her for help. The incumbent eSafety Commissioner then allegedly blocked another individual who claimed they were simply disagreeing with the first individual’s vaccination opinions. “Part of eSafety’s role is to provide education, support, and advice. We frequently offer information to those in distress — including offering advice about using the reporting tools available on the platforms,” an eSafety spokesperson told ZDNet.”Although we don’t yet have laws in place that allow us to deal with serious adult cyber abuse, currently we can help informally by providing support and guidance on what to do.”The eSafety spokesperson did not respond to questions, however, on whether a banhammer would be waved in a short amount of time when the scheme is formalised.

    “In this case, the eSafety Commissioner was tweeted at by a person in distress, and the Commissioner provided our standard advice, including encouraging people to report an issue to the platform in the first instance,” they said. “This information is also available on the eSafety website, and advice that Twitter provides through its safety centre. This advice did not involve use of the Commissioner’s powers, as tweeting at us (as described above) does not constitute a report that enlivens our powers.”The spokesperson then reiterated the office would take its obligations seriously under the Act and said the new laws would be critical in helping more Australians who are experiencing online harm. They also said the complaints mechanism for reporting adult cyber abuse would be robust and that a simple tag of eSafety or the eSafety Commissioner in posts or comments on social media would not be treated as a formal report, as per its current practice.MORE ONLINE SAFETY ACTAI bias and discrimination aplenty: Australian Greens want Online Safety Bill repealedAustralian Greens have put forward an amendment that seeks to withdraw the Bill and have it re-drafted to address its rushed nature.Protecting women in the cloud: eSafety hopes the Online Safety Act will do just thatThe commissioner said a lot of online abuse is rooted in misogyny and intended to silence women’s voices. She hopes the new Online Safety Act will go some way to prevent such abuse.Australia’s eSafety and the uphill battle of regulating the ever-changing online realmThe eSafety Commissioner has defended the Online Safety Act, saying it’s about protecting the vulnerable and holding the social media platforms accountable for offering a safe product, much the same way as car manufacturers and food producers are in the offline world. More

  • 50 Shares129 Views

    in Artificial Intelligence

    Giving robots better moves

    For most people, the task of identifying an object, picking it up, and placing it somewhere else is trivial. For robots, it requires the latest in machine intelligence and robotic manipulation.

    That’s what MIT spinoff RightHand Robotics has incorporated into its robotic piece-picking systems, which combine unique gripper designs with artificial intelligence and machine vision to help companies sort products and get orders out the door.

    “If you buy something at the store, you push the cart down the aisle and pick it yourself. When you order online, there is an equivalent operation inside a fulfillment center,” says RightHand Robotics co-founder Lael Odhner ’04, SM ’06, PhD ’09. “The retailer typically needs to pick up single items, run them through a scanner, and put them into a sorter or conveyor belt to complete the order. It sounds easy until you imagine tens of thousands of orders a day and more than 100,000 unique products stored in a facility the size of 10 or 20 football fields, with the delivery expectation clock ticking.”

    RightHand Robotics is helping companies respond to two broad trends that have transformed retail operations. One is the explosion of e-commerce, which only accelerated during the Covid-19 pandemic. The other is a shift to just-in-time inventory fulfillment, in which pharmacies, grocery stores, and apparel companies restock items based on what’s been purchased that day or week to improve efficiency.

    The robot fleet also collects data that help RightHand Robotics improve its system over time and enable it to learn new skills, such as more gentle or precise placement. Process and performance data feed into the company’s fleet management software, which can help customers understand how their inventory moves through the warehouse and identify bottlenecks or quality problems.

    “The idea is that rather than looking at just the performance of a single operation, e-commerce firms can modify or overhaul the operational flow throughout the warehouse,” Odhner says. “The goal is to eliminate variability as far upstream as is feasible, making a simpler, streamlined process.”

    Pushing the limit

    Odhner completed his PhD in the lab of Harry Asada, MIT’s Ford Professor of Engineering in the Department of Mechanical Engineering, who Odhner says encouraged students to develop a broad familiarity with robotics research. Colleagues also frequently shared their work in seminars, giving Odhner a well-rounded view of the field.

    “Asada is a very well-known robotics researcher, and his early work, as well as the projects I worked on with him, are very much fundamental to what we’re doing at RightHand Robotics,” Odhner says.

    In 2009, Odhner was part of the winning team in the DARPA Autonomous Robotic and Manipulation Challenge. Many of the competing teams had MIT connections, and the entire program was eventually run by former MIT associate professor Gill Pratt. After making the semifinals of the MIT 100K competition in 2013 as “Manus Robotics,” the team was introduced to Mick Mountz ’87, founder of Kiva Systems (later acquired by Amazon), who encouraged the team to look at applications in supply chain and logistics.

    Today, a significant amount of RightHand Robotics employees and leadership come from MIT. MIT researchers also accounted for many early customers, buying components Odhner’s team had invented during the DARPA program.

    “Generally, we’ve been in such close proximity to MIT that it’s hard to avoid circling back there,” Odhner says. “It’s kind of a family. You don’t ever really leave MIT.”

    At the core of the RightH and Robotics solution is the idea of using machine vision and intelligent grippers to make piece-picking robots more adaptable. The combination also limits the amount of training needed to run the robots, equipping each machine with what the company equates to hand-eye coordination.

    “The technical part of what we do is we have to look at an unstructured presentation of consumer goods and semantically understand what’s in there,” Odhner says.

    RightHand Robotics also utilizes an end-of-arm tool that combines suction with novel underactuated fingers, which Odhner says gives the robots more flexibility than robots relying solely on suction cups or simple pinching grippers.

    “Sometimes it actually helps you to have passive degrees of freedom in your hand, passive motions that it can make and can’t actively control,” Odhner says of the robots. “Very often those simplify the control task. They take problems from being heavily over-constrained and make them tractable to run through a motion planning algorithm.”

    The data the robots collect are also used to improve reliability over time and shed light on warehouse operations for customers.

    “We can give people insights into their inventory, insights into how they’re storing their inventory, how they’re structuring tasks both upstream and downstream of any picking we’re doing,” Odhner says. “We have very good insight as to what may be a source of future problems, and we can feed that back to customers.”

    Odhner notes that warehouse fulfillment could grow to be a much larger industry if throughput were improved.

    “As consumers increasingly value the option of shopping online, more and more items need to get into a growing number of ‘virtual’ carts. The availability of people near order fulfillment centers tends to be a limiting factor for e-commerce growth. All of that is really indicative of a massive economic inefficiency, and that’s essentially what we’re trying to address,” Odhner says. “We are taking the least engaging tasks in the warehouse — things like sorter induction, where you’re just picking, scanning, and putting something on a belt all day long — and we’re working to automate those tasks to the point where you can take your people and you can direct them to things that are going to be more directly felt by the customer.”

    Odhner also says more automated fulfillment centers offer improved measures to protect worker health and safety, such as ergonomic stations where goods are brought to workers for specialized tasks and increased social distancing. Rather than reducing the number of people employed in a warehouse, he says, “Ultimately, what you want is a system with people working in roles like quality control, overseeing the robots.”

    Robots made easy

    This year, the company is introducing the third version of its picking robot, which ships with standardized integration and safety features in an attempt to make deploying piece-picking robots easier for warehouse operators.

    “People may not necessarily grasp the enormity of our progress in productizing this autonomous system, in terms of ease of integration, configuration, safety, and reliability, but it is huge because it means that our robot systems can be drop-shipped pretty much worldwide and get up and running with minimal customization,” Odhner says. “There is no reason why this can’t just come in a box or on a pallet and be set up by anyone. That’s our big vision.” More

  • 125 Shares119 Views

    in Information Technology

    New data security rules instituted for US payment processing system

    New data security rules governing how money changes hands in the US have gone into effect today, forcing major digital money processors to render deposit account information unreadable in electronic storage.The National Automated Clearinghouse Association (NACHA), the body that passed the rules, governs the ACH Network, the payment system that drives direct deposits and direct payments for nearly all US bank and credit union accounts. The national automated clearing house processes massive amounts of credit and debit transactions in the US and handles financial transactions for consumers, businesses, and federal, state, and local governments.Starting on June 30, if an account number is used for any ACH payment — consumer or corporate — it must be rendered unreadable while stored electronically, according to NACHA, which added that any place where account numbers related to ACH entries are stored is in the rule’s scope.”This includes systems on which authorizations are obtained or stored electronically, as well as databases or systems platforms that support ACH entries. As an example, for a Third-Party Service Provider whose client is a financial institution, these can include platforms that service ACH transaction warehousing and posting, and client information reporting systems,” NACHA explained. “For Originators and their Third-Party Service Providers, accounts payables and accounts receivables systems will be impacted, as may be other systems (for example, claims management systems for insurance companies).”The rule also applies to paper authorizations or other documents containing ACH account numbers that are scanned for electronic record retention and storage purposes.In 2020, there were almost 27 billion ACH Network payments made at a value of close to $62 trillion. The body processed $17.3 trillion just for Q1 of 2021 and managed the 110 million economic impact payments that came through direct deposit from the federal government.

    ACH Network has grown significantly over the years and set a record in February when it averaged more than 118 million payments per day. It set another record in March when ACH volume hit 2.7 billion payments, its largest monthly volume ever. In order to keep the data that is flowing through the system safe and secure, Nacha is requiring ACH originators and third parties that process greater than 6 million ACH payments annually to render deposit account information unreadable in electronic storage. It suggests organizations do this using encryption, truncation, tokenization, destruction, or having the financial institution store, host, or tokenize the account numbers.The first phase of the new rules took effect on June 30 but the second phase, which covers those with ACH volume of 2 million transactions or greater annually, will take effect on June 30, 2022.Those forced to make the changes initially asked for an extension in 2020 and were granted it. NACHA also said it will not enforce the rule “for an additional period of one year from the effective date with respect to covered entities that are working in good faith toward compliance, but that require additional time to implement solutions.””The new requirement applies to non-consumer Originators that are not Participating Depository Financial Institutions (as defined by the Nacha Operating Rules), and to Third-Party Senders and Third-Party Service Providers that perform any function of ACH processing on behalf of an Originator, Third-Party Sender, ODFI, RDFI, or ACH Operator,” NACHA said in a statement. “Financial institutions are not included within the scope of the new requirement to render ACH account numbers unreadable when stored electronically because they are already subject to rigorous data security requirements imposed by their regulators.” NACHA noted that access controls such as passwords do not meet the new standard. Disk encryption is an acceptable protection method only if additional, prescribed physical security steps are taken, the organization added. Alex Pezold, CEO of TokenEx, said his company was recently named as a NACHA Preferred Partner for ACH data security and is currently working with organizations to comply with the new rules. “In terms of ACH data, we render deposit account information (generally bank account and routing numbers) unreadable via tokenization, which is an example technology referenced by NACHA to help satisfy this new requirement,” Pezold told ZDNet. “This replaces the deposit account information with an irreversible token that can be safely stored in place of the original number to prevent data theft in the event of an exposure. The motivation for this change is to build on existing requirements to improve the security and efficiency of the ACH Network by introducing specific standards for the protection of deposit account information stored by originators, third-party service providers, and third-party senders.”Pezold added that it is still unclear what the specific fines or penalties will be but if an egregious violation occurs — a willful or reckless action that involves at least 500 entries or involves multiple entries in the aggregate amount of at least $500,000 — it can result in a $500,000 fine per occurrence and a suspension of use of the ACH Network.Some cybersecurity experts, like comforte AG product manager Trevor Morgan, said the best way to follow through with this rule would be through encryption or tokenization. The new rules, he said, force organizations to know precisely the data being handled, including ACH account information, and also where it is stored, how it travels, and who accesses it. “A complete solution to this problem would entail not only a protection method such as tokenization but also a broader capability to find and classify this type of information. Don’t assume that you know where all your sensitive ACH data is!” Morgan said. Oliver Tavakoli, CTO of Vectra, said similar rules have applied to banks and other financial institutions for a long time, but they are now being applied to large-scale users of banking services. Tavakoli suggested organizations either choose not to keep the data at all or have the financial institutions who are already set up to protect the data store it for them. Enterprises can also encrypt the data before storing it, truncate the data by keeping only the last 4 digits of an account number or obscure the information in some other way. Far too often, data troves are stored in clear text, making the new rules pushed by NACHA evermore important, according to Dirk Schrader, a vice president at New Net Technologies.”Implementing this requirement will likely be an issue for some financial institutions, depending on their data models,” Schrader said. “One solution can be based on HSMs, offloading much of the encryption work to specialized hardware.”Other experts said it took NACHA far too long to put rules like this in place. Netenrich threat intelligence advisor John Bambenek said ACH transactions are possible simply by knowing the account information of a person. “The fact that it’s 2021, and only now is basic security being required on processors of this information, just goes to show how truly insecure our financial transaction systems are,” Bambenek said. “Arguably, this has already been required by law and regulation for years, however, that it has to be reiterated demonstrates that the many companies processing large amounts of financial transactions are committed to doing absolutely nothing to protect consumers until they are forced to.” More

  • 150 Shares199 Views

    in Networking

    Microsoft acquires AT&T networking tech to bolster its Azure for Operators strategy

    Credit: Microsoft
    AT&T has been working with Microsoft for several years to test its 5G workloads on Azure. Today, June 30 — the last day of Microsoft’s fiscal 2021 — the pair announced the renewal of their partnership, with Microsoft acquiring AT&T’s carrier-grade Network Cloud platform technology. Does this mean Microsoft is becoming a mobile operator? No. Nor is AT&T getting out of the telco business. The Network Cloud Platform is what AT&T has used to run its 5G technology since 2018. Microsoft plans to take this Network Cloud platform, specifically the intellectual property and technical expertise around it — and bring it to its Azure for Operators telco offering, the pair said. “This move brings real-world production 5G workloads to Azure for Operators,” said Microsoft via a press release. Microsoft will make offers to the AT&T Network Cloud platform engineering team to move to work for Microsoft. Announced last year, Azure for Operators is about making Azure more appealing to telecommunication companies. Microsoft officials said at the time that it had no intentions to become a telco provider in its own right. Microsoft also bought a couple of 5G-centric companies in recent months — Metaswitch Networks and Affirmed Networks — to further bolster its ability to sell Azure to telcos. Telecommunications is one of Microsoft’s key vertical markets. The company already counts NTT, Vodafone, T-Mobile, Verizon Business, Deutsche Telekom, Telefonica, and Telstra, along with AT&T, as partners and/or customers in this space.Today, AT&T officials said they are moving their 5G mobile network to Microsoft’s cloud, which provides a path for all of its mobile network traffic to be managed using Azure technologies. The first piece to be moved will be AT&T’s 5G core, which connects mobile users and IoT devices with Internet and other services. In 2019, Microsoft and AT&T announced Azure technology would be woven into AT&T’s 5G and edge networks, so that AT&T’s virtualized 5G core Network Cloud will be able to deliver Azure services to customers. Today’s announcement advances the original 2019 deal between the two companies. More

  • 63 Shares189 Views

    in Information Technology

    Major Linux RPM problem uncovered

    In 1995, when Linux 1.x was the hot new Linux kernel, early Red Hat founding programmers Marc Ewing and Erik Troan created RPM. This software package management system became the default way to distribute software for Red Hat Linux-based distributions such as Red Hat Enterprise Linux (RHEL), CentOS Stream, AlmaLinux OS, and Rocky Linux. Unfortunately, hidden within its heart is a major security hole. 

    Dmitry Antipov, a Linux developer at CloudLinux, AlmaLinux OS’s parent company, first spotted the problem in March 2021. Antipov found that RPM would work with unauthorized RPM packages. This meant that unsigned packages or packages signed with revoked keys could silently be patched or updated without a word of warning that they might not be kosher. Why? Because RPM had never properly checked revoked certificate key handling. Specifically, as Linux and lead RPM developer Panu Matilainen explained: “Revocation is one of the many unimplemented things in rpm’s OpenPGP support. In other words, you’re not seeing a bug as such; it’s just not implemented at all, much like expiration is not.” How could this be? It’s because RPM dates back from the days when getting code to work was the first priority and security came a long way second. For example, we don’t know whether the first RPM commit was made by Marc Ewing or Erik Troan because it was done as root. Those were the days! Things have changed. Security is a much higher priority.  Antipov, wearing his hat as a TuxCare (CloudLinux’s KernelCare and Extended Lifecycle Support) team member, has submitted a patch to fix this problem. As Antipov explained in an interview: “The problem is that both RPM and DNF, [a popular software package manager that installs, updates, and removes packages on RPM-based Linux distributions]  do a check to see if the key is valid and genuine but not expired, but not for revocation. As I understand it, all the distribution vendors have just been lucky enough to never have been hit by this.” They have indeed been lucky. Armed with an out-of-date key, it could be child’s play to sneak malware into a Linux desktop or server. 

    Joao Correia, a TuxCare Technical Evangelist, asked: “Do you know how long it takes for the distros to pick up the changes that are submitted to the code repositories?” Antipov replied: That’s hard to know. In general, the problem is that crypto is hard. It takes a special background, some special experience, and so on. Package management projects are doing package management, not crypto, so they don’t want, and don’t need to, develop their own crypto libraries to include RPM and DNF. I’m not an expert in the crypto field to be able to fix current DNF and RPM issues. I’ve used the RNP library, a well-known library in the open-source world, already used in Mozilla Thunderbird, for example, but the library itself is not a part of Red Hat or any other RPM-based Linux distribution. So to take my fix as is, for the moment, they need to add it to the library first. This is not so quick, so it’s hard to say how long it will take. He fears though it may be months before the fix is released. At the moment, the security hole is still alive, well, and open for attack. Antipov and his team are considering opening a Common Vulnerabilities and Exposures (CVE) about the issue since, in the end, it’s clearly a security issue.  If I may be so bold: File a CVE with Red Hat. This needs fixing, and it needs fixing now. In the meantime, administrators of RPM-based systems will need to take a closer look at the patch programs to make sure they are legitimate patches. Related Stories: More

  • 100 Shares159 Views

    in Networking

    Best mesh Wi-Fi system 2021: Top routers compared

    Demand for fast and reliable Wi-Fi is probably at an all-time high, as millions of people continue to work from home, relying on Zoom and other video conferencing apps to keep in touch with colleagues and clients. Many organizations are also finding that video calls reduce the need for business travel and client visits. That increased reliance on Wi-Fi can reveal problems, though — especially in larger offices or homes, where the Wi-Fi signal may struggle to reach more distant rooms on other floors. Instead of relying on a conventional Wi-Fi router and access points or range extenders, an alternative solution is to opt for a “mesh” networking system. Depending on the size of the building, mesh systems typically use a main router with a wired connection to a broadband modem, plus two or more wireless nodes that can be placed in different rooms or locations. The main router and the satellite nodes form their own “mesh” Wi-Fi network, covering a wider area and delivering greater speed and reliability than a conventional Wi-Fi router, even with extra access points or range extenders. Most mesh systems are aimed at home users and marketed as easily-configured solutions for “whole home Wi-Fi,” but some are particularly suitable for business users. These can include features such as multiple Ethernet ports, or the ability to create several networks with different passwords. The latest mesh systems are now adopting the new Wi-Fi 6 standard (aka IEEE 802.11ax), which is certainly worth considering for businesses wanting to maximize the performance and flexibility of their Wi-Fi setups.

    Two-piece tri-band Wi-Fi 6

    Images: Asus

    Asus claims that the AX6100 Wi-Fi System is the “world’s first Wi-Fi 6 mesh system” — a claim that will doubtless be questioned by a few of its rivals. Nonetheless, the AiMesh AX6100 is an impressive mesh system that will be suitable for larger office buildings or public venues such as hotels or warehouses.You can buy a single RT-AX92U router for $229.99, which offers tri-band Wi-Fi 6 (802.11ax) with a top speed of 6.1Gbps, as well as four Gigabit Ethernet ports for wired connections. Or, for more extensive Wi-Fi coverage, there’s this twin-pack mesh system currently priced at $340.99. This covers areas of up to 5,500 square feet and uses one of the 5GHz bands as a 4.8Gbps “backhaul” that links the two routers in order to provide strong performance across the entire network. The price is similar to that of other high-end Wi-Fi 6 systems, but Asus also offers its ZenWifi range of mesh systems for smaller offices or working from home, including new Wi-Fi 6 models such as the affordable ZenWifi AX Mini ($279.99 for a three-pack system).

    Two-piece tri-band Wi-Fi 6

    Images: BT

    BT is still the dominant force in the UK telecoms market, providing broadband services to millions of businesses and home users. That makes its range of Whole Home Wi-Fi mesh systems an obvious upgrade for many BT customers. (BT also points out that the system is compatible with broadband services from other providers, too.)The standard Whole Home Wi-Fi is an affordable option, starting at £104.16 (ex. VAT; £124.99 inc. VAT) or $174 for a two-piece system using 802.11ac Wi-Fi. But BT has also released a high-performance premium model that steps up to the latest Wi-Fi 6 (802.11ax) standard. It’s still competitively priced (and occasionally on sale, as in the link below), starting at £191.67 (ex. VAT; £229.99 inc. VAT) or $320 for a mesh system with two of BT’s distinctive “disc” routers. The Premium model is a tri-band system (2.4GHz 802.11n, 5GHz 802.11ac, 5GHz 802.11ax/Wi-Fi 6), with a combined top speed of 3700Mbps. Each router also has two Gigabit Ethernet ports for wired connections.There are three- and four-piece systems also available for larger buildings, and BT’s website has a useful “selector” tool that can help you choose the best option for your home or office.

    $285 at Amazon

    PowerLine dual-band Wi-Fi 5 systems

    Images: Devolo

    Mesh networking systems can be pretty expensive, and if you’re just having trouble with the Wi-Fi signal in one room then a range extender is an affordable option that can boost the Wi-Fi signal in just that specific location. Alternatively, you could use a PowerLine adapter to send a wired network connection over your home or office electrical wiring — an ingenious and somewhat magical solution.Several companies make range extenders and PowerLine adapters, but Devolo specializes in this area with its extensive Magic range of devices. Devolo’s latest Magic 2 adapters combine a Wi-Fi range extender with PowerLine wired connectivity, and are compatible with existing routers from other manufacturers. Unlike conventional range extenders, Devolo’s Magic adapters also include a “mesh” option that allows you to link two or more devices in different rooms in order to create a more extensive Wi-Fi network.Devolo offers the Magic 2 Wi-Fi Next starter kit with two adapters (a Magic 2 LAN adapter that plugs into your broadband modem, and a Magic 2 Wi-Fi Next adapter) priced at £141.67 (ex. VAT; £169.99 inc. VAT) or $236. This supports dual-band 802.11ac Wi-Fi at up to 2400Mbps, and will boost Wi-Fi coverage in a room or floor, covering an area up to 120 square meters. Additional Wi-Fi Next adapters cost £91.67 (ex. VAT; £109.99 inc. VAT) or $152; there’s also a three-piece Wi-Fi Next Whole Home Kit, which costs £224.99 (ex. VAT; £269.99 inc. VAT).

    Devolo (UK)

    $179 at Amazon

    Two-piece 802.11s system

    Images: Google/Nest

    The original Google Wifi mesh system got very good reviews when it was first launched in 2016, and it helped to introduce mesh technology to a mainstream audience. The original Google Wi-Fi product has since been discontinued, but its successor emerged at the end of 2019 as part of the Google-owned Nest range of smart home devices.The two-piece Nest Wi-Fi system shown here consists of a primary Nest Wi-Fi router (110mm diameter, 380g) which plugs into your broadband modem and a secondary Nest Wi-Fi point (102.2mm diameter, 350g). This system, which costs $269, provides dual-band 802.11s Wi-Fi (a mesh-oriented variation of standard 802.11ac) with the main router running at 2200Mbps. The Wi-Fi point runs at a more modest 1200Mbps, but that should still be more than adequate for streaming video, music, or Zoom calls with colleagues.The Wi-Fi point also includes a speaker and microphone that support the voice-controlled Google Assistant. The two-piece system should be able to cover homes of up to 3,800 square feet (353 square meters), Google says, and you can purchase additional Wi-Fi points for $149 if required, each of which can cover an additional 1,600 square feet (149 square meters).

    Tri-band Wi-Fi 6E

    Images: Linksys

    This is another “first,” with Linksys claiming to be the first company to ship a mesh system that supports the new Wi-Fi 6E standard, which can use the 6GHz frequency band in addition to existing 2.4GHz and 5.0GHz bands.The tall, white plastic design looks very similar to Linksys’s popular Velop mesh systems, and houses no less than 12 internal antennae, powered by a 2.2GHz quad-core processor. However, Linksys has clearly decided that this new Wi-Fi 6E system deserves a powerful new name befitting its high-performance credentials — hence the Linksys Atlas Max 6E.Prices start at $499.99 for a single Atlas router, which provides tri-band Wi-Fi 6E with a top speed of 8.4Gbps (referred to as AXE8400). To match its high-end wireless speed, the Atlas also includes a 5-Gigabit Ethernet port for your internet connection, along with four Gigabit Ethernet ports for devices that require a wired connection. There’s also a USB 3.0 port for connecting USB storage devices that can be shared on the network.One Atlas router can cover an area of up to 3,000 square feet, but there’s a two-pack mesh system available for $899.99, or a three-pack for $1,199.99 (UK pricing TBA), with professional installation also available for business users. And, of course, the existing Velop range continues to be available for smaller offices or working from home.

    $499 at Linksys

    Two-piece tri-band Wi-Fi 6 system

    Images: Netgear

    Netgear’s Orbi range of mesh systems includes a variety of different designs and price points — including the Orbi Voice with a built-in smart-speaker that supports Amazon Alexa. The Orbi Wi-Fi 6, as the name suggests, employs the latest Wi-Fi 6 technology (aka 802.11ax).The Orbi Wi-Fi 6 System AX6000 is very much a top-of-the-range mesh system, starting at $699.99 for a two-piece system comprised of a primary router and a secondary satellite. It offers impressive performance, though, with tri-band Wi-Fi capable of a combined top speed of 6Gbps — twice that of even the fastest Orbi systems based on Wi-Fi 5/802.11ac.It’s fast when it comes to wired connections too, with the primary router including a 2.5Gbps WAN port for a high-speed internet connection for office networks, along with four Gigabit Ethernet ports on both router and satellite for wired connections. The two-piece system is designed to cover buildings of up to 5,000 square feet. There’s also a three-piece system that covers up to 7,500 square feet, but it won’t leave you much change from £1,000/$1,400.

    Two-piece tri-band Wi-Fi 6 system

    Images: Netgear

    Last year, Netgear’s Orbi Pro was one of the few mesh systems specifically designed for business users, and stood out by allowing business users to set up three separate networks for IT staff, employees, and guests who may be visiting offices or retail locations. The original Orbi Pro model, using 802.11ac (now known as Wi-Fi 5), is still available but, as the name suggests, the new AX6000 Tri-Band Orbi Pro Wi-Fi 6 ups the ante in terms of both Wi-Fi performance and features. Orbi Pro mesh systems consist of a primary router with either one, two, or three additional satellites that help to extend the range of your new mesh network. Prices start at $769.99 for a two-piece mesh system with one router and one satellite. That system supports tri-band Wi-Fi 6 with a maximum speed of 6Gbps, and the ability to cover areas of up to 6,000 square feet. Both router and satellite also include four Gigabit Ethernet ports and one 2.5Gbps — although the router will need to use the latter for your main internet connection. For larger premises, there are systems available with two or three satellites, with the top-end bundle bringing the price to a hefty $1,489.99. This latest model also adds a fourth network (SSID) option, which could be reserved for Zoom calls or managing smart IoT devices.

    View Now at Netgear

    Two-piece dual-band Wi-Fi 6 system

    Images: Netgear

    The tri-band Orbi Pro provides impressive Wi-Fi 6 performance, and is well-suited for organizations that need to manage multiple networks with different groups of users. It’s pretty expensive, though, so Netgear recently introduced the more affordable dual-band Orbi Pro Wi-Fi 6 Mini for small businesses and remote workers. Like other Orbi systems, the Mini consists of a primary router, with either one or two additional satellites that are used to extend the range of the mesh network. Prices start at $299.99 for a system consisting of a router and one satellite. Both devices provide dual-band Wi-Fi 6 (802.11ax) running at 1.8Gbps, which isn’t going to win any awards, but is still perfectly adequate for Zoom calls and some after-hours Netflix video or gaming action. Each device has four Gigabit Ethernet ports for wired connections, although the primary router will need to use one of those ports for your internet connection. Customers in the UK can also opt for a three-pack system that consists of a router and two satellites for £324.67 (ex. VAT, or £389.60 inc. VAT). The three-pack is currently on pre-order in the US (until July), priced at $399.99. The Orbi Pro Mini is still relatively expensive for a dual-band system, but like other Orbi Pro models, the Mini stands out with additional features that cater specifically to business users. The key feature here is the ability to create four separate networks, each with its own password, which allows you to provide different levels of network access for admin and IT staff, guests who may be visiting your office or other public venues. And, when working from home, you can reserve one network to ensure that your Zoom calls aren’t affected by family members bingeing on Netflix or the kids’ gaming console.

    $300 at Amazon

    $366 at Walmart

    Dual-band Wi-Fi 6 systems

    Images: TP-Link

    TP-Link’s Deco range can be a little confusing at times, with many different models that all share the same distinctive cylindrical design (there’s even a model with a built-in microphone for Alexa voice controls), so it’s important to pay close attention to the model numbers when buying. The Deco M4 that we reviewed last year is still available and provides a very affordable mesh system for home users and small businesses that only need modest 802.11ac (Wi-Fi 5) performance. But, of course, the latest Deco models offer Wi-Fi 6 (a.k.a. 802.11ax), with the new Deco X60 offering a good mid-range option at a competitive price. Customers in the US get the best deal, as a two-piece X60 system covering up to 5,000 square feet currently costs just $209.99, compared to £270.99 (inc. VAT) in the UK. However, UK customers get an additional option that doesn’t currently seem to be available in the US (on Amazon, at least), with a three-piece system covering 7,000 square feet for £374.45 (inc. VAT). Both options provide dual-band Wi-Fi 6 running at 3Gbps, which should be able to cope with Zoom calls and other bandwidth-hungry tasks with no trouble at all. The only sign of cost-cutting is the modest pair of Gigabit Ethernet ports provided by each unit. And, since one router will need to use one of those ports for your internet connection, the Deco X60 might not be the best option for users who need additional wired connections for laptops and other devices.

    TP-Link (UK)

    $209 at Amazon

    Three-piece dual-band Wi-Fi 5 system

    Images: Ubiquiti

    Ubiquiti’s AmpliFi HD is a neatly designed mesh Wi-Fi system whose ease of use will appeal to a wide range of users.Most mesh systems use two or more identical-looking routers, but the AmpliFi HD takes a more imaginative approach — perhaps inspired by founder Robert Pera’s previous job at Apple. The three-piece AmpliFi HD system includes a primary router that consists of a compact 4-inch cube with a touch-sensitive LED display giving quick access to the main network settings. This is backed up by two larger “mesh points” that plug directly into a mains power socket in rooms where your Wi-Fi needs a boost.Other aspects of the design are more conventional, utilizing dual-band 802.11ac Wi-Fi with a top combined speed of 1750Mbps. The AmpliFi HD costs a rather hefty $340, but its attractive design and simple controls help it to stand out from its many mesh rivals. There’s also a more affordable model, called AmpliFi Instant.

    $179 at Amazon

    $231 at Walmart

    Why should you buy a mesh system?

    A single, standalone router is generally adequate for smaller offices, or single-story homes with one or two bedrooms. But if you have rooms on other floors, or thick walls that can block your Wi-Fi signal, then you may experience “dead zones” that have weak Wi-Fi. A mesh system uses several devices — usually a main router and one or more satellite nodes — in different locations to extend the Wi-Fi signal beyond the range of a single router.

    How many mesh devices do I need?

    A two-piece mesh should be able to cover homes or offices up to 4,000 – 5,000 square feet (check the manufacturer’s specifications to see what they recommend). Buildings or outdoor venues larger than 5,000 square feet may need another satellite device.

    What about range extenders?

    If you just have one or two rooms where the Wi-Fi is weak, then a low-cost “range extender” may be able to boost the Wi-Fi signal just in those rooms, with prices starting as low as £50 ($69). However, multi-device mesh Wi-Fi systems are designed to provide a more extensive Wi-Fi network that covers your entire home or office.

    Which is the right mesh system for you?

    As mentioned, the size of your home or office building is the key factor in choosing a mesh system. The good news here is that even less-expensive mesh systems that still use older Wi-Fi 5 networking are fast enough to cope with Zoom calls, music, video, and gaming. However, more expensive Wi-Fi 6 systems can offer increased speed, and are also more efficient at streaming data to multiple connected devices all at the same time. So, as well as providing greater speed, Wi-Fi 6 systems are the best option for homes or offices that have lots of computers, mobile devices, and IoT devices that are in use all day long.

    How did we choose these mesh Wi-Fi systems?

    We’ve focused on two key areas, starting with affordable systems that simply provide greater range and reliability than a single, conventional Wi-Fi router. However, we’ve also included a number of high-end mesh systems — primarily using the new Wi-Fi 6 standard (802.11ax) — that provide greater performance than older Wi-Fi 5 (802.11ac) routers. As well as being suitable for homes and offices, these high-end systems also offer greater range and reliability for buildings such as warehouses and public venues such as restaurants and hotels.

    ZDNet Recommends More