Mac Users Should Upgrade GarageBand ASAP To Fix A Security Issue

Posted in Commentary with tags on March 17, 2024 by itnerd

If you use a Mac, chances are that you have a copy of GarageBand on it. Whether you use it or not isn’t the point. But if you have it, and you’re running macOS Ventura or Sonoma, you should make sure that you it is updated to 10.4.11 ASAP. Why? It fixes a security issue according to this:

The quickest way to confirm that you have 10.4.11 is to go to the App Store and click on Update to see if it’s been updated. If not, search for GarageBand, and click on Update.

Leave a comment »

43 Million Job Seekers Impacted By French Unemployment Agency Hack…Again

Posted in Commentary with tags on March 16, 2024 by itnerd

Wednesday, France Travail disclosed (Translation here) that hackers stole personal data belonging to 43 million job seekers who had registered with the French governmental unemployment agency. France Travail is the government agency in France tasked with registering unemployed citizens, offering financial assistance, and aiding them in securing employment opportunities.

The cyberattack occurred between February 6th and March 5th and includes data spanning 20 years. 

The data that has been exposed from this attack includes:

  • Full name
  • Date of birth
  • Place of birth
  • Social security number
  • France Travail identifier
  • Email address
  • Postal address
  • Phone number

This is the second data breach France Travail has suffered. Last August approximately 10 million individuals (Translation here) were impacted by an attack indirectly attributed to the Clop ransomware group who exploited a zero-day vulnerability in the MOVEit Transfer software tool.

The cyberattack on the agency sets a new record for France impacting the largest number of individuals, surpassing the more than the 33 million people (Translation here) impacted by the Viamedis and Almerys breach in February.

Ted Miracco, CEO, Approov Mobile Security:

   “The good news here is that while the disclosed information includes sensitive personal identifiers, it does not extend to passwords or banking information, limiting the scope of immediate financial fraud, however the potential for identity theft or other forms of cybercrime remains. Also, the response from France Travail aligns with best practices in handling data breaches, in compliance with the General Data Protection Regulation (GDPR). 

   “This incident underscores the critical need for organizations to implement robust cybersecurity measures at the edge, especially when it comes to mobile devices, which are increasingly used in attacks. Comprehensive security audits, regular vulnerability assessments, and real-time analytics are critical for security awareness. Lastly, it highlights the importance of having an incident response plan that can be quickly activated to mitigate the impact of data breaches.”

The fact that this organization has been pwned twice isn’t good. They really have some work to do to make sure that they don’t get pwned a third time.

Leave a comment »

Certero Launches Global Partner Program

Posted in Commentary with tags on March 15, 2024 by itnerd

 Certero, a leader in IT asset management, software asset management, SaaS optimization, and cloud FinOps solutions, announced a new Partner Program to support channel partners. This initiative is designed to help partners and their customers manage technology costs effectively, especially in a changing market and economic climate. The program aims to transform technology asset management and reduce overspending.

The program offers a straightforward structure with incentives, intending to generate new revenue opportunities for channel partners. Josh Shields, with nearly 20 years of experience in channel operations, has been appointed as the new Director of Strategic & Channel Partnerships to oversee this initiative.

Recent Certero Highlights:

  •     Increased solution-scope to tackle Shadow IT, SaaS optimization
  •     Revitalized ‘ITAM’ for modern IT infrastructure
  •     Significant investment in Cloud FinOps technology
  •     Technology-Led Services introduces live data into ITAM / SAM Services
  •     An Oracle Gold Partner, Certero earns additional Oracle Third-Party Tool Vendor Verification for Java, on top of Database & Fusion Middleware.
  •     Consistently Gartner Peer Insights’ highest-rated major SAM vendor across every pre-sales, implementation, solution and on-going support categories.

The Partner Program includes three levels of partnership: Connect, for transactional relationships; Advance, for strategic collaborations without a services capability; and Elite, for partners with their service delivery capabilities. This structure offers flexibility and support for partners at different engagement levels.

Certero is committed to a collaborative, customer-led, and partner-focused approach, promising a supportive onboarding process, expert-led training, and a partnership aimed at long-term success. The program is open to new partners looking to deliver value to customers through Certero’s advanced technology solutions.

Leave a comment »

McDonald’s Facing Some Sort Of GLOBAL IT Outage

Posted in Commentary with tags on March 15, 2024 by itnerd

Today is not a good day for McDonald’s as there is news that they have some sort of IT issue is crippling the fast food chain worldwide:

System failures at McDonald’s were reported worldwide Friday, shuttering some restaurants for hours and leading to social media complaints from customers, in what the fast food chain called a “technology outage” that was being fixed.

Chicago-based McDonald’s Corp. said the problems were not related to a cybersecurity attack, without giving more details on what caused them.

“We are aware of a technology outage, which impacted our restaurants; the issue is now being resolved,” the burger giant said in a statement. “We thank customers for their patience and apologize for any inconvenience this may have caused.”

That’s not a very reassuring statement and it’s kind of vague. It makes me wonder what the issue is. And for the record, the fact that they say it’s not a cybersecurity incident doesn’t mean that it isn’t one and they either don’t know or don’t want to admit to it. Hopefully whatever the cause of this, the fast food chain is transparent about what actually is the cause.

Meanwhile on Twitter:

https://twitter.com/moonlitempire/status/1768584337400951282

The repetitional damage to McDonald’s because people can’t get their Big Macs is going to be huge.

Leave a comment »

Canadian Government Has Been Conducting A National Security Review Of TikTok

Posted in Commentary with tags on March 14, 2024 by itnerd

Hot off the heels of the US House Of Representatives passing a bill to potentially ban TikTok, come the news that the Canadian Government has been doing a national security review of TikTok:

The federal Liberals ordered a national security review of popular video app TikTok in September 2023 but did not disclose it publicly.

“This is still an ongoing case. We can’t comment further because of the confidentiality provisions of the Investment Canada Act,” a spokesperson for Industry Minister Francois-Philippe Champagne said.

“Our government has never hesitated to (take) action, when necessary, if a case under review is found to be injurious to Canada’s national security.”

The revelation comes after the U.S. House of Representatives passed a bill Wednesday to ban TikTok unless its China-based owner sells its stake in the business.

That’s interesting. I have a comment from Ken Westin, Field CISO, Panther Labs relative to what the US has done. But is likely applicable to Canada as well:

I fear the bill to ban TikTok is mostly political grandstanding close to an election year feeding off of xenophobic rhetoric against China. That’s not to say the fear of the Chinese government accessing TikTok data isn’t real, but one has to wonder what value this data has, as the platform isn’t a place where documents or sensitive PII is stored. If the real intent is on protecting the data of US citizens, then it seems there should be a more robust set of legislation around the collection, sharing and selling of personal data in general. China can and probably has purchased data on US citizens from the same data brokers US companies buy it from. There is also a wealth of data often from data breaches available in underground forums that is free or cheap to access. It seems it would be better for us to focus on the real source of the problem, regarding private data access as well as bolstering cybersecurity to protect intellectual property from foreign powers which is what we’ve seen China and the nation state actors target in the past. 

I’ve gone on record multiple times as saying that TikTok needs to be banned because if we’re having this much discussion about it, it’s likely not a good thing. Or put another way, if there’s smoke there’s fire. Hopefully this whole episode leads to consumers on both sides of the border being better protected from adversaries like China.

Leave a comment »

HHS Opens Investigation Into Change Healthcare Hack

Posted in Commentary with tags on March 14, 2024 by itnerd

The thing with cyberattacks is that they come in two parts. The first is that you get pwned. The second is that authorities often want to investigate you to see if you did or didn’t do something that led to the attack. Change Healthcare is into the second part after being pwned a few weeks ago. Here’s what HHS had to say:

Given the unprecedented magnitude of this cyberattack, and in the best interest of patients and health care providers, OCR is initiating an investigation into this incident. OCR’s investigation of Change Healthcare and UHG will focus on whether a breach of protected health information occurred and Change Healthcare’s and UHG’s compliance with the HIPAA Rules.

Ken Westin, Field CISO, Panther Labs had this to say:

I hope the investigation focuses on lessons learned and what both healthcare and government can do in partnership to both reduce the threat, as well as increase resilience to these types of attacks. If the goal of the investigation is to be punitive and seek fault to levy fines, I fear it would send the wrong message to the healthcare industry and will result in less collaboration and openness about these high impact security incidents. In my experience, healthcare IT and security departments are often underfunded and under resourced compared to other industries while at the same time dealing with unique challenges while having to navigate strict regulatory compliance frameworks. The best way to better secure the healthcare industry is through open dialogue and collaboration across the industry and with government resources. 

I for one will be interested to see what comes of this investigation given how much disruption that it has caused. I am sure that there will be other interested parties interested in the outcome as well. Having said that, I am sure that Change Healthcare and its parent UHG will find this investigation a couple steps below a proctology exam. Which is good because all the facts of this attack need to come out.

Leave a comment »

Multiple Fortinet FortiWLM Vulnerablities, Indicators Of Compromise Documented By Horizon3.ai

Posted in Commentary with tags on March 14, 2024 by itnerd

Horizon3.ai this morning published “Fortinet FortiWLM Deep-Dive, IOCs, and the Almost Story of the “Forti Forty” disclosing several vulnerabilities effecting the #Fortinet #FortiWLM (Wireless LAN Manager). The vulnerabilities span from command injection, SQL injection, to file reads. While most were patched late last year, 2 remained unpatched as of March 13, 2024, after 307 days from Horizon3.ai’s initial report.

This blog details several of the issues discovered in the FortiWLM that have since been patched:

  1. CVE-2023-34993 – Multiple Unauthenticated Command Injections – PSIRT-23-140
  2. CVE-2023-34991 – Unauthenticated SQL Injection – PSIRT-23-142
  3. CVE-2023-42783 – Unauthenticated Arbitrary File Read – PSIRT-23-143
  4. CVE-2023-48782 – Authenticated Command Injection – PSIRT-23-450

Additionally two vulnerabilities that have not received patches leading to appliance compromise:

  1. Unauthenticated Limited Log File Read – Allows retrieval of arbitrary log files which contain administrator session ID tokens
  2. Static Session ID Vulnerability – Session IDs do not change between sessions for users. Chained with the above issue allows trivial compromise of the device.

This morning’s blog post includes paths to remote code execution and indicators of compromise. 

Leave a comment »

Launching today: Reddit Free-Form Ads

Posted in Commentary with tags on March 14, 2024 by itnerd

Reddit has launched free-form ads, a unique-to-Reddit ad format with a “free form” layout that empowers advertisers to share in-depth information and maximize community engagement. It’s their most native format yet, which means it’s designed to look and feel similar to the ways Reddit users engage with each other on the platform. 

In early testing with brands like Philadelphia cream cheese Canada and Starbucks Canada, they’ve seen free-form ads outperform all other ad types in average click-through rate (CTR) by 28%, as well as increased community engagement when comments are enabled. 

You can have a look at their blog post for more information.

Leave a comment »

US Intelligence Cites Global Conflict, Unprecedented Capabilities As Greatest Cyber Threat

Posted in Commentary with tags on March 14, 2024 by itnerd

According to the Office of the Director of National Intelligence’s (ODNI) 2024 Annual Assessment of the US Intelligence Community, accelerating competition between nation-states, regional conflicts with far-reaching impact, and non-state threat actors with unprecedented capabilities are three of the main cyber threats the US intelligence community (IC) will face over the next few months.

After examining all threats, including cyber threats, the report finds China to be the most prevalent and persistent cyber threat to US government, private-sector, and critical infrastructure networks.

In cyberspace, the ODNI expects Russia, Iran and North Korea to maintain thier intent to target critical infrastructure, undermine US political processes, and amplify discord in in the Middle East and other regions. Threat actors originating from these countries will likely leverage existing and potential, international crises to conduct offensive cyber operations against the US and its allies.

The report assesses that these transnational issues also pose a serious threat to the US in the way of competition over disruptive technology, digital authoritarianism, and transnational repression.

The ODNI observed three trends increasing the cybercrime threat to the US and its allies:

  • The emergence of inexpensive and anonymizing online infrastructure
  • The growing profitability of ransomware, which has led to the proliferation, decentralization, and specialization of cyber-criminal activity
  • Absent cooperative law enforcement that provide cybercriminals a permissive environment limiting the efficacy of any law enforcement operations

Dave Ratner, CEO, HYAS had this comment:

   “Given the trends stated by the ODNI, it’s vital that organizations immediately re-assess their security-in-depth strategy and implement cyber resiliency approaches. It’s clear that the risks are growing, the threats are real, and the onslaught of attacks will only increase. Ensuring that organizations are capable of seeing the digital exhaust and tell-tale signs of a breach in real-time is the only way that they will be able to have the confidence to drive operational resiliency across the entire business.”

What’s clear from this is that cyber threats are not going away. Thus every organization needs to put in the time and effort to make sure that they are fully secure. Otherwise one of these threat actors are going to make them very miserable.

Leave a comment »

Nikon Releases Firmware Version 5.00 for the Nikon Z 9 Full-frame Mirrorless Camera

Posted in Commentary with tags on March 13, 2024 by itnerd

Nikon has released of firmware version 5.00 for its flagship full-frame/FX-format mirrorless camera, the Nikon Z 9.

Firmware version 5.00 is the fourth major update since the release of the Z 9 and increases usability for sports photography by expanding the Auto Capture and High-Speed Frame Capture+ functions. Portrait photography is also enhanced for more effective capture of the images photographers want, with the Skin Softening and Portrait Impression Balance functions, and Rich Tone Portrait Picture Control that enables rendering of details of the subject’s complexion with rich tones. Furthermore, the evolution of the Z 9 continues with improved operability achieved in response to feedback from professionals requesting increased speed and efficiency.

Nikon will continuously meet users’ needs through firmware updates that expand the functionality of its cameras.

Primary features of firmware version 5.00 for the Z 9

•   Expanded functions for sports photography

  • A reserve function that lets users specify the shooting start date/time and duration in advance has been added to Auto Capture. This helps to reduce battery consumption for more efficient shooting, even when the camera must be positioned and configured well before it will actually be used. Auto Capture flexibility has also been increased to allow users to shoot using the DX crop (24×16) image area, and also adds the addition of an [Airplanes] AF subject-detection mode, plus the display of a yellow frame when the camera is in standby for shooting.
  • In addition, a low-speed [C15] item has been added to High-Speed Frame Capture+ options for increased usability with continuous shooting. What’s more, frequency presets for common LED lighting and signboards have been added to the High-Frequency Flicker Reduction function, making it easier to choose the optimal shutter speed and efficiently reduce the effects of high-frequency flicker.

•   Enhanced portrait functions

  • A Rich Tone Portrait Picture Control suitable for creating base images in situations that require retouching, such as wedding and studio photography, has been added. Also, a variety of functions designed to improve portrait photography, including Portrait Impression Balance and Skin Softening have been incorporated. Further, Nikon offers NIKKOR Z lenses including the NIKKOR Z 50mm f/1.2 S, NIKKOR Z 85mm f/1.2 S, and NIKKOR Z 135mm f/1.8 S Plena, all of which support the capture of portraits that accurately express the user’s intent.
  • Overall convenience has been increased with the ability to use the continuous LED light of the Profoto A10 as an AF-assist illuminator and the addition of a [Prefer focus point (face priority)] option for frame advance when reviewing images displayed with playback zoom enabled.

•   Other features added for enhanced operability

  • When [Extended menu banks] is enabled, users can now manage the shooting modes for photo mode and video mode, which were previously linked, separately.
  • Visibility is improved with an option that allows the user to adjust the width of the focus point border.
  • Manual focusing is now possible with maximum aperture live view in manual focus mode.
  • A function that allows the user to cancel zoom when focus mode is set to manual focus and the view through the lens is zoomed in by pressing the shutter-release button halfway has been added.
  • High-Res Zoom operability has been improved, and the AF-area brackets display colour when the subject is in focus has been changed from red to green.
  • The number of functions that can be assigned to custom controls has been increased, as has the number of controls that can be customized.
  • The addition of a [Customize retouch options] item allows the user to choose the functions displayed in the retouch menu.
  • [Loop playback], [Wait before playback], and [Auto series playback speed] options have been added for playback of a series of images captured with a burst of continuous shooting.
  • Playback speed for all videos can now be specified in advance from the i menu ([Original speed], [1/2× speed], [1/4× speed]).
  • Wi-Fi station mode has been added to enable connection to SnapBridge without occupying the entire Wi-Fi connection on a smartphone.

Nikon SnapBridge Update
Nikon SnapBridge is Nikon’s companion Android and iOS app that connects to your camera to automatically download photos and videos and remotely activate the shutter. Now with Ver.2.11.0, SnapBridge adds new functions such as Easy Shooting Setup, which allows users to configure camera shooting settings suited to a particular scene or subject directly from a user’s smart device.

The new Easy Shooting Setup function can be used by tapping [Easy Shooting Setup] in the SnapBridge camera tab, selecting a main subject or situation, and deciding output parameters, such as having a soft out-of-focus background or motion blur. It allows even those who are unsure about camera functions and terms to easily create camera shooting settings that achieve desired results. Settings are applied the moment they’re sent to the camera, allowing users to immediately begin capturing their vision. Easy Shooting Setup also provides tips for available scenes and subjects such as people, landscapes and pets to help users better achieve the intended results. Furthermore, favourite shooting settings can be assigned to one of the user setting positions.

Supported operating systems
Android™ (version 10 or later), iOS (version 15.7 or later)

Cameras that support Ver.2.11.0’s Easy Shooting Setup:
Nikon Z f, Nikon Z 5, Nikon Z fc, Nikon Z 50, and Nikon Z 30

The NX Ready app available in some regions will be discontinued with the release of SnapBridge Ver.2.11.0.

Leave a comment »

« Older Entries
Newer Entries »