Archive for March 28, 2022

Spotify Rolls Out A COVID19 Disclosure Tab…. What Took Them So Long

Posted in Commentary with tags on March 28, 2022 by itnerd

I haven’t written about Spotify for a while now. At least not since the whole Joe Rogan thing blew up. But I’m writing about it today because according to CNBC Spotify is rolling out a COVID19 disclosure tab in content that mentions COVID19.

Spotify is rolling out a Covid content advisory tab on podcasts and other content that mentions the coronavirus.

Spotify promised the feature, a small blue tab that directs to its Covid-19 information hub, nearly two months ago. It comes after a handful of musicians and creators boycotted the platform for its airing of “The Joe Rogan Experience,” which they say spread Covid-19 vaccine misinformation.

So why did it take them two months to roll this out? The fact that it took them this long would be laughable if it weren’t so serious. You have to wonder if they really take this seriously. My guess is no.

Leave a comment »

Researchers Discover New MS Exchange Hijacking Campaign

Posted in Commentary with tags on March 28, 2022 by itnerd

Researchers at Intezer has reported a new hijacking campaign that targets Microsoft Exchange with the IcedID modular banking trojan:

One of these banking trojans that have been used to deploy ransomware is IcedID (BokBot). IcedID was first reported on by IBM X-Force in November 2017 and the malware shared some code with Pony. While initially designed to steal banking credentials, like many other banking trojans, the malware has been repurposed for deploying other malware on the infected machines.

One way IcedID infects machines is via phishing emails. The infection chain that commonly has been used is an email with an attached password protected “zip” archive. Inside the archive is a macro enabled office document that executes the IcedID installer. Some phishing emails reuse previously stolen emails to make the lure more convincing. 

In the new IcedID campaign we have discovered a further evolution of the threat actors’ technique. The threat actor now uses compromised Microsoft Exchange servers to send the phishing emails from the account that they stole from. The payload has also moved away from using office documents to the use of ISO files with a Windows LNK file and a DLL file. The use of ISO files allows the threat actor to bypass the Mark-of-the-Web controls, resulting in execution of the malware without warning to the user. With regards to targeting, we have seen organizations within energy, healthcare, law, and pharmaceutical sectors.

The way this has evolved has clearly made this dangerous as someone went through a lot of time and effort to ensure that their attack isn’t detected until it’s too late. Saumitra Das, CTO and Cofounder of Blue Hexagon agrees:

“This attack shows how much effort attackers put in all the time to evade detection and why defense in depth is necessary. 

1. Reputation: Many email security systems use reputation of senders to block malicious email without being able to assess the email itself. Here they used compromised Exchange servers to make it through

2. Obfuscation: They used obfuscated file formats to deliver malware, encrypted archive – ISO – LNK – DLL to evade signature and sandboxes

3. Mutation: The DLL file was recently created so no signatures and hash lookups would help

4. Multi-Stage: The final payload is delivered over the network and not visible to email sandboxes. This shows why defense has to be done not just over email but also to go beyond and inspect the final download.”

Clearly it’s time for Exchange admins to up their game. Because these threat actors clearly have upped their game.

Leave a comment »

Update Google Chrome ASAP To Avoid A Zero Day That Has Been In Exploited By North Koreans Hackers For Weeks

Posted in Commentary with tags , , on March 28, 2022 by itnerd

Now would be a very good time to update Google Chrome to version 98.0.4758.102 for Windows, Mac, and Linux because North Korean Hackers have been using this exploit for weeks to do semi-targeted attacks:

The flaw, tracked as CVE-2022-0609, was exploited by two separate North Korean hacking groups. Both groups deployed the same exploit kit on websites that either belonged to legitimate organizations and were hacked or were set up for the express purpose of serving attack code on unsuspecting visitors. One group was dubbed Operation Dream Job, and it targeted more than 250 people working for 10 different companies. The other group, known as AppleJeus, targeted 85 users.

This is bad. And fortunately it’s patched. Marcus Fowler, SVP Strategic Engagements and Threats at Darktrace had this comment:  


“Hackers backed by North Korea’s government exploited a critical zero-day, attempting to infect hundreds of computers. We should be very cautious about assuming this is tied to rising geopolitical tensions. While North Korea may be trying to take advantage of the US turning its attention to mainly focus on Russia, the two separate North Korean hacking groups who exploited the flaw seem to go back much further. Both Operation Dream Job and AppleJeus have focused on monetary gain — frequently the top priority with North Korean cyber operations. 

Previously, Operation Dream Job used spearphishing emails to target specific employees with fake job offers from high-profile organizations. This timing is fascinating given the “Great Resignation” context and employees seeking more flexible jobs and leaving the workforce in droves. The other group, AppleJeus, targeted a cryptocurrency exchange. We have observed an increase in crypto mining attacks over the last few years, so this is also in line with broader hacking trends, not geopolitical happenings.” 

I would run and update your copy of Chrome ASAP to make sure that other threat actors don’t exploit this now that it is public.

Leave a comment »

Atlas VPN introduces MultiHop+

Posted in Commentary with tags on March 28, 2022 by itnerd

Virtual private network service provider Atlas VPN has launched the first of its kind VPN technology — MultiHop+ — which offers a new, more private, and secure way to route internet traffic. 

The recently released feature allows users to connect to the internet through several rotating VPN locations simultaneously,  carefully selected for optimal latency and speed for improved protection online.

Traditionally, a VPN works by creating a secure tunnel between a user’s device and a chosen private VPN server and encrypting the data that travels through that tunnel. It is through the VPN server the user then connects to the internet, as a result masking their real IP address.

Unlike standard VPN setup, however, the MultiHop+ routes internet traffic via several VPN servers simultaneously instead of one. This way, the user’s connection is protected with an additional layer of encryption and hidden behind multiple IP addresses from different geographical locations.

Similar to the anonymous Tor network, the servers within the Atlas VPN MultiHop+ chain are selected randomly. However, what’s unique to the MultiHop+ is the fact that the exit server rotates throughout the browsing. It means that each time a user accesses a different domain, their traffic takes a new and random route through the network, making it near impossible to predict and therefore track, and hence resulting in significantly higher levels of privacy and security. 

MultiHop+ is the second exclusive VPN technology developed by Atlas VPN engineers. In July, the team also introduced the SafeSwap privacy feature, which allows users to have many changing IP addresses without having to switch between different VPN servers.

Leave a comment »

My Thoughts On The Reaction To Apple’s Studio Display

Posted in Commentary with tags on March 28, 2022 by itnerd

Until two weeks or so ago, the only option for a display from Apple was the $5000 USD Apple Pro Display XDR that shipped with the Mac Pro in 2019. Of course to use it, you needed a $1000 USD stand, but the fact was that the display existed and was an option for people who wanted a first party option from Apple. But here’s the problem with that display. It was $6000 to get your hands on it. And it was total overkill for 99% of the public. Not to mention that the price put it out of the reach of the average person. Which is why many people wanted a lower cost option from Apple.

Two weeks ago or so ago they got that option in the form of the Studio Display at $1599 USD. And the reviews shall we say have been less than glowing. And I’ve been thinking about why this is the case as I rarely see this level of backlash against Apple, and come to the conclusion that some of this backlash is unwarranted, and some of it is due to how Apple brought this to market.

Let’s start with what Apple did wrong here by going through the specs of the Studio Display:

  • 27″
  • 5K resolution
  • 60Hz
  • P3 Wide Color
  • IPS panel
  • 600 nits brightness
  • 12MP Webcam with Center Stage powered by an A13 Bionic processor
  • Six speakers
  • Three microphones
  • One Thunderbolt 3 connector that delivers 96W of power
  • Three USB-C connectors
  • Option for Nano-Texture anti-glare coating at $300 USD
  • Option for height adjustable stand installed at time of purchase or later at an Apple Store for $400 USD
  • Option for VESA mount installed at time of purchase or later at an Apple Store at no additional charge.

Those are decent specs. More than decent in fact. But at $1599 USD to start? That’s a bit of a problem. The price relative to what you get seems seriously out of step with a lot of sub $1000 displays. I say that because it has no HDR support. Even cheap gaming monitors have some sort of HDR support. More on that in a moment. And reviews of the camera all basically say that it sucks. Though one assumes that this will be fixed through a software update. In fact Apple said so. But we’ll see if they deliver on that front. When it comes to the panel, it’s an IPS panel being used instead of mini-LED. If it were the latter, the $1599 price point would be easier to accept. But at least they included a stand this time. Though having to pay $400 to make it height adjustable seems obscene to me given that every other monitor on Earth has this functionality right out of the box.

Here’s where I won’t ding Apple. This monitor is 60Hz. And a lot of people on the Internet are upset about that as Apple has released iPads, iPhones, and MacBook Pros with ProMotion displays. That’s their variable refresh rate technology which allows a monitor to go from 120Hz down to as low as 24 Hz depending on the device. Thus it seems logical to expect a ProMotion display on a brand new monitor. Right? But here’s some facts. Thunderbolt doesn’t support 120Hz above a resolution of 4K. So there’s no technical way for Apple to bring ProMotion to a 5K monitor. Which meant ProMotion was never going to happen unless Apple went with a 4K panel. Which I am guessing was never going to happen either.

On top of that, the people who are the targets for this monitor are not the average person. It’s someone who wants:

  • A monitor that has the same calibration as their other Apple products (MacBook Pros, iPad Pros, etc.) so that they can work on content in a consistent manner as it supports many reference modes including Apple Display, HDTV Video, NTSC, PAL, SECAM, Digital Cinema, Design and Print, Photography, and Internet and Web sRGB.
  • Video professionals typically work with monitors locked to 60Hz, 30Hz, or 24Hz depending on the project. Thus the lack of ProMotion is a non-factor for them. Ditto for HDR support as anyone who needed HDR in their workflow would have brought a Pro Display XDR by now because it supports Dolby Vision HDR. There aren’t many monitors in the sub $1000 price range, or sub $5000 price range for that matter that support Dolby Vision HDR. In fact, any monitor in that price range with HDR support would be laughed at by a video or photography pro due to whatever HDR support it had if it wasn’t Dolby Vision HDR.

The above likely explains why if you wanted to buy a Studio Display, you currently have to wait at least 8 weeks to get one.

So in short, Apple likely hit the mark with the target audience of this monitor. But that’s not helping them in the PR space where people who were never, ever going to buy this monitor are saying that this monitor is a #Fail. Which means that the monitor is perceived as a #Fail. And perception is reality. The key word is perception. Because the reality is that this monitor is not a #Fail. It’s a good first party solution for the people who can utilize it.

Here’s my last point on this, while there are other monitors that do HDR, or do 120Hz, or have built in webcams finding one that checks the boxes of the Studio Display is going to be a huge challenge as almost nothing does 5K resolution. Nothing out there has the integration with macOS that the Studio Display has. And even if you downscale your ambitions to 4K or even HD like I did when I got this monitor, nothing is going to support the reference modes that the Studio Display has. Thus if you get a third party monitor, you’ll pay less money, but you’ll get less monitor. And you’ll likely be looking at a gaming monitor to get 120Hz and not ProMotion, passable HDR support, and either HD or QHD resolution due to the fact that 4K gaming monitors are currently few and far between. And it won’t have the sound quality that the Studio Display has. And I would question if you would get a usable webcam with it. On the flipside, if Apple came out with this monitor two years ago, or even a year ago, we would not be talking about this monitor as being a #Fail because it would be at worst in line with the competition. And further to that, if Apple came out with this monitor today with HDR, or ProMotion (not that it’s possible, but let’s pretend that it was possible for the sake of this argument), or a camera that worked out of the box, or some combination of those, we would not be talking about this monitor as being a #Fail because it would justify the price.

Apple didn’t exactly help their own cause here by how they brought this monitor to market. But I also think that there’s been an overreaction to this monitor’s perceived shortcomings. So I would say that people who hate this monitor need to take a breath here and relax. But at the same time, Apple needs to think about how to bring a monitor to market that has features that the people who are flipping out about this monitor want, but at the same time meets the $1599 price point, if not lower. Because this clearly is being perceived as a swing and miss by Apple. Even if it isn’t.

Leave a comment »

GIMMICK Malware Goes After macOS Computers

Posted in Commentary with tags , on March 28, 2022 by itnerd

macOS users need to worry about a new piece of malware called GIMMICK. The malware was discovered by researchers at Volexity, who retrieved it from the RAM of a MacBook Pro running macOS 11.6 (Big Sur), which was compromised in a late 2021 cyberespionage campaign:

GIMMICK is used in targeted attacks by Storm Cloud, a Chinese espionage threat actor known to attack organizations across Asia. It is a feature-rich, multi-platform malware family that uses public cloud hosting services (such as Google Drive) for command-and-control (C2) channels. The newly identified macOS variant is written primarily in Objective C, with Windows versions written in both .NET and Delphi. Despite core differences in programming languages used and operating systems targeted, Volexity tracks the malware under the same name due to shared C2 architecture, file paths, and behavioral patterns used by all variants.

The post from Volexity goes into detail about how this malware works. But here’s the high level explanation. After initializing the malware loads additional components that can remotely manage a Google Drive session. By using Google Drive as a command-and-control platform, the malware can go undetected by network monitoring solutions. Once on a machine, attackers can carry out a variety of other tasks using the malware, including uploading files from the machine to command-and-control infrastructure, downloading additional malicious files to the machine, and gaining a shell that allows it to execute commands.

Here’s the good news. If you’re on macOS Monterey, you’re protected from this malware. So your best defence is to get macOS Monterey onto your computer. Also, the usual advice of not clicking on attachments that you don’t recognize applies, along look considering the use a security product to protect yourself. Because as this illustrates, Macs are not immune to malware.

Leave a comment »