Archive for July 2, 2024

Targus Announces Industry-First Five-Year Warranty with Price Cuts on Select Premium Docking Station Models

Posted in Commentary with tags on July 2, 2024 by itnerd

 Targus today announced that it now offers an industry-first five year warranty with new reduced pricing on its best-in-class universal docking stations – specifically DOCK310DOCK315, and DOCK430 – purchased after July 1, 2024. The extended five-year warranty on these select models further demonstrates the company’s long track record of delivering superior quality tech solutions that boost workers’ productivity, performance, and connectivity, anywhere. 

This new extended warranty is now being offered with unbeatable pricing on three of its latest universal docking stations compatible with Windows, macOS, Android, Chrome OS, and other major operating systems, to ensure business customers are covered with the best warranty in the industry that will meet or exceed the expected three- to five-year lifecycle of their PCs.

The Universal USB-C DV4K Docking Station with 65W Power Delivery (DOCK310) is a sleek and powerful dock packed with all the necessary ports and power needed in a single dock to create a convenient, productive workstation. This universal docking station connects two 4K displays to multiple hosts and peripherals for a dual ultra-high-definition video experience with power delivery 3.0 up to 65WDC. Three USB 3.2 Gen 1 Type-A ports and 1 USB 3.2 Gen 1 Type-C port make it simple to add the latest keyboards, exterior hard drives, and other peripherals to customize the workspace experience.

The Universal USB-C DV4K DP Docking Station with 65W Power Delivery (DOCK315) is the ultimate universal docking station to expand a workstation and connect to nearly any laptop with a single cable. This dual monitor docking station delivers crisp and clear 4K video outputs while supporting a connection up to two displays via DisplayPort ™ to multiple hosts and peripherals for a dual ultra-high-definition video experience. This powerful dock supports single 5K and dual 4K UHD HDR at 65WDC, offering video performance up to 4096×2160 p60 for dual displays. Users can also connect their favorite accessories with a combination of USB-A (3x USB 3.2 Gen 1 Type-A ports) and USB-C (1x USB 3.2 Gen 2 Type-C), plus Ethernet and audio ports.

The USB-C Multi-Function 202DisplayPort Alt. Mode Triple Video Docking Station with 85W Power (DOCK430) is a sleek and powerful Alternate Mode dock which packs all of the ports and power needed in a single dock to create a more powerful, productive workstation. Enjoy crisp, clear native video while supporting a connection up to three monitors. With two DisplayPort™ 1.4 ports and one HDMI 2.0 port, this dock supports three monitors (1920×1080 p60), two monitors (2560×1440 p60) or one monitor (3840×2160 p60) and various lower resolutions. Plus, users can connect to all of their favorite accessories with a combination of USB-A (4 USB 3.2 Gen1 ports, 1 fast-charging) and USB-C (1x 3.2 Gen2), plus Ethernet and audio ports.

All three of these Targus universal docking stations, which come with the new extended five-year warranty, are available for sale at Targus.com and through participating resellers and distributors worldwide. Visit Targus.com for additional product details, pricing, and availability.

The IMS Hack Is MUCH Worse Than Previously Thought

Posted in Commentary with tags on July 2, 2024 by itnerd

Infosys McCamish Systems (IMS) has started sending out data breach notification letters regarding a ransomware attack that it disclosed in February 2024 to over 6 million victims, far more than the initially reported 57,000 Bank of America customers. I covered that initial report here.

IMS is a multinational corporation that provides business consulting, IT, and outsourcing services in the insurance and financial services industries for companies such as the Bank of America and seven out of the top ten insurers in the country.

In February 2024, IMS informed the public that it had been hit by ransomware in November 2023 resulting in the compromise of the personal data of about 57,000 Bank of America customers.

In a new notification shared with the authorities, IMS now says the total number of people affected is over 6 million.

The compromised data varies by individual but includes the following:

  • Social Security Number 
  • Date of birth
  • Medical treatment/record information
  • Biometric data
  • Email address and password
  • Username and password
  • Driver’s License number or state ID number
  • Financial account information
  • Payment card information
  • Passport number
  • Tribal ID number
  • U.S. military ID number

IMS has not disclosed which of its clients were impacted except for Oceanview Life and Annuity Company. The list of impacted data owners may be supplemented as more customers request to be named in the filing.

Evan Dornbush, former NSA cybersecurity expert, has this comment:

“This is another example of attacks becoming more complex and taking longer to determine full impact.

 “Also once again, this is an example of customers becoming passive victims in a process where they cannot take any action beyond hoping the breach isn’t so bad.  It’s simply maddening.  While some of the compromised data can be easily replaced – such as credit card numbers, license and passport identifiers are less easily renewed, and the loss of medical treatment and biometric data is irrevocably damaging to one’s privacy.”

Given the scope of this breach, I am hoping that IMS, Bank of America, and whomever else was involved in this is hauled before the relevant authorities and made to answer questions on this. Because a breach this size that took months to figure out is simply unacceptable.

A New OpenSSH Vulnerability Is Going To Be A Big Deal As It Affects A Whole Lot Of Things

Posted in Commentary with tags on July 2, 2024 by itnerd

It is being reported that a new OpenSSH vulnerability which is currently being tracked as CVE-2024-6387 could impact 14 million internet-facing OpenSSH instances:

The Qualys Threat Research Unit (TRU) discovered this unauthenticated Remote Code Execution (RCE) vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems. This bug marks the first OpenSSH vulnerability in nearly two decades—an unauthenticated RCE that grants full root access. It affects the default configuration and does not require user interaction, posing a significant exploit risk. 

In Qualys TRU’s analysis, we identified that this vulnerability is a regression of the previously patched vulnerability CVE-2006-5051, reported in 2006. A regression in this context means that a flaw, once fixed, has reappeared in a subsequent software release, typically due to changes or updates that inadvertently reintroduce the issue. This incident highlights the crucial role of thorough regression testing to prevent the reintroduction of known vulnerabilities into the environment. This regression was introduced in October 2020 (OpenSSH 8.5p1).

Rogier Fischer, CEO and Co-Founder at Hadrian Security noted the following:

“While there is currently no proof of concept demonstrating this vulnerability, and it has only been shown to be exploitable under controlled lab conditions, it is plausible that a public exploit for this vulnerability could emerge in the near future. Hence it’s strongly advised to patch this vulnerability before this becomes the case”.

This is correct. Now that this is out there, it’s time to patch all the things. Hadrian has a blog post that goes down the rabbit hole on this vulnerability including mitigation steps.