Information Technology

The latest open-source project to be hosted on the Linux Foundation is Servo, the experimental web engine developed at cash-strapped Mozilla.
Servo was hatched in 2012 at Firefox-maker Mozilla, which recently made significant headcount reductions that mostly affected developers working on Servo.      

Servo is written in the programming language Rust, giving it advantages in memory safety, speed and parallelism over other browser engines. 
It has the potential to be an alternative to Google’s Blink engine for Chrome and Chromium-based browsers, or WebKit, the open-source engine behind Apple’s Safari browser. 
Servo offers components that other projects can use to bring web content to other applications with support for HTML, CSS, JavaScript, WebSockets, WebVR, and WebGL. Mozilla used it for part of its overhauled Quantum Firefox browser. 
Futurewei, Let’s Encrypt, Mozilla, Samsung, and Three.js are among the organizations that are supporting Servo’s move to be hosted by the Linux Foundation.
“The Linux Foundation’s track record for hosting and supporting the world’s most ubiquitous open-source technologies makes it the natural home for growing the Servo community and increasing its platform support,” said Alan Jeffrey, technical chair of the Servo project.

“There’s a lot of development work and opportunities for our Servo Technical Steering Committee to consider, and we know this cross-industry open-source collaboration model will enable us to accelerate the highest priorities for web developers.” 
Mike Dolan, senior vice president, and general manager of projects at the Linux Foundation described Servo as “the most promising, modern, and open web engine” for building applications using web technologies. 
“That has a lot to do with the Rust programming language,” he said. “We’re excited to support and sustain this important work for decades to come.” 
Servo runs on Linux, macOS, and Windows. Samsung helped port it to Android phones, while there’s also support for headsets like Oculus, Magic Leap, and Microsoft HoloLens.
Servo is more efficient than most web engines because it takes advantage of low-power multi-core CPUs thanks to Rust. 
The Linux Foundation noted that Rust and Servo evolved together during their early days. Servo was initially the largest Rust program other than the Rust compiler itself. Rust’s memory-safety helps reduce Servo’s attack surface for common security vulnerabilities such as buffer overflow flaws. 
More on Rust and programming languages More

Microsoft has announced its Pluton processor, a forthcoming chip that lives apart from the main CPU and which will be available in future Windows 10 PCs.
The Microsoft Pluton processor is designed to improve protections against physical attacks and stop attackers stealing user credentials and encryption keys with malware. The chip should also help systems recover from software bugs. 

Windows 10

Essentially, the Pluton chip is a Trusted Platform Module (TPM) that’s isolated from the rest of the system to help protect encryption keys from attacks on the speculative execution process in CPUs. 
Microsoft promises Pluton will make it easier to keep system firmware up to date, for example, in cases when TPM firmware for separate security processors is required. 
In Intel’s case, the Pluton processor will ship with future chips but will be isolated from their cores. However, at present there’s no precise timeline for the appearance of the first Intel chips containing the Pluton security processor. 
Pluton will be integrated with the Windows Update process on Windows 10 PCs, according to Microsoft. The chip is an up-dateable platform for running firmware that implements end-to-end security that is authored, maintained, and updated by Microsoft.
The firmware updates will follow the same process that the Azure Sphere Security Service uses to connect to IoT devices.

Microsoft notes that the Pluton design was in fact introduced as part of the integrated hardware and OS security capabilities in its Xbox One game console with AMD chips released in 2013, and also within Azure Sphere.
“Our question was how could we build the most secure PC by taking advantage of the best hardware Intel and others have and integrating that into the operating system. This is really the next evolution,” David Weston, Microsoft’s partner director of enterprise and OS security, told ZDNet. 
Microsoft is also planning to release Pluton security processors with AMD and Qualcomm Technologies.  
“Microsoft has developed this security processor. We’re partnering with Intel to actually stick it into their CPUs. We all know how powerful and capable Intel CPUs are, as well as all the other security capabilities they have in the platform. But to us, this is cementing that the PC ecosystem has unmatched innovation,” Weston continued.  
“The Pluton processor is not bolted on. It’s right in there, and you get security as well because there’s very little attack surface around the processor.” 
Weston said Pluton represents a big change from the Secured-Core Windows 10 PCs that Microsoft announced last year, which have been available in higher-end laptops aimed at business users. 
Some of the more advanced physical attacks techniques available today can target the communication channel between the CPU and TPM, which is typically a bus interface, Microsoft explains. 
While this interface allows for information to be shared between the main CPU and security processor, attackers in possession of the device can steal or modify information in transit.
“Pluton is for the entire Windows PC ecosystem. We are putting this in Intel chips and it will be available to everybody as a security baseline,” said Weston. 
He notes that customers used to have to explicitly choose and then go buy a security processor, and then pick a different vendor. 
“We’re making that dead simple. You buy an Intel processor, you have this Intel-Microsoft security processor that is 10 years of evolution based on what we learned from the TPM,” said Weston.
“You’re getting better protection against physical attacks, you’re getting Microsoft verification of firmware to stop some of the new firmware attacks, and we’re going to update this thing every month just like it’s Patch Tuesday.” 
He added that Microsoft is collaborating on authoring the hardware and firmware. “You don’t have to think that much about how you’re going to manage or maintain it.” 
Weston argued that a lot of challenges in the ecosystem today arise from problems with keeping security processors up to date.
“You have different places you have to go and source [updates]. This makes it deadly simple. It’s my team that builds Windows BitLocker and Windows Hello and all the great technologies that take advantage of this security processor are also now we’re working with Intel to build it,” he said.
“So we have this deep integration that’s going to pay off in spades in terms of user experience and the security fundamentals.”

Microsoft says the Pluton processor will ship with future Intel chips but will be isolated from their cores.  
Image: Microsoft More

Researchers have outlined weak security points in Tesla Backup Gateway and the ways in which they can be exploited. 

On Tuesday, Rapid7 described the security risks associated with connecting Tesla Backup Gateway to the internet; in particular, ways that open connections can be used to violate user privacy and security. 
Tesla Backup Gateway (.PDF) is a platform designed by the automaker for managing solar and battery/Powerwall installations. The system is able to connect directly to the grid, monitor outages, and gives users the option to watch and control energy reserves via a connected mobile application. Connections can be established via wifi, Ethernet cable, or mobile. 
In order to access the gateway, users connect to the software’s wifi network, enter its serial number — which acts as a password — and access Tesla Backup Gateway from an internet browser. Each gateway uses a self-signed SSL certificate.
The first time a user logs in, their email and a password — the last five digits of the gateway password — are used. 
See also: Tesla’s April Fool joke turns into $250 tequila reality, sells out in hours
According to Rapid7 and past research conducted by Vince Loschiavo, the risk with this practice is that weak credentials can be exploited. 

At worst, five digits for first-time logins result in 60.4 million password combinations and the team says there does not appear to be restrictions in place to stop brute-force attempts. However, there are ways to circumvent the challenge of trying out millions of combinations, as a simple drive-by to record the wifi access point can reduce this volume. 
The access point SSID uses the last three characters of the serial number, leaving only two to guess. 
Rapid7 also notes that many counties publish household Tesla Solar and Powerwall install permits online, giving attackers direction toward potential targets. 
When the gateway is connected to a local area network, its hostname is broadcast using the full serial number. 
CNET: Rules for strong passwords don’t work, researchers find. Here’s what does
A number of Tesla Backup Gateway installations have also been found, open and available on the internet. The researchers have documented 379 exposed installations since January in the US and Europe, some of which are commercial-grade Tesla Powerpacks. 
The platform includes APIs documenting power usage, draw, and some ownership information — but there are also hidden APIs that can be leveraged for additional statistics.
“In theory, the voltage, cycle, and other settings of the energy managed by the Backup Gateway, and the batteries connected to it are configurable,” Rapid7 says. “It may be possible to do damage to a battery, or even the electrical grid, if these settings could be tampered with. Though placing a Tesla Backup Gateway or Tesla Powerpack on the internet may be tempting, we should remember that the internet is noisy by nature, with lots of unsolicited traffic being passed through various ports on a regular basis.”
TechRepublic: Hackers for hire target victims with cyber espionage campaign
Rapid7 reached out to Tesla prior to publication and the company said that upcoming security updates will feature hardening and mitigation of the issues mentioned. 
Furthermore, Tesla said, “predictable installer passwords have been fixed for some time on newly-commissioned Backup Gateway V1 devices, but some previously commissioned devices still had them, and all online Backup Gateway V1 devices have had their installer passwords randomized.” Backup Gateway V2 devices also now come with randomized passwords. 
ZDNet has reached out to Tesla and will update when we hear back. 
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Firefox 83, scheduled for release later today, will ship with a new security feature named “HTTPS-Only Mode” that will try to load all websites via HTTPS or show an error message on sites that only support the older and insecure HTTP protocol.
By default, the new feature is disabled, but users can enable it by going to the Firefox Options page, to the Privacy & Security section, and then searching for the HTTPS-Only Mode settings.
Image: Mozilla
According to Mozilla, the new feature works by attempting to find the HTTPS version of any website, even if the user has accessed the site by typing or clicking on an HTTP link.
If Firefox can’t auto-upgrade a site to an HTTPS connection, the browser will show an error to the user and ask them to click a button to confirm they want to access a website via an older HTTP connection.

Image: Mozilla
The new HTTPS-Only Mode feature can also be enabled or disabled by clicking the lock icon in the address bar and selecting it from the drop-down panel that appears.

Image: Mozilla
Today, the HTTP protocol is considered insecure because all traffic occurs via plaintext messages that can be intercepted and expose a user’s web traffic.
The HTTPS protocol is the natural evolution of the HTTP protocol, with the connection being established and taking place via an encrypted channel.

Mozilla said it fully expects that HTTPS will become the standard way to navigate the web. As more websites will migrate to HTTPS, Mozilla said it will soon be possible for browser makers to deprecate HTTP connections altogether, effectively making the HTTPS-Only Mode the default browsing state going forward. More

Akropolis has offered the hacker who stole $2 million in Dai cryptocurrency a “bug bounty” reward in return for the missing funds.

In an open letter published on Medium, the cryptocurrency “community economy” platform proposed a $200,000 “reward” for the threat actor’s cooperation. 
See also: Chinese city launches cryptocurrency lottery, gives away digital coins to promote adoption
Describing the bug bounty payment “as compensation for your exploit,” Akropolis said it “hope[s] that the hacker will take our offer into consideration and cooperate with the team to resolve the issue.”
The platform revealed the theft of cryptocurrency from its platform last week. As previously reported by ZDNet, transactions were temporarily paused to stop more Dai tokens from being stolen in what is known as a “flash loan” attack.
Flash loan attacks occur on decentralized finance (DeFi) platforms. An attacker loans funds but then exploits a security weakness — such as a vulnerability — to bypass loan mechanisms and walk away with the cryptocurrency they have ‘borrowed.’ 
CNET: The best DIY home security systems for 2020

Since the cyberattack, Akropolis has internally investigated the exploit and is currently fixing “contract-level” issues. The company has also launched an external analysis of the incident together with partners and investors. 
However, Akropolis has chosen not to go to law enforcement — yet — in the hope that the hacker will agree to the firm’s proposal. 
“We would like to propose that you return the funds of our community members within 48 hours and in return, we will offer a $200,000 bug bounty,” Akropolis said. “We will take measures to protect your identity as required. If you decide not to cooperate we will pursue criminal action and contact law enforcement.”
TechRepublic: How to secure your Zoom account with two-factor authentication
There is no word as of yet, over 48 hours later, if the hacker responsible has accepted this proposal — or what Akropolis’ next course of action may be. At the time of writing, the stolen Dai coins are still being held in a blacklisted, attacker-controlled wallet. 
In a project update on November 16, Akropolis said the threat actor was able to exploit the “flawed handling of the deposit logic in the SavingsModule smart contract.”
“The exploitation leads to a large number of pool tokens minted without being backed by valuable assets,” the company added. 
Checks for deposit tokens and whitelist functions have now been implemented. Akropolis is currently working on adding test coverage for staking pools, boosting security check-ups, and deciding on how to compensate users. The platform is also on the hunt for two new senior developers to join the team. 
ZDNet has reached out to Akropolis for additional comment and will update when we hear back.
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Getty Images/iStockphoto
A new Chinese state-sponsored hacking group (also known as an APT) has infected more than 200 systems across Southeast Asia with malware over the past two years.

Special feature

Cyberwar and the Future of Cybersecurity
Today’s security threats have expanded in scope and seriousness. There can now be millions — or even billions — of dollars at risk when information security isn’t handled properly.
Read More

The malware infections are part of a widespread cyber-espionage campaign carried out by a group named FunnyDream, according to a new report published today by security firm Bitdefender.
The attacks have primarily targeted Southeast Asian governments. While Bitdefender has not named any victim countries, a report published earlier this spring by fellow security firm Kaspersky Lab has identified FunnyDream targets in Malaysia, Taiwan, and the Philippines, with the most victims being located in Vietnam.
Both Bitdefender and Kaspersky said the group is still active even today and appears to be primarily interested in cyber-espionage, concentrating on stealing sensitive documents from infected hosts, with a special focus on national security and industrial espionage.
Similar attacks dating back to 2018
Per Bitdefender, most of these attacks have followed a simple pattern and combined three malware payloads — Chinoxy, PCShare, and FunnyDream (malware after which the group was named).
Each of the three malware strains has a precise role. Chinoxy was deployed as the initial malware, acting as a simple backdoor for initial access.
PCShare, a known Chinese open-source remote access trojan, was deployed via Chinoxy and was used for exploring infected hosts.

FunnyDream was deployed with the help of PCShare, and was the most potent and feature-rich of the three, had more advanced persistence and communication capabilities, and was used for data gathering and exfiltration.

Image: Bitdefender
“Even looking at the tool usage timeline we can see that threat actors started by deploying a series of tools meant for quick and covert data exploration and exfiltration, and later decided to bring on a full toolkit, specifically the FunnyDream toolkit, for prolonged surveillance capabilities,” Liviu Arsene, Global Cybersecurity Researcher at Bitdefender, told ZDNet.
“We’ve seen government infrastructure compromise and years-old persistence, custom exfiltration tools, and the use of living-off-the-land tools, all of which point to an espionage campaign, potentially politically motivated,” Arsene added.
“Considering that Southeastern Asia has been under a lot of economic and trade issues related to shifting supply chains from China to Southeast Asia, as well as escalating US-China tariffs, this effort might be part of potential Chinese APT campaigns targeting South Eastern government institutions for potential espionage, aimed at figuring out how governments within the region plan to navigate these shifts.
“Some countries within the region have even gone through recent elections and governance changes, all of which could merit interest from potential Chinese APT groups in terms of how local regimes could align ideologically and politically to China’s interests,” the Bitdefender researcher told ZDNet. More

Singapore has unveiled plans to pilot a new common data infrastructure that it says is necessary to facilitate a more robust supply chain ecosystem for international trade flows. Organisations from both the public and private sectors will participate in trials that aim to improve data efficiencies in container flow and financial processes. 
Efforts are led by the Alliance for Action (AFA) on Supply Chain Digitalisation, one of seven industry groups put together by the Singapore government in June to identify and prototype new ideas to drive the local economy. The other alliances look at key growth growth areas such as robotics, e-commerce, and environmental sustainability.
The COVID-19 pandemic had resulted in a “reconfiguration” of trade flows and supply chains physically and digitally, pushing nations and businesses to seek out better efficiencies and resilience in their supply chains. 

Specifically, significant inefficiencies have been identified in physical event, documentation, and financial data flows across the value chain, according to a joint statement issued by the Infocomm Media Development Authority (IMDA), PSA International, and Trafigura. These gaps have resulted in cost and asset underutilisation impacting all enterprises. 
The alliance, hence, concluded that a common data infrastructure was necessary to resolve painpoints in the ecosystem, they said. The AFA, jointly led by PSA and Trafigura Group, over the past three months had gathered more than 50 supply chain players, including multinational corporations, local large enterprises as well as SMBs (small and midsize businesses), and government agencies to highlight gaps and opportunities across the supply chain. 
“For Singapore to remain relevant in the growing digital economy, it is laying a common foundational layer with digital utilities that enable businesses to move into the digital domain [and] build a stronger and more robust supply chain ecosystem for international trade flows, thereby, advancing our position as a global supply chain and trading hub,” the alliance said.
It added that a common digital platform would facilitate data sharing and enable all businesses to easily “plug and play” into the infrastructure. 

To kick off the initiative, two applications would be developed to improve trade finance and container flow node. 
Financial institutions, for instance, currently lack visibility over the physical movement of goods in the supply chain, hindering their ability to address demand from shippers. These sellers will be able to make better decisions from digitally tracking the physical movement of their goods, which provide higher visibility and traceability across the trade process. 
Logistics players, on the other hand, have limited visibility across container flows, resulting in frequent congestion at container flow nodes including depots and warehouses. This translates to long waiting times and added cost. 
For these organisations, a data common infrastructure would improve process flow efficiencies — enabling financial institutions to provide and access information directly from trusted parties to reconcile trade details — as well as enhance planning asset utilisation, since shipping lines, depot and warehouse operators, and hauliers more seamlessly share operational and event data, such as container bookings and job management. 
It also reduces dependency on physical documents, improve data flow, and build greater trust across trading and financial communities, the alliance said. 
The common data infrastructure would be developed based on key principles around “open, trusted, and secure data-sharing” and the scalability and interoperability of local as well as global data platforms. It also aimed to provide timely access to all players in the value chain.
IMDA and other government agencies would work alongside the AFA to develop and pilot the common data infrastructure.
Trafigura’s Asia-Pacific CEO Tan Chin Hwee said his organisation would work with Singapore banks during the pilot to “access data directly from reliable sources and parties to reconcile trade details with ease”. The platform also could potentially help detect and mitigate trade-related fraud, he added. 
“Building a ‘digital twin’ of the physical movement of goods will improve visibility across the trade process, and help stakeholders reduce dependency on physical documents in the long term,” Tan said.
PSA Group CEO Tan Chong Meng added: “COVID-19 has revealed both vulnerabilities and opportunities in the global supply chain ecosystem. It is Singapore’s ability to rally together multiple stakeholders to co-create and bring a common vision of supply chain end-to-end visibility to fruition, that will set us apart as a trusted global trade and logistics hub. 
“The development of a common data infrastructure is our opportunity to enable large and small businesses to optimise their supply chain flows through Singapore, promote long-term sustainability as a key nodal hub in the global supply chain, and at the same time, support Singapore businesses in expanding their export markets,” the PSA chief said.
Other organisations involved in the initiative include ExxonMobil Asia-Pacific, DBS Bank, and Standard Chartered Bank.
Pointing to the bank’s experience in tapping distributed ledger and other emerging technologies to digitise its processes, Standard Chartered’s Singapore CEO Patrick Lee said: “Establishing a common set of digital standards and guidelines around data sharing across trade platforms will be key to achieving enhanced interoperability, secured data flows, and a seamless e-invoicing experience for trade participants.”
RELATED COVERAGE More

Image: Jan Kopriva
A year and a half after Microsoft disclosed the BlueKeep vulnerability impacting the Windows RDP service, more than 245,000 Windows systems still remain unpatched and vulnerable to attacks.

The number represents around 25% of the 950,000 systems that were initially discovered to be vulnerable to BlueKeep attacks during a first scan in May 2019.
Similarly, more than 103,000 Windows systems also remain vulnerable to SMBGhost, a vulnerability in the Server Message Block v3 (SMB) protocol that ships with recent versions of Windows, disclosed in March 2020.
Both vulnerabilities allow attackers to take over Windows systems remotely and are considered some of the most severe bugs disclosed in Windows over the past few years.
However, despite their severity, many systems have remained unpatched, according to research compiled over the past few weeks by SANS ISC handler Jan Kopriva [1, 2].
Kopriva says that BlueKeep and SMBGhost aren’t the only major remotely-exploitable vulnerabilities that still have a strong presence online these days, exposing systems to attacks.
According to the Czech security researcher, there are still millions of internet-accessible systems that administrators have failed to patch and are vulnerable to remote takeovers. These include systems like IIS servers, Exim email agents, OpenSSL clients, and WordPress sites.
CVE
PRODUCT
UNPATCHED SYSTEMS
CVSSv3
CVE-2019-0211
Apache web server
3,357,835
7.8
CVE-2019-12525
Squid
1,219,716
9.8
CVE-2015-1635
Microsoft IIS
374,113
10
CVE-2019-13917
Exim
268,409
9.8
CVE-2019-10149 (Return of the WIZard)
Exim
264,655
9.8
CVE-2019-0708 (BlueKeep)
Windows RDP
246,869
9.8
CVE-2014-0160 (Heartbleed)
OpenSSL
204,878
7.5
CVE-2020-0796 (SMBGhost)
Windows SMB
103,000
10
CVE-2019-9787
WordPress
83,951
8.8
CVE-2019-12815
ProFTPD
80,434
9.8
CVE-2018-6789
Exim
76,344
9.8

The causes why these systems have been left unpatched remain unknown, but even recent warnings from US government cyber-security agencies have not helped.
This includes two warnings from the US National Security Agency (NSA), one issued in May (for the Exim bug CVE-2019-10149 that was exploited by Russian state hackers), and a second in October (for the BlueKeep bug that was exploited by Chinese state hackers).
Yet, despite these warnings, there are still more than 268,000 Exim servers unpatched for the Exim bug and more than 245,000 unpatched for BlueKeep.
Kopriva says the numbers show that “even very well-known vulnerabilities are sometimes left unpatched for years on end.”
“Given how dangerous and well known BlueKeep is, it rather begs the question of how many other, less well-known critical vulnerabilities are still left unpatched on a similar number of systems,” Kopriva also adds. More