Information Technology

Security automation technology firm Rapid7 beat Wall Street estimates on Wednesday, reporting strong growth throughout 2021.Rapid7 delivered fourth quarter revenue of $151.6 million, up 34% from a year ago. For the fourth quarter, Rapid7’s non-GAAP earnings of -$0.16 a share were above expectations. 

ZDNet Recommends

Wall Street was expecting Rapid7 to report fourth quarter earnings of -$0.17 a share on revenue of $145.88 million. For 2021, Rapid7 reported a total revenue of $535.3 million and a products revenue of more than $500 billion. The company grew its customer base last year from 8,718 to 10,283. “We ended 2021 on a high note, delivering strong fourth quarter results across our security transformation and vulnerability management solutions,” said Corey Thomas, chairman and CEO of Rapid7.”We grew ARR by 38% during the year while eclipsing 10,000 customers globally, highlighting our team’s strong execution and the growing need for customers to manage increasingly complex security environments.”Product revenue in Q4 2021 was up 35% compared to Q4 2020 at $141.2 million. Professional services revenue was $10.3 million for the fourth quarter, an increase of 18% compared to the same quarter of 2020.

The company is predicting a Q1 revenue in the range of $153 million and $155 million and a non-GAAP net loss in the range of $0.18 and $0.15.For the full year, the company is expecting a revenue between $682 million and $690 million as well as an EPS between $0.05 and $0.16. In July 2021, Rapid7 announced it was spending $335 million in cash and stock to buy New York-based, privately held cybersecurity company IntSights to add “outside the wire” capabilities. 

Tech Earnings More

Image: Getty Images
Telstra is going after the government’s cyber dollars with the launch of specialist compliance, detection and response capabilities, along with a team aimed specifically at the sector. One of the reasons the telco is for moving in this direction is the recent federal government announcement that all services would be digital by 2025. “As we recover from the pandemic, reliance on digital services will remain critical, so it’s important that we secure and protect our digital environment, as disruptions due to cyber attacks could significantly impact the economy and its’ recovery,” Telstra Enterprise group owner for government Nicole McMahon said. “Telstra’s capability to protect, detect and respond to cyber threats, coupled with the unparalleled visibility of threats we have from operating the largest and most complex network in Australia, uniquely positions us to be able to act on cyber issues in real time.” The telco is offering detection and response out of its current security operations centres, which it said integrates with government systems to monitor threats with the help of analytics from its managed security service platform. Under compliance, which Telstra is dubbing Sovereign SecureEdge, it is using a cloud-based solution to “reduce latency and limitations that often come with more complex perimeter-based security solutions”. The telco said governments will be able to purchase its solutions in the coming months.

See also: How Vodafone Australia changed its 5G plans after the Huawei ban Earlier in the week, Telstra was crowing over taking out the Ookla Speedtest over the latter half of 2021. Telstra recorded median download speeds of 78Mbps, against 70Mbps for Optus, and 60Mbps for Vodafone. On the median upload front, Telstra led the way with 11.7Mbps, followed by Vodafone with 10.3Mbps, and Optus on 9Mbps. For median latency, Telstra lagged on 24 milliseconds, with both Optus and Vodafone on 21 milliseconds. In further good news for the telco, the Telecommunications Industry Ombudsman (TIO) said on Wednesday that it saw complaints about Telstra halve year-on-year. For the quarter to the end of 2021, Telstra had 9,660 complaints against it recorded by the TIO, with Optus having 3,800, and Vodafone having 1,155 and stablemates TPG and iiNet with a further 685 and 490 complaints respectively. Over the past year, complaints involving mobile has become the clear leading category for Telstra, making up 3,800 complaints, while the number of complaints involving multiple internet, landline, or mobile categories has shifted from north of 5,200 complaints to just over 1,930. Overall, total industry complaints have continued to trend downwards, with 18,386 complaints filed, compared to almost 30,500 a year ago. Last week it was announced that Cynthia Gebert was appointed as the Telecommunications Industry Ombudsman for a period of five years due to begin on May 2. Current TIO Judy Jones is set to leave the post next month. Related Coverage More

A decryptor has been released for the Maze, Sekhmet, and Egregor ransomware after someone published the master decryption keys in a BleepingComputer forum post. 

ZDNet Recommends

Around 6:30 yesterday evening, someone identifying themselves as “Topleak” said, “It was decided to release keys to the public for Egregor, Maze, Sekhmet ransomware families.” “Each archive with keys have corresponding keys inside the numeric folders which equal to advert id in the config. In the “OLD” folder of maze leak is keys for it’s old version with e-mail based. Consider to make decryptor first for this one, because there were too many regular PC users for this version,” the user wrote. “Since it will raise too much clues and most of them will be false, it is necessary to emphasize that it is planned leak, and have no any connections to recent arrests and takedowns. M0yv source is a bonus, because there was no any major source code of resident software for years now, so here we go. Neither of our team member will never return to this kind of activity, it was pleasant to work with you. All source code of tools ever made is wiped out.”Cybersecurity company Emsisoft created a decryptor using the keys but victims need to have the ransom note they received. The decryptor already has more than 200 downloads. Bleeping Computer administrators removed the link because it included the source code for the ‘M0yv’ malware.  Emsisoft threat analyst Brett Callow said that while Maze, Sekhmet, and Egregor are no longer active, companies typically archive any encrypted data that they were unable to recover in the hope that a decryptor will eventually become available — which it now has. “The release of the keys is another sign that ransomware gangs are rattled. While the gang claims their decision had nothing to do with the recent arrests of REvil — yeah, right. The reality is that gangs’ costs and risks are both increasing. Ransomware became such an enormous problem because threat actors were able to operate with almost complete impunity,” Callow told ZDNet. 

He went on to explain that there is a “stunning” enforcement gap when it comes to cybersecurity, noting that the chances of being successfully investigated and prosecuted for a cyber attack in the US are now estimated at 0.05%. “That’s no longer the case. The ransomware problem is far from solved, but there’s now far more ‘risk’ in the risk/reward ratio. The Biden administration’s policy measures, multi-million dollar rewards, international cooperation, offensive actions and disruptions are all combining to make it harder and riskier for ransomware gangs to operate while insurers are simultaneously pushing their customers to become resilient,” Callow said. In February 2021, members of the Egregor ransomware cartel were arrested in Ukraine after a joint investigation by French and Ukrainian police. According to France Inter, French authorities got involved in the investigation after game studio Ubisoft, logistics firm Gefco and several other major French companies were attacked by Egregor members. It was long suspected that Egregor, Maze, and Sekhmet were developed by the same group. Allan Liska, a ransomware expert with threat intelligence firm Recorded Future, told ZDNet in 2020 that they tracked 206 victims published to the Egregor extortion site and, before the switchover, 263 victims published to the Maze site. At the time, Liska said the two variants accounted for 34.3% of victims published to all ransomware extortion sites.On Wednesday, Liska told ZDNet that Maze, Egregor, and Sekhment were always tied together, each seen as a successor to the other He said they were notable for a number of reasons. Maze codified the idea of the ransomware extortion site, which most ransomware groups now have, Liska explained. “The arrests of Maze affiliates in February of 2021 really kicked off the year of ransomware arrests,” Liska said.”Sadly, by now any decryptors are likely useless. Though, you never know, some victim may have a server in storage hoping for this day.” More

Members of Congress are continuing their push against facial recognition used by the federal government in the wake of the IRS decision to stop using ID.me facial recognition software.On Wednesday, Secretary Alejandro Mayorkas, Rep. Pramila Jayapal, and Rep Ayanna Pressley joined Senators Ed Markey and Jeff Merkley in calling for DHS to end its use of Clearview AI’s facial recognition technology.”Facial recognition tools pose a serious threat to the public’s civil liberties and privacy rights, and Clearview AI’s product is particularly dangerous. We urge you to immediately stop the Department’s use of facial recognition technology, including Clearview AI’s tools. Clearview AI’s technology could eliminate public anonymity in the United States,” the members of Congress wrote in a letter to Homeland Security.”It reportedly allows users to capture and upload photos of strangers, analyze the photographed individuals’ biometric information, and provide users with existing images and personal information of the photographed individuals found online. Clearview AI reportedly scrapes billions of photos from social media sites without permission from or notice to the pictured individuals. In conjunction with the company’s facial recognition capabilities, this trove of personal information is capable of fundamentally dismantling Americans’ expectation that they can move, assemble, or simply appear in public without being identified. Reports indicate that use of this technology is already threatening to do so.”They go on to explain that the use of facial recognition technology would deter people from participating in marches and rallies “for fear of being permanently included in law enforcement databases.”The technology poses unique threats to Black communities, other communities of color, and immigrant communities, the members of Congress added, noting that three Black men have already been wrongfully arrested based on mistakes made by a facial recognition system. Studies from the National Institute of Standards and Technology (NIST) have also found that Black, Brown, and Asian individuals were up to 100 times more likely to be misidentified than white male faces with most facial recognition tools available. According to the letter, facial recognition software is being promoted widely among law enforcement agencies, and “reviews of deployment of facial recognition technology show that law enforcement entities are more likely to use it on Black and Brown individuals than they are on white individuals.”

“Additionally, past law enforcement use of this technology reportedly targeted Black Lives Matter activists. Use of increasingly powerful technologies like Clearview AI’s have the concerning potential to violate Americans’ privacy rights and exacerbate existing injustices,” Jayapal, Markey, Pressley, and Merkley wrote. “Therefore, as the authors of the Facial Recognition and Biometric Technology Moratorium Act (S. 2052/H.R. 3907) — which would halt a federal agency or official from using these technologies — we urge you to stop use of facial recognition tools, including Clearview AI’s products.”The Department of Homeland Security did not respond to requests for comment. The letter comes two days after the Internal Revenue Service (IRS) announced that it will no longer be using ID.me facial recognition software. The agency added in a statement that it will “transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts.”The IRS had faced overwhelming backlash from civil rights groups and members of Congress from both parties, all of whom questioned how the IRS could begin the use of facial recognition without advance warning. But the issue revealed that the IRS was one of many federal and state agencies using facial recognition tools to provide access to vital government services and benefits. ID.me’s facial recognition tools are already used by 27 states for their unemployment benefits systems, according to CyberScoop, while 30 states and 10 federal agencies also use ID.me for other government services. The Veterans Affairs Administration and Social Security Administration both use facial recognition.More than 70 million Americans who filed for unemployment insurance, pandemic assistance grants, child tax credit payments, or other services have already had their faces scanned by ID.me. Several civil rights groups — including Fight for the Future, Algorithmic Justice League, the Electronic Privacy Information Center, and others — that started a protest movement last week designed to stop the IRS plan have expanded the effort to other agencies.Caitlin Seeley George, campaign director at Fight for the Future, told ZDNet they have updated their campaign page, dumpID.me, and are urging the Veterans Affairs Administration, the Social Security Administration, the US Patent and Trademark Office, and the many states using ID.me for unemployment benefits to follow the example of the IRS.”Veterans trying to access their benefits, elderly people trying to access Social Security Administration resources, and those applying for unemployment benefits in dozens of states are all facing the same problems and threats that caused the IRS to stop using ID.me. Many of these essential services are critical for marginalized groups, people who are already disproportionately targeted by surveillance and misidentified by facial recognition technologies,” Seeley George said. “No one should be coerced into giving their biometric information to a third party vendor for seven years or longer in order to access these essential government services. We expect all the lawmakers who spoke out against the broad use of facial recognition by the IRS to push these other agencies to stop using ID.me and any other biometric verification tools.”ID.me to let users delete selfiesIn the wake of the IRS decision, ID.me founder and CEO Blake Hall said they decided to modify their process and will now allow people to choose to verify their identity with a human agent without going through a “selfie check.” Agencies will now be able to choose this option, and Hall said they were also going to allow ID.me users to delete their selfie or photo at account.ID.me beginning on March 1.Aubrey Turner, the executive advisor at identity access management software company Ping Identity, listed several other authentication methods that agencies could use to replace their reliance on facial recognition as a means to stop fraud. He said they could use security keys (FIDO), mobile push, behavioral biometrics, authenticator apps like Google Authenticator, SMS, email, or voice. But all have their pros and cons relative to the balance of security and end-user convenience, he noted.”Static Knowledge Based Answers (KBAs) can no longer be trusted as a means of identity verification and authentication. Facial recognition as implemented by ID.me may not be the answer for IRS, but neither is UID + password. We deserve and should demand better as citizens,” Turner said. “What’s done is done as far as the IRS ending the relationship with ID.me, but how Congress plans to secure taxpayer accounts after abandoning ID.me is now my biggest question and concern.” More

A growing wave of increasingly sophisticated ransomware attacks poses a threat to critical infrastructure and organisations around the world – and attacks will continue as long as victims keep giving in to ransom demands, a joint advisory by cybersecurity bodies in the US, UK and Australia has warned. The advisory from the UK’s National Cyber Security Centre (NCSC), Australian Cyber Security Centre (ACSC), Federal Bureau of Investigation (FBI), National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) has detailed the growing risk posed by ransomware and has urged businesses to take action to protect themselves from attacks.

ZDNet Recommends

The NCSC describes ransomware as “the biggest cyber threat facing the United Kingdom”, with education one of the top targets of ransomware gangs, alongside businesses, charities, local government and the health sectors.SEE: A winning strategy for cybersecurity (ZDNet special report)The FBI, CISA and NSA warn that 14 of the 16 US critical infrastructure sectors have been targeted by ransomware, including defence, industrial systems, emergency services, food and agriculture, government and information technology, while the ACSC has warned that ransomware attacks continue to target critical infrastructure across Australia.In what represents the first international joint advisory on ransomware, organisations are being urged to take action in order to defend against attacks and avoid becoming a victim.”Ransomware is a rising global threat with potentially devastating consequences but there are steps organisations can take to protect themselves,” said Lindy Cameron, CEO of the NCSC.

“To help ensure organisations are aware of the threat and how to defend themselves we have joined our international partners to set out the very latest threat picture alongside key advice”.Mitigation advice includes implementing multi-factor authentication, employing a zero-trust strategy, and training users, so they can identify and report phishing attacks.”We live at a time when every government, every business, every person must focus on the threat of ransomware and take action to mitigate the risk of becoming a victim,” said Jen Easterly, director of CISA.”Reducing risk to ransomware is core to CISA’s mission as the nation’s cyber defense agency, and while we have taken strides over the past year to increase awareness of the threat, we know there is more work to be done to build collective resilience,” she added.Some of the key techniques ransomware groups are using to launch attacks include gaining access to networks via phishing, exploiting stolen Remote Desktop Protocol (RDP) passwords, brute force attacks, and taking advantage of unpatched vulnerabilities.The paper also warns that cyber-criminal services for hire and ransomware-as-a-service schemes are becoming increasingly professional and efficient, even offering “help centres” to talk victims through how to make the ransom payments required for the decryption key required to restore the network. Ransomware attacks are still evolving and the alert warns that one way in which this is happening is the increasing targeting of cloud infrastructure, which can affect multiple organisations at once.SEE: DDoS attacks that come combined with extortion demands are on the riseCyber criminals are also increasingly targeting managed service providers (MSPs), abusing the widespread and trusted access into clients in order to affect multiple organisations at once. The security agencies warn that it’s likely that ransomware gangs will increase attacks targeting MSPs, as will attacks that target other elements of the software supply chain. Each of the cybersecurity authorities in the United States, Australia and United Kingdom warns that, so long as victims are paying ransoms, ransomware attacks will continue.”If the ransomware criminal business model continues to yield financial returns for ransomware actors, ransomware incidents will become more frequent. Every time a ransom is paid, it confirms the viability and financial attractiveness of the ransomware criminal business model,” the alert warns.The paper suggests that by applying cybersecurity hygiene protocols, including updating operating systems and software in a timely manner, using offline backups and deploying multi-factor authentication, organisations can take major steps towards avoiding becoming another ransomware victim.MORE ON CYBERSECURITY More

Qbot, otherwise known as Qakbot or QuakBot, is an old software threat to Windows users that pre-dates the first iPhone, but it’s still being improved for nefarious efficiency.  The malware emerged in 2007, making it almost an antique in the new service-led ransomware world, but the malware is still nimble and efficient, according to cybersecurity outfit DFIR’s analysis of a sample its researchers found in October. 

ZDNet Recommends

Qbot is known for reaching Windows PCs via phishing emails and exploiting bugs in key apps like Microsoft’s email client, Outlook. The malware recently gained a module that reads email threads to improve the message’s apparent legitimacy to victims. SEE: Cybersecurity: Let’s get tactical (ZDNet special report)The malware’s operators rely on clickable phishing messages, including tax payment reminders, job offers, and COVID-19 alerts. It can steal data from Chrome, Edge, email, and online bank passwords. DFIR researchers looked at a case where initial access wasn’t known but was likely delivered via a tainted Microsoft Excel document that was configured to download malware from a web page and then used a Windows schedule task to get higher level access to the system. Qbot’s authors have learned to live off the land by utilizing legitimate Microsoft tools. In this case, it used these tools to raid an entire network within 30 minutes of the victim clicking on a link in the Excel sheet. 

“Thirty minutes after initial access, Qbot was observed collecting data from the beachhead host including browser data and emails from Outlook. At around 50 minutes into the infection, the beachhead host copied a Qbot dll to an adjacent workstation, which was then executed by remotely creating a service. Minutes later, the beachhead host did the same thing to another adjacent workstation and then another, and before we knew it, all workstations in the environment were compromised.” The attack affected PCs on the network but not servers, according to DFIR.Qbot’s operators have branched out to ransomware. Security firm Kaspersky reported that Qbot malware had infected 65% more PCs in the six months to July 2021 compared to last year. Microsoft spotlighted the malware for its modular design that makes it difficult to detect. The malware hides malicious processes and creates scheduled tasks to persist on a machine. Once running on an infected device, it uses multiple techniques for lateral movement.The FBI has warned that Qbot trojans are used to distribute ProLock, a “human-operated ransomware”.  More

The Federal Bureau of Investigation (FBI) is warning about a big uptick in scams using smartphone SIM swapping to defraud victims. Subscriber Identity Module (SIM) swapping is an old trick, but the FBI has issued a new alert about it because of a massive leap in reported cases in 2021 compared to previous years.    

ZDNet Recommends

Smartphones are critical tools for authenticating to online services, such as banks that use SMS for sign-in codes. It is a serious problem – if crooks can gain control of these services, they can access the victim’s bank, email, social media, and bank accounts. Complaints to the FBI’s Internet Crime Complaint Center (IC3) have skyrocketed in the past year.SEE: Cybersecurity: Let’s get tactical (ZDNet special report)From January 2018 to December 2020, the FBI received 320 complaints related to SIM-swapping incidents with losses of approximately $12 million. In 2021, it received 1,611 SIM-swapping complaints with losses of more than $68 million, the FBI warned in a new public service announcement. Scammers abuse the support services of mobile network operator call centers by calling them and posing as customers to get a new SIM card. The victim doesn’t know a new SIM card is connected to their phone number, which gives attackers the access they need.”Once the SIM is swapped, the victim’s calls, texts, and other data are diverted to the criminal’s device. This access allows criminals to send ‘Forgot Password’ or ‘Account Recovery’ requests to the victim’s email and other online accounts associated with the victim’s mobile telephone number,” the FBI’s IC3 warns. 

“Using SMS-based two-factor authentication, mobile application providers send a link or one-time passcode via text to the victim’s number, now owned by the criminal, to access accounts. The criminal uses the codes to login and reset passwords, gaining control of online accounts associated with the victim’s phone profile.” To improve security, many organizations use SMS messages as a form of multi-factor authentication because the account owner is assumed to have control over the device. Codes delivered via SMS are convenient because of high adoption and the belief that SMS is better than just relying on a password that can be compromised. SIM swapping is one way for crooks to circumnavigate this security.As Microsoft and others have argued, SMS is an insecure and unreliable way to deliver codes for authenticating to online accounts. Microsoft wants organizations to use apps, such as its Authenticator, because they’re a harder target to compromise.The FBI details the many ways in which attackers can not only dupe but also entice employees of mobile network operators for nefarious goals. From the attacker’s perspective, the rise of cryptocurrencies like Bitcoin and exchanges’ reliance on phones for authentication adds to the appeal of SIM-swapping scams. “Criminal actors primarily conduct SIM swap schemes using social engineering, insider threat, or phishing techniques,” the FBI’s IC3 says. The attacker often impersonates a victim and tricks the mobile carrier’s employees into switching the victim’s mobile number to a SIM card in the criminal’s possession. “Criminal actors using insider threat to conduct SIM swap schemes pay off a mobile carrier employee to switch a victim’s mobile number to a SIM card in the criminal’s possession. Criminal actors often use phishing techniques to deceive employees into downloading malware used to hack mobile carrier systems that carry out SIM swaps,” says the FBI’s IC3.SIM swapping is a real problem. T-Mobile in December confirmed SIM swapping was behind a major data breach. A former employee of a US mobile carrier was sentenced in October for taking bribes of up to $500 a day to swap phone numbers. Operators also lack procedures to help customers when they become victims of SIM-swapping scams, as detailed in a personal account in 2019 by ZDNet’s mobile specialist Matthew Miller. It’s a global problem for telcos, too. Australia’s Telstra now flags to banks when a mobile number is ported to counter SIM-swapping attacks.The FBI’s tips for protecting yourself include:Do not advertise information about financial assets, including ownership or investment of cryptocurrency, on social media websites and forums.Do not provide your mobile number or account information over the phone to representatives that request your account password or pin. Verify who they really are by dialing the customer service line of your mobile carrier.Avoid posting personal information online, such as mobile phone number, address, or other personal identifying information.Use a variation of unique passwords to access online accounts. More

Brute-forcing passwords, as well as the exploit of ProxyLogon vulnerabilities against Microsoft Exchange Server, were among the most popular attack vectors last year. 

According to ESET’s Q3 Threat Report, covering September to December 2021, while the rates of supply chain attacks rose over 2020, 2021 was defined by the continual discoveries of zero-day vulnerabilities powerful enough to wreak havoc on enterprise systems. The discovery of zero-day flaws in Exchange Server and Microsoft’s emergency patches to resolve the on-premise issues continued to haunt IT administrators well into the year.  Brute-force and automated password guessing, such as through dictionary-based attacks, were the most frequent attack vectors detected according to ESET telemetry. Attacks against remote desktop protocol (RDP) increased by 274% during the four-month period.  “The average number of unique clients that reported at least one such attack per day shrank by 5% from 161,000 in T2 2021 to 153,000 in T3 2021,” the report says. “In other words, the intensity of RDP password-guessing attacks is growing rapidly, yet the pool of potential victims is becoming smaller.” Also: One in seven ransomware extortion attempts leak key operational tech recordsPublic-facing SQL servers and SMB services also saw an uptick in credential-based attacks. 

However, exchange Server’s ProxyLogon bugs secured the second spot when it came to popular attack vectors. “Microsoft Exchange servers ended up under siege again in August 2021, with ProxyLogon’s “younger sibling”, named ProxyShell, exploited worldwide by several threat groups,” the report says.  The last four months of 2021 also revealed the consequences of a critical vulnerability in Log4j. Tracked as CVE-2021-44228, the remote code execution (RCE) flaw in Log4j issued a CVSS severity score of 10.0, sent teams scrambling to patch the problem. Threat actors instantaneously began attempting to exploit the vulnerability. Even though the issue was only made public in the last three weeks of 2021, ESET has recorded CVE-2021-44228 among the top five attack vectors of the year.  Ransomware, as expected, remains a thorn in the side of businesses today. ESET says its “worst expectations” of this malware variant were surpassed during 2021, with critical infrastructure attacked — including the assault against Colonial Pipeline — and over $5 billion in cryptocurrency transactions tied to ransomware campaigns were recorded during the first half of 2021 alone.  The research also notes a recent surge in Android banking malware, rising by 428% in 2021 in comparison to 2020. According to ESET, infection rates associated with Android banking Trojans — such as SharkBot, Anatsa, Vultur, and BRATA — have now reached the same levels as adware.  See alsoHave a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More