Eliana Willis

More stories

  • 125 Shares169 Views

    in Information Technology

    Travel and retail industries facing wave of credential stuffing attacks

    A new report from Auth0 has discovered that government institutions as well as travel and retail companies continue to face an inordinate amount of credential stuffing attacks. 

    ZDNet Recommends

    Auth0, which was recently acquired by Okta for $6.5 billion, released startling statistics of what they are seeing in their State of Secure Identity report.In the first three months of 2021, Auth0 found that credential stuffing accounted for 16.5% of attempted login traffic on its platform, with a peak of over 40% near the end of March. About 15% of all attempts to register a new account can be attributed to bots, according to Auth0, which found that for certain industries, the numbers are even higher. The report also said that Auth0 maintains a constantly-growing database of username-password pairs that were known to be compromised in data breaches. For the first 90 days of 2021, the Auth0 platform detected an average of more than 26,600 breached passwords being used each day. On Feb. 9, the numbers reached a high for 2021 at more than 182,000.Attackers will spend between $50 and $1,000 for validated credentials from credit card records, crypto accounts, social media accounts and even Netflix accounts, according to the report. The most commonly detected threats on Auth0’s platform include credential stuffing, fraudulent registrations, MFA bypass, and breached password usage. 

    Auth0’s platform found that 39% of IP addresses associated with credential stuffing attacks are based in the US. The technology and travel industries account for more than 50% of all SQL injection attacks seen on the platform. Travel and retail enterprises are targeted the most by brute attacks activities, followed by government institutions, industrial services companies and technology organizations. The technology industry faces the most MFA brute force attempts at 42% on Auth0’s platform, followed by consumer goods at 15% and financial services at 13%.Auth0 noted that attackers often target rewards programs offered by restaurants or stores because “they are rarely secured well and the benefits are easily monetized.”Companies in the financial services industry lead the way in MFA adoption, followed by technology and industrial services, according to the report. While most people choose email or SMS as their MFA factor, many use time-based one-time passcodes as well. Many organizations in the technology, financial services and industrial services industries are also using bot detection programs as a way to slow down or limit credential stuffing attacks. Duncan Godfrey, vice president of security engineering at Auth0, said it is becoming harder and harder for security companies to secure their customers’ identities because of the widespread failure to protect data and the prevalence of breached passwords. The availability of automated attack tools has made the humble password “a protective measure from the past,” Godfrey explained.Multiple breaches and cyberattacks in the last month originated from reused passwords or account details that had been leaked in previous attacks.  More

  • 75 Shares149 Views

    in Information Technology

    McAfee discovers vulnerability in Peloton Bike+

    McAfee has uncovered a vulnerability in Peloton’s Bike+ line and Tread exercise equipment that would give an attacker full, unnoticed access to the device, including its camera and microphone. 

    McAfee worked with Peloton in March to fix the issue and Peloton has since released an update that solves the vulnerability. In a blog post, McAfee’s Advanced Threat Research team researchers Sam Quinn and Mark Bereza explained that the flaw was with the bike’s Android Verified Boot process, which they said was initially out of scope and left the Peloton vulnerable.Quinn and Bereza shared a video of their work demonstrating how they were able to bypass the Android Verified Boot process and compromise the Android OS. The blog describes a variety of ways the vulnerability could have been used by attackers with physical access to a Bike+ or Tread exercise equipment. The researchers included a map that lists all of the publicly available Peloton equipment available in spaces like gyms, hotels, apartment complexes, and even cruise ships.
    PeloBuddy
    “A worst-case scenario for such an attack vector might involve a malicious agent booting the Peloton with a modified image to gain elevated privileges and then leveraging those privileges to establish a reverse shell, granting the attacker unfettered root access on the bike remotely. Since the attacker never has to unlock the device to boot a modified image, there would be no trace of any access they achieved on the device,” Quinn and Bereza wrote. “This sort of attack could be effectively delivered via the supply chain process. A malicious actor could tamper with the product at any point from construction to warehouse to delivery, installing a backdoor into the Android tablet without any way the end user could know. Another scenario could be that an attacker could simply walk up to one of these devices that is installed in a gym or a fitness room and perform the same attack, gaining root access on these devices for later use.”

    There were even ways for attackers to make their presence permanent by modifying the OS, putting themselves in a man-in-the-middle position. In this case, an attacker would have full access to network traffic and SSL encrypted traffic using a technique called SSL unpinning, the blog explained. “Intercepting and decrypting network traffic in this fashion could lead to users’ personal data being compromised. Lastly, the Peloton Bike+ also has a camera and a microphone installed. Having remote access with root permissions on the Android tablet would allow an attacker to monitor these devices and is demoed in the impact video [above],” the researchers said. The simplicity of the vulnerability prompted Quinn and Bereza to reach out to Peloton, which later discovered that the problem extended beyond just the Bike+ to the Tread exercise equipment.The company released a fix for the problem that no longer allows for the “boot” command to work on a user build, mitigating this vulnerability entirely, according to the researchers. Adrian Stone, Peloton’s head of global information security, said that if an attacker is able to gain physical access to any connected device in the home, additional physical controls and safeguards become increasingly important. “To keep our members safe, we acted quickly and in coordination with McAfee. We pushed a mandatory update in early June and every device with the update installed is protected from this issue,” Stone added. 

    ZDNet Recommends More

  • 75 Shares149 Views

    in Artificial Intelligence

    The new wave of robotic automation

    Ask Peter Howard SM ’84, CEO of Realtime Robotics and MIT Sloan School of Management alumnus, what he thinks is the biggest bottleneck facing the robotics industry, and he’ll tell you without hesitation it’s return on investment. “Robotics automation is capable of handling almost any single task that a human can do, but the ROI is not compelling due to the high cost of deployment and the inability to achieve commensurate throughput,” he says.

    But Realtime Robotics has developed a combination of proprietary software and hardware that reduces system deployment time by 70 percent or more, reduces deployment costs by 30 percent or more, and reduces the programming component of building a robotic system in the industrial robot space by upwards of 90 percent. In other words, Realtime Robotics is making robot adoption well worth the investment.

    On some level, people are always planning — even the most spontaneous among us. We plan the day: breakfast, work, meeting, lunch, pick up the dry cleaning, etc. On a more intuitive level, that trip from your desk to the coffee machine and back requires many micro-decisions that get you from point A to point B without bumping into anything or anyone. In fact, we don’t stop making decisions that allow us to successfully navigate our physical environment until we fall asleep.

    In the field of robotics, the computational process of moving a robot from one place to another in the optimal manner without collisions is called motion planning. For 30 years, it has been a thorn in the side of the industry, because successful motion planning is really about instilling robots with the capabilities (intelligence) to make their own decisions to achieve their goals. To be successful, it has to be done in real-time to accommodate variables that pop up in real-life situations. Furthermore, if a robot is going to work with other robots or people, its movements need to be coordinated with its teammates.

    But traditional motion planning relies on rigid software that only allows robots to follow absolute motion plans based on a strict decision tree. It’s a painstaking process that can take days, weeks, even months of point-by-point programming that must take into consideration all possible options to recommend the best, collision-free path for the robot. The fact is, it’s always been too slow to be effective for robot and autonomous vehicle applications in dynamic environments like a factory floor shared by robots and people alike.

    Until Realtime Robotics stepped up and solved the problem with autonomous robot motion planning and multi-robot deconfliction. Meaning, they’ve developed a platform including a proprietary processor tailor-made to produce autonomous, collision-free motion plans for multiple robots.

    Built on the research of co-founder George Konidaris, a former postdoc at MIT in the Department of Electrical Engineering and Computer Science, the core technology is embodied in an industrial PC called the Realtime Controller. It precomputes a field of thousands, even millions, of potential motions that the robot is likely to need, and then hardware accelerates the searching of those motions at runtime.

    “We can look at all the potential options, see moment-to-moment, millisecond-to-millisecond, which ones are available, and then find the optimal path through the workspace to get the job done,” says Howard.

    They’ve baked in AI-for-multiple-robot optimization to find the best and highest efficiency for the structure of the work cell — everything from the positioning of the robot to the sequencing of tasks, and which tasks are going to be done by which robot. “In the space of running this AI for just a few hours, you’re able to achieve a throughput rate that is unimaginably better than what a human programmer is capable of doing,” explains Howard. “Our platform allows new AI-based system makers to stay focused on what they’re good at, while we take care of the difficult underside of the robotics problem.”

    The Realtime Robotics platform also incorporates powerful spatial and object perception pipelines that are used for collision avoidance and workpiece perception, providing unprecedented flexibility while keeping human coworkers safe. “We’re putting on the market the first system that is capable of interacting intimately with people and keeping them safe in the presence of industrial robots,” says Howard.

    In May 2017, Realtime Robotics set up shop at MassRobotics, a Boston-area robotics collective. Three months later they had completed their first seed round of funding and landed their first contract with Amazon Robotics. A year later, they had demonstrated their first killer demo for an audience that included two of the top six robot makers.

    Howard says their strong ties to MIT played no small role in helping garner attention. “MIT ILP [Industrial Liaison Program] and the Startup Exchange have a very strong relationship at MassRobotics and throughout the Boston robotics ecosystem — they were continuously bringing world leaders in the robotics industry through the facility.”

    With Howard guiding the decision-making processes for Realtime Robotics, the go-to-market strategy is to reach end users by collaborating with leading industrial manufacturers as non-exclusive partners. Most recently, they’ve teamed up with Siemens Digital Industries software division to help original equipment manufacturers (OEMs) reduce the time to deploy and adapt to changes during simulation and on the shop floor.

    As for use cases, Howard points to Realtime Robotics’ recent work with Toyota. After working through the first three phases of a multi-phase project, he says they are now entering the exciting process of going out on the factory floor with the automotive manufacturer. To date, they are controlling a multi-robot cell with four robots on the production line. But it won’t be long before this expands to more applications and facilities across North America.

    And it’s not just the factory floor where Realtime Robotics expects to have an impact. Autonomous vehicles (AVs) will benefit tremendously from risk-aware motion planning. Realtime Robotics’ dedicated technology, known as Lightning, can run through hundreds of potential forecasts per sensor cycle. It gives AV stack partners the ability to imagine a world of possibilities and their various probabilities as identified by Realtime Robotics’ sensors and AI-powered perception stack to calculate the best immediate motion plan that ensures safety in anticipation of those possibilities.

    Realtime Robotics currently has global automation OEM leaders promoting their products and top 10 automakers doing the first product rollouts while incorporating the game-changing technology in their own standard tools and workflows. “With breakthrough new capabilities for optimization and safety being added to our platform, as well as tanking up a little bit on the fundraising side, the next six months are going to be a very exciting time,” says Howard. More

  • 125 Shares99 Views

    in Information Technology

    Over a billion records belonging to CVS Health exposed online

    In another example of misconfigured cloud services impacting security, over a billion records belonging to CVS Health have been exposed online.  

    On Thursday, WebsitePlanet, together with researcher Jeremiah Fowler, revealed the discovery of an online database belonging to CVS Health. The database was not password-protected and had no form of authentication in place to prevent unauthorized entry.Upon examination of the database, the team found over one billion records that were connected to the US healthcare and pharmaceutical giant, which owns brands including CVS Pharmacy and Aetna.  The database, 204GB in size, contained event and configuration data including production records of visitor IDs, session IDs, device access information — such as whether visitors to the firm’s domains used an iPhone or Android handset — as well as what the team calls a “blueprint” of how the logging system operated from the backend.  Search records exposed also included queries for medications, COVID-19 vaccines, and a variety of CVS products, referencing both CVS Health and CVS.com. “Hypothetically, it could have been possible to match the Session ID with what they searched for or added to the shopping cart during that session and then try to identify the customer using the exposed emails,” the report states.  The researchers say the unsecured database could be used in targeted phishing by cross-referencing some of the emails also logged in the system — likely through accidental search bar submission — or for cross-referencing other actions. Competitors, too, may have been interested in the search query data generated and stored in the system. 

    WebsitePlanet sent a private disclosure notice to CVS Health and quickly received a response confirming the dataset belonged to the company.  CVS Health said the database was managed by an unnamed vendor on behalf of the firm and public access was restricted following disclosure.  “In March of this year, a security researcher notified us of a publicly-accessible database that contained non-identifiable CVS Health metadata,” CVS Health told ZDNet. “We immediately investigated and determined that the database, which was hosted by a third party vendor, did not contain any personal information of our customers, members, or patients. We worked with the vendor to quickly take the database down. We’ve addressed the issue with the vendor to prevent a recurrence and we thank the researcher who notified us about this matter.” Update 15.49 BST: Clarified over a billion records rather than billions. ZDNet regrets this error. 

    Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 113 Shares129 Views

    in Information Technology

    Microsoft adds to its Android and iOS security tools

    Microsoft has announced some improvements to Microsoft Defender for Endpoint (formerly Defender ATP) that should help remote workers with Androids and iPhones more securely access information from the corporate network. Microsoft has refreshed the look and feel of the Microsoft Defender for Endpoint apps for Android and iOS. It’s also enabled mobile application management for devices that aren’t enrolled in Microsoft’s Intune mobile device management (MDM) platform, and enabled jailbreak detection for iOS. Previously, Microsoft Defender for Endpoint worked on devices that were enrolled using Intune mobile device management (MDM) only.  Microsoft Defender for Endpoint is a cloud-based service and distinct from Microsoft Defender antivirus. In April, Microsoft released a preview of Microsoft Defender for Endpoint that supported unmanaged devices running Windows, Linux, macOS, iOS and Android as well as network devices. Part of its functionality is aimed at helping security teams investigate and secure unmanaged PCs, mobile devices, servers, and network devices on a network.This update is about broadening mobile application support for organizations that are using Intune but might have devices that aren’t enrolled in an MDM, including popular third-party MDM solutions. “With this update Microsoft Defender for Endpoint can protect an organization’s data within a managed application for those who aren’t using an MDM but are using Intune to manage mobile applications,” Microsoft said in a blogpost. 

    “It also extends support to customers who use other enterprise mobility management solutions such as AirWatch, MobileIron, MaaS360, and others, while still using Intune for mobile application management.”The other interesting feature is the product can now detect jailbreaks on iOS devices. “Jailbreaking an iOS device elevates root access that is granted to the user of the device,” Microsoft says. “Once this happens, users can easily sideload potentially malicious applications and the iPhone won’t get critical, automatic iOS updates that may fix security vulnerabilities.”The jailbreak detection feature for Microsoft Defender for Endpoint has now reached general availability. It detects both unmanaged and managed devices that have been jailbroken and sends an alert when it happens to Microsoft 365 Defender. “These kinds of devices introduce additional risk and a higher probability of a breach to your organization,” Microsoft says. It should be easier now to enroll iOS devices since users no longer need to provide VPN permissions to get anti-phishing protection. Admins can now just push the VPN profile to enrolled devices. Lastly, Microsoft Tunnel VPN within the Microsoft Defender for Endpoint app for Android has reached general availability. 
    Microsoft More

  • 100 Shares129 Views

    in Networking

    Brazil seeks $1 billion to bolster connectivity plan

    The Brazilian government requested $1 billion in funding to support a plan to deliver connectivity to the digitally excluded in the North of the country. During a government mission to the US last week, the Brazilian delegation met the Inter-American Development Bank (IDB) to request the resources, on top of the $1 billion conditional credit line for investment projects granted in April. The resources will go towards providing connectivity to more than 9.2 million Brazilians who still don’t have Internet access in states in the North, including the Amazon region. According to a note published by the Brazilian government during the US visit, which was aimed at finding out more about 5G private networks and attract investments, the Ministry of Communications stated that it had secured the additional $1 billion credit during a meeting with the IDB in Washington, meaning it now had $2 billion to invest in the connectivity projects.

    Contacted by ZDNet, the organization said in a statement that “IDB president Mauricio Claver-Carone maintains a close dialogue with the Brazilian government and is committed to allocating resources and expertise to support the country’s digital transformation.”Additionally, the IDB said it is channeling its efforts towards providing the $1 billion credit line focused on Brazil’s digital transformation, which was already approved and available to governments and SMEs in April. It added that the resources are also available for connectivity projects in the Brazilian Amazon region. However, the IDB did not confirm the additional $1 billion credit line the Brazilian government claimed to have secured last week. “In line with the IDB Group’s strategy for the recovery of Latin America and the Caribbean, Vision 2025, which has sustainability and digital transformation as pillars to contribute to the country in its efforts to resume growth, the Bank is evaluating resources for the digital transformation in Brazil according to its needs”, the IDB said.Millions of Brazilians are still lacking access to the Internet, according to figures published by the the Brazilian Internet Steering Committee (CGI.br) last year. According to the study, some 71% of Brazilian households currently have access to the Internet. However, more than 20 million households are digitally excluded.

    The issue of lack of connectivity is particularly noticeable in households in the poorest areas of the country, the study noted: 35% of homes in the Northeast region don’t use the web, also a reality for 45% of Brazilian families on minimum wage.The smartphone is the main device used to access the Internet in Brazil, with 99% of all users saying they use their phones for that purpose. However, more than half (58%) of Brazilians access the network exclusively through their mobile phones, with that percentage reaching 85% among the poorest population. Exclusive use of smartphones to access the Internet is also prevalent among the black population (65%), compared to 51% of the white population. More

  • 125 Shares149 Views

    in Information Technology

    Nasty Linux systemd root level security bug revealed and patched

    The good news is the seven-year-old security bug in Linux systemd’s polkit, used in many Linux distros, has been patched. The bad news is that it was ever there in the first place. Polkit, which systemd uses in place of sudo, enables unauthorized users to run privileged processes they’d otherwise couldn’t run. It turned out that you could also abuse polkit to get root access to a system. 

    Open Source

    Can you say, “Ow!”?  The power to grab root privileges is the ultimate evil in Unix and Linux systems. Kevin Backhouse, a member of the GitHub Security Lab, found the polkit security hole in the course of his duties. He revealed it to the polkit maintainers and Red Hat’s security team. Then, when a fix was released on June 3, 2021, it was publicly disclosed as CVE-2021-3560. Backhouse found an unauthorized local user could easily get a root shell on a system using a few standard shell tools such as bash, kill, and dbus-send. Oddly enough, while the bug is quite old, it only recently started shipping in the most popular Linux distributions. For example, if you’re running Red Hat Enterprise Linux (RHEL) 7; Debian 10; or Ubuntu 18.04; you’re invulnerable to this security hole. But, if you’re running the newer RHEL 8, Debian testing; or Ubuntu 20.04, you can be attacked with it. Why? Because this buggy code hadn’t been used in most Linux distros. Recently, however, the vulnerable code was backported into shipping versions of polkit. An old security hole was given a new lease on life.  That’s not the only reason this bug hid in plain sight for so long. Backhouse explained the security hole isn’t triggered every time you run programs that can call it. Why? It turns out that polkit asks dbus-daemon for the UID [User ID] of the requesting process multiple times, on different codepaths. Most of those codepaths handle the error correctly, but one of them doesn’t. If you kill the dbus-send command early, it’s handled by one of the correct codepaths and the request is rejected. To trigger the vulnerable codepath, you have to disconnect at just the right moment. And because there are multiple processes involved, the timing of that “right moment” varies from one run to the next. That’s why it usually takes a few tries for the exploit to succeed. I’d guess it’s also the reason why the bug wasn’t previously discovered. It’s a sneaky little thing. 

    But, when Backhouse said it can’t always be exploited, that’s no reason not to worry about it. You can easily write a script that’s sure to activate it after a few minutes of trying. Red Hat warns “The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.”  Therefore, as Backhouse points out, since it’s “very simple and quick to exploit … it’s important that you update your Linux installations as soon as possible.” So, you know what to do now right? Get to work patching: You’ll want to upgrade polkit to version 0.119 or later.

    Related Stories: More

  • 88 Shares149 Views

    in Robotics

    Robot 'rosetta stone' will unify the bots

    Robotics, once a fractured field of scrappy tech startups, is starting to come of age. The latest proof is a set of interoperability standards that will allow Autonomous Mobile Robots (AMRs) from leading vendors to integrate and work together in settings like factories, warehouses, and ecommerce fulfillment centers. 

    MassRobotics, an independent non-profit, recently released the MassRobotics Interoperability Standard to allow units from competing automation marques to seamlessly interact. Initial participating vendors include Vecna Robotics, 6 River Systems, Waypoint Robotics, Locus Robotics, Seegrid, MiR, Autoguide Mobile Robots, Third Wave Automation, and Open Robotics Foundation, all leaders in the AMR space.”The release of version 1.0 of the MassRobotics Interoperability Standard is a crucial milestone for the industry,” said Daniel Theobald, CEO of Vecna Robotics and co-founder of MassRobotics. “It’s this pre-competitive collaboration and combined thinking from the greatest minds in the field that drive the sector forward exponentially faster than any one vendor could otherwise.”In other words, the thinking here is that a rising tide will lift all ships. There’s always been a strain of collaborative collegiality in the industry, which is tight knit and largely fed on the engineering side by a handful of powerhouse robotics grad programs and storied development labs. Many robotics companies utilize the open source Robot Operating System (ROS), which lives under the stewardship of Open Robotics.But to be sure, a big part of the willingness to collaborate is the surging demand for automation attributed to the unrestrained rise of ecommerce and the corresponding expectation of fast fulfillment. The global AMR and Automated Guided Vehicle (AGV) market is expected to reach $14 billion by 2026, with more than 270 vendors leading the manufacturing and logistics space, according to Logistic IQ. AMR adoption is growing with a CAGR of roughly 45 percent between 2020 and 2026.In that environment, it makes sense for competing vendors to build in interoperability. With logistics companies expanding and already benefiting from the flexibility afforded by the current spate of AMRs, which can be integrated into existing operations with minimal downtimes, a paradigm in which buyers are locked into a specific automation manufacturer limits  growth potential across the sector. An interoperable paradigm, by contrast, bolsters the case for automation among potential customers and potentially gives competing automation manufacturers multiple bites at the apple. A warehouse that already uses pick-and-place machines from Brand A can now buy integrate AMRs from Brand B into the same operation. The integration is also safer, as the systems can share information, something that previously wasn’t possible.This all came together fairly quickly during the pandemic, corresponding to a major surge in ecommerce demand — the MassRobotics AMR Interoperability Working Group was formed in 2020. The group’s newly issued standard allows robots of different types to share status information and operational conventions, or “rules of the road,” so they can work together more cohesively on a warehouse or factory floor. The standard also enables the creation of operational dashboards so managers can gain insights into fleet productivity and resource utilization.

    “Functional and practical standards are a critical next step for robotic automation,” said Tom Ryden, executive director, MassRobotics. “Our AMR Interoperability Working Group has diligently focused on development and testing of these standards, which are needed now, and we fully expect will evolve as the robotics industry and end-user companies implement them. We encourage buyers to begin looking for the MassRobotics Interoperability Standard compliance badge when making purchasing decisions.”In part, the effort was driven by customers operating major shipping and distribution centers, which by necessity have cobbled together automation systems from multiple vendors to provide for a range of applications. “Support for this effort has been broad, and we are indebted to numerous companies and individuals for donating so much time and expertise to the development of this standard,” said Theobald. “This important technology lays the groundwork for future innovation and concrete value for customers worldwide.”The first use case for the new interoperability standards will be trialed at a FedEx facility where AMRs from Waypoint Robotics, Vecna Robotics, and others will be operating in the same production area.”I applaud the Working Group for their efforts and dedication in laying out these first steps toward AMR interoperability. The diversity of the team shows that the industry can work together in finding solutions around this issue,” said Aaron Prather, senior advisor, FedEx. “Our interoperability validation in Memphis later this year will be a great real-world application of Version 1.0’s capabilities and will help to provide feedback to the Working Group to potentially demonstrate what future steps may need to be taken to make further improvements.” More