ConnectWise ScreenConnect Authentication Bypass POC, IOCs Released

Posted in Commentary with tags on February 21, 2024 by itnerd

On February 19, 2023, ConnectWise published a security advisory for their ScreenConnect remote management tool. In the advisory, they describe two vulnerabilities, an authentication bypass with CVSS 10.0 and a path traversal with CVSS 8.4 (both currently without assigned CVE IDs). 

The first vulnerability (auth bypass) was disclosed with a critical base CVSS scoring of 10, as it enables access to the path traversal vuln, which in turn enables unauthorized file access.

James Horseman, Horizon3.ai Exploit Developer, has just published ConnectWise ScreenConnect: Authentication Bypass Deep Dive which dives into the technical details of the authentication bypass, provides indicators of compromise, and includes a link to a Horizon3.i proof of concept auth bypass vulnerability on GitHub here.

Leave a comment »

PKI Solutions Host Web Seminar on Avoiding Pentesting Pitfalls

Posted in Commentary with tags on February 21, 2024 by itnerd

 PKI Solutions will host a PKI Insights Series Web Seminar to help IT security professionals avoid common mistakes prior to scheduled Penetration Testing and better secure important PKI system.  Mark B. Cooper, president and founder of PKI Solutions, and Nick Sirikulbut, director of business development will host this event on Thursday, February 22, 2024 at  11-11:30am MST.  The PKI Spotlight event will cover real world case studies to highlight common mistakes that lead to PKI failures and cover steps teams can take immediately to better manage their PKI environment.

To register for the PKI Insights Web Seminar, go to https://www.bigmarker.com/pkisolutions/PKI-Insights-Avoiding-Pen-Test-Pitfalls.

Leave a comment »

Gayming Awards Moves 2024 Host City To LA

Posted in Commentary with tags on February 21, 2024 by itnerd

Now in its fourth year, the Gayming Awards, the world’s only LGBTQ video game award show, returns on April 7th, 2024, from Los Angeles, hosted by DEERE and MiladyConfetti.

The celebration of queer geek culture is continuing its journey to become a key player on the global video game stage by heading over to California, the home of the video game industry, with a broadcast set in Los Angeles. The ceremony also recognizes television and film moments in a brand-new category, LGBTQ Geek Entertainment Moment of the Year – celebrating The Last of Us, Doctor Who, Harley Quinn, Nimona, Scott Pilgrim Takes Off, and The Legend of Vox Machina.

Building on the huge success of the 2023 Awards which were hosted in New York City and saw the honors of the night being shared amongst an incredibly diverse lineup of games, content creators and companies, the Gayming Awards are set to grow even more as it pivots to a virtual, pre-recorded show.

The show is being produced by the creative powerhouse of Nathan Noyes and Ian Devoglaer (The Boulet Brothers’ Dragula) and will broadcast on April 7th at 2pm PT (5pm ET/10pm UK) on Gayming Magazine’s Twitch and TikTok accounts. There will also be a Spanish language co-stream on TikTok and a captioned stream on YouTube, greatly increasing the accessibility and reach of the Gayming Awards. 

Nominees, celebrities, industry professionals and press will gather and celebrate at an exclusive VIP event hosted in Los Angeles on the award’s day itself.

The contenders for the coveted Game of the Year title encompass an impressive lineup with Baldur’s Gate 3, Final Fantasy XVI, Legend of Zelda: Tears of the Kingdom, Thirsty Suitors, Spider-Man 2, and Stray Gods: The Roleplaying Musical. 

In recognition of outstanding contributions and commitment to inclusivity in the gaming industry, the nominees for the Industry Diversity Award showcase a remarkable array of companies and organizations trailblazing the way for diversity: Humble Games, Larian Studios, Latinx In Gaming, Qweerty Gamers, Roll7 and Women in Games International.

In honor of the vibrant streaming community, where gamers unite to share their passions, the nominees for the LGBTQ+ Streamer of the Year Award are Apothicdecay, Eevoh, Elix, EspeSymone, Halfmoonjoe, MysticKittenn, Sheilur, and SpringSims.

The Gayming Awards are sponsored by TikTok, Devolver Digital, Logitech G and Art & Rev, and supported by Humble Games, Zynga, Out Making Games, Qweerty Games and NYC Gaymers. 

Full nominations for the Gayming Awards 2024 were announced on January 9, 2024.  For more information, head to gaymingawards.com and follow Gayming Magazine on all socials @gaymingmag 

Leave a comment »

Woman Sues Sex Toy Company For Collecting Her Sex Toy Searches…. No I Am Not Making This Up

Posted in Commentary with tags on February 21, 2024 by itnerd

Following on the heels of this story, I have another story about the dark side of sex toys and the Internet. Which to be clear isn’t really about sex toys. But it is about your privacy.

404 Media is reporting on a lawsuit where a woman is suing Adam & Eve for collecting details of her searches sex toys on their site. Brace yourself for the details:

A woman just brought a class action lawsuit against one of the biggest online retailers for sex toys, Adam and Eve, claiming that the site gave Google information about her searches for 8-inch dildos and strap-on harnesses. 

The plaintiff, who isn’t named in the complaint but goes by “Jane Doe,” claims that Adam and Eve uses Google Analytics, which has an anonymization feature that obscures IP addresses of users, but that the site didn’t have that feature enabled. She’s suing PHE, the owner of Adam and Eve, as well as Google, for allegedly disclosing her “sexual preferences, sexual orientation, sexual practices, sexual fetishes, sex toy preferences, lubricant preferences, and search terms” without her consent.

“By using the Google Analytics tool without anonymized IP feature, PHE is sharing with Google Plaintiff’s online activity, along with her IP addresses, even when consumers have not shared (nor have consented to share) such information,” the complaint claims.

Specifically, the plaintiff takes issue with PHE telling Google that she was browsing the site’s categories for “lesbian toys,” women’s sex toys, and realistic dildos. The complaint describes her online shopping trips in detail, claiming that Analytics captured her looking at listings for “Kingcock Strap-on Harness With 8-Inch Dildo” and showed that she added a “Pink Jelly Slim Dildo” to her cart. It also claims that “any information submitted by consumers through the search bar on the site’s homepage is shared with Google,” which in her case was a search for “strap-on dildo.” 

“The above information, combined with the consumer’s IP address, enables Google to identify the person who has interacted with PHE’s Website or has submitted information through the site,” the complaint claims. “Website consumers did not know that the communications between them and PHE would be shared with a third party, Google. PHE did not obtain consent or authorization of Website consumers to disclose communications about their Private and Protected Sexual Information. The surreptitious disclosure of Private and Protected Sexual Information is an outrageous invasion of privacy and would be offensive to a reasonable person.”

She’s suing PHE and Google for violations of the California Invasion of Privacy Act, which prohibits services from communicating information about users to third parties without their consent. Someone doesn’t have to have suffered “actual damages” to bring legal action under CIPA, and can sue for $5,000 per violation.

Now Google is saying that it doesn’t try to identify individuals and has policies to try and stop that from happening. And it’s really up to the retailer to do the right thing. In other words, Google is using the Shaggy excuse. As in “it wasn’t me.” Adam & Eve didn’t have anything to say to 404 Media. But let’s just take a step back and take the words “sex toys” out of this discussion. What this is really about is the fact that ANY retailer can take your shopping habits, collect that up, and use it or sell it however they see fit. If you’re on Amazon, you might not have an issue with that. But if you are shopping for something more “personal” you might have a problem with that. This really isn’t new. But it highlights the fact that your data is valuable and retailers will want to make money off of it, even if you don’t buy anything from them. That’s something that you might want keep in mind if you shop online.

Leave a comment »

Beyond Identity Introduces Device360 

Posted in Commentary with tags on February 21, 2024 by itnerd

Beyond Identity, the leading provider of passwordless, phishing-resistant MFA, today announced the release of its new Device360 solution for continuous device security posture management. Device360 is the first and only device security tool designed from day 0, offering a simple admin experience, providing visibility into security posture of 100% of devices, including unmanaged devices, and combining device security with authentication. The new tool empowers organizations of any size to instantly identify device security risks, including both vulnerabilities and misconfigurations, across both managed and unmanaged devices and stop vulnerable devices from entering the digital ecosystem to prevent breaches from happening. 

Device360 addresses the rising need for organizations to prevent risks associated with bring-your-own-device, or BYOD practices, where users and collaborators can use their computers, smartphones, and other devices for work purposes. The tool empowers organizations to quickly and easily monitor the security of an entire fleet of devices, each of which may be owned, managed, and configured differently. Until now, organizations could only gain this level of visibility and proactive security for managed devices using mobile device management (MDM) and endpoint detection and response (EDR) tools, which are costly and resource-intensive to manage.

Available as a standalone solution or as a complement to Beyond Identity’s Secure Workforce offering, Device360 can be quickly deployed without reliance on MDMs. Features include:

Centralized visibility into vulnerabilities and misconfigurations

Device360 provides an overview of vulnerabilities and misconfigurations across your entire fleet of devices, a central report to help track, assure, and prove device compliance, and the ability to drill down on risky devices to perform more in-depth diagnoses on device security posture.

Real-time and scheduled device query with managed Osquery

With 45 ready-made device queries, Device360 simplifies using Osquery, requiring no SQL knowledge or experience. It facilitates real-time and scheduled queries, ensuring continuous endpoint security and risk assessment over time.

Visibility over unmanaged devices

Device360 solves this challenge by combining privacy-preserving security assessments with authentication in a lightweight single authenticator that does not require administrative privileges to the end user’s device.

Test zero-trust access policies

Device360 enables policy simulation, allowing administrators to test access policies without affecting user authentication in production, enabling administrators to build complex policies and understand the impact of enforcing device trust policies per zero-trust authentication strategies.

Enforce device security compliance at the time of authentication

In conjunction with Beyond Identity’s Secure Workforce platform, Device360 allows administrators to go beyond visibility and enforce access policies using device security insights, ensuring that only compliant devices can access corporate resources and applications.

Beyond Identity provides the first 100 users a free year of access to Device360 in the product’s earliest stage. For more information about Device360, please visit https://beyondidentity.com/device360.

To learn more about Beyond Identity’s platform, including their Secure Workforce next-generation MFA solution and diagnostic tool offerings, please visit https://www.beyondidentity.com/get-demo.

Leave a comment »

Yazara Awarded PCI MPoC Certification for its Isolated SoftPOS SDK

Posted in Commentary with tags on February 21, 2024 by itnerd

Yazara, a global leader in SoftPOS technology and the payment acceptance industry, today announced that it is now recognized as a Mobile Payments on COTS (MPoC) certified vendor by the Payment Card Industry PCI Security Standards Council (PCI SSC). Yazara’s cloud-based SaaS point-of-sale solution provides merchants who are unable to accept digital payments with a low-cost, secure, effortless, and modern solution to support their goals of increasing sales/revenue and improving customer experience. Yazara is the first PCI MPoC-certified isolated SoftPOS SDK, which provides increased integrity, faster integrations, and lighter security assessments. MPoC certification serves as an indicator of a product that has been evaluated for compliance against the standards established by the PCI SSC. 

Powered by years of global experience in the SoftPOS and payments vertical, and with over 35 projects deployed worldwide, Yazara is well positioned to shake up the payments acceptance industry. Yazara’s payment software turns any NFC enabled smartphone into an acceptance device and provides merchants who were previously not able to accept digital payments or want to quickly augment their existing POS estate with a solution. The solution enables payment acceptance both on NFC enabled Android and Apple iOS devices such as a smart phone, tablet, or mobile device with any of the major global payment schemes, such as Visa, Mastercard, Amex, and Discover. Implementations on Apple iOS devices are currently being deployed in Europe.

The PCI Security Standards Council released the new MPoC Standard on 16th November 2022, which built on its previously established SPoC and CPoC standards. MPoC standard certification is designed to enable increased flexibility for payment acceptance and bolster the development of innovative COTS-based payment acceptance solutions.

This announcement comes on the heels of significant momentum for Yazara in recent months, including another 25+ projects currently being implemented, totaling over 60 projects globally, and with an ever-growing base of over 80,000 active devices. With new directives from international schemes about MPoC compliance for new projects, this certification becomes time critical as no new SoftPOS projects are allowed if they are not using an MPoC certified solution. 

To learn more about Yazara, please visit A Better POS Solution | Yazara.

Leave a comment »

Welch Has Been Pwned In A Cyberattack

Posted in Commentary with tags on February 20, 2024 by itnerd

On Friday, a spokesperson from Welch’s, said that a recent “system disruption” that brought their Erie, Pennsylvania operations to a halt was actually a cyberattack.
 
Welch’s, known for its long tradition of producing grape juice and jams, said the attack happened on Feb. 2nd, when the company shut down all operations leaving hundreds of workers temporarily out of work, unsure when they would return and unable to pick up their paychecks as no direct deposits are being made.
 
As of Friday, the Welch’s spokesperson said a team of more than 100 technology and cybersecurity experts have been working to restore the company’s systems and the company is working with law enforcement and an investigation is underway.

Carol Volk, EVP, BullWall had this comment:

   “The cyberattack on Welch’s underscores the vulnerability of food providers to cyber attacks, which can disrupt operations and compromise the safety of food production. Unfortunately, this incident is not an isolated case; food companies are increasingly becoming targets of cyberattacks due to the critical role they play in providing sustenance to communities. Such attacks lead to significant financial losses, damage to reputation, and can even pose risks to public health.

   “Food providers must adopt robust cybersecurity measures including regularly updating devices, software, and systems with the latest security patches. Additionally, implementing endpoint monitoring, ransomware containment systems and regular air-gapped backups can better prepare them for the inevitable cyber-attack and reduce costly downtime. By prioritizing cybersecurity best practices, food companies can safeguard their operations and uphold the trust of consumers in the safety and integrity of their products.”

Craig Harber, Security Evangelist: Open Systems had this to say:

   “The specific nature of the cyberattack, which halted operations for two weeks at Welch’s Northeast plant, has not been publicly disclosed. Based on the scope of the response, it is very likely that Welch was the target of the many ransomware criminal gangs that continue to plague companies around the globe. Incident response teams are fully engaged in determining the full scope of the attack, including what systems were impacted and what data was stolen. Once the full extent of the damage is determined, Welch company executives must decide about the next steps.

   “Ransomware remains profitable; efforts to improve cybersecurity and discourage payments are crucial in mitigating its impact now and in the future. Companies should take the necessary protective and proactive measures to protect their systems and data.

   “The decision to pay a ransom is always complex. There are many factors to consider, not the least of which is you are negotiating with a cybercriminal. There is no guarantee that even if you pay the ransom, these cybercriminals will restore systems and return stolen company data. If you pay a ransom once, you only increase your chances of being attacked again. The next ransom demand will undoubtedly be higher.”

I wish Welch luck in getting up and running again. As we’ve seen in recent cyberattacks, like this one, the can be devastating and long lasting. Neither of which is good.

Leave a comment »

404 Media Investigates Vibrators With Malware On Them…. I’m Not Making This Up

Posted in Commentary with tags on February 20, 2024 by itnerd

Usually when you speak about anything sexual, the only thing to worry about besides pregnancy is catching an STD. Well, I’m here to tell you that you may now need to worry about catching something else. Malware. I’ll let 404 Media give you the details:

Reddit user VegetableLuck posted to r/malware that they bought a small vibrator from the mall, plugged it into their computer’s USB port to charge “without any thought,” and claimed that it downloaded a file flagged by their system’s anti-virus protection software as malware. 

“Opened my web browser and a file is instantly downloaded without opening any webpages, malwarebytes has flagged it as malware and stopped the download,” they wrote. This supposed virus-laden vibrator post went viral on Reddit and Twitter over the weekend.

“No damage was done! Malwarebytes did catch it before I even knew what was happening and then I only investigated where I was able to see the file and get the download source/link from it,” VegetableLuck told 404 Media. “I was very confused as something like this has never happened before, and I hadn’t done anything out of the ordinary on my computer, I had also just turned it on for the day and opened my web browser, the only new variable was I had this vibrator plugged into the usb port!”

They told us they bought it in person on Valentine’s Day at Spencer’s Gifts, a store that largely sells Family Guy t-shirts, Rick and Morty bongs, and lava lamps. Spencer’s stores usually also have a section dedicated to adult toys. The specific item VegetableLuck told us they bought—”Pussy Power 8-Function Rechargeable Bullet Vibrator 4 Inch” by the brand Sexology, according to VegetableLuck—is still listed on the Spencer’s website but is sold out. It has mostly 5-star ratings, and none mention viruses or malware.

404 Media tried to buy the same vibrator but couldn’t get one online. So they went for another model and this is what happened:

The only interesting thing that happened during our test is that, at one point, when plugging the Pussy Power vibrator into the iMac, we captured a split-second popup. Jason happened to be recording the screen with his phone at the time, so he put that video into Adobe Premiere and went frame-by-frame. 

So there’s something that’s clearly on this vibrator. What it is, they don’t know. And more forensics work couldn’t come to a conclusion. But the thing is, if you stick anything into your computer, it could be infected with something. So the safe thing to do is to practise safe computing at all times, just like you practice safe sex.

1 Comment »

New Redis Malware In The Wild Exploits System-Weakening Commands for Cryptojacking Attack

Posted in Commentary with tags on February 20, 2024 by itnerd

Cado Security has revealed that it discovered a new malware, Migo, that aims to compromise Redis servers for mining cryptocurrency demonstrating that cloud-focused attackers continue refining techniques and improving their ability to exploit web-facing services. 

This campaign utilized several Redis system weakening commands to turn off security features of the data store that may impede their initial access attempts. These commands have not previously been reported in campaigns leveraging Redis for initial access.  

Migo is taking steps to obfuscate and aid reverse engineering. Rather than a series of shell scripts, as seen in previous campaigns, Migo is delivered to produce a compiled binary as the primary payload. It continues to hone its techniques and complicate the analysis process. 

The malware deploys a modified version of a popular user-mode rootkit to hide processes and on-disk artifacts. Although cryptojacking campaigns frequently use process hiders, this variant includes the ability to hide on-disk artifacts in addition to malicious processes. 

You can read this report here.

Leave a comment »

New Research Identifies the 5 Most Popular Phishing Themes in 2023, Convincing Users to Click

Posted in Commentary with tags on February 20, 2024 by itnerd

Credential phishing is the number one email attack by volume, responsible for over 70% of all advanced attacks targeting Abnormal customers- utilizing deceptive social engineering tactics to trick recipients into rendering their credentials for various accounts, including email, banking, and social media.

Abnormal Security has revealed its latest research analyzing the top five phishing attacks that had the highest click rates in 2023, categorized based on the words included in the subject line. These top engaging phishing attacks ranged from invoice payments designed to trick recipients into believing that they owe or are receiving money all the way to account notices stating that an account has been suspended and is in need of urgent attention.

You can read this research here: https://abnormalsecurity.com/blog/most-popular-phishing-themes

Leave a comment »

« Older Entries
Newer Entries »