CISA Issues Urgent Warning Regarding Mirth Connect

Posted in Commentary with tags on May 22, 2024 by itnerd

CISA has added a critical security flaw impacting NextGen Healthcare’s Mirth Connect to its Known Exploited Vulnerabilities (KEV) catalog. This flaw, identified as CVE-2023-43208, has been actively exploited in the wild.

Mirth Connect is an open-source data integration platform extensively used in the healthcare industry to facilitate standardized data exchange between various systems. It handles over a billion transactions daily across thirty countries. 

The vulnerability allows unauthenticated remote code execution and stems from an incomplete patch for another significant flaw, CVE-2023-37679, which carries a CVSS score of 9.8. Details of CVE-2023-43208 were first disclosed by Horizon3.ai in late October 2023, with additional technical information and a proof-of-concept exploit released in January 2024. 

According to security researcher Naveen Sunkavally, CVE-2023-43208 is linked to the insecure use of the Java XStream library for unmarshalling XML payloads, making it easily exploitable.

CISA has not released details regarding the specific nature of the attacks exploiting this flaw or the entities responsible for weaponizing it. The timing of these exploitations also remains unclear. However, federal agencies are mandated to update to a patched version of the software, specifically Mirth Connect version 4.4.1 or later, by June 10, 2024.

The aforementioned Naveen Sunkavally, Chief Architect, Horizon3.ai had this to say: 

   “It’s not surprising that CVE-2023-43208 was added to the CISA KEV catalog. Back in April, Microsoft threat intelligence reported that CVE-2023-43208 was being exploited by China-based threat actor Storm-1175 for initial access. And there have been reports of exploitation prior to that.

   “We work with a lot of healthcare companies. While Mirth Connect may not be a familiar name, the data we have backs up the fact that it is a widely adopted technology. Our data is what led us to research Mirth Connect for vulnerabilities in the first place last summer. Our own pentesting product, NodeZero, routinely exploits CVE-2023-43208 in client environments, both for initial access and lateral movement.

   “The inclusion of CVE-2023-43208 in the CISA KEV catalog is a reminder that attackers are inherently opportunistic and will exploit anything that seems valuable – not just VPNs, Microsoft Exchange, and Confluence. We highly encourage companies to check for Mirth Connect in their environments and patch to the latest version.”

While patching all the things isn’t a guarantee that it will keep the bad guys from pwning you, it’s a great start as vulnerabilities that have patches available are low hanging fruit for threat actors.

Leave a comment »

Highlights From Google Marketing Live 2024

Posted in Commentary with tags on May 21, 2024 by itnerd

Coming out of  Google Marketing Live, Google showcased the latest product innovations across Google Ads and Commerce to help businesses thrive. 

Key announcement highlights included: 

  • New Performance Max creative controls. Soon, advertisers can share their font and color guidelines, as well as provide helpful image reference points to generate new asset variations. We’re introducing new image editing capabilities so advertisers can try adding new objects, extending backgrounds, and cropping to adapt to any format, size and orientation. 
  • New immersive Shopping Ad experiences. Advertisers will soon be able to enhance their Shopping ads with immersive visuals, including Virtual Try-On and generated 3D spinning ads, and later this year, we’re introducing a feature that lets shoppers dive deeper into an ad to see product videos, summaries and similar products provided by the advertiser.
  • Driving results and visual storytelling through Demand Gen: Beyond visually immersive ads, there are opportunities to connect with consumers on our most visually immersive channels — YouTube, Discover and Gmail. We launched Demand Gen last year, helping advertisers drive demand and conversions, and soon we’ll roll them out to even more advertisers on Display & Video 360 and Search Ads 360.
  • New opportunities for consumers. Ads have always been an important part of consumer’s information journeys. Soon, we’ll start testing Search and Shopping ads in AI Overviews for users in the U.S. In addition, we will start testing a new ad experience in Search to help guide people through complex purchase decisions.

Read about these and more on Google’s Keyword blog:

Leave a comment »

Samsung Launches Galaxy Book4 Edge

Posted in Commentary with tags on May 21, 2024 by itnerd

Samsung unveiled today the Galaxy Book4 Edge, the next-generation of AI PCs. With 45 TOPS NPU AI computing performance and cutting-edge hybrid AI integrations, the Galaxy Book4 Edge amplifies the PC experience and offers the most hyperconnected mobile AI ecosystem yet. Together, Samsung and leading industry partners are propelling AI innovation and unleashing a next-generation AI PC with the Galaxy Book4 Edge.

Galaxy AI on Galaxy Book4 Edge enables the ultimate connected experience, backed with Wi-Fi 7 readiness for quick and seamless cross-device connectivity, while uniquely bridging the use of on-device and cloud-based processing. With this hybrid approach, users can benefit from AI features even when offline, while still maintaining top-of-the-line security over their data. Thanks to on-device AI, the intelligent Snapdragon platform learns from users over time, increasing productivity and creating optimized AI experiences.

With the addition of the Galaxy Book4 Edge, experiencing comprehensive AI enhancements across Samsung Galaxy devices is now easily accessible. Galaxy Book4 Edge is a Copilot+ PC, transforming the way users interact with their devices by allowing users to be more productive and creative using simple, everyday language. Connect a mobile device to Galaxy Book4 Edge to experience Galaxy AI features on an even bigger, more immersive display with Link to Windows. Mirror Circle to Search with Google results on a PC display and paste them directly into files to work quickly and seamlessly. Galaxy Book4 Edge also brings fan-favorite features, Chat Assist and Live Translate, to the PC.

Samsung collaborated with Microsoft to bring Copilot in Windows to Galaxy Book, enabling a spectacular mix of on-device and cloud-based AI for an amazing experience. For everyday actions such as setting alarms, retrieving contacts, sending messages, and more, users can access their mobile devices via Copilot voice prompts. Copilot also supports intelligent, next-step action suggestions for increased productivity.

The Galaxy Book4 Edge is a continuation of Samsung’s legacy in providing best-in-class experiences through premium hardware expertly tuned with cutting-edge software. Designed from the ground up for AI, the Galaxy Book4 Edge introduces the next generation of AI PCs – putting a broad scope of AI in users’ hands and empowering them to accomplish more with less effort. With 45 TOPS NPU processing power, the Snapdragon® X Elite processor equips the Galaxy Book4 Edge with incredible performance for accelerated AI capabilities across all functions. Powered by the fastest, most powerful Snapdragon processor on a laptop, Galaxy’s on-device AI technology will continuously improve, providing a seamless and responsive experience.

Searching for documents, emails or web pages on your PC can be time consuming. With Recall, now you can just describe the clues you remember to find it. Or, search across time to find the content you need and re-engage with it.

In today’s hybrid work environment, video calls are a daily occurrence, and Galaxy Book4 Edge helps defy language barriers with international colleagues, friends, and family. Live Captions provide accurate subtitles in real time. If there are spoken words, regardless of the application, turn them into English subtitles in real time on your screen.

Galaxy Book4 Edge is designed to make workflows simple and comprehensive, backed by incredibly efficient, 4x faster AI processing thanks to the Snapdragon X Elite compute platform. Move between applications and commands seamlessly with the device’s dedicated AI key, activating AI capabilities with a simple keystroke. And while using Galaxy Book4 Edge, count on all-day battery life, up to 22 hours of video playback time, and Super-Fast Charging.

Samsung Galaxy users can now enjoy an even larger suite of tools for creators. Galaxy Book4 Edge with Cocreator uses AI to transform creative pursuits. Turn sketches and text into fine art, or input text prompts to create entirely new designs.

Take creativity on video calls to the next level with Windows Studio effects. Make video conferences a bit more fun by experimenting with camera filters and background effects powered by on-device AI, or enjoy voice focus, portrait blur and eye contact.

Galaxy Book4 Edge’s premium display and design upgrades make it even easier to be fully immersed in creative pursuits. Vision Booster delivers improved outdoor visibility and the anti-reflective 10-point multi-touch touchscreen dramatically reduces glare alongside the Dynamic AMOLED 2X display. Its ultra-thin and light design allows users have the freedom to create whenever, and wherever creativity strikes. An adaptive refresh rate of up to 120Hz also delivers a remarkable display alongside cinema-grade brightness and colour standards.

With Auto Super Resolution, the Galaxy Book4 Edge does not compromise graphics, delivering high-definition and high frame graphics that upscale games in real-time.

Secured by Samsung Knox, Samsung’s defense-grade, multi-layer security platform, Galaxy Book4 Edge safeguards critical on-device information and protects against vulnerabilities with secure hardware, real-time threat detection, and collaborative protection. And as a Microsoft Secured-core PC out of the box, Windows customers can feel confident in the advanced safeguarding of firmware that comes with the highest level of Windows 11 protection.

With on-device AI, select Galaxy AI and Copilot+ features process user functions without uploading data to the cloud, protecting user privacy. For Recall, your snapshots are yours. They stay local on your PC and you can use easy controls to delete, adjust and filter what content is saved. You are always in control with privacy you can trust. For features that require cloud-based AI activity, Microsoft’s suite of security features offer around the clock protection. Device Privacy Settings further embody Samsung Galaxy’s commitment to give users choice over their device and AI safeguards.

With the enhanced security of Samsung Knox, Galaxy Book4 Edge gives businesses an entry point to integrate AI-functionality into their organizations, helping them to take the next steps in their technology roadmaps. Businesses can now securely provide their employees with AI-driven functionality that will make it easier to do their jobs. For example, employees can use natural language to quickly locate documents and easily discover related files to the task at hand for a comprehensive workflow; remove language barriers with colleagues with Live Captions translation of video calls; and finally have their own personal assistant that can help make calls, send texts, and stay in touch on the go. These advanced AI capabilities empower users with intelligent features that improve productivity and enable intuitive multitasking.

Availability

The Galaxy Book4 Edge and Galaxy Book4 Edge Pro will be available in Canada starting June 18, 2024. The 14-inch Galaxy Book4 Edge and 16-inch Galaxy Book4 Edge | Edge Pro size options come with an enhanced refined finish for a sleek, premium feel, created from a wide variety of Device available for pre-order at samsung.com/ca, Samsung Experience Stores, and participating authorized Canadian retailers and carriers in Canada starting May 20.

Leave a comment »

Horizon3.ai Expands Leadership Team with New Appointments

Posted in Commentary with tags on May 21, 2024 by itnerd

Horizon3.ai, a leader in autonomous security solutions, is pleased to announce the appointments of Erick Dean and Vice President of Product Management and Drew Mullen as Vice President of Revenue Operations. These key executive hires underscore the management team Horizon3.ai continues to build, fueling significant growth.

Erick Dean leverages over 20 years of product development experience, where he has demonstrated a consistent ability to develop effective product strategies and foster growth in both startups and large organizations.  Known for being an accomplished product management leader, Dean will specialize in assembling and guiding a high-performance team across the domains of product management and UX design to further accelerate the capabilities of Horizon3.ai’s flagship product, NodeZero. He has a well-established record of crafting go-to-market strategies and successfully launching early-stage hardware and cloud products, and is passionate about building innovative products that leverage analytics and ML to improve everyday experiences.

Drew Mullen brings over 15 years of experience in sales management, operations, enablement, and strategy. Known for his proven track record in driving revenue growth, optimizing resource allocation, and enhancing sales performance, he will effectively support go-to-market strategies and operations throughout the entire customer lifecycle, from demand generation to customer acquisition. Passionate about cybersecurity, Mullen possesses a deep understanding of market dynamics, customer needs, and the competitive landscape. He leverages his analytical, communication, and leadership skills to align and empower cross-functional teams, deliver executive-level insights and presentations, and champion process improvements and best practices.

Dean and Mullen share a profound passion for Horizon3.ai’s NodeZero platform and the critical issues it addresses for both public and private entities. Both view their involvement with the company as a once-in-a-career opportunity. They are eager to contribute to the scaling of the go-to-market (GTM) motion and the organization, as the company aims to achieve new milestones in the cybersecurity industry.

Leave a comment »

TELUS GenAI Tool Meets International Data Privacy Criteria

Posted in Commentary with tags on May 21, 2024 by itnerd

TELUS has announced that its generative AI (GenAI) customer support tool has made history by becoming the first in the world to be internationally certified in Privacy by Design (ISO 31700-1). This milestone underscores TELUS’ commitment to ensuring the highest standards of privacy and data protection, while continuously innovating to deliver a best-in-class customer experience. It is the second such MSECB certification for TELUS, which became the first company in the world to secure the ISO 31700-1 Privacy by Design certification for its Data for Good program in October 2023.

The TELUS.com GenAI support tool, powered by Fuel iX, an enterprise-grade AI engine provided by TELUS International, is one of the first customer-accessible GenAI solutions developed by a Canadian organization. The support tool gives TELUS customers the ability to access fast and intuitive responses to their queries, providing them with a more convenient and seamless digital experience. Privacy by Design is a framework that proactively embeds privacy into the design and operation of systems, ensuring that privacy is the default setting. By achieving this certification, TELUS has continued to demonstrate its dedication to safeguarding user data and upholding the highest ethical standards in technology, including the use of AI. 

To address concerns around and limitations of generative AI, TELUS has a comprehensive Responsible AI program in place and conducted a robust risk management assessment that included alignment with the ISED Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems. TELUS also applies a collaborative and rigorous approach to testing its AI tools to reduce risks and improve accuracy, called Purple Teaming. This approach combines both adversarial testing, commonly known as red-teaming, with blue-teaming, that consists of innovative defensive techniques to effectively enable the company to identify weaknesses and confirm validity and robustness of an AI application. TELUS provides clear information on how the tool works, and how it doesn’t work while also following a data ethics framework and continued monitoring of the system with human oversight. 

The GenAI tool’s evaluation was conducted by KPMG, an international auditing and advisory firm, which reported its alignment with international privacy criteria and the requirements laid out in the ISO 31700-1 Privacy by Design Standard. 

TELUS is a global leader in the responsible and ethical use of AI, and recently won an international Outstanding Organization 2023 prize from the Responsible AI Institute in recognition of its commitment to fostering trust and benefitting society. It’s also the first telecom company in Canada to sign the Government of Canada’s voluntary code of conduct for generative AI, which aims to ensure the transparent, equitable and responsible development and deployment of GenAI technology. Earlier this year, the company published its inaugural TELUS AI report: The power of perspectives in Canada, sharing the perceptions, insights and opinions of AI from nearly 5,000 Canadians, including Indigenous Peoples, racialized groups, older Canadians, new Canadians, youth, people with physical disabilities, and the LGBTQ2S+ community.

For more information about TELUS’ commitment to responsible AI, visit telus.com/responsibleAI.

Leave a comment »

HP Launches World’s Most Powerful And Secure Ultra-Mobile Next-Gen AI PCs

Posted in Commentary on May 21, 2024 by itnerd

Yesterday at Microsoft’s AI Vision Event, HP unveiled a new class of next-generation AI PCs designed to empower people to work and create more meaningfully. The HP OmniBook X AI PC and HP EliteBook Ultra AI PC are part of HP’s first next-gen AI PCs built from the ground up with the latest ARM architecture to harness the most powerful AI technologies.

HP’s latest next-gen AI PCs unlock capabilities beyond traditional PCs, running AI locally on the device for maximum performance, efficiency, and privacy with longer battery life than ever before. The HP OmniBook X and HP EliteBook Ultra are designed for tech-savvy freelancers and on-the-go leaders with a sleek design and the perfect synergy of AI-enhanced power and mobility. 

  • Sleek & Versatile – As the world’s thinnest next-gen AI PCs with 26 hours battery life, these devices take productivity and creativity to new heights with unprecedented style and mobility. Both PCs feature HP’s new AI Helix Logo, reflecting HP AI engineering that delivers optimized performance and security for AI today. The HP EliteBook Ultra adds an additional layer of durability for commercial customers in a blue finish with a smudge-resistant Physical Vapor Deposition (PVD) coating. 
  • Lightning-Fast Responsiveness – With the HP OmniBook X and HP EliteBook Ultra, experience top performance without sacrificing portability. Open a large Microsoft Excel file almost 2x faster,  stream up to 12 hours of Microsoft Teams calls or binge up to 22 hours of Netflix streaming. 
  • Responsibly Crafted – As part of the world’s most sustainable PC portfolio, both devices incorporate 50% recycled aluminum in the covers and 100% sustainably sourced materials for packaging, along with EPEAT®Climate+ Gold Registration and ENERGY STAR® Certification. Representing HP’s commitment to sustainability, the HP EliteBook Ultra’s three-year warranty saves costs and decreases downtime for professionals working in a mix of environments. 

Pricing + Availability: 

  • The HP OmniBook X AI PC is available for pre-order at BestBuy.ca for a starting price of $1,599.99 with 1 TB storage and will begin shipping on June 18, 2024. 
  • Details on pre-order and pricing for the HP EliteBook Ultra AI PC are to be confirmed.  

To learn more about HP’s new branding, including the new OmniBook lineup, visit this link for more details.

1 Comment »

Trump Media Loses $327 Million During Q1

Posted in Commentary with tags on May 21, 2024 by itnerd

Trump Media who is the parent company of Truth Social has lost massive amounts of cash in Q1 of their fiscal year. How much cash? Variety has the answer:

Trump Media and Technology Group, the company affiliated with former U.S. president Donald Trump that operates Truth Social, reported $770,500 in revenue for the first quarter of 2024 and a net loss of $327.6 million. 

So in short, Trump Media has earned next to nothing in Q1, and lost an insane amount of money in Q1. For any other business, this would be pretty much fatal. But somehow, these guys are still operating. At least for now. The long and short of it that this is a meme stock. And there’s no scenario that I can see where this changes.

Leave a comment »

Cigent Announces Cigent Endpoint Data Protection

Posted in Commentary with tags on May 21, 2024 by itnerd

Cigent Technology today announced the Cigent Endpoint Data Protection Platform that protects data from ransomware, data exfiltration, and data loss. The Endpoint Data Protection Platform provides a comprehensive portfolio of endpoint data offerings.

It is the first known commercial solution that protects Microsoft Windows endpoint device data every time, against every attack, and enables businesses to continue operating even while under attack – with minimal impact to users and minimal administrative demands on IT resources.

The High Price of Insufficient Endpoint Security: Existing commercial endpoint and data security products are repeatedly proven to be ineffective at stopping ransomware, malware, and advanced persistent threats from disabling endpoints. Because of this, fully 68% to 70% of data loss incidents occur at the endpoint.

Cyberattacks will increase aggressively – in their frequency, their ability to penetrate traditional defenses, and their sophistication – with the imminent widespread adoption of AI by attackers. Attack volumes, sophistication, and precise targeting will escalate rapidly.

The outcome is broadly expected to result in more successful endpoint compromise attacks.

Recent ITIC research on the hourly costs of downtime found that costs now exceed $300,000 /hr for 91% of SME and large enterprises. Fully 44% of mid-sized and large enterprise survey participants reported that a single hour of downtime can cost their business as much as $1 million.

Cigent delivers:

  • Zero Trust Access Control: Verified, policy-driven step-up access control protects files from unauthorized access. Utilizing AI and integration with major authentication solutions, it protects data with minimal end-user impact.
  • Hidden Data Drives: Attackers cannot see or even locate protected drives even when a deception is compromised. Data remains hidden at the sector level until unlocked with step-up authentication.
  • AI Threat Defense: AI monitoring instantly elevates the threat level when ransomware or other malware attempts to access data. Additionally, integration and automation with EDR solutions elevates protection if threats are detected or if they are rendered inoperable by attackers.
  • “Set and Forget” Operations: Protection is in place and automated, requiring no direct intervention or administration by security or IT resources.
  • Data Protection for Modern Workforce: Minimal impact of end-user experience and sustained device usability during an attack event.

The Cigent Endpoint Data Protection Platform At Work

Cigent begins with the assumption that the PC is going to be compromised. While there continue to be advances in the detect and respond approach, it remains insufficient to prevent data compromises.

Cigent provides layered defense that protects data at rest or when in use. We use software, hardware, or dual encryption as foundational data at rest protection. Customers using SSDs are able to provide additional protection with hidden partitions that are invisible to attackers. When a device is in use we maintain data protection with zero-trust access controls that prevent unauthorized access with minimal user disruption. In addition, we integrate with EDR and SIEM solutions instantly elevating protections based on their status. Finally, Cigent leverages its own AI to detect malicious data activity and instantly secure files. This layered approach proactively protects data.

Importantly – Cigent is the first solution that actively preserves user productivity and device efficiency whenever an attack is in process or has occurred.

In field tests with a current and pernicious attack, file access was immediately locked and the user’s ability to continue work was protected. No immediate IT intervention occurred or was needed.

Also Introducing – Cigent BitLocker Manager: Cigent is also delivering BitLocker Manager, another new capability in the Cigent Data Defense Platform that protects full disk encryption environments currently using “tired” technology and facing end-of-life resource issues.

Additional Resources:

Cigent Endpoint Data Protection Platform – Demo: https://www.cigent.com/thinkshield-data-defense-cigent

Leave a comment »

Global Banking Trojan Resurfaces With A Vengeance 

Posted in Commentary with tags on May 21, 2024 by itnerd

According to a new report from IBM’s X-Force, a widespread banking malware Grandoreiro has resurfaced in numerous new campaigns with improved functionality designed to make it a more meaningful threat.

The cybersecurity unit has been tracking several large-scale phishing campaigns since March including attacks impersonating Mexico’s Tax Administration Service, Federal Electricity Commission and Secretary of Administration and Finance, as well as the Revenue Service of Argentina and the South African Revenue Service.

“In each campaign, the recipients are instructed to click on a link to view an invoice or fee, account statement, make a payment, etc. depending on the impersonated entity.

“If the user who clicks on the links is within a specific country (depending on the campaign, Mexico, Chile, Spain, Costa Rica, Peru, or Argentina), they are redirected to an image of a PDF icon, and a ZIP file is downloaded in the background. The ZIP files contain a large executable disguised with a PDF icon, found to have been created the day prior to, or the day of the email being sent,” IBM X-Force said.

The malware has been observed since at least 2017 previously only targeting Spanish-speaking countries. The new Grandoreiro is a modular operation with the ability to target over 1500 global banking applications and websites in over 60 countries.

The latest version features updates that allow the malware to contact at least 12 different C2 domains per day. There are also new capabilities allowing it to spread more efficiently by harvesting victim data from targeted email clients.

“The updates made to the malware, in addition to the significant increase in banking applications across several nations, indicate that the Grandoreiro distributors are seeking to conduct campaigns and deliver malware on a global scale,” IBM X-Force concluded.

Emily Phelps, Director, Cyware:

   “This incident underscores the need for organizations to adopt more proactive cybersecurity strategies. A collective defense approach and the implementation of cyber fusion strategies can help organizations get ahead of threats, operationalizing relevant threat insights and breaking down silos so that security teams can rapidly take action. As adversaries evolve their tactics, our collective defense must be equally dynamic and resilient.”

This highlights the fact that threat actors are taking attack code that is already out there and making them a lot more dangerous. This is why having the sort of defence that Ms. Phelps describes is the best way to stop your organization from getting pwned.

Leave a comment »

WebTPA Discloses 2023 Breach Impacting Over 2.4 Million

Posted in Commentary on May 21, 2024 by itnerd

In an undated notice on its website, WebTPA has reported it was the victim of a “data security incident” last year that may have impacted 2,429,175 people.

Texas-based WebTPA, a company that provides administrative services to health benefit plans and insurance companies, says an investigation launched in late last year revealed that an “unauthorized actor may have obtained personal information between April 18 and April 23, 2023.”

On May 8, WebTPA told the federal Department of Health and Human Services that the exposed information is different depending on the individual, and data may include:

  • Name
  • Contact information
  • Date of birth
  • Date of death
  • Social Security number
  • Insurance information

Company President Lisa Tranberg said that “financial information, such as financial account information or credit card numbers, and treatment or diagnostic information were not impacted.”

The announcement comes amidst the global healthcare disruption of the Change Healthcare breach and, more recently, the attack on the Ascension hospital chain and Australian prescriptions company MediSecure.

BullWall Executive, Carol Volk had this to say:

   “It’s no longer up for debate, assume you will be hacked and breached and that your data will be stolen, held for ransom or destroyed. Your only option is to be prepared. Every organization with valuable data, which means every one of us, must have in place, in addition to sophisticated EDR defense and backup methods, a comprehensive ransomware containment solution. The focus must be to protect, not just detect. When attackers breach the walls, they must not be allowed into the vault.”

This is good advice as we’re in a place now where it’s not if, but when you’re going to get pwned by hackers. Thus you have to shift from not just trying to keep the bad guys out, but containment if they do get in.

Leave a comment »

« Older Entries
Newer Entries »