EchoMark Customer Successfully Identifies Source of Sensitive Email Leak For The First Time

Posted in Commentary with tags on January 23, 2024 by itnerd

EchoMark, the company pioneering an unprecedented approach to information protection, announced a landmark achievement for its innovative solution to protect the confidentiality of corporate email and other content: An early EchoMark customer successfully identified the source of an ongoing online email leak.

EchoMark launched in late 2023, and this is the first time it was used in a live information breach situation. The company’s technology worked with flying colors, identifying the source of the leak in minutes.

EchoMark’s advanced, invisible, personalized forensic watermarking was seamlessly added to the company’s corporate emails after the organization saw evidence of a potential unauthorized exposure of confidential information. When one email was later disclosed online, the hidden and proprietary forensics markings positively identified the source of the leak.

EchoMark can be easily deployed with customizable policies across both Microsoft Exchange and Google Gmail, and does not require any client software. For organizations that desire more selective end-user control, EchoMark also announced the availability of optional Outlook and Gmail Add-Ons.

Insider risk management, including information leaks and intellectual property theft, is a big and growing problem. Responsible data sharing and trustful collaboration have emerged as a top concern, even among the world’s most sophisticated organizations. EchoMark’s solutions are designed to protect an organization’s intellectual property and support trustful collaboration. EchoMark represents a major advance in digital asset privacy and protection that helps organizations foster the seamless flow of information among legitimate participants and prevent and mitigate leaks so that everyone involved can do their best work.

Leave a comment »

Appdome Extends Mobile Bot Defense Leadership

Posted in Commentary with tags on January 23, 2024 by itnerd

Appdome announced extensions to its groundbreaking MOBILEBot Defense product, making it fully portable to any web application firewall (WAF). These extensions save mobile brands millions of dollars, extend the useful life of existing WAF infrastructures and drive down the cost to extend bot defense to the mobile channel.  

Appdome’s MOBILEBot Defense product is the industry’s only comprehensive anti-bot defense solution built-from-the-ground-up for mobile apps. It offers mobile brands multi-layered bot detection, intelligence and defense all in one solution, easily protecting the mobile channel from 100+ attack vectors including fake apps, weaponized apps, malware-controlled apps, bot attacks, credential stuffing, DDoS and account takeovers (ATOs). It requires no SDK, no coding, and no added servers to deploy, and is fully compatible with all coding languages and frameworks used in mobile app development. With the new line up of extensions announced today, Appdome’s MOBILEBot Defense product now works seamlessly with any WAF used in a mobile brand’s network. 

Unlike other anti-bot products, Appdome MOBILEBot Defense can be used with any cloud, hosted or on-premises WAF including Akamai WAF, Cloudflare WAF, Fastly WAF, F5 WAF, Radware WAF, AWS WAF and more. MOBILEBot Defense does not require an SDK, mobile app code changes or any servers and offers full support for all mobile languages and frameworks, including Obj-C, C+, Java, JS, C#, C++, Swift, Kotlin, Flutter, React Native, Unity, Xamarin, Maui, Cordova and more.  

As part of its announcement, Appdome also released real-time visibility of bot attacks in its ThreatScope Mobile XDR. The new bot detection and analytics service allows mobile brands to measure, track, investigate, report, and respond to threats and attacks across the WAF infrastructure, providing SOC-class visibility into mobile bot attacks and threats with full drill-down on attacks against specific apps, devices, OSs, releases, and more, all without a separate analytics package, SDK or device agent. 

Visit Appdome’s web site to learn more about MOBILEBot Defense, and about Appdome’s support for WAF providers including Akamai, AWS Virtual Server, Azure Virtual Server, Cloudflare, Fastly, Google Cloud Platform, Imperva, Radware and F5. 

Leave a comment »

Panther Labs Achieves AWS Security Competency Status

Posted in Commentary with tags on January 23, 2024 by itnerd

Panther Labs announced today that it has achieved Amazon Web Services (AWS) Security Competency status. This designation recognizes that Panther has demonstrated proven technology and deep expertise that helps customers achieve their cloud security goals.

Achieving the AWS Security Competency differentiates Panther as an AWS Partner Network (APN) member that provides specialized software designed to help enterprises adopt, develop and deploy complex security projects on AWS. To receive the designation, AWS Partners must possess deep AWS expertise and experience and deliver solutions seamlessly on AWS.

AWS is enabling scalable, flexible, and cost-effective solutions from startups to global enterprises. To support the seamless integration and deployment of these solutions, AWS established the AWS Competency Program to help customers identify AWS Partners with deep industry experience and expertise.

Panther’s cloud-native SIEM is built on and for AWS, empowering modern security teams to ensure real-time threat detection, log aggregation, incident response and continuous compliance.

Panther Labs is a cybersecurity company building the future of Detection and Response for the cloud-native era. Panther’s advanced data lake architecture, Detection-as-Code workflows, and intelligent correlation capabilities enable organizations to derive security signal from high-scale security data to rapidly detect and respond to threats. From startups to global enterprises, Panther’s mission is to help security teams move faster than the most advanced attackers. For more information about Panther, please visit www.panther.com or follow on X @runpanther.

Leave a comment »

Apple’s Stolen Device Protection For iPhone…. Why You Should Activate It NOW

Posted in Commentary with tags on January 23, 2024 by itnerd

Yesterday, Apple released iOS 17.3. And as part of this release was a new feature called Stolen Device Protection. This is one of these things that you need to drop what you’re doing and upgrade to iOS 17.3 so that you can activate this feature immediately. To understand why it’s so important, let’s start with the scenario that explains why this feature exists.

There’s been a rise in iPhone thefts lately where thieves not only steal iPhones, but because they had been watching their targets closely, the thieves also steal the passcodes for said iPhones. That allowed the thieves to change their Apple ID passwords which not only locked victims out of the Apple accounts, stopped them from accessing their iCloud backups, but gave them access to any passwords stored within their Apple accounts. If you want to see an example of this, Joanna Stern of the Wall Street Journal interviewed an iPhone thief who was able to steal more than $300,000 from victims using this attack.

Another thing to consider is that using this attack, the thief could also completely reset the iPhone and sell it for a huge sum of money as the thief could bypass one of Apple’s other security features which is Activation Lock. Which up until recently, prevented thieves for selling intact iPhones because the iPhone is “locked” to the owner, and only the owner could reactivate the phone after a reset. Instead the thief is forced to sell it for parts. And that’s becoming increasingly harder to do as Apple locks the parts down to the specific iPhone. That’s another reason why this attack vector is so dangerous.

All of this is very bad and clearly needed a solution. Which is where Stolen Device Protection comes in. What this feature does is it requires biometric authentication, meaning Face ID or Touch ID, when away from trusted places that the iPhone knows about like home and work to change a handful of settings. Specifically:

  • Viewing/using passwords or passkeys saved in ‌iCloud‌ Keychain
  • Applying for a new Apple Card
  • Viewing an ‌Apple Card‌ virtual card
  • Turning off Lost Mode
  • Erasing all content and settings
  • Taking certain Apple Cash and Savings actions in Wallet
  • Using payment methods saved in Safari
  • Using the ‌iPhone‌ to set up a new device

And it also includes a time delay for a second biometric authentication for certain sensitive actions. Specifically:

  • Changing the ‌Apple ID‌ password
  • Updating select ‌Apple ID‌ account security settings, including adding or removing a trusted device, trusted phone number, Recovery Key, or Recovery Contact
  • Changing the ‌iPhone‌ passcode
  • Adding or removing ‌Face ID‌ or ‌Touch ID‌
  • Turning off Find My
  • Turning off Stolen Device Protection

In short, knowing the passcode is no longer good enough to get access to a victim’s iCloud account or reset the phone among other things.

Here’s how you enable it. And I would recommend doing this at home:

IMPORTANT: To use Stolen Device Protection, you must have two-factor authentication and Find My enabled for your Apple ID account along with Significant Locations enabled on your iPhone. Significant Locations is an option within Location Services that you can find by going to Settings -> Privacy & Security -> Location Services -> System Services -> Significant Locations. 

  1. Update to iOS 17.3 as this security feature is at the time of writing this article is only available on that version of iOS.
  2. Once you’ve updated to 17.3, go to Settings and then Face ID and Passcode.
  3. Enter your passcode
  4. Scroll down until you see the words Stolen Device Protection. Then click on Turn On Protection.

You’ll either be prompted to authenticate using Face ID or Touch ID, and it takes a moment to turn it on. But if it turns on successfully, it should look like this:

Now if you need to turn it off, you can follow the same steps, but you need to click on Turn Off Protection. Again, I would do this from your home. The only reason that I can think of as to why you would want to turn this off is if Face ID or Touch ID isn’t working and you need to take the phone to an Apple Store for repair as they will require you to turn it off. I should note that you may have to wait for an hour before you can turn this feature off, even if you’re at home.

And while I’m here, let me pass along some tips to keep you and your iPhone safe:

  • NEVER hand your iPhone over to strangers.
  • NEVER enter your passcode in public, instead use Face ID or Touch ID
  • If you’re not using your iPhone, put it away in a pocket, bag, or purse.
  • If you do get your iPhone stolen, follow these instructions promptly.

The thing is that even with Stolen Device Protection, it’s going to take a while for the dirtbag criminal low life scumbag types to get the message that this feature is now out there. Thus iPhone users will still be targets for theft until whenever they do get the message.

So, will you be enabling Stolen Device Protection? Leave a comment below as to why (or why you’re not) enabling that feature.

Leave a comment »

Trello And loanDepot Pwned…. Millions Affected

Posted in Commentary with tags on January 23, 2024 by itnerd

 I have two data breaches to report on today. Let’s start with Trello. A data breach there has the personal details of more than 15 million users put up for sale on the dark web.

This has been confirmed by haveibeenpwned.com. Meaning that’s not good. I strongly suggest that you check your email addresses in the haveibeenpwned.com database to see if you’re affected.

Meanwhile,  Bleeping Computer is reporting that more than 16 million loanDepot customers are affected by a data breach:

Mortgage lender loanDepot says that approximately 16.6 million people had their personal information stolen in a ransomware attack disclosed earlier this month.

Following a January 6 attack that forced it to shut down some of its systems to contain the breach, the company told customers that recurring automatic payments would still be processed, with payment history delays.

And:

Given that loanDepot stores sensitive customer financial and bank account information, those affected by this breach should know they might be the target of phishing attacks and identity theft attempts.

However, loanDepot has yet to share what type of customer personal information was accessed and stolen from its systems.

This one is really bad. But in both cases, I’d be changing my password to a strong and unique password. On top of that, you can fully expect that phishing attacks and other scams will be inbound now that this information is out there.

Leave a comment »

Strong Dealer Momentum, Financials, Leadership Additions And More Noted By Fisker

Posted in Commentary with tags on January 23, 2024 by itnerd

 Fisker Inc. is providing an update on recent business activities.

Dealer Partner Model Update

On January 4, Fisker announced a change in its vehicle distribution strategy toward an innovative Dealer Partnership model in North America and hybrid model in Europe that will continue to include direct sales to consumers and dealer arrangements. Since this announcement, Fisker has seen substantial interest from potential partner dealers across the United States, Canada, and Europe. The company is currently engaged with over 100 dealers. Enthusiasm has been driven by the fact that Fisker is the only American brand available to dealers that manufactures exclusively electric vehicles that have class leading features (for example, the Fisker Ocean has the longest range in its segment). Fisker is scheduled to host dealers at its headquarters in Manhattan Beach during the week of January 29. In addition, Chairman and CEO Henrik Fisker and several Fisker executives are scheduled to attend the National Automobile Dealers Association (NADA) show in early February to meet with prospective dealers and promote the company’s new dealership model. Fisker expects the first Oceans to be available in dealer showrooms in February.

Many of Fisker’s potential dealer partners already support multiple brands of vehicles, have existing EV infrastructure and the ability to service vehicles. The company anticipates that dealers will be able to purchase vehicles for their inventory shortly after finalizing the partner agreements. Fisker believes this strategy is consistent with its asset-light business model and will allow the company to build a strong distribution network capable of servicing its customers in a more cost-efficient way. Initial dealer agreements will likely cover California, Illinois, New York, New Jersey, Massachusetts, Florida, Maryland, and Canada.

Anticipated Positive Impact to Cash Flow

Fisker expects that the Dealer Partnership model will enhance its ability to turn new vehicles into cash by reducing the time vehicles are retained on its balance sheet. Similar to the traditional automotive OEM/dealer model, Fisker will recognize revenue when a vehicle is sold to a dealer. Fisker anticipates that it will sell most of the vehicles it currently has in inventory before the end of this year’s first quarter and expects to provide a delivery update in February.

During the first half of 2024, the company expects to generate cash from the sale of existing 2023 production vehicle as well as a consumption of raw materials, including batteries, in producing cars in first half of 2024 that are currently on its balance sheet. The carrying value of completed vehicles in Fisker’s inventory at the end of 2023 was approximately $290 million. Since Fisker has been selling vehicles through its direct to customer model and will pivot to a dealership model during Q1. We expect to sell the balance of our 2023 vehicle inventory before end of the quarter, releasing almost $290 million on the balance sheet that can be used for working capital. In addition, Fisker has approximately $260 million of parts, including batteries, which will support the production of Ocean vehicles in 2024. As a result, Fisker expects to achieve a higher contribution to cash flow from Oceans produced and sold in early 2024. 

Amendment to 2025 Convertible Notes

As previously announced, on January 21, Fisker entered into a second amendment and waiver agreement with the holder of its 2025 senior convertible notes. Pursuant to this waiver, among other items, the company no longer is required to maintain a minimum cash balance. In addition, the company has obtained a release from the investor of certain intellectual property belonging to Fisker upon the company entering into certain commercial agreements with an automotive original equipment manufacturer (OEM). Fisker believes this waiver provides increased flexibility to pursue strategic collaborations. Reflecting a series of conversions by the senior convertible notes holder, the company’s overall debt level has been reduced. As of January 19, 2024, the principal balance outstanding on the 2025 notes has been reduced by approximately $185.5 million to $324.5 million. 

NHTSA Preliminary Evaluation

Fisker issued the following statement on the National Highway Traffic Safety Administration (NHTSA) Office of Defects Investigation’s (ODI) Preliminary Evaluation of reported braking issues with the 2023 Fisker Ocean:

The Fisker Ocean brake system uses both friction braking and regenerative braking. In December 2023, Fisker responded to customer feedback and issued an Over-the-Air update (Version 1.10) to the regenerative system that improved the customer experience when traveling over bumps and uneven surfaces, resolving the issue. The Fisker Ocean brake system meets or exceeds all US and international performance requirements.

Key Executive Leadership Updates

As previously announced, Fisker has strengthened its leadership team with the addition of seasoned and experienced executives across departments including finance, accounting, marketing, and sales.

These leaders include Angel Salinas as Chief Accounting Officer; Eric Goldstein as Head of Investor Relations; Beverly Lively as VP, Internal Controls & Audit; and Dan Quirk as EVP, of Finance and Accounting. Wolfgang Hoffman has also joined as Country Manager for Canada as well as Amira Aly as VP, Marketing, Sales & Financial Service US.

Fisker also held the largest meetup in company history, with approximately 2,500 owners and prospective owners gathering in 24 US locations and at six locations in Europe.

Leave a comment »

CISA, FBI, EPA Releases A Water And Wastewater Cyber Incident Response Guide

Posted in Commentary with tags , on January 22, 2024 by itnerd

In a joint effort, CISA, the FBI, and the EPA have introduced an incident response guide designed to aid owners and operators in the Water and Wastewater Systems (WWS) Sector.

The agencies partnered with over 25 industry, non-profit and government organizations within the WWS Sector to create the response guide which outlines four pivotal stages of the incident response lifecycle:

  • Preparation
  • Detection and Analysis
  • Containment, Eradication, and Recovery
  • Post-Incident Activities

“The Water and Wastewater Systems Sector is a vital part of our critical infrastructure, and the FBI will continue to combat cyber actors who threaten it. A key part of our cyber strategy is building strong partnerships and sharing threat information with the owners and operators of critical infrastructure before they are hit with an attack,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division.

Mark B. Cooper, President & Founder, PKI Solutions had this to say:

   “Just as we have seen the creation and focus of Critical Infrastructure Protection (CIP) controls for the energy industry, vital infrastructure services such as water, waste treatment, and gas should have similar regulatory and industrial standards for cybersecurity controls. Through enforcing strong CIP standards for all vital services, these critical services can be better prepared for a world that has ever evolving cybersecurity threats and deliberate actors seeking to disrupt services.”

Incident response guides like these are valuable as they save a company or a sector from the trouble of trying to figure out what the best practices are to responding to an incident. Frankly, we need to see more of these out there ASAP.

Leave a comment »

Nearly 1.3 Million Patients’ Covid19 Records Exposed In Data Breach 

Posted in Commentary with tags on January 22, 2024 by itnerd

Almost 1.3 Million records belonging to Coronalab.eu (owned by Microbe & Lab), a Netherlands-based Covid-19 test laboratory, were exposed according to cybersecurity researcher Jeremiah Fowler, putting its patients at risk of many online threats. 

The key findings are the following: 

  • An estimated 1,285,277 records; 
  • That included patients’ testing samples, appointments and certificates; 
  • Testing samples revealed patients’ name, email address, date of birth, passport number and more. 

If you want to know more about Jeremiah’s findings, you will find all the details here: https://www.vpnmentor.com/news/report-coronalab-breach/

Leave a comment »

Visa And Plug And Play Announce Alliance To Grow The Canadian Fintech Ecosystem

Posted in Commentary with tags on January 22, 2024 by itnerd

Visa Canada has announced a new alliance with Plug and Play, one of the world’s largest accelerators and venture capital firms. As a founding sponsor, Visa will support Plug and Play’s entrance into the Canadian fintech market and together, establish a platform to enable fintechs to flourish. 

The Canadian fintech industry is experiencing tremendous growth with an expected compound annual growth rate of 25% through 2029. Through this collaboration, fintechs will access the power, scale, trust, and security of Visa’s global network. They will also be invited to exclusive, interactive events where they can learn, collaborate, network, and connect with new partners to grow their business.  

This relationship builds on Visa’s successful collaboration with Plug and Play in the U.S. which launched an Inclusive Fintech Accelerator program to help foster diversity and inclusivity in the sector by addressing some of the unique challenges faced by diverse founders in the tech industry. Founders selected to be a part of the program receive access to Visa products, APIs, and insights. 

Visa’s Fintech Fast Track Program 

Visa’s commitment to enhancing the payment ecosystem includes working shoulder to shoulder with fintechs through a number of programs created to support the industry, like Visa’s Fintech Fast Track Program. This initiative is designed to help fintech and crypto companies bring new payments solutions to market with speed, harnessing the reach, capabilities, and security of VisaNet, Visa’s global payment network. Through the program, approved fintech startups can strengthen global payout service offerings, expand capabilities, and gain access to Visa’s growing partner network of 4.1 billion cards and 80 million merchant locations worldwide in over 200 countries and territories.

Learn more about Visa’s Fintech Fast Track program here. 

Leave a comment »

Tesla Cybertruck Owners Need To Wash Their Truck Frequently Or Bad Things Will Happen…. No Seriously

Posted in Commentary with tags on January 21, 2024 by itnerd

The Tesla Cybertruck is starting to create a lot of negative news now that owners are getting their hands on on them. Hot off the heels of this, comes news that Tesla recommends that you wash the Cybertruck frequently if certain substances get onto the stainless steel body. Don’t believe me. Have a look at this:

That’s just insane. I say that because car manufacturers have spent a lot of time and effort to stop this sort of thing from happening as long as you take care of the vehicle. Meaning you wash it on a regular basis, along with waxing it. I’ve never seen a car that requires you to immediately wash stuff off of it or bad things will happen. Though I will admit that you SHOULD wash your car as soon as you can if a bird poops on it for example. But that’s usually never a today problem as it can likely wait a day or two without anything bad happening.

While I am sure that this is written by a lawyer who is trying to cover Elon Musk’s posterior legally, it really doesn’t put the Cybertruck in a good light. Real truck owners do real truck things with their trucks and don’t give a second thought about having to make sure that it is cleaned immediately if a bird poops on it. It’s another data point that illustrates that the Cybertruck isn’t a rugged as Elon claims it is. Which means that if you’re looking for an electric truck and you do real truck things with it, you should look elsewhere.

Leave a comment »

« Older Entries
Newer Entries »