Information Technology

Microsoft has posted an advisory and detailed instructions on how to protect Windows domain controllers and other Windows servers from the NTLM Relay Attack known as PetitPotam.

ZDNet Recommends

The PetitPotam take on the NTLM Relay attack was discovered last week by French security researcher Gilles Lionel, as first reported by The Record. The tool Lionel posted can “coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw function,” he explains.  In other words, the attack can make a remote Windows server authenticate with an attacker and share Microsoft NTLM authentication credentials and certificates.  Microsoft notes that PetitPotam “is a classic NTLM Relay Attack” that it describes in a 2009 security security advisory, which it says “can potentially be used in an attack on Windows domain controllers or other Windows servers.” It says customers may be vulnerable to PetitPotam if NTLM authentication is enabled on a domain and Active Directory Certificate Services (AD CS) is in use with Certificate Authority Web Enrollment or Certificate Enrollment Web Service.  To prevent NTLM Relay Attacks that meet these conditions, Microsoft advises domain admins to ensure that services that permit NTLM authentication must “make use of protections such as Extended Protection for Authentication (EPA) or signing features such as SMB signing.” “PetitPotam takes advantage of servers where Active Directory Certificate Services (AD CS) is not configured with protections for NTLM Relay Attacks,” Microsoft notes in ADV210003.  

Microsoft has provided more detailed mitigation instructions in a separate KB article, KB5005413. Microsoft’s “preferred mitigation” is disabling NTLM authentication on a Windows domain controller.  But it also has detailed and graphical instructions for alternative mitigations if it’s not possible to disable NTLM authentication on a domain. “They are listed in order of more secure to less secure,” it notes. More

(Image: StackCommerce)
There are so many threats to our personal data, even from companies we are supposed to be able to trust, it can sometimes seem like it’s impossible to stay safe. But it may be a whole lot easier to protect yourself than you imagined when you have the right tools. The Lifetime Mobile Privacy & Security Subscription Bundle may actually be all that you need.

see also

Best VPN services

Virtual private networks are essential to staying safe online — especially for remote workers and businesses. Here are your top choices in VPN service providers and how to get set up fast.

Read More

You get a lifetime subscription to KeepSolid VPN Unlimited, which will allow you to browse forever while protecting all of your online activity. It has a wide variety of features that will work together to keep hackers out of your sensitive personal data. You will enjoy military-grade encryption with no limits to your speed or bandwidth, and there is even a kill switch.The service has over 400 servers, so you can also access content regardless of geographic restrictions. It works on Windows, macOS, iOS, and Android, so you can use it on your computer, laptop, and mobile devices.KeepSolid VPN was named PC Mag’s Top VPN and Laptop Review Pro’s Best VPN for Laptop, so you know that the service will do exactly as it claims.The second part of the bundle is a Hushed Private Phone Line that includes 6,000 SMS messages or 1,000 voice minutes that automatically renew every year. This service provides you with a secure extra phone number that allows you to keep your real phone number hidden. Instead of having to commit to another expensive, long phone contract, you can use choose from hundreds of US or Canadian area codes to use for Craigslist, dating, work, and more. You can add more minutes or messages at any time and make calls using WiFi or mobile data.Hushed Private Phone Line is extremely popular. It has received more than 5,000 reviews on the App Store and has an average rating of 4.6 out of 5 stars.Now you can protect yourself while browsing, talking, and texting. Don’t pass up this chance to get The Lifetime Mobile Privacy & Security Subscription Bundle while it’s on sale for just $29.99.

ZDNet Recommends More

A man has been jailed for his role in a swatting incident leading to the death of a 60-year-old man.

The victim, Mark Herring, was a resident of Tennessee and owned the Twitter account @Tennessee, which happened to be a sought-after name.  As reported by the Washington Post, the coveted handle was the object of Shane Sonderman, who was just under 18 years old at the time.  Sonderman, together with co-conspirators, attempted to coerce Herring into giving it up by intimidating him and his family. These methods included harassing texts, cash-on-delivery food orders, and phone calls, the aim being to obtain the handle and then sell it on.  According to federal prosecutors, in April 2020, the harassment reached a new level when Herring’s address and contact information was posted to a Discord server used by a group dedicated to obtaining valuable Twitter and Instagram handles.  “C.B,” a minor in the United Kingdom, then used this information to report a murder at Herring’s home falsely. This is known as “swatting,” in which a fake report of a serious crime is illegally made to send armed law enforcement to a victim’s home address and has been commonly reported during gaming live streams. 

Following the swat, Herring had a heart attack and passed away. His daughter told NBC that she believed he had been “scared to death.”  While out on bond, Sonderman reportedly continued to harass others for their social media handles, leading to re-arrest. Sonderman was charged with conspiracy in Memphis federal court and will now spend five years in prison. Sonderman agreed to plead guilty in return for other charges, including wire fraud, to be dropped. He must also adhere to three years of supervised release. US prosecutors say that the 20-year-old was part of a series of events that triggered a “juvenile halfway across the globe calling for emergency responses to a non-emergency.” This is not the first time swatting has had tragic consequences. In 2019, a California man was sentenced to 20 years behind bars for making swatting calls leading to a Kansas man being fatally shot by law enforcement. 

Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0

ZDNet Recommends More

The head of WhatsApp says that “allies” of US officials are among those targeted by NSO Group spyware in 2019. 

Speaking to The Guardian, WhatsApp’s chief executive, Will Cathcart, said there are “parallels” between the 2019 attacks and a recent data leak allegedly implicating NSO Group clients in widespread cybersurveillance. Israeli vendor NSO Group has experienced bad press in recent weeks due to a damning report issued by Forbidden Stories, Amnesty International, and various media outlets worldwide. Forbidden Stories claimed that a leaked list of over 50,000 phone numbers allegedly revealed individuals either “of interest” or selected for targeting by clients. According to the non-profit’s Pegasus project, while an appearance on the list does not mean that someone was targeted or compromised by Pegasus, infection by the firm’s spyware was confirmed in “dozens” of cases.  Pegasus spyware has capabilities including remote access, both email and browser monitoring, location checks, information exfiltration, call recording, and the extraction of conversations across messaging applications including WhatsApp and Facebook. NSO Group markets its products for use in criminal and terrorism-related investigations. Alongside the alleged targeting of government officials, journalists, diplomats, political dissidents, lawyers, and activists were reportedly included in the leak. 

In 2019, WhatsApp filed a complaint against NSO Group, alleging that the company was responsible for the targeting of at least 100 human rights activists, journalists, and other figures of interest. A vulnerability in the WhatsApp video calling feature, since resolved, was allegedly exploited to load spyware on victim handsets without user interaction.  In the latest leak, a phone number belonging to the president of France, Emmanuel Macron, was said to be included in the records. Macron has now reportedly spoken to Israel’s Prime Minister, Naftali Bennett, to obtain assurances that the country is “properly investigating” the allegations laid at NSO Group’s door. However, NSO Group says that Macron was not a “target.” In contrast, last week, it was reported that India’s opposition leader, Rajiv Gandhi, was selected. In addition, it has been alleged that Pegasus has been used to covertly monitor the mobile devices of up to 1,000 citizens in the country over the past six years.  Morocco has reportedly filed a complaint against Amnesty International and Forbidden Stories, citing defamation over claims the government used Pegasus to target French reporters and lawyers. Amnesty International has stood by the validity of the data set.  Cathcart said the incident should be a “wake-up call” to all of us, adding that governments should take an active role in creating accountability for spyware vendors.  “NSO Group claims that a large number of governments are buying their software, that means those governments, even if their use of it is more controlled, those governments are funding this,” Cathcart told The Guardian. “Should they stop? Should there be a discussion about which governments were paying for this software?” In an update posted July 21, NSO Group said “enough is enough” and the company would no longer answer media inquiries related to the Forbidden Stories report, and it would “not play along with the vicious and slanderous campaign.” The spyware seller said the lists obtained were not related to NSO Group and the firm does not “have access to the data of our customers, yet they are obligated to provide us with such information under investigations.” “NSO will thoroughly investigate any credible proof of misuse of its technologies, as we always had, and will shut down the system where necessary,” the company added.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

South Sea Island in Fiji, looks nice, but the internet is not.
Image: Getty Images
Remember that TikTok deal involving Oracle and Walmart under President Trump? The one that had Oracle purchasing the social network’s US operations and flinging money into an education fund because Trump demanded a payment to the government? It’s probably best the deal fell through, but it now appears Australia also wants a crack at showing the world how to keep companies out of Chinese ownership. If we rewind to 2018, Australia used around AU$200 million of its foreign aid budget to lock Huawei out of building a subsea cable to the Solomon Islands and Papua New Guinea. Instead of Huawei, local telco Vocus eventually picked up a AU$137 million contract to build the cable. That might work for one-off projects, but for the Pacific arm of bankrupt telco Digicel — that is reportedly swimming in around $7 billion of debt with yearly revenue of $2.3 billion — which China Mobile is said to be circling, another model would be needed.  Enter Australia’s largest telco Telstra, who confirmed last week it was approached by the Australian government regarding a Digicel deal, with the government set to stump up “significant funding” for any transaction. Rather than the Trumpian demand for an upfront payment, Canberra has spun it around and decided it needs to put its money where its increasingly large mouth is. While Telstra was mute on the details, the ABC put the deal at around AU$2 billion, including Canberra lending Telstra AU$1.5 billion at reduced rates that would net Australia about AU$30 million annually in interest. Digicel Pacific has networks in Papua New Guinea, Fiji, Nauru, Samoa, Tonga, and Vanuatu.

There is a delicious irony in the government helping the telco it privatised last century to fund the purchase of another operator, but Canberra has few other options. Optus is owned by the Singaporean government, TPG has offshore Vodafone and Hutchison ownership entanglements, the likes of Vocus are too small, and creating something akin to an NBN South Pacific would be a disaster waiting to happen. Meanwhile, as Telstra CEO Andy Penn pointed out recently, Telstra is mostly owned by the pension funds of Australia. At the same time of Telstra lifting the veil on the Digicel deal, Australia joined a collection of nations to attribute the Exchange hack to China and its Ministry of State Security. One of the big questions about the action from the United States, NATO, European Union, United Kingdom, Australia, Canada, New Zealand, and Japan was why stop short of the sort of sanctions that have been applied to Russia recently? The quick answer is supply chain entanglement. The diminishing returns of Huawei show Chinese autarky has not reached a level where it is immune from Western restrictions, but conversely, if China played hardball and clamped down on manufacturing, while that would hurt itself, that would also really hurt the West.  We are currently at the stage where fighters are circling each other, not throwing punches. In terms of real-world impact, the attribution provided rhetorical strength to Australia’s claim that infrastructure in neighbouring countries needs to be kept out of Chinese telco hands. “This is a must do thing as we don’t want our neighbouring countries, especially the low developing countries’ critical infrastructure to be controlled by other countries that might have other intentions,” Monash University senior lecturer in criminology at the School of Social Sciences told ZDNet. “Critical infrastructure protection is now essential to national security. It is important that individual countries can understand that the service provider that they are using has no hidden agenda that is malicious.” While the Digicel Pacific footprint is now caught up in a geopolitical tug of war, spare a thought for those on the ground who have to live with decisions made in Bermuda, Beijing, and Canberra. In places where only 35% of people have internet access, some simply want better coverage. If Telstra does indeed win out, it should invest in its purchase and maintain its Australian reputation as having the best coverage.The problem now for governments like Australia, especially if they want to continue to engage in this sort of activity, is they will have to avoid being milked by companies looking to sell infrastructure that could be deemed critical. Because suddenly, the first step in selling subsea cables, a semiconductor fab, or a telco could mean getting a company in China to give you an outrageous price and seeing whether a nation calls your bluff. If that happens, things could turn silly quite easily. ZDNET’S MONDAY MORNING OPENER  The Monday Morning Opener is our opening salvo for the week in tech. Since we run a global site, this editorial publishes on Monday at 8:00am AEST in Sydney, Australia, which is 6:00pm Eastern Time on Sunday in the US. It is written by a member of ZDNet’s global editorial board, which is comprised of our lead editors across Asia, Australia, Europe, and North America.  PREVIOUSLY ON MONDAY MORNING OPENER: More

(Image: StackCommerce)
Global corporations have been ridiculously lazy in implementing the most powerful cybersecurity measures available, which puts all of our personal data at risk. That’s all the more reason to make sure your own personal security is as strong as possible, and a lifetime subscription to FastestVPN for up to 10 devices provides some of the most comprehensive protection on the market.

FastestVPN offers a smart, user-friendly service for all of your devices, including Android, iOS, Windows, Mac, your router, and even your Smart TV. It uses more than 200 high-speed servers around the world, all with military-grade 256-bit AES encryption. And you get unlimited switches between them, as well as unlimited bandwidth for the simultaneous use of your 10 devices.An ad blocker is included for your convenience, and FastestVPN’s strict no-logging policy ensures no one will have access to your personal data. Anti-malware software is included and an extra layer of protection is provided by a NAT firewall. There is even a kill switch to disconnect you from the internet if your VPN connection drops for any reason.While some VPNs may slow down your internet connection, as you might expect from its name, FastestVPN provides all of this protection at blazing fast speeds. You can also access any content you like, regardless of geographic restrictions. Simply access the service’s fastest server and you can download or stream even HD-quality video with absolute anonymity and zero buffering. USA Netflix support is included in your plan.Given the depth of features, it should come as no surprise that TenBestVPNs said:”FastestVPN is one of the most promising VPN services in the market.”You really don’t want to pass up this opportunity to get a lifetime subscription to FastestVPN for 10 devices, because it’s currently available at the heavily discounted price of $24.99.

ZDNet Recommends More

Malware delivered over the cloud increased by 68% in Q2, according to data from cybersecurity firm Netskope.

ZDNet Recommends

The company released the fifth edition of its Cloud and Threat Report that covers the cloud data risks, threats and trends they see throughout the quarter. The report noted that cloud storage apps account for more than 66% of cloud malware delivery.”In Q2 2021, 43% of all malware downloads were malicious Office docs, compared to just 20% at the beginning of 2020. This increase comes even after the Emotet takedown, indicating that other groups observed the success of the Emotet crew and have adopted similar techniques,” the report said. “Collaboration apps and development tools account for the next largest percentage, as attackers abuse popular chat apps and code repositories to deliver malware. In total, Netskope detected and blocked malware downloads originating from 290 distinct cloud apps in the first half of 2021.”
Netskope
The researchers behind the report explained that cybercriminals deliver malware through cloud apps “to bypass blocklists and take advantage of any app-specific allow lists.” Cloud service providers generally remove most malware immediately, but some attackers have found ways to do significant damage in the short time they spend undetected in a system. According to the company’s researchers, about 35% of all workloads are also exposed to the public internet within AWS, Azure, and GCP, with public IP addresses that are reachable from anywhere on the internet.

RDP servers — which they say have become “a popular infiltration vector for attackers” — were exposed in 8.3% of workloads. The average company with anywhere between 500 and 2000 employees now deploys 805 distinct apps and cloud services, with 97% of those being “unmanaged and often freely adopted by business units and users.”The rapid adoption of enterprise cloud apps has continued into 2021, with data showing adoption is up 22% for the first half of the year. But, the report notes that “97% of cloud apps used in the enterprise are shadowing IT, unmanaged and often freely adopted by business units and users.”There are also issues raised in the report about employee habits, both at the workplace and at home. The report raises concerns about the nearly universal trend of employees authorizing at least one third-party app in Google Workspace. Netskope’s report says employees leaving an organization upload three times more data to their personal apps in the final 30 days of employment. The uploads are leaving company data exposed because much of it is uploaded to personal Google Drive and Microsoft OneDrive, which are popular targets for cyberattackers. According to Netskope’s findings, 15% “either upload files that were copied directly from managed app instances or that violate a corporate data policy.”The researchers also add that remote work is still in full swing as of the end of June 2021, with 70% of users surveyed still working remotely. “At the beginning of the pandemic, when users began working from home, we saw a spike in users visiting risky websites, including adult content, file sharing, and piracy websites,” the report added. “Over time, this risky web surfing subsided as users presumably became more accustomed to working from home, and IT teams were able to coach users on acceptable use policies.”The report touts the decline in risky browsing but also highlights the “growing danger of malicious Office documents” and cloud configurations as particularly thorny problems. Joseph Carson, chief security scientist and advisory CISO at ThycoticCentrify, said the change to a hybrid work environment last year meant that cybersecurity needed to evolve from being perimeter and network-based to one that is focused on cloud, identity and privileged access management.  “Organizations must continue to adapt and prioritize managing and securing access to the business applications and data, such as that similar to the BYOD types of devices, and that means further segregation networks for untrusted devices but secured with strong privileged access security controls to enable productivity and access,” Carson said.  More

Mitre has released its rundown of the most widespread and critical vulnerabilities in software, many of which are easy to find and can be exploited by cyber criminals to take over systems, steal data or crash applications and even computers.

ZDNet Recommends

The 2021 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses details the most common and most impactful security issues.   The list is based on published Common Vulnerabilities and Exposures (CVE) data, as well as data from the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) and the Common Vulnerability Scoring System (CVSS) scores of the CVEs.  Top of the list with the highest score by some margin is CWE-787: Out-of-bounds Write, a vulnerability where software writes past the end, or before the beginning, of the intended buffer. Like many of the vulnerabilities in the list this can lead to corruption of data and crashing systems, as well as the ability for attackers to execute code.  “These weaknesses are dangerous because they are often easy to find, exploit, and can allow adversaries to completely take over a system, steal data, or prevent an application from working,” Mitre said in a blog post.  Mitre Corporation is an US non-for-profit organisation behind the MITRE ATT&CK framework – a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.  SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)  

Second in the list is CWE-79: Improper Neutralization of Input During Web Page Generation, a cross-site scripting vulnerability which doesn’t correctly neutralise inputs before being placed as outputs on a website. This can lead to attackers being able to inject malicious script and allow them to steal sensitive information and send other malicious requests, particularly if they able to gain administrator privileges.  Third in the list is CWE-125: Out-of-bounds Read, a vulnerability which can allow attackers read sensitive information from other memory locations or cause a crash. While many of the vulnerabilities are potentially very damaging if they’re discovered and exploited by cyber criminals, the weaknesses can often be countered, particularly for those for which a security patch is available. Applying security patches to fix known vulnerabilities is one of the key things that organisations can do to help protect their networks from cyber attacks and intrusions.  The 2021 CWE Top 25 uses NVD data from the years 2019 and 2020, which consists of approximately 32,500 CVEs that are associated with a weakness. The full list is available on the CWE website.

MORE ON CYBERSECURITY More