Search This Blog

Powered by Blogger.

Blog Archive

Labels

About Me

Showing posts with label Network Security News. Show all posts

China Accuses Walmart For Nineteen Cybersecurity Network Breaches

 

American retail giant 'Walmart' is alleged for causing nineteen cybersecurity incidents in the country by China, according to state-sponsored media. As per the reports, public security agencies found nineteen exploitable network security vulnerabilities in Walmart's network system on November 25, last year. 

The company didn't patch these vulnerabilities immediately, says China Quality News, a state-sponsored media for State Administration Market Supervision (SAMR) regulatory agency. The news outlet believes it is a breach of China's Internet Security Law. 

It also reports that an administrative penalty warning is issued besides an order to Walmart to correct their network flaws. No financial penalty has been issued to date. The Register reports, "the timing of the announcement is curious, as earlier in the week reports emerged in the Middle Kingdom that Walmart subsidiary Sam's Club was not stocking Xinjiang-produced goods." 

Xinjiang is a conflicted area in US-China relations, the west has a notion that China's minority Muslim Uyghur population members are kept detained in monitored internment camps, facing human rights violations. 

China, however, denies all these accusations of violations by the western world. Sam's Club in November last year claims to sell over four million Chinese memberships in 36 stores across 23 cities, saying its platform covered "most of the country." 

Sam's Club customers are canceling their memberships now because of the controversy. According to Reuters, Sam's Club puts the whole incident as a misunderstanding. 

It received a message from China's Central Commission for Discipline 
Inspection, alleging Sam's club of "secretly" and "maliciously" removing the products and giving a "deceptive excuse" of products not in stock. "Removing all products from a region without a valid reason hides an ulterior motive behind it, exposes stupidity and short-sightedness, and is bound to suffer its own evil consequences," said the Chinese agency. 

It also accused Sam's Club of using "dirty means to boycott" Chinese products and said customers would answer back by canceling their memberships.

90% of Russian entrepreneurs faced external cyber threats, says ESET


The antivirus company ESET conducted a comprehensive study on the state of information security in Russian companies, interviewing dozens of IT Directors and business owners.
According to the study, 90% of Russian companies faced external cyber threats and about 50% faced internal ones. Among external cyber threats spam (65%), malware (47%) and encryptors (35%) are leading.

The distribution of malicious software is closely linked to the activity of spammers and phishers who seek to lull the employee's vigilance and force him to follow a malicious link or download a dangerous file. At the same time, many respondents noted that often viruses, Trojans and other malware got on devices because of the human factor - employees used unverified external drives or installed unwanted software.

In addition, 7% of respondents experienced the loss of corporate smartphones, tablets or laptops with confidential information by employees.
It is worth noting that specialists from the CIS often face internal problems of information security. At the same time, Russian companies often had to repel more serious threats: DDoS attacks, phishing, encryptors.

Every fifth Russian company suffered from accidental data leaks due to a lack of knowledge of the security rules for employees working with confidential information. At the same time, Russian IT managers are concerned about the protection of personal data of employees (60%), which is also due to the tightening of the relevant norms of Russian law.

90% of respondents reported that they use anti-virus solutions, 45% control the work with external drives, 26% implement financial protection systems and 28% fight against DDoS attacks. In addition, managers are increasingly turning to third-party companies for audits to ensure information security (15%). At the moment, according to experts, outsourcing security is one of the trends in cybersecurity.

At the end of 2019, 5% of Russian companies are not satisfied with the state of information security and would like to increase the budget. Moreover, with the growth of the number of computers, the level of dissatisfaction and the desire to increase the budget for information security are growing.

The guards at the Ukrainian nuclear power plant mined cryptocurrency and divulged state secrets


The attackers used the resources of the South Ukrainian nuclear power plant for mining digital currency. The Security Service of Ukraine (SBU) stopped the activity of criminals.

Agents of the SBU, checking objects of the nuclear power plant, found computer equipment, illegally connected to the systems for mining. On July 10, the employees of the Department searched and seized the media converter, fiber optic and part of the network cable.

It’s important to note that information about the physical protection of the station, which is a state secret, leaked to the network due to the unauthorized placement of computer equipment in the territory of a nuclear power plant.

Specialists of the Security Service of Ukraine have information according to which members of the National Guard of Ukraine may be involved in illegal mining. The SBU has achieved the initiation of criminal proceedings against them.

It is an interesting fact that recently it became known that in Ukraine the authority that controls the quality of equipment for the South Ukrainian nuclear power plant since 1992 will be eliminated. Employees of the structure carried out examinations, as well as participated in tests of the equipment.

The decision was made after the evaluation of the enterprise. The work of the center was deemed ineffective.

However, it can be assumed that this is due to the fact that someone was mining cryptocurrency on the territory of the South Ukrainian nuclear power plant.

In addition, this week the police discovered an underground farm for the production of cryptocurrency in Ingushetia. Its owners were engaged in illegal and unaccounted electricity consumption. During the inspection of this room, law enforcement officers found that more than 1.5 thousand devices for receiving crypto currency, a laptop, two system units, a video recorder of a video surveillance system, as well as two transformer points with a capacity of 1.6 thousand kW each were connected to the power supply system without appropriate documentation.

Recall that in May 2018 it became known that the police in the Ukrainian city Rovno were mining cryptocurrency directly at the workplace. Since Ukraine does not have legislation regulating the circulation and mining of cryptocurrencies, an investigation was conducted into the theft of electricity.

This was not the first case of using the official position for cryptocurrency mining. In September 2017, Crimean government officials were fired for mining bitcoins in the workplace, and on February 2018 it became known that employees of the Ministry of Finance of Kazakhstan used office computers and department servers for cryptocurrency mining.

Chinese Network Security Laboratory Offering Bounty for Cyber Attacks



A 24-hour online testbed known as Network Endogens Security Testbed (NEST) is proposed by a Chinese network security laboratory for the purpose of testing the security measures provided by various organizations. It's a globally accessible testbed which would welcome cyber attacks from people and organizations across the world.

As per the Purple Mountain Laboratory for Network Communication and Security, the testbed would accept public tests with a reward money of 1.5 million yuan ($2,18,000).

Authorized users are likely to receive corresponding bounties on the basis of their test outcomes, according to the Nanjing-based laboratory.

Justifying the purpose of the proposal, Wu, the proposer of Cyber Mimic Defence Theory, said that improved "autoimmunity" should be made a priority for the upcoming generation information technology.

Wu Jiangxing, an academician of the Chinese Academy of Engineering, compared the present day network security measures which are patches for the flaws and the antiviruses to taking medicine after catching the disease.

“Whether the network is safe or not, hackers have a say. They are also welcomed to challenge it,” he added.

NEST is designed to subdue security threats that arise due to unknown flaws, vulnerabilities or Trojans, Wu told that NEST could effectively put an end to such network security threats without having to rely upon an external safeguarding measure.



A new virus attacked computers in Russia


Cases of malicious e-mails to Russian companies have become more frequent. Attackers write on behalf of Banks, large air operators, car dealers and mass media. They offer cooperation to companies and advise to open the file in the attachment, where there are details about a good deal. If the user does this, the computer is infected with the so-called Troldesh virus. This malware encrypts files on the infected device and demands a ransom.

Fraudsters claim that they are employees of companies and attach a password-protected archive to the letter, in which, according to them, the details of the order are indicated. But in fact, a malicious virus is attached to this email. When a victim gains access to the archive, important files are blocked in his operating system that can be opened only by paying a ransom to the fraudsters. Of course, the addresses from which the letters were sent are fake.

Group-IB found out that in June more than a thousand such messages were sent to different Russian companies. The number of attacks using Troldesh only in this quarter increased 2.5 times compared to 2018. Yaroslav Kargalev, the Deputy Head of Information Security Incident Monitoring and Response Division of Group-IB, said that it is almost impossible to destroy the virus.

Experts of Group-IB noted that Troldesh was previously sent out mainly on behalf of Banks, however, at the moment, the attackers stopped doing it, as Banks have strengthened measures to counter phishing.

It is interesting to note that Troldesh can be bought or rented at specialized sites on the Darknet. Judging from the latest attacks, Troldesh not only encrypts files but also mines cryptocurrency and generates traffic to websites, thereby increasing their traffic and revenue from online advertising.

Experts of Group-IB also stressed that a fairly large-scale infrastructure is involved in the virus distribution, which includes servers, infected IoT (Internet of Things) devices, for example, routers. Now the virus distribution campaign is still active.

It is worth noting that Troldesh attacks companies not for the first time. Such attacks were first recorded in 2015, and the largest took place in March 2019. Then messages came from well-known retailers, as well as financial and construction companies.

Mark Zuckerberg's Previous Facebook Posts Deleted, the Company Blames Technical Errors


The public posts made by Facebook’s CEO Mark Zuckerberg on his personal Facebook profile have been deleted; it included some of the critical updates and important announcements made by the company. All the information shared by Zuckerberg in the year 2007 and 2008 has also vanished.
On being enquired, a spokesperson of Facebook said that these posts which included the major announcements like the one regarding the acquisition of Instagram were erased mistakenly because of some technical errors. Another crucial announcement which was disappeared is Zuckerberg’s promise to keep Instagram free from Facebook.
However, today Instagram is integrated more closely by Facebook than what was said to be. The matter is reported to be escalated to an extent that it led two of Instagram’s co-founders to resign last year.

The deletion of the post where Mark pledged to build and grow Instagram separately is the highlight as Zuckerberg seemingly did not abide by it. 

'Every day, we make decisions about what speech is harmful, what constitutes political advertising, and how to prevent sophisticated cyber attacks.’ Zuckerberg told to The Washington Post.

'These are important for keeping our community safe. But if we were starting from scratch, we wouldn't ask companies to make these judgments alone,' he added.

Referencing from the statements given to Business insider by Facebook’s spokesperson, 'A few years ago some of Mark's posts were mistakenly deleted due to technical errors. The work required to restore them would have been extensive and not guaranteed to be successful so we didn't do it,'

'We agree people should be able to find information about past announcements and major company news, which is why for years we've shared and archived this information publicly — first on our blog and in recent years on our Newsroom.’


Facebook to be reoriented towards user privacy and encryption says Mark Zuckerberg



On Wednesday, Facebook’s CEO, Mark Zuckerberg put forth a reoriented model of privacy for the social media platform which has continued to encourage generation after generation to share what’s up with their life via pictures and status updates.

In an essay Mark posted on his account, he announced his future plans regarding Facebook which are focused on safety, interoperability, private interactions, encryption, secure data storage and reducing permanence.

After consistently being in news for security issues, the company has finally decided to appropriately position itself for an unknown time which is yet to come. Seemingly, the plan of action has been fuelled by the descending trust of the users and ongoing arguments with regulators across the globe.

Explaining the new model, Zuckerberg told that Facebook would be subjected to a change which would remodel the platform after a living room, where people will have complete control over who can communicate with them and a trust that no one else can access what they share, which is in contrast to the initial model which was based into broadcasting information to large sections.

Referencing from Zuckerberg’s Facebook post, “Public social networks will continue to be very important in people's lives -- for connecting with everyone you know, discovering new people, ideas and content, and giving people a voice more broadly. People find these valuable every day, and there are still a lot of useful services to build on top of them. But now, with all the ways people also want to interact privately, there's also an opportunity to build a simpler platform that's focused on privacy first.”

“In a few years, I expect future versions of Messenger and WhatsApp to become the main ways people communicate on the Facebook network. We're focused on making both of these apps faster, simpler, more private and more secure, including with end-to-end encryption. We then plan to add more ways to interact privately with your friends, groups, and businesses. If this evolution is successful, interacting with your friends and family across the Facebook network will become a fundamentally more private experience.”

The subtle and skeptical reactions to Mark’s announcement included privacy advocates questioning about the data that is collected for Facebook’s benefits, they asked if the practice will be minimized. Meanwhile, they asserted on the CEO’s need to talk beyond encryption and prioritize answering the questions on data collection for business purposes.

Referenced from the statements given by Jess Chester, executive director of a nonprofit privacy advocacy group in Washington, “Why does it always sound like we are witnessing a digital version of Groundhog Day when Facebook yet again promises — when it’s in a crisis — that it will do better,”

“Will it actually bring a change to how Facebook continually gathers data on its users in order to drive big profits?" He added.

Commenting on the matter, Jennifer Grygiel, assistant professor of communications at Syracuse University, questioned, “What’s not clear is how they are going to make this transition safely. We have already seen the risks associated with WhatsApp and private encryption in India, for example, where misinformation has led to mobs and the loss of life,”

Studies suggest that consumer trust in Facebook took critical hits due to continuous exploitation of users’ data. In terms of reputation among 100 highly visible public companies, Facebook fell from being 51st to 94th last year. Moreover, certain Facebook user polls implied people entirely getting rid of the app by uninstalling it.

While acknowledging the reduced trust quotient in his post, Zuckerberg wrote, “I understand that many people don’t think Facebook can or would even want to build this kind of privacy-focused platform — because frankly we don’t currently have a strong reputation for building privacy protective services, and we’ve historically focused on tools for more open sharing,” he said. “But we’ve repeatedly shown that we can evolve to build the services that people really want, including in private messaging and stories.”


To Zuckerberg’s proposal of a future which would look different, Twitter bore witness to another skeptical remark as Ashkan Soltani, a former Federal Trade Commission official and privacy researcher, said “This move is entirely a strategic play to use privacy as a competitive advantage and further lock in Facebook as the dominant messaging platform.”

Flaw in D-Link switches; A threat to security

Independent security researcher Varang Amin and Aditya Sood, chief architect at Elastica’s Cloud Threat Labs discovered a flaw in DGS-1210 Series Gigabit smart switches from D-Link which could be exploited to access log and configuration files without any authentication credentials.

These switches which can be configured to store backup files, including logs, firmware and configuration files lack proper authorization and authentication controls, allowing an attacker to access the backup files found both on the device’s flash memory and the web server.

The duo also pointed out that while the web server’s root directory is easily accessible, the back files from the flash memory could be remotely accessed by knowing the IP address of target device.

The access of configuration file can pose a threat as it can expose all the details about the switch including configuration, username, etc. The file can be uploaded to another switch to obtain further information about the clients which is stored in log files.

According to Sood, the flaw was detected on October 07, but the company did not release a fix for it till now.

After waiting for a month, the researchers recently disclosed their discovery at the ToorCon security conference. However, in order to give time to the firm to address the issue, the duo did not make the exploit details public.