More stories

  • in

    IT, healthcare and manufacturing facing most phishing attacks: report

    A new report from cybersecurity firm Avanan found that their customers in the IT, healthcare and manufacturing industries were facing the highest number of phishing emails. The company’s researchers examined more than 905 million emails for the 1H 2021 Global Phish Cyber Attack Report, finding that the IT industry specifically saw 9,000 phishing emails in a one month span out of almost 400,000 total emails. Their healthcare industry customers saw more than 6,000 phishing emails in one month out of an average of over 450,000 emails and manufacturing saw a bit less than 6,000 phishing emails out of about 330,000 total emails. 

    ZDNet Recommends

    Avanan researchers said these industries are ripe targets because of the massive amount of personal data they collect and because they are often stocked with outdated technology that can be easily attacked. Gil Friedrich, CEO of Avanan, said the report highlighted the perilous situation facing thousands of hospitals around the world. “The Avanan research shows that hackers are using one of the most basic tactics to get in ‒- phishing attacks,” Friedrich said.About 5% of all emails are phishing, according to the report, and many hackers are now attempting to target “low-hanging fruit” as opposed to more important C-level executive accounts. Most phishing attacks involve either impersonation or credential harvesting, the researchers found. More than half of all phishing attacks involve credential harvesting and that figure has grown by almost 15% since 2019. About 20% of all phishing attacks are related to Business Email Compromise. 

    Non-executive accounts are targeted 77% more than other accounts, the report said, and nearly 52% of all impersonation emails are pretending to be from a non-executive account at an enterprise. “There are a few reasons behind this. One, security admins might be spending a lot of time providing extra attention to the C-Suite and hackers have adjusted. Two, non-executives still hold sensitive information and have access to financial data. There is no need to go all the way up the food chain,” Avanan researchers said. Avanan works as a second layer of defense behind Microsoft’s EOP, ATP/Defender, Google Workspace and other tools. The report said more than 8% of all phishing emails managed to get past the first layers of defense and into people’s inboxes “because of an allow or block list misconfiguration, a 5% increase from last year, and 15.4% of email attacks are on an Allow List.””The most commonly used tactic is using non-standard characters and limited sender reputation. Non-standard characters are used in 50.6% of phishing links and 84.3% of phishing emails do not have a significant historical reputation with the victim,” the report said. Avanan researchers also noted the Junk Email folder in many inboxes has become a haven for phishing emails, confusing many users who look through their Junk folders for marketing emails and subscriptions. The report said SCL scores of 5,6, and 9 will be sent to a Microsoft user’s Junk folder, leaving them alongside more legitimate emails offering deals and other things. “You now have monthly subscriptions, newsletters, and targeted phishing attacks in your spam folder, and you have to leave it up to the end-user to decide which ones are safe to open,” one unnamed CIO told Avanan researchers. The same happens for Google users but Microsoft users see 89% more emails in Junk than Google does, according to the report. “An easy way to determine if an email is suspicious is by looking at sender reputation. It’s no wonder, then, that 84.3% of all phishing emails do not have a significant historical reputation with the victim. Further, 43.35% of all phishing emails come from domains with very low traffic,” the report said.  More

  • in

    This VPN service used by ransomware gangs was just taken down by police

    An underground virtual private network (VPN) service used by cyber criminals to hide their activities while conducting ransomware attacks, phishing campaigns and other malicious hacking operations has been taken down in a major international law enforcement operation. DoubleVPN offered users the ability to mask their locations and identities, allowing cyber criminals to carry out activities anonymously, according to police.

    ZDNet Recommends

    Now its servers and web domains have been seized by a coordinated law enforcement takedown led by the the Dutch National Police (Politie) and involving agencies including Europol’s European Cybercrime Centre (EC3), Eurojust, the FBI, and the UK National Crime Agency. SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)    DoubleVPN was heavily advertised across Russian and English-speaking dark web cybercrime forums as means for criminals, including ransomware gangs and phishing operations, to hide their activities, according to Europol. The cheapest VPN connection on offer cost just $25, while more expensive services offered what’s described as double, triple and even quadruple VPN connections to criminal clients. Servers hosting DoubleVPN around the world have been seized and web domains relating to the service have been replaced with a takedown notice, reading: “On 29th of June 2021, law enforcement took down DoubleVPN. Law enforcement gained access to the servers of DoubleVPN and seized personal information, logs and statistics kept by DoubleVPN about all of its customers. Double VPN’s owners failed to provide the services they promised.” Dutch public prosecutor Wieteke Koorn said: “This criminal investigation concerns perpetrators who think they can remain anonymous, while facilitating large-scale cybercrime operations.

    “By taking legal action, including the special investigatory power for digital intrusion, we want to make it very clear there cannot be any safe havens for these kind of criminals. Their criminal acts damage the digitalised society and erode the trust of citizens and companies in digital technologies, therefore their behaviour has to be stopped,” she added. The joint operation involved more than 30 coordination meetings and four workshops to prepare for the final stage of the takedown that was organised on the day the via virtual command post was set up by Europol. SEE: Ransomware: Paying up won’t stop you from getting hit again, says cybersecurity chief “Law enforcement is most effective when working together and today’s announcement sends a strong message to the criminals using such services: the golden age of criminal VPNs is over. Together with our international partners, we are committed to getting this message across loud and clear,” said Edvardas Šileris, head of Europol’s EC3. Law enforcement services from Germany, Canada, Sweden, Italy, Bulgaria and Switzerland also participated in the takedown, which was was carried out following the the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).

    MORE ON CYBERSECURITY More

  • in

    Singapore startup touts need to mitigate risks, automate cloud security

    Every business, large of small, is a target of cybercriminals and should look at minimising security risks, not simply preventing them. This is essential as more businesses move to the cloud and organisations in Asia largely still lack an urgency in addressing security. Unlike their peers in the US, where enterprises across most sectors considered security as part of their business process, Asia-Pacific companies had yet to do so, said Paul Hadjy, CEO and co-founder of Horangi. The Singapore-based security startup’s flagship product, Warden, is a cloud security posture management software touted to safeguard against misconfigurations and compliance breaches. Likely distracted by having to keep the business running and day-to-day management, Hadjy noted that Asia-Pacific organisations generally did not regard security as topmost on their agenda when it would be commonly discussed at every meeting in the boardroom and amongst C-level executives in the US. 

    This was changing, though, he said, adding that focus on security would intensify as more regulations were introduced around the use of cloud and businesses would be concerned about staying in compliance.And they would reasons to be anxious. By 2023, at least 99% of cloud security failures were projected to be the customer’s fault, according to Gartner. The research firm also predicted that half of enterprises this year would unknowingly and erroneously expose some cloud services or applications to the public internet, including storage, APIs (application programming interfaces), and network segments. Hadjy noted that most customers Horangi worked with had no prior cloud security framework in place. “If you’re not using a cloud security platform, you’re going to have issues because you don’t have visibility across the cloud architecture,” he said. “You can use tools to do so manually, but you’ll need to repeatedly follow [the steps] to do so when you use different cloud platforms.”He stressed the need for proper security and processes, such as patch management, to be in place to address any potential misconfigurations. 

    He warned that no business today was too small to be a target and all were at risk of cybersecurity attacks. Hackers also would target organisations that did not take security seriously. Technology, too, was no different from any other business, with opportunities for mistakes to be made, he said, especially if there was no automation involved. IT environments also could become challenging to manage over time, with organisations challenged to manage systems and software that were more than a decade old alongside modern applications running on cloud.Hadjy added that the move to remote work further complicated IT infrastructures, where traditional methods of ring-fencing corporate networks were no longer effective as more employees worked from home. Noting that no security solution was perfect, he noted the need for organisations to focus on mitigating risks and their ability to react quickly to reduce their risks should they suffer a security breach. Founded in 2016, Horangi last month was added to Amazon Web Services’ (AWS) ISV Accelerate programme, having obtained the cloud vendor’s security competency status. The Singapore startup last year secured $20 million in Series B funding, adding to its Series A $3.1 million haul, and might embark on another fund-raising initiative this or next year, Hadjy told ZDNet.Horangi’s Warden is pitched as a multi-cloud security platform designed to automatically safeguard against misconfigurations and compliance violations. It identifies “critical cloud resource configurations that may become entry points for attackers”, according to the startup. RELATED COVERAGE More

  • in

    South Korea to allocate more 5G spectrum in November

    South Korea’s Ministry of Science and ICT has announced it will allocate 28GHz and sub-6GHz spectrum in November to promote 5G-related services in the country. The spectrum will be open to telcos and non-telcos alike. The ministry will make 600MHz of the 28GHz band and 100MHz of 4.7GHz band available. The 28GHz band will be divided into 12 blocks and the 4.7GHz band into 10 blocks, respectively. The ministry said the 28GHz band would be offered at one-tenth of the price of the 4.7GHz spectrum due to the band’s characteristic and current ecosystem around the band. Pricing of the blocks will also differ depending on region and whether a company plans to use the band in cities or rural areas, the ministry said. It said it hopes the allocation will lead to the development of various new services in smart factories, smart farms, healthcare, robotics and high-resolution videos. Companies have until the end of September to apply for the spectrum. Applicants will be able to ask for licences that last from two to five years. The ministry added it would shorten and simplify the review process from three months to a month so that companies can be notified of the band they are receiving by October. Spectrum will then be allocated around the end of November, the ministry said. South Korea has already allocated the 3.5GHz and 28GHz bands to local telcos SK Telecom, KT, and LG Uplus, with the telcos launching their 5G services back in 2019.While 3.5GHz is also available nationwide, telcos are yet to make 28GHz band available for consumers, despite previously saying they would launch mmWave services in 2020. The telcos have been only testing private networks using mmWave with their enterprise customers so far. Related Coverage More

  • in

    Higher NBN speeds and changing retailers does not make web browsing faster: ACCC

    Average speed on NBN’s 500-1000/50Mbps plan
    Image: ACCC
    If you are thinking that you need to jump from an NBN 50Mbps speed plan to 100Mbps because your web browsing seems slow, the the Australian Competition and Consumer Commission (ACCC) has a simple piece of advice: Don’t. “Moving from the 50/20Mbps tier to the 100/40Mbps tier would lead to almost no noticeable improvement in web performance,” a report from the ACCC prepared by SamKnows said. “This finding suggests for consumers whose main activity is web browsing that plan speed need not be a core consideration when selecting an internet plan.” Naturally enough, higher speed plans do make for slight increases in page load times, but the report said these differences were not material. Similarly, there is little to be gained from switching NBN providers. “Results for all the major RSPs tested are very satisfactory and suggest there are immaterial differences in performance between providers. All the RSPs studied offer good web performance which suggest that choice of RSP is not likely to have a significant impact on web browsing performance,” it said. “This finding means that other factors outside of a consumer’s control, such as the design and operability of a website, will have a greater impact on how a website performs and the experience of interacting with it.”

    In the regular Measuring Broadband Australia report also released on Wednesday, it was revealed that 500-1000/50Mbps services that NBN labels as Home Ultafast receive an average download speed of 670Mbps. This number was determined from 6,750 tests conducted across 52 fibre-to-the-premises and HFC connections. At this speed tier, the report said there was “considerable variation” throughout the day, with the 6pm drop being 138Mbps below the 11pm peak. “This dip in speeds for very high speed services is greater than for the other major NBN plans … including NBN100 plans,” it said. “This shows that NBN very high speed plans are more susceptible to congestion during busy periods than lower speed plans.” Uploads speeds were much more reliable, and sat around the 45Mbps mark throughout the day. For the month of February, the report said Vocus-owned Dodo and iPrimus were dragging the chain on download speeds, only hitting 87.7% of plan speeds. Leading the way was Exetel on 100.3%, followed by Optus on 100%, Telstra with 98.3%, TPG with 97.5%, and Aussie Broadband on 96.6%. For upload speeds, iiNet was slowest with 81.6% of plan speeds, followed by Aussie Broadband on 81.9%, while Exetel continued to lead the way with 89.2%, and MyRepublic had 87%. The rest of the NBN retailers were clumped in the 84-87% range. Uploads speeds will not reach the same percentage mark as download because NBN does not overprovision it. Of the 1.117 services used for the speed test, 8.1% were classed as underperforming. “0% of underperforming NBN services are fibre to the node connections. 98% of underperforming NBN services are on NBN50 and NBN100 plans,” the report said. “The average download performance once underperforming services are excluded is 100.3% as against the 96.7% figure quoted earlier for all services.” On 50Mbps plans, fibre to the node was around 6Mbps, or 12%, lower than other access technologies, and on 100Mbps plans was 16Mbps slower. Related Coverage More

  • in

    The power of two

    MIT’s Hockfield Court is bordered on the west by the ultramodern Stata Center, with its reflective, silver alcoves that jut off at odd angles, and on the east by Building 68, which is a simple, window-lined, cement rectangle. At first glance, Bonnie Berger’s mathematics lab in the Stata Center and Joey Davis’s biology lab in Building 68 are as different as the buildings that house them. And yet, a recent collaboration between these two labs shows how their disciplines complement each other. The partnership started when Ellen Zhong, a graduate student from the Computational and Systems Biology (CSB) Program, decided to use a computational pattern-recognition tool called a neural network to study the shapes of molecular machines. Three years later, Zhong’s project is letting scientists see patterns that run beneath the surface of their data, and deepening their understanding of the molecules that shape life.

    Zhong’s work builds on a technique from the 1970s called cryo-electron microscopy (cryo-EM), which lets researchers take high-resolution images of frozen protein complexes. Over the past decade, better microscopes and cameras have led to a “resolution revolution” in cryo-EM that’s allowed scientists to see individual atoms within proteins. But, as good as these images are, they’re still only static snapshots. In reality, many of these molecular machines are constantly changing shape and composition as cells carry out their normal functions and adjust to new situations.

    Along with former Berger lab member Tristan Belper, Zhong devised software called cryoDRGN. The tool uses neural nets to combine hundreds of thousands of cryo-EM images, and shows scientists the full range of three-dimensional conformations that protein complexes can take, letting them reconstruct the proteins’ motion as they carry out cellular functions. Understanding the range of shapes that protein complexes can take helps scientists develop drugs that block viruses from entering cells, study how pests kill crops, and even design custom proteins that can cure disease. Covid-19 vaccines, for example, work partly because they include a mutated version of the virus’s spike protein that’s stuck in its active conformation, so vaccinated people produce antibodies that block the virus from entering human cells. Scientists needed to understand the variety of shapes that spike proteins can take in order to figure out how to force spike into its active conformation.

    Getting off the computer and into the lab

    Zhong’s interest in computational biology goes back to 2011 when, as a chemical engineering undergrad at the University of Virginia, she worked with Professor Michael Shirts to simulate how proteins fold and unfold. After college, Zhong took her skills to a company called D. E. Shaw Research, where, as a scientific programmer, she took a computational approach to studying how proteins interact with small-molecule drugs.

    “The research was very exciting,” Zhong says, “but all based on computer simulations. To really understand biological systems, you need to do experiments.”

    This goal of combining computation with experimentation motivated Zhong to join MIT’s CSB PhD program, where students often work with multiple supervisors to blend computational work with bench work. Zhong “rotated” in both the Davis and Berger labs, then decided to combine the Davis lab’s goal of understanding how protein complexes form with the Berger lab’s expertise in machine learning and algorithms. Davis was interested in building up the computational side of his lab, so he welcomed the opportunity to co-supervise a student with Berger, who has a long history of collaborating with biologists.

    Davis himself holds a dual bachelor’s degree in computer science and biological engineering, so he’s long believed in the power of combining complementary disciplines. “There are a lot of things you can learn about biology by looking in a microscope,” he says. “But as we start to ask more complicated questions about entire systems, we’re going to require computation to manage the high-dimensional data that come back.”

    Reconstructing Molecules in Motion

    Before rotating in the Davis lab, Zhong had never performed bench work before — or even touched a pipette. She was fascinated to find how streamlined some very powerful molecular biology techniques can be. Still, Zhong realized that physical limitations mean that biology is much slower when it’s done at the bench instead of on a computer. “With computational research, you can automate experiments and run them super quickly, whereas in the wet lab, you only have two hands, so you can only do one experiment at a time,” she says.

    Zhong says that synergizing the two different cultures of the Davis and Berger labs is helping her become a well-rounded, adaptable scientist. Working around experimentalists in the Davis lab has shown her how much labor goes into experimental results, and also helped her to understand the hurdles that scientists face at the bench. In the Berger lab, she enjoys having coworkers who understand the challenges of computer programming.

    “The key challenge in collaborating across disciplines is understanding each other’s ‘languages,’” Berger says. “Students like Ellen are fortunate to be learning both biology and computing dialects simultaneously.”

    Bringing in the community

    Last spring revealed another reason for biologists to learn computational skills: these tools can be used anywhere there’s a computer and an internet connection. When the Covid-19 pandemic hit, Zhong’s colleagues in the Davis lab had to wind down their bench work for a few months, and many of them filled their time at home by using cryo-EM data that’s freely available online to help Zhong test her cryoDRGN software. The difficulty of understanding another discipline’s language quickly became apparent, and Zhong spent a lot of time teaching her colleagues to be programmers. Seeing the problems that nonprogrammers ran into when they used cryoDRGN was very informative, Zhong says, and helped her create a more user-friendly interface.

    Although the paper announcing cryoDRGN was just published in February, the tool created a stir as soon as Zhong posted her code online, many months prior. The cryoDRGN team thinks this is because leveraging knowledge from two disciplines let them visualize the full range of structures that protein complexes can have, and that’s something researchers have wanted to do for a long time. For example, the cryoDRGN team recently collaborated with researchers from Harvard and Washington universities to study locomotion of the single-celled organism Chlamydomonas reinhardtii. The mechanisms they uncovered could shed light on human health conditions, like male infertility, that arise when cells lose the ability to move. The team is also using cryoDRGN to study the structure of the SARS-CoV-2 spike protein, which could help scientists design treatments and vaccines to fight coronaviruses.

    Zhong, Berger, and Davis say they’re excited to continue using neural nets to improve cryo-EM analysis, and to extend their computational work to other aspects of biology. Davis cited mass spectrometry as “a ripe area to apply computation.” This technique can complement cryo-EM by showing researchers the identities of proteins, how many of them are bound together, and how cells have modified them.

    “Collaborations between disciplines are the future,” Berger says. “Researchers focused on a single discipline can take it only so far with existing techniques. Shining a different lens on the problem is how advances can be made.”

    Zhong says it’s not a bad way to spend a PhD, either. Asked what she’d say to incoming graduate students considering interdisciplinary projects, she says: “Definitely do it.” More

  • in

    JFrog acquires Vdoo to provide security from development to device

    DevOps platform maker JFrog, the first company to develop a binary code management repository for developers, said June 29 that it is acquiring Tel Aviv-based Vdoo in a cash- and stock-based deal valued at about $300 million. Vdoo makes an integrated security platform for connected, IoT, and embedded devices.

    see also

    Best VPN services

    Virtual private networks are essential to staying safe online, especially for remote workers and businesses. Here are your top choices in VPN service providers and how to get set up fast.

    Read More

    JFrog founder and CEO Shlomi Ben Haim told ZDNet that adding Vdoo’s intellectual property was important to his company’s efforts to develop a next-generation security offering to support DevOps users as they respond to a disruption in the market for continuous software delivery. Both companies focus on protecting binary code in enterprise IT systems, a central target for hackers, Ben Haim said.Sunnyvale, Calif.-based JFrog is expanding its end-to-end DevOps platform offering, which provides holistic security ranging from the development environment all the way to edge systems, IoT, and other devices. DevOps is a set of best practices that combines software development and IT operations, with its purpose to shorten a system’s development life cycle and provide continuous delivery with high software quality. Affiliated with DevOps is a relatively new segment called “liquid software,” which describes the flow of software packages from the moment they are created all the way to deployment. Whereas software companies years ago used to publish one or two updates per year, they now often produce updates and patches whenever they are needed–sometimes multiple times per day. Because of these developments, namely all this new software filling the internet traffic lanes every second, new security processes are required, Ben Haim said.Most current DevOps and liquid software solutions lack proper security capabilities that are fully integrated into the software lifecycle, Ben Haim said. These security tools are point products with their own data sets, which create friction between development and security teams and slow the release of software updates. This problem is especially acute when updates are continuously delivered to the edge or across a large fleet of devices. As a result, many of these security tools are not delivering on the promise of fast, automated, and secure releases, Ben Haim said.”The main motivation behind this is that we want to provide the world with a real DevSecOps solution, all the way from the DevOps pipeline, to the edge, to whatever destination,” Ben Haim said. “What we built during the past four years is technology–and better software security–around focusing on binary. We identify binary as the highest priority.”

    Vdoo’s product security platform automates software security tasks throughout the entire product lifecycle, ensuring that all findings are prioritized, communicated, and mitigated. The company’s security experts and vulnerability researchers will join the JFrog team to develop advanced security solutions for developers and security engineers, CEO and co-founder Nati Davidi told ZDNet.JFrog said it will expand its JFrog Xray vulnerability detection product to include Vdoo’s data and improved scanning across multiple dimensions, including configuration and applicability scanning, by the end of this year. In addition, JFrog expects to fully integrate Vdoo’s technology into its DevOps platform to provide an all-in-one secured platform in 2022, Ben Haim said. More

  • in

    MIT and U.S. Department of Defense team up to launch a new edX learning platform

    MIT has pioneered many online learning solutions, and the U.S. Department of Defense (DoD) has taken note. MIT and the DoD have teamed up to launch a new edX learning platform, manufacturingworkforce.org.

    In the past decade, the DoD has launched nine public-private manufacturing institutes to spur U.S. advanced manufacturing industry forward in areas such as additive manufacturing, robotics, photonics, functional fabrics, and bio-fabrication. An important part of the institutes’ mission is workforce development, which includes online learning. To that end, the DoD has tasked MIT’s Initiative for Knowledge and Innovation in Manufacturing (IKIM) to stand up an Open edX platform for the DoD’s nine institutes and the larger advanced technologies community.

    IKIM leads the education and workforce effort of the manufacturing institute AIM Photonics, and just launched the first two courses on the new platform, on photonic integrated circuit (PIC) sensors and on integrated photonics passive device testing. Principal Research Scientist Anu Agarwal and Professor Juejun Hu’s courses are what you might expect from MIT; they cover technical cutting-edge material. MIT IKIM will release five more courses this summer on the new platform, all tied to integrated photonics, and all courses that would fit into MIT’s course catalog.

    The DoD’s mission for the new learning platform, however, is to reach far beyond hosting MIT-like classes. The Commonwealth of Massachusetts, in partnership with MIT and others, is building an advanced manufacturing awareness course for high school students exploring potential careers that will go on the platform, tied to at least five of the manufacturing institute technologies. That project is part of a $3.2 million grant announced last October. MIT IKIM also plans to create technician and technologist edX training programs for students seeking careers in advanced technologies, but not necessarily interested in pursuing bachelor’s degrees. Many institutes are planning their online offerings, targeting students at all levels, even starting in elementary school.

    Although some people might not associate the DoD with STEM education, it invests heavily in innovative STEM initiatives. MIT IKIM received DoD funding from the Manufacturing Engineering Education Program to build technician programs in robotics and photonics, and to launch a Virtual Manufacturing Lab — a suite of virtual reality simulations in photonics and other advanced manufacturing technologies. The DoD’s investment in the Open edX platform is consistent with its goal of making top-notch education more accessible for students at all levels. 

    “The Department of Defense is eager to help build a robust domestic manufacturing industry. To do this, we need cutting-edge advanced manufacturing education and training available to more Americans,” says Michael Britt-Crane, education and workforce lead for the DoD’s Manufacturing Technology Program Office. “This platform is an important way to do this, and to bring these resources to the DoD workforce.”

    The Advanced Robotics for Manufacturing (ARM) institute recently received funding to create a virtual manufacturing environment on the Open edX platform, where students can train on virtual equipment. The environment could become a place to demonstrate competency and receive credentials. ARM recognizes the vast potential of virtual and augmented realities to quickly scale its manufacturing workforce in the use of robotics and automation. More