Beyond Identity Introduces Device360 

Posted in Commentary with tags on February 21, 2024 by itnerd

Beyond Identity, the leading provider of passwordless, phishing-resistant MFA, today announced the release of its new Device360 solution for continuous device security posture management. Device360 is the first and only device security tool designed from day 0, offering a simple admin experience, providing visibility into security posture of 100% of devices, including unmanaged devices, and combining device security with authentication. The new tool empowers organizations of any size to instantly identify device security risks, including both vulnerabilities and misconfigurations, across both managed and unmanaged devices and stop vulnerable devices from entering the digital ecosystem to prevent breaches from happening. 

Device360 addresses the rising need for organizations to prevent risks associated with bring-your-own-device, or BYOD practices, where users and collaborators can use their computers, smartphones, and other devices for work purposes. The tool empowers organizations to quickly and easily monitor the security of an entire fleet of devices, each of which may be owned, managed, and configured differently. Until now, organizations could only gain this level of visibility and proactive security for managed devices using mobile device management (MDM) and endpoint detection and response (EDR) tools, which are costly and resource-intensive to manage.

Available as a standalone solution or as a complement to Beyond Identity’s Secure Workforce offering, Device360 can be quickly deployed without reliance on MDMs. Features include:

Centralized visibility into vulnerabilities and misconfigurations

Device360 provides an overview of vulnerabilities and misconfigurations across your entire fleet of devices, a central report to help track, assure, and prove device compliance, and the ability to drill down on risky devices to perform more in-depth diagnoses on device security posture.

Real-time and scheduled device query with managed Osquery

With 45 ready-made device queries, Device360 simplifies using Osquery, requiring no SQL knowledge or experience. It facilitates real-time and scheduled queries, ensuring continuous endpoint security and risk assessment over time.

Visibility over unmanaged devices

Device360 solves this challenge by combining privacy-preserving security assessments with authentication in a lightweight single authenticator that does not require administrative privileges to the end user’s device.

Test zero-trust access policies

Device360 enables policy simulation, allowing administrators to test access policies without affecting user authentication in production, enabling administrators to build complex policies and understand the impact of enforcing device trust policies per zero-trust authentication strategies.

Enforce device security compliance at the time of authentication

In conjunction with Beyond Identity’s Secure Workforce platform, Device360 allows administrators to go beyond visibility and enforce access policies using device security insights, ensuring that only compliant devices can access corporate resources and applications.

Beyond Identity provides the first 100 users a free year of access to Device360 in the product’s earliest stage. For more information about Device360, please visit https://beyondidentity.com/device360.

To learn more about Beyond Identity’s platform, including their Secure Workforce next-generation MFA solution and diagnostic tool offerings, please visit https://www.beyondidentity.com/get-demo.

Leave a comment »

Yazara Awarded PCI MPoC Certification for its Isolated SoftPOS SDK

Posted in Commentary with tags on February 21, 2024 by itnerd

Yazara, a global leader in SoftPOS technology and the payment acceptance industry, today announced that it is now recognized as a Mobile Payments on COTS (MPoC) certified vendor by the Payment Card Industry PCI Security Standards Council (PCI SSC). Yazara’s cloud-based SaaS point-of-sale solution provides merchants who are unable to accept digital payments with a low-cost, secure, effortless, and modern solution to support their goals of increasing sales/revenue and improving customer experience. Yazara is the first PCI MPoC-certified isolated SoftPOS SDK, which provides increased integrity, faster integrations, and lighter security assessments. MPoC certification serves as an indicator of a product that has been evaluated for compliance against the standards established by the PCI SSC. 

Powered by years of global experience in the SoftPOS and payments vertical, and with over 35 projects deployed worldwide, Yazara is well positioned to shake up the payments acceptance industry. Yazara’s payment software turns any NFC enabled smartphone into an acceptance device and provides merchants who were previously not able to accept digital payments or want to quickly augment their existing POS estate with a solution. The solution enables payment acceptance both on NFC enabled Android and Apple iOS devices such as a smart phone, tablet, or mobile device with any of the major global payment schemes, such as Visa, Mastercard, Amex, and Discover. Implementations on Apple iOS devices are currently being deployed in Europe.

The PCI Security Standards Council released the new MPoC Standard on 16th November 2022, which built on its previously established SPoC and CPoC standards. MPoC standard certification is designed to enable increased flexibility for payment acceptance and bolster the development of innovative COTS-based payment acceptance solutions.

This announcement comes on the heels of significant momentum for Yazara in recent months, including another 25+ projects currently being implemented, totaling over 60 projects globally, and with an ever-growing base of over 80,000 active devices. With new directives from international schemes about MPoC compliance for new projects, this certification becomes time critical as no new SoftPOS projects are allowed if they are not using an MPoC certified solution. 

To learn more about Yazara, please visit A Better POS Solution | Yazara.

Leave a comment »

Welch Has Been Pwned In A Cyberattack

Posted in Commentary with tags on February 20, 2024 by itnerd

On Friday, a spokesperson from Welch’s, said that a recent “system disruption” that brought their Erie, Pennsylvania operations to a halt was actually a cyberattack.
 
Welch’s, known for its long tradition of producing grape juice and jams, said the attack happened on Feb. 2nd, when the company shut down all operations leaving hundreds of workers temporarily out of work, unsure when they would return and unable to pick up their paychecks as no direct deposits are being made.
 
As of Friday, the Welch’s spokesperson said a team of more than 100 technology and cybersecurity experts have been working to restore the company’s systems and the company is working with law enforcement and an investigation is underway.

Carol Volk, EVP, BullWall had this comment:

   “The cyberattack on Welch’s underscores the vulnerability of food providers to cyber attacks, which can disrupt operations and compromise the safety of food production. Unfortunately, this incident is not an isolated case; food companies are increasingly becoming targets of cyberattacks due to the critical role they play in providing sustenance to communities. Such attacks lead to significant financial losses, damage to reputation, and can even pose risks to public health.

   “Food providers must adopt robust cybersecurity measures including regularly updating devices, software, and systems with the latest security patches. Additionally, implementing endpoint monitoring, ransomware containment systems and regular air-gapped backups can better prepare them for the inevitable cyber-attack and reduce costly downtime. By prioritizing cybersecurity best practices, food companies can safeguard their operations and uphold the trust of consumers in the safety and integrity of their products.”

Craig Harber, Security Evangelist: Open Systems had this to say:

   “The specific nature of the cyberattack, which halted operations for two weeks at Welch’s Northeast plant, has not been publicly disclosed. Based on the scope of the response, it is very likely that Welch was the target of the many ransomware criminal gangs that continue to plague companies around the globe. Incident response teams are fully engaged in determining the full scope of the attack, including what systems were impacted and what data was stolen. Once the full extent of the damage is determined, Welch company executives must decide about the next steps.

   “Ransomware remains profitable; efforts to improve cybersecurity and discourage payments are crucial in mitigating its impact now and in the future. Companies should take the necessary protective and proactive measures to protect their systems and data.

   “The decision to pay a ransom is always complex. There are many factors to consider, not the least of which is you are negotiating with a cybercriminal. There is no guarantee that even if you pay the ransom, these cybercriminals will restore systems and return stolen company data. If you pay a ransom once, you only increase your chances of being attacked again. The next ransom demand will undoubtedly be higher.”

I wish Welch luck in getting up and running again. As we’ve seen in recent cyberattacks, like this one, the can be devastating and long lasting. Neither of which is good.

Leave a comment »

404 Media Investigates Vibrators With Malware On Them…. I’m Not Making This Up

Posted in Commentary with tags on February 20, 2024 by itnerd

Usually when you speak about anything sexual, the only thing to worry about besides pregnancy is catching an STD. Well, I’m here to tell you that you may now need to worry about catching something else. Malware. I’ll let 404 Media give you the details:

Reddit user VegetableLuck posted to r/malware that they bought a small vibrator from the mall, plugged it into their computer’s USB port to charge “without any thought,” and claimed that it downloaded a file flagged by their system’s anti-virus protection software as malware. 

“Opened my web browser and a file is instantly downloaded without opening any webpages, malwarebytes has flagged it as malware and stopped the download,” they wrote. This supposed virus-laden vibrator post went viral on Reddit and Twitter over the weekend.

“No damage was done! Malwarebytes did catch it before I even knew what was happening and then I only investigated where I was able to see the file and get the download source/link from it,” VegetableLuck told 404 Media. “I was very confused as something like this has never happened before, and I hadn’t done anything out of the ordinary on my computer, I had also just turned it on for the day and opened my web browser, the only new variable was I had this vibrator plugged into the usb port!”

They told us they bought it in person on Valentine’s Day at Spencer’s Gifts, a store that largely sells Family Guy t-shirts, Rick and Morty bongs, and lava lamps. Spencer’s stores usually also have a section dedicated to adult toys. The specific item VegetableLuck told us they bought—”Pussy Power 8-Function Rechargeable Bullet Vibrator 4 Inch” by the brand Sexology, according to VegetableLuck—is still listed on the Spencer’s website but is sold out. It has mostly 5-star ratings, and none mention viruses or malware.

404 Media tried to buy the same vibrator but couldn’t get one online. So they went for another model and this is what happened:

The only interesting thing that happened during our test is that, at one point, when plugging the Pussy Power vibrator into the iMac, we captured a split-second popup. Jason happened to be recording the screen with his phone at the time, so he put that video into Adobe Premiere and went frame-by-frame. 

So there’s something that’s clearly on this vibrator. What it is, they don’t know. And more forensics work couldn’t come to a conclusion. But the thing is, if you stick anything into your computer, it could be infected with something. So the safe thing to do is to practise safe computing at all times, just like you practice safe sex.

1 Comment »

New Redis Malware In The Wild Exploits System-Weakening Commands for Cryptojacking Attack

Posted in Commentary with tags on February 20, 2024 by itnerd

Cado Security has revealed that it discovered a new malware, Migo, that aims to compromise Redis servers for mining cryptocurrency demonstrating that cloud-focused attackers continue refining techniques and improving their ability to exploit web-facing services. 

This campaign utilized several Redis system weakening commands to turn off security features of the data store that may impede their initial access attempts. These commands have not previously been reported in campaigns leveraging Redis for initial access.  

Migo is taking steps to obfuscate and aid reverse engineering. Rather than a series of shell scripts, as seen in previous campaigns, Migo is delivered to produce a compiled binary as the primary payload. It continues to hone its techniques and complicate the analysis process. 

The malware deploys a modified version of a popular user-mode rootkit to hide processes and on-disk artifacts. Although cryptojacking campaigns frequently use process hiders, this variant includes the ability to hide on-disk artifacts in addition to malicious processes. 

You can read this report here.

Leave a comment »

New Research Identifies the 5 Most Popular Phishing Themes in 2023, Convincing Users to Click

Posted in Commentary with tags on February 20, 2024 by itnerd

Credential phishing is the number one email attack by volume, responsible for over 70% of all advanced attacks targeting Abnormal customers- utilizing deceptive social engineering tactics to trick recipients into rendering their credentials for various accounts, including email, banking, and social media.

Abnormal Security has revealed its latest research analyzing the top five phishing attacks that had the highest click rates in 2023, categorized based on the words included in the subject line. These top engaging phishing attacks ranged from invoice payments designed to trick recipients into believing that they owe or are receiving money all the way to account notices stating that an account has been suspended and is in need of urgent attention.

You can read this research here: https://abnormalsecurity.com/blog/most-popular-phishing-themes

Leave a comment »

Fortra’s Terranova Security Unveils Latest Global Phishing Benchmark Report

Posted in Commentary with tags on February 20, 2024 by itnerd

According to the latest Phishing Benchmark Global Report, based on results from the 2023 Gone Phishing Tournament (GPT) hosted by Fortra’s Terranova Security, findings revealed that one in ten people are susceptible to phishing scams, clicking on dubious email links, potentially exposing confidential and sensitive information to cyber criminals.

The GPT is an annual virtual event that, with the help of Microsoft’s phishing intel, measures and evaluates how employees respond to simulated phishing attacks, still among the most common (and most potentially harmful) cyber threats out there. The 2023 results emphasize how crucial implementing an engaging, informative security awareness training program is for security leaders. Ideally, components like phishing simulations and interactive, gamified learning modules work together to build an organizational culture where security is always a top priority.

The 2023 GPT demonstrated a stark reality: 60% of participants who clicked on the simulated phishing email compromised their business account passwords on the subsequent landing page. In a real-world scenario, this could have resulted in nearly 90,000 corporate passwords falling into the hands of hackers, paving the way for Account Takeovers (ATO), Business Email Compromise (BEC), and other nefarious activities.

Key findings of the 2023 report include:

  • 10.4% click-through rate on phishing simulation emails, marking a 3.4 percentage point increase from the previous year. (Note: the 2022 simulation template used a different context but targeted the same behaviors with its tactics).
  • 6.5% of recipients submitted their passwords in the form embedded in the malicious webpage, a 3.5 percentage point rise from 2022, with 60% of clickers eventually compromising their passwords.
  • For click rates by industry, the Finance sector posted the lowest click rate (6.2%) across all industries for the second year. The Transport sector (6.8%) came in second, followed by the Manufacturing sector at 7.7%. Conversely, the Education sector saw both the highest click and password submission rates, totaling 16.8% and 12.2%, respectively.
  • Geographical trends showed South/Latin America with the best performance (7.8% click rate, 3.9% password submission) and the Asia and Pacific region the worst (14.9% click rate, 9.2% password submission). Europe scored a click rate of 9% and password submission rate of 5.6%, while North America finished with totals of 10% and 6.5%, respectively.
  • Organizations with less than 100 employees posted the highest click rate (12.9%), despite being the size segment with the lowest click rate in 2022. Organizations with an employee count between 100 and 499 had the highest overall password submission rate (7.3%).

The GPT results webinar will take place on March 26 (EN) and March 27 (FR). Webinar speakers will include Theo Zafirakos, CISO at Terranova Security, as well as representatives from Fortra, Microsoft, and the National Cybersecurity Alliance.

About the 2023 Gone Phishing Tournament (GPT)

The latest GPT took place between October 9 and 27, 2023, to coincide with Cybersecurity Awareness Month. With nearly 300 participating organizations and over 1.37 million phishing emails sent to participating end users worldwide, it continues to be one of the biggest phishing simulations of its kind. Increased participation year-over-year highlights how many organizations are moving to address the rapidly evolving nature of phishing threats.

As in previous years, Terranova Security worked with Microsoft to create the GPT phishing simulation email and webpage templates. The simulation emulated a common cyber tactic: a fake password expiration notification aimed at extracting user information. 

The scenario measured several user behaviors, such as clicking on a link in the body of a phishing email and entering credentials—in this case, a business account password—into a phishing webpage form. Participants who submitted their password during the simulation were directed to a feedback page that provided just-in-time training.

The email and webpage spoofed the look of emails end users can receive related to account security. However, there was an important twist: The phishing simulation email prompted recipients to keep the same email associated with their account instead of resetting it, contradicting cyber security best practices.

Download the latest Phishing Benchmark Global Report to get all the results and facts from the latest edition of the GPT.

Leave a comment »

Over 210K Philippines Students And Parents’ PII Exposed in Data Breach

Posted in Commentary with tags on February 20, 2024 by itnerd

Over 210K records belonging to the Philippines Department of Education (DepEd) and the Private Education Assistance Committee (PEAC), were exposed according to cybersecurity researcher Jeremiah Fowler, putting students and parents at risk of many online threats. As of now, it is unknown who owns and manages the database. 

The key findings are the following: 

  • 210,020 records totalling 153.76 GB; 
  • Children’s and family members’ PII such as full names, DOB, home addresses, phone numbers, tax records and much more; 
  • Unredacted images of childrens (profile pictures). 

If you want to know more about this, you will find all the details here: https://www.vpnmentor.com/news/report-philippines-ovap-breach/

Leave a comment »

11 Countries Combine To Take Down LockBit

Posted in Commentary with tags on February 19, 2024 by itnerd

Clearly the LockBit ransomware gang is on the radar screens of many. And they should be as they’ve proven to be one of the more dangerous ransomware gangs out there. But that notoriety may be having a negative effect on LockBit as 11 countries have teamed up to take a shot at them:

Reuters has more details:

Lockbit, a notorious cybercrime gang that holds its victims’ data to ransom, has been disrupted in a rare international law enforcement operation by Britain’s National Crime Agency, the U.S. Federal Bureau of Investigation and Europol, according to a post on the gang’s extortion website on Monday.

“This site is now under the control of the National Crime Agency of the UK, working in close cooperation with the FBI and the international law enforcement task force, ‘Operation Cronos’,” the post said.

An NCA spokesperson confirmed that the agency had disrupted the gang and said the operation was “ongoing and developing”.

The U.S. Department of Justice did not immediately respond to requests for comment.

The post named other international police organizations from France, Japan, Switzerland, Canada, Australia, Sweden, the Netherlands, Finland and Germany.

Since LockBit is basically “ransomware as a service” where affiliate actors can use LockBit’s services to go after companies as long as LockBit gets a cut, this takedown is hugely disruptive. Sure these affiliates will go elsewhere eventually, but for the time being you may see a decrease in ransomware activity. It will be interesting to get more details of this takedown, and if any more are planned.

1 Comment »

The Majority Of Traffic To Twitter On Super Bowl Sunday Was Fake

Posted in Commentary with tags on February 18, 2024 by itnerd

Elon Musk has been very vocal about bots on Twitter and wanting to get rid of them. But the fact is that bots are everywhere on Twitter and anyone who still uses the platform will tell you that. As proof of that, there’s this report from Mashable that says the following:

This week, Super Bowl 2024 shattered records, with the NFL championship broadcast on CBS becoming the most-watched televised event in U.S. history.

Also riding high from the big game? Elon Musk’s X. The company formerly known as Twitter published its own press release, lauding Super Bowl LVIII as one of the biggest events ever on the social media platform with more than 10 billion impressions and over 1 billion video views.

However, it appears that a significant portion of that traffic on X could be fake, according to data provided to Mashable by CHEQ, a leading cybersecurity firm that tracks bots and fake users.

According to CHEQ, a whopping 75.85 percent of traffic from X to its advertising clients’ websites during the weekend of the Super Bowl was fake.

“I’ve never seen anything even remotely close to 50 percent, not to mention 76 percent,” CHEQ founder and CEO Guy Tytunovich told Mashable regarding X’s fake traffic data. “I’m amazed…I’ve never, ever, ever, ever seen anything even remotely close.”

So it seems that this battle against bots that Elon is waging is a losing one. Assuming that he’s truly waging a war against bots and not just lying about waging a war against bots. This really hurts the credibility of the platform when it comes to advertising on the platform. And I suspect that this report may send some more advertisers heading to the exits. It will be interesting to see how Elon reacts to this report as this really looks bad.


Leave a comment »

« Older Entries
Newer Entries »