Kashable and BrightDime Launch New Partnership

Posted in Commentary with tags , on May 20, 2024 by itnerd

Kashable, a fintech platform that provides Socially Responsible Credit™ and financial wellness solutions as an employer-sponsored voluntary benefit, and BrightDime®, a trusted partner that provides a real-time 360-degree view of individuals’ holistic financial picture, have announced a new partnership. This partnership aims to provide access to personalized financial coaching and money management tools. At inception, the program will be implemented across 50 companies, including IKEA, Chobani, and Nasdaq, covering over 170,000 employees.

According to a recent study, 86% of employees indicated that they’re stressed about finances, directly impacting their overall health and performance at work. Having access to financial literacy and coaching tools is crucial to lowering stress and empowering employees to manage their finances effectively and achieve long-term financial stability and security.

Beginning today, employees who have access to Kashable’s Financial Wellness Program will also have access to free financial coaching sessions and other educational resources from BrightDime.

Adding BrightDime’s financial coaching marks a significant stride in empowering employees with the tools they need to enhance and prioritize their financial wellness and security. Through one-on-one and on-demand financial coaching, employees receive support during challenging financial circumstances. This guidance is essential in navigating important financial decisions, enabling employees to stride confidently toward financial independence and well-being.

To speak with Kashable about access to BrightDime’s personalized financial wellness tools, visit Kashable.com.

Horizon3.ai Publishes Fortinet FortiSIEM Command Injection Deep-Dive & Exploit POC 

Posted in Commentary with tags on May 20, 2024 by itnerd

Horizon3.ai Chief Attack Engineer Zach Hanley and the Horizon3.ai Red Team Zach Hanley has just published CVE-2023-34992: Fortinet FortiSIEM Command Injection Deep-Dive with indicators of compromise and a link to the team’s proof of concept exploit on GitHub to blindly execute commands as root on vulnerable FortiSIEM appliances.  

Hanley said: “Several issues were discovered during this audit that ultimately lead to unauthenticated remote code execution in the context of the root user. The vulnerabilities were assigned CVE-2023-34992 with a CVSS3.0 score of 10.0 given that the access allowed reading of secrets for integrated systems, allowing for pivoting into those systems.”

FortiSIEM is Fortinet’s security information and event management (SIEM) with user and entity behavior analytics (UEBA), with the functionality typical to SIEM solutions such as log collection, correlation, automated response, and remediation. It also allows for simple and complex deployments ranging from a standalone appliance to scaled out solutions for enterprises and MSPs.

The App Tracking Bug In iOS 17.5 Has Been Fixed

Posted in Commentary with tags on May 19, 2024 by itnerd

It appears this issue for app tracking and asking apps to request to track is now working properly. To recap, after updating to iOS 17.5, many people noticed that if you went to Privacy & Security –> Tracking, an option called “Allow apps to request to track” was greyed out so that you couldn’t turn it off or on. This blew up the Internet for a couple of days as this wasn’t exactly a trivial bug.

Apple appears to have fixed it based on the fact that I noted this late yesterday:

Compare that with this photo taken at the time that the issue surfaced:

You’ll note in the first picture the control for this option is now live again. I am guessing that this was some sort of server side fix. As in Apple made some sort of change on their end for iPhones running iOS 17.5 that fixed this.

Now if they would only fix this issue which appears to be extremely widespread. I haven’t seen it. But I know people who have and this looks really bad on Apple.

Twitter.com Is Now X.com…. But It’s Still Twitter To Me

Posted in Commentary with tags on May 19, 2024 by itnerd

Elon Musk has been obsessed with rebranding Twitter to X. But if you went to various parts of the site, you would find references to Twitter. But that appears to be no longer the case based on this Tweet from Elon himself:

Let’s start with the fact that this X logo looks nothing like the X logo that Elon has been using for a while now. What’s up with that? And how much does this move to X.com break things for people on the Internet? That’s a good question.

Regardless of what Elon thinks. This site will still be Twitter to me and many other people. And there’s nothing that Elon can do about it.

Presto Card Support Coming To iPhone…. Soon…. Whatever That Means

Posted in Commentary with tags on May 18, 2024 by itnerd

For those of you who live in the Greater Toronto Area, your best way to use public transit is to use a Presto Card to pay for your trips on transit. Now Android users have had the ability to have their Presto Cards on their phones for a while now. iPhone users were out of luck. But that appears to be changing based on this Tweet:

I’m not sure what “soon” means to Metrolinx which is the organization that oversees transit in the Greater Toronto Area. I say that because this organization has a pretty poor track record of delivering projects on time and on budget. Thus “soon” could be next year or next week. Who knows? But the fact that they are saying something implies that maybe something is coming in the next few weeks? We will have to see and hopefully this doesn’t become another Metrolinx fiasco where they promise something but don’t deliver on time.

AI Increases True Positives On Vendor Risk 500%: VISO TRUST

Posted in Commentary with tags on May 17, 2024 by itnerd

VISO TRUST has issued its “2024 State of Third Party Risk Management: AI’s Impacts and Future Trends” which codifies that longstanding Third-Party Risk Management (TPRM) methods are increasingly inadequate in today’s digital business environment. 

The report leverages VISO TRUST Platform-derived data, which includes profiles of more than 2.4 million companies, and insight from CISOs, security, and TPRM professionals across various industries.

Among key findings on legacy TPRM: 

  • Inadequate responses: Approximately 75% of vendors responding to legacy questionnaire approaches requiring manual input either ignore or delay crucial risk assessments.
  • False positives: Conventional cyber risk ratings yield a 90% false positive rate, undermining their reliability.

AI-driven transformation of TPRM findings:

  • Efficiency gains: AI-assisted modern TPRM programs reduce vendor and partner assessment timelines from months to days.
  • Near-complete coverage: AI and automation achieve almost 100% coverage of third-party networks.
  • Significant increase in true positives: data analysis revealed a 500% rise in accurate risk identifications.
  • Faster assessments: Risk evaluation times have decreased from 60 to 90 days to just five to eight days.
  • Enhanced accuracy: AI-driven methods refine risk assessment precision.

Apple Has A Significant Bug In iOS 17.5

Posted in Commentary with tags on May 17, 2024 by itnerd

Apple is likely looking at this bug that appears to be widespread based on what I am seeing online. If you go to Privacy & Security –> Tracking, you’ll see this:

The allow apps to request to track is completely greyed out. You can’t change this option at all. Now the second paragraph says that this is due to the fact that my Apple ID is missing age information. Except that it isn’t. I checked that. So this is a bug.

Why should you care? If you want to control how apps track you across the Internet, then this setting is kind of important because when it’s turned on, it allows apps to request permission to do so. When it’s off, apps can’t track you at all. So in the state that this setting is currently in, you may actually be better off as it is ensuring that your app usage and the like remains private. But at the same time, I can see a scenario where this breaks some application because it can’t track your activities. Thus this needs to be fixed. And I assume that Apple will have to push out an iOS update to do that. Let’s hope that they do that soon as this bug along with a Photo’s bug where photos that were deleted have come back from the dead make it look like Apple’s QA team dropped the ball. Which of course isn’t a good look for Apple.

GuidePoint GRIT Ransomware Report For April Is Out

Posted in Commentary with tags on May 17, 2024 by itnerd

GuidePoint Security has published its April 2024 GRIT (GuidePoint Research and Intelligence Team) Ransomware report.

Last month, research revealed one of the year’s biggest takeaways thus far: Play, a typically smaller ransomware group, has overtaken Alphv and LockBit for the top spot in April 2024. 

Additional key highlights include vertical trends as manufacturing remains the most impacted industry, with technology resurging as a frequent target, healthcare and retail/wholesale continue to be in the Top 5 most impacted industries, a notable change from previous years.

With regards to geographical distribution, the US remains the most targeted country, while attacks in the south worldwide are increasingly attributed to newer, developing groups.

Additionally, the report explores the operations of emerging ransomware groups and their innovative tactics, including using lower-quality malware and exploiting historical vulnerabilities. 

You can read the report at https://www.guidepointsecurity.com/blog/grit-ransomware-report-april-2024/

MediSecure Ransomware Attack Impacts Millions of Australians

Posted in Commentary with tags on May 17, 2024 by itnerd

Yesterday, MediSecure, an Australian, digital prescription company, announced that the medical data of its million customers is at risk after hackers accessed their systems and demanded a ransom from the company.

At this time, MediSecure’s website and phone lines are out of operation.

“MediSecure has identified a cyber security incident impacting the personal and health information of individuals. We have taken immediate steps to mitigate any potential impact on our systems. While we continue to gather more information, early indicators suggest the incident originated from one of our third-party vendors,” the company said in a statement posted to its landing page.

Exactly what was taken is unknown but between 2020 and 2023, doctors issued more than 122 million digital scripts across the platforms.

MediSecure, based in Melbourne, was one of two companies awarded contracts by the federal government to provide public e-script services until late last year, when the contract was granted exclusively to another company and MediSecure transferred all publicly- funded electronic prescriptions and data to eRx.

No data appears to have been released online from the MediSecure hack and the hackers have not been identified publicly.

Stephen Gates, Principal Security SME, Horizon3.ai had this to say:

   “Supply chain risks are becoming more prominent as attackers increasingly focus their efforts on smaller suppliers, who are often the weakest link. This fact poses a significant threat to the operational integrity and business continuity of buying and/or partnering organizations, making it a critical issue for CEOs, COOs, and CISOs to promptly address.

   “Today’s organizations must affirm that their cyber-attack surface is no longer just their own. It now encompasses all of their third-party suppliers and partners’ attack surfaces as well. Therefore, not only do upstream buyers need to continuously assess their own cyber risk, but they also need to encourage and even demand their suppliers are doing the same.”

Another day, another third party hack. Sigh. You have to wonder what it will take for organizations to learn that they need to make their suppliers demonstrate that they are as secure as possible. Because this nonsense can’t continue.

ASUS Pledges To Do Better When It Comes To Their Shady Warranty Claim Behaviour…. And I Don’t Buy What They Are Saying

Posted in Commentary with tags on May 16, 2024 by itnerd

You might recall that earlier this week, I posted a story about ASUS doing all sorts of shady things when it came to warranty claims that were sent into ASUS by customers, and their crappy tech support. When it comes to the first part, I said this:

That brings me to the second point. Which is ASUS not supporting their customers warranty claims by bullying them into paying for repairs that they don’t need.

I encourage you to look at the original story as it goes into way more detail about this. This morning I woke up to this document from ASUS trending on Reddit. ASUS is claiming that based on the feedback that surfaced in the last few days, they will be making changes to their RMA process and they apologize for any “communication of frustration”.

The thing is that I don’t buy this at all. This is not the first time that ASUS has been in a situation like this. Last year Gamers Nexus highlighted ASUS and their questionable behaviour in terms of their motherboards and how they worked with AMD Rizen 7000 CPUs. Which at the time was not well. The TL:DR is this:  Some users had problems with their Ryzen 7000 processors on Asus motherboards. And ASUS completely mishandled the situation in epic fashion, resulting in tech YouTube calling them out on it. Gamers Nexus was one of the loudest voices on YouTube calling them out as evidenced by this video:

As a result, ASUS had to do all sorts of damage control to deal with this issue. And they pledged to do better. Here’s the Gamers Nexus video that details that:

Fast forward to today and ASUS is again pledging to do better when they are caught red handed in a bad situation, and tech YouTube calls them on it. What this looks like to me is not a genuine attempt to address their issues and make things better for their customers, but more of a “let’s say something that sounds warm and fuzzy to make this go away as quickly as possible.” In other words, I am calling BS on this.

My advice from earlier this week remains the same. In short, don’t buy ASUS products as they need to be taught a lesson that this sort of behaviour isn’t acceptable and has a cost to it. And this change to their RMA process doesn’t change the fact that this company has issues that have a direct impact on you the consumer should you need assistance from them. There are plenty of other companies who have better service than ASUS. And you should make sure those companies get your hard earned money instead of ASUS.