Fubo Canada Serves Up A Limited Time Promo Offer

Posted in Commentary with tags on March 12, 2024 by itnerd

Fubo, the leading sports-first live TV streaming platform, is offering Canadians an exciting, limited time offer for subscribers on its Sports Quarterly or Annual plan, starting as low as $12.50 a month.  

Until May 3, 2024, new subscribers can save 38 per cent off for six months (savings of $25.00) on the Quarterly plan, or 32 per cent off for twelve months (savings of $70.00) on the Annual Sports plan, bringing Canadians more of the content they love, for less. With this plan, subscribers can watch Premier League, Serie A, Coppa Italia, Global news, HGTV, Disney Channel and more. 

Canadians can learn more and take advantage of this limited time offer at this link: Watch the Premier League all season | Fubo 

Stanford University Pwned…. 27,000 People Affected

Posted in Commentary with tags on March 12, 2024 by itnerd

Stanford University has notified victims of a data breach in which the personal info of more than 27,000 people was accessed. The ransomware gang known as Akira was able to gain access to the schools Department of Public Safety’s network from May 12th until September 27th, 2023. The data collected includes DOBs, SSNs, Gov ID #’s, passport #’s, driver’s license #’s and, for some victims, biometric data, health/medical info, email addresses and passwords, and more. 

Darren Williams, CEO and Founder, BlackFog had this to say:

     “The attack on Stanford University highlights the need for consistent monitoring of data leaving the network. With hackers successfully exfiltrating sensitive data, the victims of this attack will no doubt be dealing with relentless extortion attempts going forward. As with many attacks, hackers were able to bypass perimeter defense tools and spend months lurking in the system undetected. To really mitigate the risk of data breaches organizations must look past perimeter defense and focus on protecting the back door with anti data exfiltration solutions.” 

I for one am a bit bothered by two things. One is that the event happened between May and September of last year. Second is that we’re only finding out about it now. That gives threat actors a whole lot of time to use that data for whatever evil purposes that they desire. Which isn’t a good thing for the victims involved.

French Government Agencies Hit By DDoS Attack

Posted in Commentary with tags on March 12, 2024 by itnerd

Since the weekend, numerous French government agency websites have been the targets of a DDoS or Distributed Denial of Service Attack. The Record has details:

A number of French government agencies have been hit by “intense” cyberattacks, the prime minister’s office announced on Monday.

The nature of the attacks, which began on Sunday night, has not been confirmed although the description is consistent with distributed-denial-of-service (DDoS) attacks.

The French government said the attack was “conducted using familiar technical means but of unprecedented intensity.”

DDoS attacks are not capable of stealing information, although they can prevent people from accessing a network resource because they flood the servers with junk requests.

Ken Westin, Field CISO, Panther Labs had this comment:

French companies and government agencies should be vigilant, although DDoS attacks themselves may pose limited risk, they’re also often a smokescreen for more sophisticated attacks where intrusion into networks occurs. The DDoS activities can reveal vulnerabilities, as well as an organization’s counter measures, and distract defenders from a more serious threat.

The Record story seems to imply that the French government has this under control. And hopefully I won’t be back in a few months saying that they’ve been pwned by hackers or something like that.

INKY Serves Up A New Fresh Phish Regarding Adobe And Constant Contact

Posted in Commentary with tags on March 12, 2024 by itnerd

INKY has published a new Fresh Phish talking about a complicated scheme leveraging legitimate Adobe and Constant Contact tools in a multi-layered attack.

Techniques include:

  • Personalized phish — algorithms that extract the recipient’s domain and impersonate that domain to create a unique phish for each recipient.
  • Image-based phish — textual phish message is embedded in an image.
  • Malicious QR code- conceals the malicious URL from recipients and security software.
  • Brand impersonation — uses company logos and trademarks to impersonate well-known brands in order to make an email or malicious site look more legitimate.
  • Advanced fees scam — occurs when a victim thinks they are logging in to one of their resource sites but are really entering payment information into a dialog box owned by the attackers.

You can read the report here.

BlackFog Strengthens Leadership Team with Two Key Appointments 

Posted in Commentary with tags on March 12, 2024 by itnerd

BlackFog, a leader in ransomware protection and anti data exfiltration technology, today announced two key appointments to its leadership team, welcoming Roger Cobb as Senior Vice President Sales and Jonathan Glass, as Vice President of Engineering.  

Cobb brings a wealth of industry experiences in consulting, sales, and security and will be leading the team in driving new business opportunities across North America. A graduate of Colorado State University, he joins BlackFog from HUMAN, where he was Senior Director, Anti Fraud. Prior to his time at HUMAN, he helped to build the channel processes at several IT and security startups including FishNet/Optive Security, Zscaler and Malwarebytes.  

A startup founder himself, Glass will be responsible for growing the engineering team and overseeing product development across different platforms including, desktop, mobile and cloud for BlackFog’s ADX (Anti Data Exfiltration) technology.  

Glass is an experienced developer and software architect and was most recently Senior Director of Engineering at ESO. He brings more than 15 years of experience in leading and growing large engineering teams with agile development processes and holds a Masters in Engineering from Cambridge University. 

Small Businesses Often Hit by Common Cloud Vulnerabilities and Threats

Posted in Commentary with tags on March 12, 2024 by itnerd

Small businesses are turning to the cloud in order to increase efficiency and operational capacity. Along with these benefits comes increased security risks, cloud vulnerabilities and threats to small businesses.

Here are some thoughts from Mike Walters, President and co-founder of Action1, who works directly with small businesses on vulnerabilities. Mike is the President and co-founder of Action1 Corporation, which provides risk-based patch management software. Mike has more than 20 years of experience in cybersecurity. Prior to Action1, Mike co-founded Netwrix, which was acquired by TA Associates.

  • What are common cloud vulnerabilities and threats for SMBs in 2024? In 2024, common cloud vulnerabilities and threats for small and medium-sized businesses (SMBs) are expected to include unauthorized access to sensitive data due to misconfigurations, weak passwords, exploitation of software vulnerabilities, or phishing attacks. Insecure APIs can also be a problem, exposing cloud services and data to unauthorized users or malicious actors. Malicious or negligent employees can cause data leaks of confidential information. And, of course, misconfigured cloud resources can lead to unintended access or data exposure. Supply chain attacks can also be very dangerous, as cloud infrastructure and MSP services can be an entry point to the SMB’s critical infrastructure and confidential information. Last but not least, non-compliance with data privacy and security regulations can result in fines and reputational damage, as SMBs are primarily focused on the bottom line and ignoring compliance can limit the pace of revenue generation.
  • What steps should SMBs take to safeguard their cloud operations? To secure their cloud operations, SMBs should implement strong access controls – use multi-factor authentication (MFA), least privilege access, and role-based access control (RBAC). Plus, they should review and update access privileges regularly. To secure APIs, SMBs need to implement API gateways, use encryption, and enforce authentication and authorization for API access. It includes regularly auditing API usage and monitoring for anomalies. SMBs need to regularly scan for misconfigured resources and automate remediation where possible. The same goes for vulnerabilities; patching must be automated. Regular security awareness training for employees focusing on cloud security best practices, phishing, and data protection is also very important. Finally, don’t forget about compliance: conducting regular audits and assessments to ensure compliance with relevant regulations such as GDPR, HIPAA, or PCI DSS, and so on, is essential to ensure cybersecurity.

Newly-Found Google Gemini Vulnerablities Give Attackers Control Over Users’ Queries & Content

Posted in Commentary with tags on March 12, 2024 by itnerd

Gemini is Google’s newest family of Large Language Models (LLMs). The Gemini suite currently houses 3 different model sizes: Nano, Pro, and Ultra.

Although Gemini has been removed from service due to politically biased content, new findings from HiddenLayer – unrelated to that issue – analyze how an attacker can directly manipulate another users’ queries and output, which represents an entirely new threat. These vulnerabilities were disclosed to DeepMind per responsible disclosure practices.

While testing the 3 LLMs in the Google Gemini family of models, HiddenLayer found multiple prompt hacking vulnerabilities, including the ability to output misinformation about elections, multiple avenues that enabled system prompt leakage, and the ability to inject a model indirectly with a delayed payload via Google Drive. These vulnerabilities enable attackers to conduct activities that allow for misuse and manipulation. In new research released from HiddenLayer today, “New Google Gemini Content Manipulation Vulns Found – Attackers Can Gain Control of Users’ Queries and LLM Data Output – Enabling Profound Misuse,” HiddenLayer deep dives into these vulnerabilities, including a proof-of-concept of an Indirect Injection.

Who should be aware of the Google Gemini vulnerabilities:

  • General Public: Misinformation generated by Gemini and other LLMs can be used to mislead people and governments.
  • Developers using the Gemini API: System prompts can be leaked, revealing the inner workings of a program using the LLM and potentially enabling more targeted attacks.
  • Users of Gemini Advanced: Indirect injections via the Google Workspace suite could potentially harm users. The attacks outlined in this research currently affect consumers using Gemini Advanced with the Google Workspace due to the risk of indirect injection, companies using the Gemini API due to data leakage attacks, allowing a user to access sensitive data/system prompts, and governments due to the risk of misinformation spreading about various geopolitical events.

Gemini Advanced currently has over 100M users, and so the ramifications of these vulnerabilities are widespread. With the accelerating adoption of LLM AI, companies must be aware of implementation risks and abuse methods that Gen AI and Large Language Models offer in order to strengthen their policies and defences.

Here is a link to the report :https://hiddenlayer.com/research/new-google-gemini-content-manipulation-vulns-found/

HYAS Partner Program Addition Gives MSPs and MSSPs True Cybersecurity Service Differentiation Without Risk

Posted in Commentary with tags on March 12, 2024 by itnerd

HYAS Infosec, the adversary infrastructure platform provider that offers unparalleled visibility, protection, and security against all kinds of malware and attacks, today announced the latest benefit of the HYAS ONPOINT Program, which lets MSPs, MSSPs and other channel partners offer HYAS Protect, cybersecurity sector’s top protective DNS solution, to their clients and leverage HYAS Insight proactive threat intelligence platform – all with unprecedented discounts and without financial risks.

HYAS is dedicated to its partners and the latest program benefit eliminates the fees, barriers, and ongoing commitments that other cybersecurity vendors often demand from their channel partners. Partners joining the HYAS ONPOINT Partner Program and offering HYAS Protect protective DNS as part of their managed service will receive a complimentary 12-month minimum subscription to the HYAS Insight threat intelligence and investigation platform to use in their security stack.

This offer brings immediate value to the internal SOC, incident response and threat analysis teams, and gives sales teams a highly differentiated solution to offer to clients and prospects. Partners will be able to protect clients more effectively and bring complex threat analysis to a close faster and more efficiently. The HYAS ONPOINT Partner Program provides an important new cybersecurity service entry point and revenue expansion opportunity that lets MSSPs and MSPs:

  • Provide exceptional proactive threat and adversary intelligence to identify and stop advanced cyberthreats, across services including managed security, DFIR, MDR, MSOC & others
  • Elevate service offerings, free from financial constraints
  • Add a sticky new revenue stream to service offerings
  • Increase client retention
  • Expand service differentiation without fees, catches, or up-front minimum revenue commitments of any kind.

The HYAS Solution

HYAS is the cybersecurity vendor that offers the unique combination of cybersecurity products that are a benefit to both managed services teams and threat intel teams:

HYAS Insight: This advanced threat intelligence and investigation platform gives organizations the ability to identify, track, and attribute fraud and attacks faster and more efficiently. HYAS Insight provides threat and fraud response teams with unprecedented visibility into everything a defender needs to know about an attack: the origin, current infrastructure being used, alerts when new relevant infrastructure is created, and any infrastructure likely to be used by an adversary in the future.

By analyzing data aggregated from leading private and commercial sources around the world, HYAS identifies suspicious infrastructure likely to be used in attacks — sometimes months before it is even activated. Top Fortune 500 companies rely on HYAS’ exclusive data sources and nontraditional collection mechanism to power their security and fraud investigations.

HYAS Protect: Built on the underpinning technology of HYAS Insight threat intelligence, HYAS Protect is a protective DNS solution that combines authoritative knowledge of attacker infrastructure and unrivaled domain-based intelligence to proactively enforce security and block the command and control (C2) communication used by malware, ransomware, phishing, and other forms of cyber-attacks.

Even if an attack has bypassed a network’s perimeter defenses – regardless of how the breach occurred – it still must “beacon out” for instructions, including lateral motion, privilege escalation, data exfiltration, and even encryption. And the need to beacon out to malicious infrastructure, commonly called command-and-control (C2), must be established prior to launching the attack.

HYAS detects and blocks these beaconing requests of nefarious C2 communication, letting users cut off these attacks before they cause harm, whether in an IT or OT environment. If an organization can be alerted to this adversary infrastructure, they can stop an attack before damage can be done and ensure true business resiliency.

Uber Launches New Rider Emissions Tracker

Posted in Commentary with tags on March 11, 2024 by itnerd

Starting today, Uber is introducing the Emission Savings feature in the Uber app, so riders around the world can track and learn more about their carbon emissions impact. 

Uber believes that knowledge is power. Just like they popularized rider ratings in an effort to promote respectful behaviour during Uber rides, Uber is excited to launch this new feature to both celebrate your impact and encourage greener choices when using Uber.

With the Emission Savings feature, you can: 

  • Tap a button, see your impact: In the Account section of the Uber app, tap “Estimated CO2saved” to see all of the emissions you’ve saved by taking Uber Green and Uber Comfort Electric.
  • Make sense of your savings: Riders tell Uber it would be helpful to see examples of how their emission savings add up. So, they’ve included a graphic that shows what your CO2 emission savings are comparable to. 
  • See how your emissions are calculated: The emission savings for an Uber Green or Uber Comfort Electric trip represents the estimated amount of CO2 emissions avoided, on average, when a rider takes Uber Green instead of an UberX or when a rider takes Uber Comfort Electric instead of an Uber Comfort trip of the same distance. See here to read more on the methodology. 
  • Get teens going green: Among Gen Alpha and Gen Z, Uber knows that the environment is their top cause. That’s why they’re also making the Emission Savings feature available for Uber teen account holders. And starting today in select cities throughout the US & Canada, they’re launching Uber Green and Uber Comfort Electric for teen riders, providing them with a way to be part of the climate solution when they ride. 
  • See a greener future: In the future, Uber plans to include even more products in your emission savings calculation including all-electric autonomous rides, trips with UberX Share, and rides on e-bikes and e-scooters booked in the Uber app.

Uber is committed to become a zero-emissions mobility platform and today is an important step in their journey to help inform riders about the estimated emissions they’ve saved and the positive impact they’re making in their communities.

Customers’ Data Exposed in Children Recreational Center Operator’s Data Breach

Posted in Commentary with tags on March 11, 2024 by itnerd

Over 2.3 million records belonging to Kids Empire, a US based operator of indoor recreational centers for kids, were exposed according to cybersecurity researcher Jeremiah Fowler, putting their customers at risk of many online threats. 

The key findings are the following: 

  • 2,363,222 documents with a total size of 92.3 GB. 
  • Records included reservations, injury waivers, and receipts with partial credit card numbers. 
  • Many documents revealing personally identifiable information (PII) such as names, physical and email addresses, phone numbers and more. 

If you want to know more about Jeremiah’s findings, you will find all the details here: https://www.vpnmentor.com/news/report-kidsempire-breach/