Eliana Willis

Cyber-security firm Zscaler this afternoon reported fiscal Q3 revenue and profit that both topped Wall Street analysts’ expectations, and an outlook that was higher as well, and said it will acquire Mumbai, India-based Smokescreen Technologies, a six-year-old startup specializing in what’s known as “active defense” technology. Terms of the deal were not disclosed.The Smokescreen technology can help block attacks such as the Colonial Pipeline ransomeware attack that took place earlier this month, Zscaler said.The report sent Zscaler shares surging by 7% in late trading. CEO and founder Jay Chaudhry, remarked, “With the addition of Smokescreen to our Zero Trust Exchange, our customers will be able to change the economics of cyberattacks by making them far more costly, complex and difficult for the adversary both before and during their attempted intrusions”For those unfamiliar with active defense, Zscaler remarks that, In contrast to traditional reactive security measures, active defense uses proactive tactics to thwart the most advanced attackers with high-confidence detections across the lifecycle of an attack. It allows businesses to rebalance the defensive equation in their favor; identifying intrusions before attackers compromise vital company data and resources. Smokescreen is fully aligned with MITRE Shield, a framework for organizations to apply active defense effectively in their security operations workflows.Revenue in the three months ended in April rose 60%, year over year, to $176.4 million, yielding a profit of 15 cents a share, excluding some costs.

Analysts had been modeling $163.7 million and 7 cents per share.For the current quarter, the company sees revenue of $185 million to $187 million, and EPS in a range of 8 cents to 9 cents, again, in a non-GAAP basis. That compares to consensus for $174 million and a 9-cent profit per share.For the full year, the company sees revenue in a range of $660 million to $664 million, and EPS of 47 cents per share. That compares to consensus of $638 million and a 40-cent profit per share.

Tech Earnings More

In a letter to New Hampshire Attorney General John Formella, audio equipment company Bose revealed that it was hit with a ransomware attack on March 7. 

The letter does not say what kind of ransomware or identify which group was behind the attack, but it explains that the company “experienced a sophisticated cyber-incident that resulted in the deployment of malware/ransomware across Bose’s environment.”By April 29, Bose and forensic analysts determined that those behind the attack managed to access internal administrative human resources files that contained the social security numbers, addresses, and compensation information of some employees, including six people who live in New Hampshire. The company said it could not confirm that the people behind the take did not take files or information out of the system. It is unclear if a ransom was paid. Bose is now working with a private company and the FBI to search the dark web for any leaked information but hasn’t found any indication that its data has been leaked, according to the letter. The company has now implemented “enhanced malware/ransomware protection” on endpoints and servers, blocked malicious files used during the attack, put in place monitoring tools to watch for subsequent attacks, and more. The six employees living in New Hampshire were offered free identity protection services through IdentityForce for just 12 months while being told to “remain vigilant” and monitor their own accounts in a letter sent out to those affected on May 19.  

Cybersecurity experts said the public notifications forced on companies hit with ransomware attacks were important as other organizations try to protect themselves from similar attacks.Saryu Nayyar, CEO of Gurucul, commended Bose for publicly disclosing the attack but noted that the timeline of events the company described in the letter was problematic. “It’s important to share what thieves are doing as they are doing it to engage the necessary authorities and cyber defense experts to lessen the ripple effect of the attack. The notification letter was pretty thorough, however, the timelines are concerning. It took Bose 1.5 months to discover which data was accessed and potentially exfiltrated. It took another 3 weeks for the company to notify the affected individuals, which is a lifetime for an attacker to use that data for malice,” she said. Other experts also noted the lengthy response time from Bose, which may have endangered the people affected by the breach. Pathlock president Kevin Dunne said Bose could have reacted faster and taken more responsibility for the attack while also laying out a clear plan for how they would prevent these future attacks from happening. “There is a lesson learned from this attack for all enterprises — keep your business-critical data in the applications where it can be managed and monitored, not in spreadsheets or other unmanaged databases,” Dunne said. “Employee data is sensitive data just like customer, financial, or IP-related data. Enterprises should invest in an HRM system and make sure that they have good access control and data loss prevention in place to limit the risk of potential damage from employee data loss.”He added that there is a great divide in attitudes when it comes to stakeholders involved in a cybersecurity attack.  Some companies, he explained, are overly cautious when reporting attacks on their systems because they want to avoid attracting further attacks or tipping their hand to ransomware groups that prey on a company’s need to solve a problem quickly.  But the employees affected by the attack will want to be notified as quickly as possible so they can monitor for any unusual activity in their compromised accounts, Dunne added. “Shareholders are often torn, as making information about a breach public can often sink a stock price dramatically, but on the flip side, expectations can be managed better when the public is informed as early as possible about a breach,” he told ZDNet. Jack Mannino, CEO at nVisium, said different states and industries have different requirements for reporting incidents. But he urged any attacked companies to be proactive about notifying victims in order to limit the scrutiny that inevitably comes after a breach. Some experts, like Shared Assessments CISO Tom Garrubba, said there was a misperception among some companies that they only have to disclose breach information if they are publicly traded or operate in a regulated environment. “Regardless of your industry, trying to keep such cards close to the chest can hinder the long-term ability of improving your cyber hygiene to fend off future events. By believing lightning doesn’t strike twice, therefore, the organization may refuse to properly fund needed improvements to your cyber hygiene,” he said. “This poses a false sense of security that by dodging the bullet of ‘going public’ the attitude may be one of ‘it won’t happen again’ since no one really knows about it. And if it does happen again and details leak of a previous breach? You may then see a rot in both your consumer base along with your business dealings as your reputation tarnishes. The overall key to success in this instance is transparency. It truly is a ‘currency’ in this world.”  More

Big changes are afoot in the ad-sponsored web, and the browser has become a key battleground for end-user privacy. While Chrome is by far the most widely used browser in the world, there are alternative browsers and ways to improve your privacy when using Chrome.Unfortunately, there’s no easy way yet to ensure total privacy through browsers, according to Dr Lukasz Olejnik, an independent privacy researcher and consultant, who led a large scale study in 2009-2011 that found web browsing histories can be used by online ad companies to fingerprint individual browsers over time. Researchers from Firefox-maker Mozilla emulated his study in 2020 with 52,000 Firefox users, which confirmed Olejnik’s findings. They warned that Google’s and Facebook’s tighter grip on online advertising today makes the practice of re-identification through browsing histories an even more pressing privacy problem today. ZDNet sought some exert tips from Olejnik, who these days is working on privacy-related specifications for the World Wide Web Consortium (W3C), including those connected to Google’s controversial Privacy Sandbox in Chrome and its related FLoC (Federated Learning of Cohorts) substitute for third-party cookies, which Google plans to block in 2022. FLoC is being trialed now with some Chrome users in the US and other markets except Europe, where Google recently admitted FLoC might not be compatible with the EU’s General Data Protection Regulation (GDPR).  But FLoC won’t solve the problem of browser fingerprinting. “Fingerprinting is here to stay and the removal of third-party cookies indeed does not impact on this technique,” says Olejnik. 

Easy to install, a burden to manage

In the past, security-conscious people advised others to disable JavaScript in the browser, but Olejnik tells ZDNet this is a sledgehammer approach for the web today. “Disabling JavaScript today is a no-go because almost every website depends on it. Disabling it would make the web essentially unusable,” says Olejnik.  One example is that today Google won’t let users who disable JavaScript to sign in to Google Accounts such as Gmail and YouTube.His recommended workaround for people wanting more privacy is to install the NoScript extension for Firefox, Chrome and Chromium-based browsers like the new Microsoft Edge. NoScript offers a more selective way to deal with invasive scripts and malware attacks that rely on JavaScript.   “In very simple ways users may easily decide which websites would be able to include what component, executing JavaScript or not,” he says. However, he warns NoScript may be “quite cumbersome” since it takes time to click-through to decide which websites should be allowed what. “But it is worth it,” he adds.  “Disabling scripting on weird or random sites is the biggest impact. Scripting is responsible for most of the most important privacy risks. It is also responsible for the delivery of some web browser exploits. So not having scripting on by default may actually save you from being hacked,” says Olejnik.   Of course, there are other approaches users can take too, including using a browser other than Chrome. To this end, Olejnik suggests it is wise to use several browsers for different tasks.Pros:   Freely available for Firefox, Chrome and Chromium-based browsers    Protects against the most common privacy and security threats on the web   Doesn’t collect your web history Cons:   A bit cumbersome to set up the allow list

View Now at NoScript

NoScript Chrome Extension

Is this really the most privacy-focused browser?

Brave is a Chromium-based browser that by default blocks ads, fingerprinting and ad-trackers. Brave in February announced it had passed 25 million monthly active users, which is still a fraction of Chrome’s 2 billion users across desktop and mobile. Brave’s business model relies on privacy-protecting ads that can pay publishers and users with Basic Attention Tokens (BAT) when users pay attention to ads. It also recently acquired Tailcat to launch Brave Search, so it can provide a privacy-focussed alternative to Google Chrome and Google Search.  The Chromium-based browser is headed up by Brendan Eich, a key designer of the JavaScript programming language and a co-founder of Mozilla and Firefox. Brave’s privacy record isn’t unblemished. Eich in 2020 apologized to customers after being caught sharing default autocomplete answers with an affiliate cryptocurrency exchange. Still, a recent study by Professor Douglas J. Leith at Trinity College at the University of Dublin rated Brave as the most private browser over Google Chrome, Mozilla Firefox, Apple Safari, and Chromium-based Microsoft Edge.Leith looked at how much browsers communicate to each browser maker’s backend servers. Brave did not use any identifiers allowing the IP addresses to be tracked over time, and did not share details of web pages visited with its backend servers. By contrast Chrome, Firefox and Safari tagged telemetry data with identifiers linked to each browser instance. Brave has removed a ton of Google code from its version of Chromium to improve user privacy and has also come out hard against Google’s FLoC ID proposal, which is beginning to roll out to Chrome users but will not been enabled in Brave.  Brave has several privacy-enhancing settings with options to block third-party ad trackers, a toggle for upgrading unsecured connections to HTTPS, cookie blocking and fingerprinting blocking. Users can adjust these in Settings with in the Shields and Privacy and security sections.     Despite alarm over FLoC, Olejnik says it is preferable to third-party cookies from a privacy standpoint, but he’s holding off judgement until he sees the final design. FLoC is a type of fingerprint designed to replace third-party cookies. In this scheme, Google assigns a FLoC ID to clusters of Chrome users with similar interests, allowing for some privacy by letting individuals ‘hide within crowds’, as Google put it, while still delivering targeted ads to advertisers. Still, Olejnik found the initial implementation of FLoC can leak users web browsing histories, so taking cover in the crowd might not actually work as intended yet.”If I had to choose between third-party cookies or FLoC, I would choose FLoC. But it all depends on the final design and configuration. Care must be exerted in the design to avert the risk of data leaks,” Olejnik says. “In my tests of the initial version, I verified that leaks of web browsing histories are indeed possible. But I am sure that the final solution would have to have some privacy settings designed and implemented. In current testing FloC, this is not the case.”Pros:   Privacy-focussed by default    Not in the traditional online ad business   A fast experience Cons:   No obvious negatives but issues in the past show it is not perfect

View Now at Brave

Probably the best privacy-preserving browser on the web

Chrome’s security and patching make it the most secure browser available today, but when looking solely at privacy, Olejnik rates Mozilla Firefox as the best of the pack. So, for those using a multi-browser strategy to improve privacy, Firefox is a must-have. One of Firefox’s most important privacy features is Enhanced Tracking Protection. Mozilla has also borrowed Tor techniques to block browser fingerprinting and, despite its declining monthly active user numbers (it’s at 220 million today, down from 250 million a year ago), Firefox developers are on a constant quest to improve tracking-prevention features, such as its work on browser data storage that can be used for tracking users across the web, which goes beyond just stored cookies and targets multiple caches.  Firefox is rich with choices to customize the browser for privacy by typing about:preferences#privacy in the address bar. The “standard” Enhanced Tracking Prevention blocks social media trackers, cross-site tracking cookies, and blocks tracking in private windows, cryptominers, and fingerprinting scripts. There is a “strict” mode too that might break some sites, but there are ways to whitelist Enhanced Tracking Protection for trusted sites. And for those with the time, Mozilla provides a way to customize the privacy feature.    The other option for Firefox fans is Firefox Focus, a privacy-focussed browser for iOS and Android that blocks ad trackers and has a built-in ad blocker.    And if you’re against Chrome’s FLoC, Mozilla this week told Digiday that it too would oppose the fingerprinting technique and won’t be implementing it in Firefox.   “We are currently evaluating many of the privacy preserving advertising proposals, including those put forward by Google, but have no current plans to implement any of them at this time,” a Mozilla spokesperson said.”We don’t buy into the assumption the industry needs billions of data points about people, that are collected and shared without their understanding, to serve relevant advertising,” they added. Pros:   Firefox has invested a lot into Enhanced Tracking Prevention    No interest in profiting from online ads   Trusted by 220 million users Cons:  Despite a major overhaul Firefox is still losing users  Mozilla is pushing its read-it-later service Pocket through Firefox 

View Now at Mozilla

Is an extension from a privacy search engine the answer?

DuckDuckGo, a privacy-focused search engine, is a vocal supporter of consumer’s privacy rights and in January hit a milestone of reaching 100 million user search queries in a day.DuckDuckGo and the rise of encrypted messaging app Signal, shows there is a growing appetite for privacy-focussed alternatives to tech giants like Facebook and Google. Still, DuckDuckGo’s daily search numbers are minuscule compared to Google’s five billion daily search queries. DuckDuckGo’s Privacy Essentials extension for Chrome, Firefox and Microsoft’s new Edge has been installed by four million Chrome users. Its reputation is built on the idea it does not collect user data but can provide the same search results as those that do collect user data. In a seeming reaction to Google’s unchallenged dominance in search, some browser makers such as the To web-anonymizing project, made DuckDuckGo the default search engine to ship with its Firefox-based browser. DuckDuckGo was founded by entrepreneur Gabriel Weinberg as a self-funded project in 2008. The DuckDuckGo extension was also quick to block Google’s FLoC fingerprinting identifier.  And the company is a founding member of the Global Privacy Control (GPC) standard (which is still being hashed out) as an answer to consumer privacy protections under the California Consumer Protection Act (CCPA) and Europe’s General Data Protection Regulation (GDPR).But it is browser extension and, like all software, there are vulnerabilities that crop up. In March, researchers discovered a cross-site scripting flaw in the DuckDuckGo Privacy Essentials that could allow an attacker to observe all websites that the user is visiting. Fortunately DuckDuckGo fixed the flaw fairly swiftly for both Chrome and Firefox.  ProsSupported on Chrome, Chromium-based browsers and FirefoxDuckDuckGo appears to have a solid commitment to user privacy If you don’t like FLoC, it blocks it automaticallyConsIt’s a software extension and that creates another avenue for security flaws to creep in 

View Now at DuckDuckGo

The wild card for online privacy

Microsoft Edge, being based on Google’s Chromium project, is now available for Windows 10, macOS and  Linux. Microsoft was rated the worst browser for privacy by Professor Leith because of how often it sent identifiers, including IP address and location data to Microsoft servers — even worse than Google Chrome. Microsoft told ZDNet it was just diagnostic data that can be easily disassociated from the device ID. Microsoft confessed its collection does include information about websites visited but said this information is not used to track users browsing history or URLs specifically tied to the user. Windows 10 telemetry data collection shows Microsoft can be clumsy on privacy despite Microsoft president Brad Smith’s principled statements on the use of facial recognition in public arenas. Microsoft also has an interesting take on Google’s FLoC. A Microsoft spokesperson told ZDNet it does not support fingerprinting because users can’t consent to it. It is however developing its own alternative to FLoC called PARAKEET, which has similar goals to FLoC, like retargeting browsers over time.”Like Google, we support solutions that give users clear consent, and do not bypass consumer choice. That’s also why we do not support solutions that leverage non-consented user identity signals, such as fingerprinting. The industry is on a journey and there will be browser-based proposals that do not need individual user ids and ID-based proposals that are based on consent and first party relationships. We will continue to explore these approaches with the community. Recently, for example, we were pleased to introduce one possible approach, as described in our PARAKEET proposal. This proposal is not the final iteration but is an evolving document,” Microsoft said.Microsoft PARAKEET proposal says it supports an “ad-funded web because we don’t want to see a day where all quality content has moved behind paywalls, accessible to only those with the financial means.”While Microsoft’s Bing search engine may not be widely-used, it does own LinkedIn and that brand’s online ad division brought in $2.58 billion in revenue in quarter ending December 2020 quarter, up 23% year on year, making up about 5% of Microsoft’s total $43.1 billion in revenue for that quarter. Microsoft has never claimed to be a guardian of end-user privacy but it does at least provide a support page explaining what data Edge collects and why Microsoft collects it. Pros:   It’s not Google Chrome    Edge is gaining new features rapidly Cons:  It has a burgeoning online advertising business  Microsoft’s position on FLoC is ambiguous 

View Now at Microsoft

Are there other browsers worth considering?

Another great choice for improving your privacy on the web is the Tor browser, which is based on Mozilla’s Firefox Extended Support Release (ESR). It’s been tweaked to help users use the Tor anonymizing network — a collection of distributed nodes versus a more centralized design like a VPN service. The Tor browser’s default search engine is DuckDuckGo.While it isn’t a mainstream browser choice, the Tor browser is a well-regarded browser for people who don’t want to be tracked across the web and it gets updated on a monthly basis by the Tor Project. However, page loads in the Tor browser can be slower and some sites might not work due to the architecture of the Tor network. Using the Tor browser for Google Search, for example, might require going through additional CAPTCHA challenges to prove you’re not a bot. Page loads are also noticeably slower on streaming services like Netflix. Nonetheless, the Tor browser is worthy addition for people who use multiple browsers to get life done on the web.   

ZDNet Recommends More

Credit: Microsoft
Just weeks after announcing plans to shut down its Azure Blockchain as a Service offering, Microsoft is back with another Blockchain-powered take on the idea with its Azure Confidential Ledger service. Microsoft officials took the wraps off the public preview of Azure Confidential Ledger on the first day of its virtual Build 2021 developer conference on May 25.

Microsoft Build 2021

Azure Confidential Ledger, like the Azure Blockchain Service, builds on the idea that blockchain is a distributed ledger. Microsoft’s Azure Confidential Ledger (ACL) adds an extra layer of security and scalability on top of blockchain. ACL uses the Azure Confidential Computing Platform, meaning an instance of ACL runs in a dedicated and fully attested hardware-backed enclave. ACL is built on top of the Confidential Consortium Framework (CCF), which Microsoft officials showed off publicly in 2017. At that time, officials said the Coco (short for “confidential consortium”) Framework was meant to work with any ledger protocol and work on any operating system and hypervisor that supports a compatible Trusted Execution Environment (TEE), or secure area of a processor. The Framework was designed to be used on-premises and/or in various vendors’ clouds, officials said. Microsoft officials said ACL works well when users need audit logging and tracking of highly sensitive admin operations. They suggested that healthcare, financial and retail, information technology, supply chain monitoring and any business where contracts and deeds need to be exchanged securely would all be good candidates for ACL. I asked Microsoft if ACL should be considered the replacement for Azure Blockchain as a Service and got no direct reply. Instead, a spokesperson said “We are asking (Azure Blockchain Service) customers to transition to the ConsenSys Quorum Blockchain Solution. As industry dynamics have changed, we made the decision to shift our focus from a product-oriented offering to a partner-oriented solution.”  Update (May 25). And here’s the direct reply on positioning of ACL, courtesy of a spokesperson:”Azure Confidential Ledger doesn’t replace Azure Blockchain Service but is another distributed ledger that can be used by customers who want the maximum level of privacy afforded to them. With Azure Confidential Ledger, customers can take advantage of Azure’s Confidential Computing to harness the power of secure enclaves when setting up the distributed blockchain network. In comparison, ConsenSys Quorum Blockchain Service is built on ConsenSys Quorum, an open source technology that is fully compatible with Azure Blockchain Service and will provide a seamless migration experience for users.”  More

Attacks on control processes, such as systems in industrial settings, are on the rise with common and unsophisticated methods being employed to compromise them. 

On Tuesday, FireEye’s Mandiant cyberforensics team released a report exploring attack rates on control processes, particularly those supported by operational technology (OT). While control process attacks may have once been viewed as complex due to access requirements, the need for malware designed to compromise proprietary industrial technologies, or the task itself of disrupting a control process to create a predictable effect, vulnerable, internet-facing OT endpoints are now offering a wider attack surface. Mandiant’s Keith Lunden, Daniel Kapellmann Zafra, and Nathan Brubaker said that there is an increasing frequency of “low sophistication” OT attack attempts and the firm has observed hackers with “varying levels of skill and resources” using “common IT tools and techniques to gain access to and interact with exposed OT systems.” Solar energy panel networks, water control systems, and building automation systems (BAS) have been targeted, and while critical infrastructure entities are on the list, the same techniques are being used against academic and private residency internet-of-things (IoT) devices, too.  According to the team, the general trend against OT systems appears to be based on attackers trying to wrestle control of vast numbers of open endpoints for “ideological, egotistical, or financial objectives,” rather than a wish to cause severe damage — such as by taking control of a core infrastructure asset.  Over the past few years, the researchers have observed OT assets becoming compromised through a variety of methods, including remote access services and virtual network computing (VNC). 

However, the “low-hanging fruit” many attackers are going for are graphical user interfaces (GUI) — including human machine interfaces (HMI) — which are, by design, intended to be simple user interfaces for controlling complex industrial processes. As a result, threat actors are able to “modify control variables without prior knowledge of a process,” Mandiant says.  Another trend of note is hacktivism, propelled by widely available and free tutorials online. Recently, the researchers have seen hacktivist groups bragging in anti-Israel/pro-Palestine social media posts that they have compromised Israeli OT assets in the renewable and mining sectors.  Other low-skilled threat actors appear to be focused on notoriety, however, with little knowledge of what they are targeting.  In two separate cases, threat actors bragged about hijacking a German rail control system — only for it to be a command station for model train sets — and in another, a group claimed they had broken into an Israeli “gas” system, but it was nothing more than a kitchen ventilation system in a restaurant.  Despite these gaffes, however, successful attacks against critical OT assets can have serious ramifications. After all, we only need to consider the panic-buying and fuel shortages across the US caused by the ransomware outbreak at Colonial Pipeline as an example.  “As the number of intrusions increase, so does the risk of process disruption,” Mandiant says. “The publicity of these incidents normalizes cyber operations against OT and may encourage other threat actors to increasingly target or impact these systems. This is consistent with the increase in OT activity by more resourced financially-motivated groups and ransomware operators.” The researchers recommend that whenever it is possible, OT assets should be removed from public, online networks. Network hardening, security audits including device discovery should be conducted on a frequent basis, and HMIs, alongside other assets, should be configured to prevent potentially hazardous variable states.  The risk of OT compromise has not gone unnoticed by federal agencies. In July, the US National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) issued a joint alert warning of attacks against critical infrastructure through vulnerable OT.   The agencies said legacy OT devices, internet connectivity, and modern attack methods have created a “perfect storm.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More