Archive for January, 2024

23andMe Didn’t Notice That They Got Pwned For Five Months…. WTF??

Posted in Commentary with tags , on January 29, 2024 by itnerd

So if you haven’t been keeping track of the ongoing story of 23andMe being pwned in epic fashion, here’s a quick update:

Let’s fast forward to today. According to a filing that was sent to California’s attorney general, the hack actually started in April 2023 and continued until September. That’s five months. Five months where threat actors were able to do their evil work. And what’s worse than that is the fact that 23andMe only found out about this when the threat actors started posting the data on the unofficial subreddit for 23andMe. Now it’s pretty bad when you get pwned. It’s worse when you don’t know about it for months and you only find out about it because someone was browsing Reddit. Which to me suggests that 23andMe was seriously asleep at the switch. 23andMe seriously needs to be sued out of existence because this is frankly unacceptable. And this level of #fail needs to be punished severely.

A Quick Look At Apple’s Live Voicemail Along With Some Troubleshooting Advice

Posted in Commentary with tags on January 29, 2024 by itnerd

One of the features that came out with iOS 17 was Live Voicemail. This basically can be described as an old school answering machine where you can take an incoming call and punt it to voice mail. Then watch a transcription of the person leaving the voice mail on your iPhone’s screen. On top of that, you can pick up the phone and talk to the person if you feel that you need to talk to them. That all sounds great, but I’ve had a number of clients have trouble with Live Voicemail. Thus I wanted to do a story on this where I talk about the main issue that I have seen in the field, as well as answering one question that I get asked on a frequent basis.

First of all, let me frame something here so that this whole discussion makes sense. Live Voicemail is a feature that is local to your iPhone. It isn’t sitting in a phone carrier’s cloud or anything like that. Thus for it to work, your iPhone has to be turned on and connected to WiFi or a cellular network. That leads to the question that I keep getting asked. Which is since this feature came out, does that mean that I can kill off my carrier’s voice mail service and save a few bucks in the process?

The answer is that it depends on your use case. If you are going to be on the Internet 99% of the time, and your phone stays on 99% of the time, then I suppose that you could do that. But here’s the catch. Remember when I said that this feature is local to your iPhone and it needs to be connected to WiFi or a cellular network, or turned on. That means that if it isn’t turned on, or connected to a cellular network, you calls will not go to voicemail. So if you depend on being able to have calls go to voice mail 100% of the time, you should not kill your carrier’s voice mail plan.

Now over to the number one issue that many of my clients have. I’ve had a surprising number of clients report that after upgrading to iOS 17, their customized voice mail greeting is gone and been replaced by a greeting that is voiced by Siri. The reason for that can be found if you go into the phone app, and then clicking on the voicemail icon at the bottom right of the screen, followed by clicking on Greeting at the top right.

Chances are that your greeting is set to Default just like the picture above. What you likely need to do is choose Custom and then click the word Record to record your own customized greeting. Once you do that everything should work you expect it to.

The other thing that I can offer up as a troubleshooting tip is to make sure that you have Live Voicemail set up as per this Apple Support document. The most common thing that I see is that a voicemail password hasn’t been set which can break Live Voicemail for whatever reason. My guess is that even though this feature is turned on by default, there are some prerequisites that need to be present for it to work.

What do you think of Live Voicemail? Drop a comment below and share your thoughts.

Today Is Data Privacy Day

Posted in Commentary with tags , , on January 28, 2024 by itnerd

Data Privacy Day is today. Led by the National Cyber Security Alliance (NCSA), this event is a key part of a yearly global campaign focused on safety, security, and privacy. The theme for this year is “Take Control of Your Data.” It represents a worldwide endeavor to raise awareness about the significance of privacy respect, the protection of personal information, and the cultivation of trust.

Executives from Appdome, Datadobi, DH2i, Folio Photonics, Mission Cloud had this to say about this important day, and the incredibly important topic it represents:

Carl D’Halluin, CTO, Datadobi

“On January 28, we celebrate Data Privacy Day. Initiated in the United States and Canada in 2008 by the National Cyber Security Alliance, its aim is to raise awareness and promote privacy and data protection best practices. 

I would say the number one data privacy best practice is pretty simple: make sure you can get the right data to the right place at the right time. Wherever the data is in its lifecycle, it should be protected and only accessible as needed. Of course, this tends to be easier said than done. But, there is perhaps nothing more critical and imperative than implementing the right strategies and technologies to do so. After all, while data is an organization’s most valuable asset (in addition to its people), it also represents its greatest potential risk. 

Balancing these two aspects is key. In other words, effective data management enables you to optimize your business intelligence, make faster and smarter decisions, and gain a competitive edge, as well as better meet business requirements such as internal governance and legal mandates, external regulations, and financial obligations and goals.” 

Don Boxley, CEO and Co-Founder, DH2i

“Data privacy isn’t just important for businesses – it is a matter of corporate survival. A company can make just one small mistake, neglect one small security check-box, and the consequences can be catastrophic. One small mistake could lead to a data breach that causes legal and regulatory fines, as well as irreparable damage to the company’s reputation — a nightmare from which recovery is near-impossible.

A software-defined perimeter (SDP) solution could be the answer! Many SDP solutions are engineered to provide secure network connectivity across on-prem, cloud, and hybrid environments. SDP enables its users to transform their traditional network-based perimeter security with a more sophisticated one that creates micro-perimeters around data. SDP enables secure connections between data centers and across private and public cloud platforms without needing a VPN or direct connect, thereby significantly reducing security vulnerabilities even further. In addition, for those focused on data protection and privacy, SDP enables the ability to create secure tunnels for specific applications, as opposed to entire network access. Ideally, such a solution would be streamlined and straightforward to manage, equipped with an intuitive interface that eases the configuration, and ongoing management of secure connections. This combination — increased security, ease-of-use, and adaptability – makes SDP the ideal choice for protecting data and ensuring data privacy.”

Steve Santamaria, CEO, Folio Photonics:

“On Data Privacy Day, we are reminded of the business-critical importance of safeguarding sensitive information – both professional and personal – at a time when data breaches and cyber threats have become all too common. For data protection professionals, this should not be viewed as a gentle nudge but rather a polite – yet strong shove toward reviewing and fortifying the technology and policies that serve as the underpinnings of your data protection strategy.

How can anyone not admire those responsible for their organization’s data protection? As we in the business know – it’s no walk in the park! The good news is of course, that smarter and more powerful technology solutions continuously enter the marketplace, ready to take their place in the data protection professional’s arsenal. Active archives built on an optical storage foundation can offer an ideal data protection solution for several compelling reasons. Firstly, they provide a high level of security as data stored on optical discs is read-only, rendering it resistant to cyber threats like ransomware. Optical storage is also highly durable — able to withstand physical damage from factors like magnetic fields, moisture, and temperature fluctuations, ensuring the safety of critical data. What’s more, optical storage media boasts a long lifespan, making it ideal for data archival and compliance requirements while also being cost-effective in the long term. And last but certainly not least, it can be easily air-gapped – adding a virtually impenetrable defense against a cyber-attack. 

Retrieving data from optical storage is quick and reliable due to fast read speeds, making archived data readily accessible. And if that isn’t enough — it is environmentally friendly, consuming less energy and having a lower carbon footprint compared to alternative storage options.”

Alan Bavosa, VP of Security Products at Appdome:

In the spirit of Data Privacy Week, we should champion initiatives that prioritize security and resiliency.  

Protecting consumer data and privacy isn’t just about how a company uses their data internally or with partners, it is how it’s guarded from wider threats, such as cyber attackers. In fact, data privacy and cybersecurity are intrinsically interlinked – you can’t ensure consumer data is kept private if you don’t prioritize cybersecurity. And this includes the protections on a brand’s mobile app offering, especially as mobile stands as the dominant channel for people’s interactions, fueling criminals to eagerly infiltrate apps.  

If brands don’t pay attention to how they protect their consumers via mobile apps, they are putting themselves at a huge commercial and reputational risk as customers may leave. For instance, nearly three-quarters of global mobile consumers stated that they’d be likely or very likely to stop using an app and tell their friend to stop using it too following a data breach or if they discovered that it didn’t protect their data. 

Clearly, brands that do have privacy and security built into their mobile applications have a lot to benefit. Not only will it address cybersecurity fears and build consumer trust, but it will put them on course to comply with regulations such as DORA (Digital Operational Resilience Act) and NIS 2 Directives that both require cybersecurity resilience.

Ryan Ries, Chief Data Science Strategist at Mission Cloud:

Data Privacy is a very difficult topic to try and understand because there are so many rules and regulations that are constantly changing and are different state to state and country to country. People have to look at what kind of data they have and understand all the rules associated with it which is very time consuming and a serious endeavor. We often see customers that had this under control when they were a smaller company, but as they grow they have to really focus on ensuring they are doing the right things with the data and understanding what rules it falls under. There are so many different layers to data privacy and how you handle it, does it fall under PII, PHI or HIPAA? Do I need to worry about GDPR or data residency? There is a lot to consider and you need to be diligent that you are handling your data properly.

Three Pieces Of Mac Software That You Should Know About

Posted in Commentary on January 27, 2024 by itnerd

Like most of you out there, I customize my Mac to meet my needs. And to do that, I am on the lookout for software that allows me to add some sort of functionality to my Mac. Sometimes very specific functionality. And I will be talking about three of those pieces of software today.

I’m going to start with Clyde which is an alarm system for your Mac. Here’s the scenario it’s designed for. You’re in a coffee shop with your MacBook and you need to go to the washroom. Sure you can ask some total stranger to watch your stuff. But that’s not going to guarantee that anything will get stolen. That’s where Clyde comes in. When you enable it on your MacBook and leave the lid open, it will lock the screen. If some criminal low life scumbag then tries to steal your MacBook, they are likely to close the lid to make it easier to escape with your MacBook. When they do that, a super loud alarm that they cannot disable will go off attracting attention. And when I say super loud, I mean it. On top of that, you will get an alert and a phone call on your iPhone and Apple Watch. That way you can stop the scumbag from escaping, assuming that others haven’t beaten the scumbag senseless. It’s $9 one time purchase, but there is also a free version that simply has the alarm. I’d invest in the $9 version as that’s cheaper than a new MacBook.

Next up is MonitorControl which is a free app. Its job is to control the brightness of non-Apple displays via an icon on the menu bar. It works quite well for those of us who run multiple monitors on our Macs like I do as I don’t have to fiddle with the buttons on the monitor if I want to adjust something. Brightness control of non-Apple monitors is something that macOS doesn’t do out of the box which makes this free app handy. Though I suspect that Apple will “Sherlock” this feature as that’s what Apple does.

The final app that I’d like to talk about is AppCleaner. This is a free app that cleanly uninstalls Mac applications that don’t have an uninstaller. Which is most apps for the Mac. The thing with Mac apps is that they scatter bits and pieces of themselves all over your hard drive. So even if you if you get rid of the main application, something is guaranteed to be left behind in some odd place on your hard drive. AppCleaner solves that problem for me. Which is important as I am often trying pieces of software for my clients, and I don’t want my hard drive cluttered with the bits and pieces of apps that I don’t use.

Are there apps that help you to customize your Mac to fit your needs? If there are, please leave a comment and feel free to share them.

HPE Got Pwned By The Same Group That Pwned Microsoft

Posted in Commentary with tags on January 27, 2024 by itnerd

At this time last week, I was writing about Microsoft getting pwned by Midnight Blizzard who also are known as Cosy Bear. Well, HPE has joined the list of companies that were pwned by this group. Here are the details:

A Russia-based threat actor known as “Cozy Bear” or “Midnight Blizzard” has breached some of HPE’s corporate mailboxes, the company revealed on Thursday in a Securities and Exchange Commission (SEC) filing

“Based on our investigation, we now believe that the threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions,” HPE said in the SEC filing.

HPE said that after being notified in June 2023 of unauthorized access to SharePoint files dating back to May 2023 by a known threat actor, it conducted an investigation with external cybersecurity experts and took containment measures.

“We determined that such activity did not materially impact the Company,” it concluded.

Sure it didn’t. But I will come back to that later. Right now I want to serve up commentary from Craig Burland, CISO, Inversion6:

Cozy Bear’s latest incursions are a not-so-subtle reminder of two things: 99% isn’t good enough in cybersecurity and if the high-level APTs want to get in, they will.  Of Microsoft’s massive defensible perimeter, they left a single gate relatively unguarded – a user credential protected with just a username and password.  The compromise of that account led to a bigger prize for Cozy Bear. 

There are a number of sayings in the cyber business about the defenders needing to be right all the time.  This example reinforces that notion.  But, perfect prevention is not easily gained.  The commitment, discipline, and cost to reach and maintain perfect prevention is staggering.  Instead, while humbling and troubling, the wiser strategy is to accept that breach is probable and spend equal time considering what you do after the initial breach.

I’ll follow that with commentary from Anurag Gurtu, CPO, StrikeReady:

The recent cyberattack on Microsoft and HPE by the Russian hacker group Cozy Bear highlights a critical challenge in cybersecurity. This incident, involving a sophisticated password spray attack that compromised high-level corporate emails, demonstrates the need for continuous vigilance and advanced security protocols in the tech industry. It underscores the evolving nature of cyber threats and the importance of robust defense mechanisms to protect sensitive information in a digitally interconnected world.

The thing is, a group like this wouldn’t be hacking into HPE or Microsoft to get stuff that wasn’t a material impact. They are a nation state group of hackers who are aligned with Russia. So there’s likely more to this. And either we don’t know about it, or HPE and Microsoft don’t know about it. I guess we’ll eventually find out.

A New And Very Dangerous Canada Revenue Agency Email Phishing #Scam Has Appeared

Posted in Commentary on January 26, 2024 by itnerd

I came across a new phishing scam that uses the name of Canada Revenue Agency to steal your Microsoft 365 credentials. And this one is very dangerous. Let me start with the email that you get:

What caught my attention is that the form that is displayed here looks very much like a Canada Revenue Agency form. And it’s a very good replication. This I can see a scenario where someone might be fooled by this. But in the case of this phishing attempt, here’s where it falls apart.

For starters the email refers to the “Canadian Revenue Service” which doesn’t exist. It’s the Canada Revenue Agency that is the actual name of the part of the Canadian government that collects your taxes. A minor point, but an important one as info like this can help you figure out if something that hits your inbox is real or fake. The next thing that I should point out is that this email is not addressed directly to anyone. It simply says “Dear taxpayer”. That should be an immediate red flag as you would expect that communication from a national government would have your name on it.

The next thing that I usually suggest that people do is to check the email address. Here is what I saw when I did that:

Well that’s interesting. It comes from a Canada.ca address. People might be fooled by that as the webpage for the Canadian government is http://www.canada.ca. Which makes this email appear to be legitimate. But this is a classic attempt to “Spoof” an email address. Meaning that they are pretending to be someone that they are not to fool you. To confirm that, I did some extra digging to show the email headers. This is all the technical information that you normally never need to see. But someone like me can use to determine if an email is a phishing attempt. Now if you ever wanted to see the header of an email that you get, here’s how to do it on Outlook and Mac.

In my case, it showed some very interesting information (click to enlarge):

Now I am only showing you the relevant parts of the header. Specifically the circled area which is where the email came from. And that source is clearly not the Government of Canada based on the fact that it is “Canada-mailer.com”. When I traced that server back to its source, I got this:

That’s very curious. Who is Gophish? Well, here’s what I found out:

So this is an open source platform that companies that companies can use to assess their exposure to phishing. But I suspect a threat actor is using this platform to launch attacks on people. Seeing as the platform is free, that’s totally plausible.

What is the end goal here by the threat actor? Well, if you click on the “Sign In With Microsoft Outlook” button, you get this:

This is an extremely convincing Microsoft 365 sign in page. I say that because here’s the real one:

It’s pretty much an exact replication except for one thing. If you look at the address bar you’ll note this:

That’s clearly not Microsoft. I say that because here’s what you see from the real Microsoft 365 login screen:

You see, it pays to pay attention to the little details to help you to avoid being pwned by a threat actor. Who in this case is clearly trying to harvest credentials.

Since this is an open source platform software I went to the GitHub site as their webpage directed me there, but I didn’t find any contact info to let them know about this. And I suspect that even if there was contact info, there would be little that they can do to stop this attack. Thus it’s going to be incumbent on you to watch out for this email or ones like it as clearly a threat actor is out to get you.

The GSA Gets Called Out By The Inspector General For Buying Suspect Chinese Videoconferencing Cameras

Posted in Commentary with tags on January 26, 2024 by itnerd

Well this is embarrassing, and a national security threat at the same time. The GSA was ratted out to the US Inspector General for the purchase of some Chinese made videoconferencing cameras. Here’s how that went down:

In 2022, our office was contacted by a GSA employee who was concerned about GSA’s purchase and use of Chinese-manufactured videoconference cameras. Since these cameras were manufactured in China, they were not compliant with the Trade Agreements Act of 1979 (TAA). Our audit objective was to determine whether GSA’s purchase and use of these Chinese-manufactured videoconference cameras were in accordance with federal laws, regulations, and internal guidance.

And:

GSA Office of Digital Infrastructure Technologies (IDT) employees misled a contracting officer with egregiously flawed information to acquire 150 Chinese-made, TAA-noncompliant videoconference cameras. Before completing the purchase, the contracting officer requested information from GSA IDT to justify its request for the TAA-noncompliant cameras, including the existence of TAA-compliant alternatives and the reason for needing this specific brand. In response, GSA IDT provided misleading market research in support of the TAA-noncompliant cameras and failed to disclose that comparable TAA-compliant alternatives were available.

The TAA-noncompliant cameras have known security vulnerabilities that need to be addressed with a software update. However, GSA records indicate that some of these TAA-noncompliant cameras have not been updated and remain susceptible to these security vulnerabilities.

Well, that’s really freaking bad. Andrew Borene, Executive Director for Global Security, Flashpoint had this comment:

“The GSA’s procurement of unauthorized Chinese-made cameras with known vulnerabilities is certainly a matter of concern, echoing similar apprehensions we’ve had in the past about other technology products, such as drones, from China. 

These cameras, like any technology that connects to IT systems, can become a potential vector for espionage, malware, or maintaining a persistent presence in federal networks. The PRC’s Communist government has passed a number of increasingly totalitarian laws mandating that all Chinese corporations share information with the government for national security purposes. This creates an inherent risk when using their manufactured technology in sensitive environments. 

Given the PRC’s history of espionage, and the increasingly intertwined relationship between the state and private enterprises, the use of these cameras in federal settings poses a significant risk, not just due to their known vulnerabilities, but also due to the potential for hidden backdoors or other compromised elements in their hardware or software.

The prevalence of unauthorized Chinese-made technologies in government agencies, despite known risks, is a multifaceted issue. One primary factor is China’s dominance in manufacturing and global supply chains, making their products readily available and often more cost-effective. 

However, this convenience comes with heightened risks, especially when considering critical infrastructure and national security. 

The challenge in keeping these products out of federal networks lies in the complexity of supply chains and the difficulty in thoroughly vetting every component for security risks. The PRC’s significant role in technology production, combined with its aggressive espionage tactics, necessitates a more cautious approach. The focus should not only be on direct components but also on an extensive evaluation of the entire supply chain, acknowledging the -nth party risks. 

In light of China’s continued efforts to infiltrate Western networks for intelligence and espionage, it is crucial for government agencies to exercise heightened diligence and opt for more secure alternatives, even if they come at a higher cost or require more rigorous procurement processes.”

Hopefully those people in the GSA who were stupid enough to buy these cameras get what’s coming to them. Because given China’s history of espionage, this was a completely unacceptable purchase.

  

EquiLend Pwned And Will Be Offline For Several Days

Posted in Commentary with tags on January 26, 2024 by itnerd

In an online statement posted online, financial technology firm EquiLend disclosed that on January 22nd it was hit with a cyberattack which forced it to take several of its systems offline and may require several more days to recover from. The firm is the owner of NGT, a trading platform that executes $2.4 trillion of securities trades each month.

“We immediately launched an investigation and have identified a cyber security incident involving unauthorized access to our systems. We took immediate steps to secure our systems and are working methodically to restore the involved services as quickly as possible.

“We are working with external cybersecurity firms and other professional advisers to assist with our investigation and restoration of service. Clients have been advised that this may take several days,” the company said.

EquiLend was created in 2000 with the intention of making the securities finance industry more efficient through a centralized platform for trading and post-trade services. Financial firms like Bank of America, Merrill Lynch, BlackRock, Credit Suisse, Goldman Sachs, JP Morgan, Morgan Stanley, UBS and others make up its board of directors.

Mark Cooper, President & Founder, PKI Solutions had this to say:

   “It is unfortunate that we continue to see day after day reports of unauthorized access to critical systems in the financial, energy, and water management industries. Modern authentication systems have been around for a number of years that increase the integrity and privacy of organizational identities. The majority of these compromises are from out-of-date approaches of user passwords. Stronger systems that utilize certificate-based identities tied to physical tokens make attacks like this considerably more complex and harder to execute. Along with stronger identities, the ability to monitor and alert on foundational security issues helps to ensure the deployed technology isn’t vulnerable to known attacks.”

We’re barely through the first month of 2024 and the pwnage is already epic. And it’s likely to get worse as we through the year. And I’m not looking forward to that.

iOS 17.3 and macOS 14.3 Fixes A Pretty Big Bug

Posted in Commentary with tags on January 26, 2024 by itnerd

For those of you that installed iOS 17.3 or macOS 14.3, there was a pretty big bug that may have been actively exploited. If you look at the security update page from Apple, you’ll see this:

There is a similar entry for macOS 14.3 as well. The fact that it appears to have been actively exploited is a huge problem.

 Appdome’s VP Security Products, Alan Bavosa had this comment:

“The Apple security vulnerability CVE-2024-23222 and its exploitation in iOS 17.3 is concerning. The recognized potential attack vectors, encompassing remote code execution, spyware, and kernel exploits, underscore the severity of this threat in the realm of mobile security as they could allow attackers to gain total control over iOS devices and compromise any unprotected apps or accounts running on the device. 

However, amidst the foreboding nature of these vulnerabilities, a ray of optimism emerges. Presently, tailored protections are at the disposal of app owners and DevOps teams, offering a means to address and pre-emptively thwart each of these threats by automating mobile app defense. This empowers them to proactively safeguard consumers. For example, Appdome itself is capable of blocking shell code, code injection, remote execution, and kernel-based attacks – effectively fortifying against the very types of attack vectors seen in CVE-2024-23222. In times of adversity, such proactive measures serve as a source of much-needed reassurance for the iOS community.” 

If you haven’t updated to macOS 14.3 and/or iOS 17.3, you should update now to protect yourself from whatever threat actors are exploiting this.

Pax8 Bolsters MSP Defenses with Industry-Leading Security Platform from Trend Micro

Posted in Commentary with tags on January 25, 2024 by itnerd

Pax8, the leading cloud commerce marketplace, today announced Trend Micro, a global cybersecurity leader, is now available on the Pax8 Marketplace in North America and Europe. Trend Micro’s proven product and program align with Pax8’s goal of increasing accessibility to market-leading cybersecurity solutions for managed service providers (MSPs).

Trend Micro is consistently recognized as a “Leader” by Forrester, Gartner, CRN, and G2, reinforcing its dedication to delivering top-notch security solutions. Its advanced platform, encompassing Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), and Managed Detection and Response (MDR), delivers multi-layered protection and heightened visibility across endpoints, mobile devices, emails, cloud applications, and browsers. With AI-powered machine learning and automatic data correlation, the co-managed offering ensures 24/7 monitoring, detection, incident investigation, and response services.

To learn more about Pax8 and Trend Micro, please visit www.pax8.com.