Category Archives: Encryption
CryptoGuard: An asymmetric approach to the ransomware battle – SC Media
Ransomware is one of the most significant threats facing organizations today. Battling it is no easy task, particularly given that threat actors are continually refining their techniques and approaches. Recent shifts, for example, include tweaks to ransomware-as-a-service (RaaS) models; the adoption of new programming languages;evolutions in targeting and deployment; andincreasingly launching attacks after business hours and at weekendsto hinder detection and incident response efforts.
One of the more substantial developments is an increase in remote ransomware: leveraging an organizations domain architecture to encrypt data on managed domain-joined machines. All the malicious activity ingress, payload execution, and encryption occurs on an unmanaged machine, therefore bypassing modern security stacks, with the only indication of compromise being the transmission of documents to and from other machines. Our telemetry indicates that there has been a 62% year-on-year increase in intentional remote encryption attacks since 2022. AndMicrosofts 2023 Digital Defense Reportstates that around 60% of human-operated ransomware attacks involve remote encryption, with80% of all compromises originating from unmanaged devices, indicating a lack of active asset management. Ransomware families known to support remote encryption include Akira, ALPHV/BlackCat, BlackMatter, LockBit, and Royal, and its a technique thats been around for some time as far back as 2013, CryptoLocker was targeting network shares.
Unsurprisingly, the rise and continuing development of ransomware has led to a plethora of research aimed at detecting and preventing it with academics, security researchers, and vendors all proposing various solutions. Ransomware, as a form of malware, presents unique practical and intellectual challenges, and the range of solutions reflects this. Many such solutions target one or more of ransomwares distinct behavioral traits: enumerating filesystems, accessing and encrypting files, and generating ransom notes. Others are more generic, applying common anti-malware techniques to ransomware.
In this, the second issue of our new technical thought leadership series (the first, on memory scanning, is availablehere), well provide a brief overview of some of these techniques and their advantages and disadvantages, before taking an in-depth look at our own contribution to the field: CryptoGuard.
Before we start, one thing to note: a ransomware attack has multiple stages, and the majority of these will occur before the solutions we discuss in this article come into play. A well-defended enterprise will have multiple layers of protection which should stop attacks at various points, meaning that in many cases specific anti-ransomware solutions shouldnt be required. But when all else fails, and a determined adversary reaches the encryption stage, we need a technology to prevent irreparable damage. Other phases of an attack initial infection, persistence, lateral movement, and so on are reversible, but encryption is not.
Static techniques (i.e., those which can be conducted passively, without requiring execution of the malware) for ransomware detection are not markedly different from those used to detect any other kind of malware. Solutions in this vein include signature-matching, comparing strings; comparing file operations; examining behavioral traits; deep learning techniques; and examining PE headers.
While static methods have the advantage of being relatively rapid and low-cost, determined attackers can also evade them by modifying code until signature detections are broken. They are also less effective against new variants, packers, obfuscators, and in-memory threats, as well as remote ransomware.
Dynamic solutions, on the other hand, tend to be more computationally expensive, but offer greater coverage. Dynamic anti-ransomware solutions in this vein include the following:
Some security solutions will monitor for changes to file extensions, high-frequency read/write and renaming operations, or new files which have extensions associated with ransomware variants. On the other hand, some solutions leverage other interactions; the open-source projectRaccine, for example, is based on the premise that many ransomware variants delete shadow copies usingvssadmin. Raccine works by intercepting requests tovssadminand killing the process responsible.
Since ransomware targets files, it seems logical that numerous approaches should focus on filesystem interactions. However, many of them are reliant on analysis within a sandboxed environment; are predicated on anomalous patterns which threat actors may try to avoid generating; or can be resource-intensive due to the amount of monitoring involved (although it is possible to dynamically adapt the degree of monitoring) Some filesystem-based techniques may also not be effective when it comes to remote ransomware.
While solutions likeControlled Folder Access (CAF) in Windows Defenderlimit access to folders to specific applications, such an approach is primarily geared towards individual users. CAF helps protect against ransomware by restricting unauthorized access to designated folders, allowing only trusted applications to modify files within them. However, for business networks, this method may be less practical due to the ongoing need for meticulous management of folders and applications. Additionally, it does not address the risk of attacks seizing control of trusted apps, a prevalent tactic in ransomware attacks
Some security solutions will assess API calls invoked by a process, either by flagging suspicious and seldom-seen calls or by determining potentially malicious call sequences.
Most ransomware employs API calls, although some variants use evasive measures to disguise these (particularly for API calls which are known to be suspicious, such as CreateRemoteThread or VirtualAllocEx, commonly used in process injection; or API calls related to encryption). Monitoring API calls at the kernel level certainly seems to be a worthwhile approach, but such monitoring is resource-intensive, can generate false positives, and is challenging to implement at scale. Additionally, when it comes to remote ransomware, the process itself may not be on the host being attacked, which can frustrate this approach.
Many security products employ honeyfiles, decoy files, bait files, or canary files as an anti-ransomware solution inconspicuous files which are placed in a directory and which legitimate users are asked not to touch. A separate monitoring system, either at the user-level or the kernel-level, is triggered if those files are accessed or changed by any process, at which point an alert is generated.
Honeyfiles are lightweight, low-effort, and can provide an early warning that an attack may be in progress. However, they do come with some caveats. Defenders must ensure that any alert is received and acted upon quickly enough, as by design an attack will already be in progress when a honeyfile is triggered. They also have to be strategically placed deep enough within filesystems to ensure that normal, legitimate users and processes wont accidentally trip them, but not so deep that important documents are encrypted before theyre accessed.
A less common technique is to fingerprint certain malicious patterns in network (C2) traffic, CPU consumption, or CPU signals.
With regards to network traffic, its worth noting that in modern human-led ransomware attacks, threat actors tailor and compile the ransomware binary uniquely for each victim, a strategic move intended to impede detection and complicate the decryption process. This custom-built ransomware typically contains a victim-specific ransom note and is deployed in a fire-and-forget manner, omitting the need for direct communication back to the threat actor, as the encryption process is self-contained within the malware, leveraging a victim-specific embedded public key.
An emerging technology from Intel called TDT (Threat Detection Technology) offers the ability to detect ransomware at the hardware level.A review by SE Labsdemonstrates a remarkable effectiveness against a diverse array of encryption schemes. However, this is confined to specific Intel CPUs, excluding ARM and AMD architectures. This limitation stems from TDTs reliance on a machine learning model trained on CPU performance signals from specific ransomware families encryption profiles. The model, trained by Intel, is dependent on vendor support and does not work with remote encryption. A disadvantage of this technology is that some ransomware strains, such as LockBit and Akira, are deliberately configured to encrypt only a portion of each file. This accelerates the impact of the attack, affecting more files in less time. It also means that detection by Intel TDT occurs after a significant number of files have already been compromised.
Most modern endpoint protection solutions transmit data to the cloud for incident response and alert analysis. However, automatically piecing together the details of an active human-led ransomware attack from alert telemetry can take anywhere from a few minutes to several hours. This latency depends on the configured telemetry reporting frequency, the presence of other alert signals, and the clouds processing capacity to assemble and correlate specific events from multiple protected machines.
Following detection, an automated response can involve deploying a containment policy to managed devices, to isolate a specific user account suspected of compromise by the attacker. While this action aims to prevent an imminent or ongoing (remote) ransomware encryption attack originating from the identified account, it is important to note that the distribution of this policy also requires time (up to hours). Moreover, in scenarios where the attacker starts encryption without triggering prior alerts on managed machines (as noted above, 80% of attacks involve unmanaged machines) or opts to begin the encryption process from an alternate user account, the conditions do not always favour an effective cloud-driven dynamic containment strategy.But it can be helpful in some instances.
In general, dynamic anti-ransomware solutions commonly require some level of encryption or data manipulation to have taken place before detecting the attack. Consequently, a certain number of files will likely become encrypted, necessitating a backup and restore function to recover affected files.
To revert unencrypted file versions, some endpoint protection products leverage Volume Shadow Copies, a Windows feature that generates data snapshots at specific time points. These shadow copies capture file or volume states, even while theyre in use. Nevertheless, this method has its limitations: attackers commonly delete the shadow copies; they do not protect files on network mapped drives; and effective rollback relies on detecting and addressing the ransomware incident before the subsequent scheduled snapshot (which typically occurs every four hours). And, as noted previously,most attacks happen after office hours, which can complicate recovery attempts using this method.
Generally, many of these approaches focus on looking for badness: characterizing and identifying behavioral traits which are indicative of ransomware activity. While this seems like a rational decision, it does have a crucial weakness, in that threat actors have an incentive to disguise or obfuscate those traits and therefore evade detection. CryptoGuard, on the other hand, takes a different approach.
CryptoGuard formerly known as HitmanPro.Alert, and part of Intercept X since 2016 was first developed in 2013, and is intended to be a last layer of defence against both local and remote ransomware, when determined threat actors have evaded all other protections and are in a position to begin encryption. Its notable successes include blocking WannaCry, LockBit, and REvil ransomware. While we keep a very watchful eye on developments in the ransomware space, CryptoGuard hasnt changed substantially over the years, primarily because it hasnt needed to.
Unlike the majority of the approaches described above, CryptoGuard doesnt look for attackers, ransomware executables, or malicious behavioral patterns at all. Other security solutions, including Sophos products, do these things, of course its a fundamental part of a layered defence, which ideally prevents attackers from getting to the encryption stage but CryptoGuard itself employs a more asymmetric approach, for when those layers have been circumvented.
Rather than looking for badness, CryptoGuard focuses on the contents of files, by analyzing their patterns with a mathematical algorithm. Whenever a process opens a file for reading and writing, CryptoGuards minifilter driver which operates within the Windows operating system kernel continuously generates histograms of the read and written data. These histograms serve to understand the overall pattern and characteristics of the data. They undergo evaluation to determine their entropy and statistically analyze whether the read and written data is unencrypted, compressed, or encrypted. The built-in evaluators employ mathematical models to classify data. Since the analysis uses the same memory buffers provided by the operating system for the requesting process, it is very efficient as it does not cause additional disk input/output (I/O).
This capability provides asymmetric protection, even in scenarios where an unprotected remote machine on the network is attacking shared documents on a Sophos-protected file server, for example. As noted above, most human-led ransomware attacks aim to also encrypt shared data on remote machines. In such cases, the ransomware itself is not executed on the protected remote machine (either because it wasnt deployed there by the attacker or was blocked by endpoint protection). As a result, the ransomware binary itself or the attacker-controlled process (that performs the encryption) cannot be observed from the machine that holds the targeted data.
So, because there is no malicious code to be detected on the attacked machine, technologies like antivirus, machine learning, indicators of breach, etc.all focused on identifying adversaries and their malicious codeare completely sidelined and not in play (even if it is a well-known years-old sample responsible for the encryption). However, CryptoGuard can recognize when a remote machine replaces documents in the shared folder with encrypted versions, and automatically takes action by blocking the IP address of the remote machine and reversing the changes it made. It creates temporary backups of any modified files, so that the changes can be rolled back if mass encryption is detected, and can also detect the deployment of ransom notes within the folders where the ransomware has encrypted files. Consequently, it sometimes identifies instances of data exfiltration, even though it was not explicitly designed for that purpose.
Adversaries will sometimes abuse an existing process, or package a normally benign process that loads a malicious DLL (known as DLL side-loading), in order to perform encryption. The encryption activity is performed under the identity of the benign process, now running attacker-code, and encrypting documents.
A real-world example of this isthe Kaseya VSA incident, where the REvil threat actor embedded a malicious DLL to be side-loaded in an outdated but vulnerable Windows Defender executable. The threat actor purposely chose Defender, because protections typically trust code signed by Microsoft. Additionally, a DLL cannot be examined as thoroughly as an executable in a sandbox environment, meaning it may be approved sooner.
On that occasion, Sophos detected both the REvil payload itself, as well as an REvil-specific code certificate. And while Kayesas protection exclusions allowed the REvil dropper to be installed on machines, CryptoGuard detected the ransomware, because its not constrained by such exclusions and blocks file encryption anywhere on protected drives.
There is no panacea when it comes to battling ransomware. An effective defence should include a myriad of layers, from vulnerability remediation and configuration reviews to user education and security solutions. But, regardless of which layers organizations employ, and how many, an important aspect to consider is the robustness and effectiveness of the last layer, when all other measures have failed and threat actors are in a position to execute their ransomware. At that point, the solutions weve covered here come into their own.
These solutions are diverse, covering numerous different behavioral traits and activity. Many vary widely in terms of their scalability, versatility, and cost-benefit ratios, and have distinct strengths and weaknesses. A key commonality is that most solutions focus on detecting badness in some way whether through API call analysis, honeyfiles, or some sort of fingerprinting. Thats not necessarily a disadvantage, and a layered and diverse defence stack is a solid approach. But, as weve shown, the CryptoGuard approach within Intercept X is slightly different, and more asymmetric: focusing on file contents rather than the behaviors of ransomware or its operators.
Ransomware continues to evolve, and more and more solutions and techniques are likely to appear in response. As weve been doing for the last ten years, well continue to track changes in both ransomware and the solutions designed to detect and prevent it.
Mark Loman, vice-president of software development and threat research at Sophos, is a ransomware expert and a good-guy hacker who really cares about keeping information safe. He leads a team of experienced developers whose main job is to create practical defenses that can spot and stop threats without needing to know about past attacks or specific signatures. With over 15 years of experience, Loman and his team really understand modern computer systems and applications. Their goal is simple: To make it difficult for the bad guys who want to sneak into computers, mess with how apps work, or lock up your files. They achieve this with security measures that safeguard documents and secrets, and by making swift adjustments to the computer's inner workings, which significantly increases the difficulty for anyone trying to cause trouble. Among his many other Sophos projects, he is the co-creator of CryptoGuard.
Matt Wixey is a Principal Technical Editor and Senior Threat Researcher at Sophos. He is a former penetration tester, and previously led cybersecurity R&D capabilities at both PwC UK and a specialist unit in the Metropolitan Police Service, digging into emerging attack vectors, vulnerabilities, and new technologies. Matt has spoken at national and international conferences, including Black Hat USA, DEF CON, ISF Annual Congress, 44con, and BruCon.
See the rest here:
CryptoGuard: An asymmetric approach to the ransomware battle - SC Media
Is Snapchat Encrypted And Safe? Let’s Find Out – Dataconomy
Is Snapchat encrypted? Delving into the realm of digital security, this article unravels the layers of Snapchats encryption practices. As users increasingly prioritize privacy, understanding the mechanisms, such as end-to-end encryption, becomes pivotal.
Join us on a journey through the intricacies of Snapchats security measures, shedding light on the protection of snaps and essential safety considerations for users navigating the ever-evolving landscape of social media.
Yes, Snapchat incorporates encryption as a fundamental component of its security infrastructure, employing a mechanism known as end-to-end encryption. This cryptographic protocol is designed to secure the content of communications, ensuring that only the intended recipients can decipher and access the shared information.
However, its important to note that the scope of encryption within Snapchat is specific. The end-to-end encryption applies primarily to one of Snapchats core features snaps, which encompass both photos and videos. When a user sends a snap, the content is encrypted on the senders device and remains encrypted during transit across the Snapchat servers. It only gets decrypted and becomes viewable when it reaches the intended recipients device.
This means that, theoretically, even if someone were to intercept the transmitted data between sender and recipient (such as a hacker or a malicious entity), they would only encounter encrypted, indecipherable information. The encryption key, which is necessary to unlock and reveal the content, resides solely with the devices at the endpoints of the communication the senders and the recipients devices.
Its crucial to highlight a limitation in Snapchats encryption strategy. While snaps benefit from end-to-end encryption, other forms of communication within the platform, such as text messages and chat interactions, do not enjoy the same level of encryption. These types of communications are subject to encryption during transit but may be stored in an accessible format on Snapchats servers.
In essence, Snapchats encryption measures enhance the privacy and security of snaps, contributing to a safer and more secure user experience. Users can, therefore, share photos and videos with a reasonable assurance that their content remains confidential between themselves and the intended recipient, even as it traverses the Snapchat network. Nonetheless, its advisable for users to remain vigilant, adhere to best practices, and take advantage of additional security measures, such as two-factor authentication, to fortify their overall online security.
Is Snapchat encrypted? Now, you know the answer! However, is it secure in general?
Snapchat, like many other social media platforms, can be considered relatively safe when used with awareness and caution. The app has implemented various security features, including end-to-end encryption for snaps, privacy settings, and additional safety measures. However, its crucial for users to be mindful of certain aspects and take steps to enhance their security and privacy.
Here are some factors to consider:
To enhance safety on Snapchat, users can follow the recommended guidelines and best practices:
Is Snapchat encrypted and safe? We explained it in detail. In conclusion, while Snapchat has implemented security measures, safety ultimately depends on user awareness and responsible use. By understanding the platforms features, configuring privacy settings, and staying informed about potential risks, users can enjoy a safer experience on Snapchat. Additionally, considering tools like Virtual Private Networks (VPNs) for enhanced online privacy can further contribute to a secure digital presence.
The rest is here:
Is Snapchat Encrypted And Safe? Let's Find Out - Dataconomy
EU ministers urged to defend citizens’ right to data privacy – TechRadar
Data Privacy Week kicked off in the EU with a pledge from the industry to defend encryption in 2024.
Some of the companies using this technology to develop security software, including VPN services, and secure email and messaging apps, are now calling EU ministers to defend their citizens' privacy and withdraw a worrying proposed regulation.
Deemed by critics as Chat Control, the EU Child Sexual Abuse Material (CSAM)Scanning Proposal could allow authorities to scan people's private and encrypted chats for dangerous content as a way to halt child sexual abuse (CSA) online.Yet, experts argue that going down this route rather endangers users (children included) instead.
"We all agree that ensuring children are safe online is one of the most important duties of tech companies and for this reason, we find the European Commissions proposed Regulation extremely worrying. If it were implemented as proposed, it would negatively impact childrens privacy and security online, while also having dramatic unforeseen consequences on the EU cybersecurity landscape, creating an ineffective administrative burden," wrote the experts in an open letter.
The group, composed of trade associations, and small and medium-sized tech companies, especially pointed out the risk of having a "backdoor" to allow authorities to scan messages in end-to-end encrypted environments.
So-called client-side scanning may help fight online crime, but, they argue, "it would also quickly be used by criminals themselves, putting citizens and businesses more at risk online by creating vulnerabilities for all users alike."
Among the signatories (22 in total) are popular VPN provider Surfshark, Swiss-based security software firm Proton, secure email service Tuta (formerly known as Tutanota), and encrypted messaging app developer Element.
The recent attack on encryption and the concept of client-side scanning began filling the news last year as tech companies raised the alarm on similar proposed legislation in the UK. While the Online Safety Act is now law, the messaging scanning requirement has been postponed until "it's technically feasible to do so" without breaking encryptiona solution that delays the issue rather than solving it.
In October the EU Parliament reached a historical agreement, though, asking for the removal of the Chat Control clause in order to safeguard online security and encryption. Now, it's the time for each EU Member State to agree on their own position.
"We call on our ministers, specifically on Nancy Faeser (SPD, Germany), to choose the right side in this discussion: uphold strong encryption and protect the human right to privacy of millions of EU citizens and businesses," said Matthias Pfau, founder of German secure email provider Tuta Mail.
According to Pfau, Europe cannot pride itself on the progress made with GDPR legislation while simultaneously promoting client-side scanning. "Such a move would destroy any credibility the EU currently holds in matters of privacy and cybersecurity," he said.
Did you know?
One of the most secure VPN providers out there, Mullvad VPN got vocal last year to raise awareness of the risks of the EU Chat Control law. It sends hundreds of emails to both journalists and politicians, while even putting giant banners across airports and the streets of some European cities. "Mullvad is usually a very silent company. This is probably the first time we really got mad enough to speak out," Jan Jonsson, CEO at Mullvad, told me when the company began its campaign in March last year.
EU State members are expected to vote on the proposed CSA regulation in the next few weeks and they hope to reach an agreement by March. Romain Digneaux, Public Policy Specialist at Proton, explained that only after that trilogue negotiations will be able to start. With EU Parliament elections happening in June, though, time is everything.
"We hope that the Belgian Presidency will act as an honest broker and take inspiration from the European Parliament to make sure that children are adequately protected, as well as everyone's right to privacy and security online," Digneaux told me. "However it looks like deep divisions still remain between member states."
All in all, experts are calling for finding a balanced approach alongside technically feasible solutions that could enhance child protection rather than undermine it. Specific requests include preserving the confidentiality of correspondence, refraining from forcing tech companies to perform mass surveillance and minimizing the administrative burden of the proposalby finding alternatives to mass scanning.
Commenting on the latter point, Digneaux told me: "There are many methods for combating crime online, as has been proven time and time again, which dont compromise privacy and security. While we cant publish the exact methods that we use (as that would play into the hands of the bad actors), at Proton we have a large team who work 24/7 to identify and remove bad actors and we cooperate with law enforcement within the framework of Swiss law.
"To sound horribly pragmatic, there is zero benefit to us to turn a blind eye to this behavior. In fact, the opposite, criminal behavior presents a huge threat to our entire business."
Read the original post:
EU ministers urged to defend citizens' right to data privacy - TechRadar
Businesses call on EU to defend encryption and privacy – BetaNews
In March this year, EU countries' interior ministers are due to vote on the introduction of mandatory client-side scanning for all providers in order to identify child abuse material.
But an open letter, published today, from a group of privacy-focused companies warns of the risk of opening up a backdoor and calls on ministers to defend citizen's right to privacy and strengthen the position of EU companies.
"Security experts agree that the chat control proposal by the EU Commission to scan every chat message and every email would create a backdoor -- one that could and will be abused by criminals. As the largest encrypted email provider in the EU, we are proud that we have built Tuta Mail here in Germany -- a secure product in line with the European GDPR enabling millions to communicate confidentially online," says Matthias Pfau, founder of Tuta Mail. "Now we call on our Interior Ministers, specifically on Nancy Faeser (SPD, Germany), to choose the right side in this discussion: uphold strong encryption and protect the human right to privacy of millions of EU citizens and businesses. Europe cannot pride itself on the progress made with GDPR legislation while simultaneously promoting client-side scanning. Such a move would destroy any credibility the EU currently holds in matters of privacy and encryption for businesses and citizens alike."
The letter points out that the EU has a unique chance to become the beacon of hope for freedom of speech and democracy by defending strong encryption so EU citizens and businesses can continue to enjoy online privacy and confidentiality at the highest possible level.
It calls on the EU council to guarantee a number of things to preserve a high level of cybersecurity in the EU by protecting end-to-end encryption and bringing the necessary safeguards in the text. It says that client-side scanning and backdoors in particular should not be mandated in order to preserve confidential correspondence.
You can read the full letter here.
Image credit: Rawpixel / depositphotos
Originally posted here:
Businesses call on EU to defend encryption and privacy - BetaNews
Attribute-based encryption could spell the end of data compromise – Help Net Security
The future of data privacy is the end of compromise. With the world producing data at astounding rates, we need ways to put data to the best use while protecting against breaches and ensuring privacy, data protection and access control.
These principles are foundational to attribute-based encryption (ABE)a novel form of encryption that after years of study is now beginning to be commercially deployed.
Compared to the prevailing coarse-grained access model of legacy encryption technologies, in which giving out a secret key essentially amounts to giving access to all the encrypted data, ABE is a more finely tuned approach that grants prescribed access of encrypted data to someone with a matching set of traits.
The paradigm is thus shifting from all-or-nothing to both-and. Both access to critical data for those with an authorized need-to-know and sustained encryption for all other data to be kept protected. The use cases for this policy-based approach are compelling, and behind them lies a distinguished theoretical foundation.
The history of ABE goes back to a ground-breaking 2005 paper titled Fuzzy Identity-Based Encryption. Fifteen years later, recognizing the papers significance, the International Association for Cryptologic Research (IACR) gave it a 2020 Test of Time Award. One of its co-authors, Dr. Brent Waters, later said the paper has had a three-fold impact.
First, there has been the concept of ABE as its own application with distinctive new use cases, several of which are discussed below. Second, the cryptographic research community not only has spent years studying ABE, but also used ABE as a building block, leveraging it to obtain new results in work on other problems. Third, according to Dr. Waters, the work in ABE inspired us to rethink encryption in even bigger and grander ways. One such overflow has been functional encryption, which allows a user to learn only a function of a data set.
For ABE, the end goal is fine-grained access to the data itself. On its own, thats a revolution. An ABE scheme can provide the right user with a key to very specific data. Not to an entire file cabinet, so to speak, but to a single line item within a category of filed documents. The elegance of this approach is that it protects the data through encryption, and by embedding access control mechanisms directly into the data, it ensures proper protection at all times, regardless of the system or environment. This unique advantage significantly enhances traditional system-based access control.
So how does this play out in practice? An ABE hackathon hosted by NTT Research in late 2022 provided several examples. The hackathon winner was an ingenious application of ABE to surveillance video, with advanced privacy protection.
Motivated by an incident involving leaked footage that revealed faces in a crowd, the data scientist and implementation engineer who created this app realized that they could use ABE to protect privacy and to make certain data (e.g., images of a criminal suspect) available to authorized personnel. Their hackathon demo extended privacy to a broader range of data, including building logos and license plates, as well as metadata containing GPS information.
This winning demo used a combination of artificial intelligence (AI), network edge processing, encryption, policy and data storage. First, using video they had shot in San Francisco, the site of the hackathon, they detected and labeled objects, through an edge-based convolutional neural network. Then they encrypted images, mapping between labels and ABE policies, such as allowing only an authenticated user with certain attributes to decrypt an object labeled face. Finally, they stored the video, including blurred images and encrypted metadata, in a database.
Demos from other hackathon participants illustrated more use cases, such as: ticketing and physical access to a transportation service; owner-control of data derived from a vehicles electronic sensors; employer access to employees personal mobile numbers; and a banking systems migration from single-factor, role-based access control (RBAC) to ABEs more granular control.
Another area ripe for ABE is the medical field. Two drivers are the acceleration of e-health and the demands of regulation, such as the U.S. Health Insurance Portability and Accountability Act (HIPPA). Back in 2011, the Johns Hopkins team had already explored the utilization of ABE to secure Electronic Medical Records (EMR).
Since then, numerous additional works have been conducted in this field.
While academics continue their research, deployments have begun. The hackathon winners, for example, are at work on several actual client projects. These include the monitoring of people in a hospital, surveillance in a manufacturing plant and the use of smart cameras while complying with the EU General Data Protection Regulation (GDPR).
The concept of the hackathon has evolved significantly. It now includes the processing of video and live-streaming content as well as still images. It is now possible to freely restrict privacy information visible to multiple recipients with different levels of security in a single real-time encrypted video. These innovative applications were introduced at the NTT R&D Forum 2023 and attracted great attention. The development is being tailored to a variety of use cases.
Another venue for vetting and rolling out ABE is at the intersection of academia, government and the private sector. A case in point is the University of Technology Sydney (UTS) Vault, a purpose-built, secure facility in New South Wales (NSW), Australia that enables collaboration between private sector tenants and a public university. In August 2023, UTS Vault announced an agreement to work with NTT DATA, an affiliate company of NTT, to validate ABE and co-develop use cases in cloud computing, healthcare, and IoT.
The world faces many conflicts today. One that has seemed intractable is the tension between data proliferation and demands for privacy. Introduced conceptually more than 15 years ago, ABE has become a plausible solution. ABE offers a compromise between data protection and access, and its a category that bears watching.
See the original post:
Attribute-based encryption could spell the end of data compromise - Help Net Security
A deep dive into encryption and end-to-end security – The Financial Express BD
In an age where information is considered wealth, protecting it has become paramount. Encryption, a process of converting information into an unconsumable form based on specific rules, has emerged as a powerful tool in this digital era.
One of its most robust forms, End-to-End (E2E) encryption, has revolutionised how various entities handle sensitive data.
From human rights organisations to law enforcement agencies and technology companies, the adoption of E2E encryption has reshaped their approach to accessing and utilising individuals' information for protection, prosecution, or profit.
At its core, encryption employs keys, data that unlocks or decrypts encrypted information. The Data Encryption Standard (DES) is a classic example of symmetric encryption, where the same key is used for encryption and decryption.
In contrast, asymmetric encryption involves separate keys for encryption and decryption. This method, exemplified by the Curve25519 algorithm used by WhatsApp, offers enhanced security with shorter keys, relying on elliptic-curve cryptography principles.
The encryption process encompasses hash functions responsible for encrypting a message. These functions ensure that the encrypted version of a message (digest) doesn't reveal the original content, produces a fixed-length digest irrespective of the message length, and generates unique digests for distinct messages.
The DES algorithm's hash function, involving S-boxes and block cyphers, illustrates the intricate processes encryption employs to obfuscate messages effectively.
E2E encryption comes into play during information transmission, particularly in messaging apps. It ensures that messages remain encrypted both in transit and at rest, only decrypted upon reaching the intended recipient.
This method enhances privacy and security, building trust among users regarding the confidentiality of their communications.
However, the effectiveness of E2E encryption is not absolute. The possibility of a man-in-the-middle (MITM) attack, where an attacker intercepts and decrypts messages, poses a threat. To counter this, users can employ fingerprint verification to confirm the authenticity of encryption keys, thwarting potential attackers.
Moreover, complacency among users is another concern. While E2E encryption secures messages during transmission, an attacker can exploit device vulnerabilities to gain unauthorised access to sensitive data. Malware attacks through channels like SMS can compromise the integrity of encrypted messages.
Legal and illegal factors also impact E2E encryption. Companies may be required by law to install backdoors, allowing access to encrypted information.
The Snowden affair exposed instances where companies cooperated with intelligence agencies, installing backdoors to provide unauthorised access to encrypted messages.
Additionally, the surveillance of users becomes possible by accessing metadata and providing details about message frequency, timing, and locations without revealing the content. Balancing the need for privacy with the legal requirements and the potential for misuse remains a complex challenge.
Its evolution from symmetric to asymmetric encryption showcases the ongoing efforts to enhance security and privacy. However, the digital security landscape is dynamic, requiring continuous adaptation to address emerging threats.
[emailprotected]
Originally posted here:
A deep dive into encryption and end-to-end security - The Financial Express BD
Breaking Barriers in 2024: Next-Gen DPI, AI, and Encrypted Traffic Intelligence to Redefine Network Visibility Featured – The Fast Mode
The anticipation around forthcoming IT and networking trends is high as we enter 2024. There is a lot of talk about Generative AI, sustainable computing and networking, and tightening regulatory landscapes. As bandwidth requirements grow and customer expectations increase, we predict heightened focus on network optimization and personalized QoE. We also expect HD video and immersive content to dominate our digital experiences more than ever. Most important of all, we think 2024 will be the year of next-gen DPI, and heres why:
#1: The rise of big tech and hyperscalers
The top six big tech companies, namely Apple, Amazon, Microsoft, Netflix, Alphabet and Meta are responsible for almost 50% of todays network traffic [1]. These, along with hyperscalers such as Google Cloud Platform, Azure, and AWS herald the era of infinite data, where networks must continuously scale up capacity, security and performance. However, to achieve this, networks need deep traffic visibility. Deep packet inspection (DPI), a cutting-edge traffic detection technology for IP networks, delivers real-time application and threat awareness. ipoque's OEM DPI engine R&SPACE 2 and its VPP-based counterpart R&SvPACE, enable granular detection and classification of applications, protocols and services and support advanced traffic metrics (e.g. application speed, container startup latency and VM data receive and transmit rates). Big tech and hyperscalers can leverage R&SPACE 2 to monitor traditional computing stacks, while R&SvPACE can be used to support VNFs and CNFs such as 5G UPFs, enabling players in this space to optimize workloads and traffic flows, secure applications and infrastructure, and shape content trends.
#2: The AI and machine learning boom
The global market for AI in telecoms is expected to reach USD 38.8 billion by 2031 [2] as operators adopt AI and automation for service improvements and cost reductions. However, increasingly stringent encryption protocols as well as the widespread use of traffic obfuscation and anonymization, challenges AIs efficiency and accuracy by impairing the quality of training data. This subsequently affects the efficacy of AI algorithms in analyzing and predicting network behavior. This is why we think that 2024 will be a big year for next-gen DPI. Next-gen DPI incorporates encrypted traffic intelligence (ETI) which combines ML and DL techniques and advanced caching methods to classify encrypted flows. Next-gen DPI with ETI enables operators to classify traffic, even across emerging encryption protocols and techniques such as TLS 1.3, QUIC and ESNI or when tunneling or when VPN is deployed. With next-gen DPI, operators can execute traffic-aware network management, for example dynamic path selection, intelligent resource allocation for latency-sensitive applications and flexible billing based on individuals resource consumption and QoE requirements.
#3: High-bandwidth mobile services to continue growing
GSMAs annual European Mobile Economy report [3] predicts a surge in demand among 5G subscribers for high-bandwidth services such as high quality gaming, XR and video content, entailing over EUR 198 billion in investments in the region, by year 2030. Most of these emerging applications have begun adopting latest encryption protocols. Again, this calls for next-gen DPI with ETI. With next-gen DPI, operators can gather new and more detailed analyses of encrypted traffic. For example, operators can distinguish on-demand streaming activity from OTT video downloading, and hence optimize routing of video traffic, reducing network costs while keeping tabs on subscriber QoE. Visibility into encrypted video traffic will become even more pertinent as the share of video traffic tops 80% [4] in not so distant future.
#4: Emergence of 5G non-terrestrial network (NTN)
5G experienced rapid rollouts throughout 2023 with around 1.6 billion [5] projected subscriptions worldwide. In 2024, chips compatible with the 3GPPs Release-17, which supports the integration of non-terrestrial network (NTN) technology into the 3GPP's 5G new radio (NR) standard, will become commercially available. This will enable ubiquitous 5G connectivity on standard unmodified smartphones and IoT devices, expanding 5G for rural users and powering various IoT / IIoT use cases in mining, agriculture, logistics, environmental monitoring and disaster response.
The introduction of NTN-NR will need DPI-enabled end-to-end visibility to establish situational and contextual awareness that is needed for seamless handoffs between operator and satellite networks and for applying QoS/QoE policies and improving network adaptability through self-optimizing capabilities. Next-gen DPI will remain indispensable for 5G NTN deployments in identifying underlying applications accurately and reliably to support real-time virtual instances spanning different connectivity technologies and to proactively monitor the performance of each session and application.
#5: Growing appetite for B2B2X offerings
The growing enterprise demand for end-to-end connectivity solutions has fostered operator B2B2X portfolios where players across the value chain - hardware manufacturers, system integrators, security vendors, analytics providers, payment intermediaries - co-create revenues. This however, has its own challenges. Mediating a diverse service portfolio spanning different industries, each characterized by unique customer needs, resource requirements and billing models, requires real-time traffic insights.
Again, next-gen DPI comes into play. Next-gen DPI enables accurate and granular analysis and accounting of operator resources (e.g. bandwidth) and vendor applications, services and hardware (e.g. cloud platform). It also speeds up diagnostics and issue resolution, especially for critical use cases. In smart manufacturing for example, R&SPACE 2, by distinguishing IIoT protocols such as Modbus, Profibus, EtherNet/IP or MQTT, and traffic patterns such as periodicity and low data rates, enable network administrators to prioritize and secure critical machine-to-server communications. Similarly, DPI in fintech can help identify behavioral characteristics such as specific transactional sequences or predictable communication flows between financial servers and clients, before these transactions are routed over low latency, secure pathways.
#6: AI to reimagine network security
In 2024, security vendors will be harnessing the power of AI for threat identification through next-gen DPI. This will help in tackling emerging exploits, for example RDP-related threats, identity-based attacks, spear-phishing and social engineering techniques that largely fly under the radar of traditional security defenses. For instance, last years massive MGM breach saw cybercriminals impersonating as employees and downloading over six terabytes of data from MGMs systems [6]. Next-gen DPI with advanced ML / DL algorithms would have averted the USD 100 million attack by identifying irregularities in application and user behavior. Similarly, in another major breach involving 23andMe [7], attackers used credential stuffing, which could have been detected by DPIs monitoring of unusual locations, devices and patterns of access. Whether it is suspicious traffic from remote C&C centers, or legitimate users accessing malicious domains, 2024 will see next-gen DPI becoming a crucial addition to networks AI-based security artillery.
Data and more data: Why we will always need DPI for network visibility
Complex communication protocols, rise in traffic diversity and the need to keep networks optimized, will all drive the need for real-time traffic visibility, and hence DPI. It is not surprising that the global DPI market will reach USD 6.58 billion by 2028, from just USD 1.32 billion in 2022 [8]. As we usher in 2024, there is no doubt that DPI will continue being at the core of major shifts in the telecom and networking space, delivering unparalleled visibility into every application and service, and keeping players traffic-aware at all times.
References
[1] What Percentage of Internet Traffic Do Technology Giants Generate?: https://senalnews.com/en/research/what-percentage-of-internet-traffic-do-technology-giants-generate
[2] AI in Telecommunication Market Research, 2031: https://www.alliedmarketresearch.com/ai-in-telecommunication-market-A09352
[3] The Mobile Economy Europe 2023 - https://www.gsma.com/mobileeconomy/wp-content/uploads/2023/11/GSMA-Mobile-Economy-Europe-2023.pdf
[4] Ericsson Mobility Report, November 2023 - https://www.ericsson.com/en/reports-and-papers/mobility-report/dataforecasts/traffic-by-application
[5] Ericsson Mobility Report, November 2023 - https://www.ericsson.com/en/reports-and-papers/mobility-report/reports
[6] Casino Giant MGM Expects $100 Million Hit from Hack That Led to Data Breach - https://edition.cnn.com/2023/10/05/business/mgm-100-million-hit-data-breach/index.html
[7] What the 23andMe Data Breach Reveals About Credential Stuffing - https://healthitsecurity.com/features/what-the-23andme-data-breach-reveals-about-credential-stuffing
[8] Deep Packet Inspection (DPI) Market Size & Trends 2023-2030 - https://www.barchart.com/story/news/19496317/deep-packet-inspection-dpi-market-size-trends-2023-2030-360-market-updates
Originally posted here:
Breaking Barriers in 2024: Next-Gen DPI, AI, and Encrypted Traffic Intelligence to Redefine Network Visibility Featured - The Fast Mode
Police radio encryption: Rep. LaShawn Ford proposes bill to give accredited media access to real-time police scanners – WLS-TV
CHICAGO (WLS) -- There is a new push to give the media more access to police scanners.
For years, the media could listen to police scanners in real time to keep track of what's going on in Chicago neighborhoods.
However, the City of Chicago recently began encrypting transmissions, putting them on a 30-minute delay.
READ MORE | Chicago officials blocking access to some live radio transmissions with encrypted scanners
In response, State Representative LaShawn Ford has introduced a bill that would require accredited newspapers and FCC licensed broadcasters, like ABC7 Chicago, to have access to real-time scanners.
"The police are not the only people that have to help protect individuals as it relates to public safety," Ford said. "They need partners. It's all hands on deck."
He hopes the bill will be taken up by lawmakers next month.
If passed, the bill would take effect next year.
Read the original post:
Police radio encryption: Rep. LaShawn Ford proposes bill to give accredited media access to real-time police scanners - WLS-TV
Cyber Intell Solution (CIS) Announces the Issuance of a Patent for Groundbreaking a Proprietary Randomized … – PR Newswire
ANNAPOLIS, Md., Jan. 23, 2024 /PRNewswire/ -- Cyber Intell Solution, LLC, a pioneer in software-defined network solutions, announced that the U.S. Patent and Trademark Office has issued patent No 0412583, for their ground breaking encrypted communication platform and related systems and methods, further strengthening the Company's intellectual property position in the cyber technology industry.
CISEN-SDN (Software Defined Network) is a dynamic, flexible solution that supports various network configurations and answers diverse implementation requirements. Agnostic in nature, the SDN networks can be configured as an end-to-end Post Quantum Cryptography (PQC) environment or a fusion PQC environment compatible with standard encryption protocols found in most commercially available hardware.
InventorAlexander Purta is recognized for his extensive experience developing, evaluating, and operating innovative cyber technology and encryption protocols to enhance secure digital communication, data exchange, and cyber obfuscation. I am thrilled to be living in an age where every day we have the opportunity to positively impact our society by developing divergent solutions through an indirect and creative approach utilizing innovative cyber technology and encryption protocols, said Alex Purta.
AboutCIS
Cyber Intell Solution (CIS) LLC is a cyber security business created by a former member of the UnitedStates Special Operations Command (USSOCOM). CIS offers proprietary hardware and software Cyber Security suite with dynamic, portable commercial off-the-shelf randomized, anonymous solutions for Data-in-Transit, Data-at-Rest, and secure communication to deliver unrivaled protection through multi-dimensional security.
Foundedin2015byAlexanderPurta, CIShasgrownexponentiallyoverthepastfewyears in supportofthe U.S. Military, Department of Defense (DoD), large and small businesses, and humanitarianorganizations worldwide. The issuance of the encrypted network patent represents a noteworthyachievementinthecompany's pursuitofadvancing scientificinnovations.
CISisproudtobeaCertifiedService-DisabledVeteran-OwnedSmallBusiness.
Contact
Ashley Kindig[emailprotected]Source: CyberIntell Solution
SOURCE Cyber Intell Solution
Go here to read the rest:
Cyber Intell Solution (CIS) Announces the Issuance of a Patent for Groundbreaking a Proprietary Randomized ... - PR Newswire
From Quantum Encryption and AI-Threat Detection to AIOps and Estate Modernisation, Kyndryl A/NZs Practice … – WhaTech Technology and Markets News
As we step into 2024, the technological landscape is undergoing a profound transformation, underscored by escalating cyber threats and a rapid shift towards advanced cloud and AI technologies. Key industry leaders from Kyndryl Australia and New Zealand, including Sandeep Parande, Michael Vincetic, and Justin Ciabotti, share their insights on these emerging trends. Parande highlights the urgent need for enhanced cybersecurity measures like quantum encryption and AI-driven threat detection, emphasizing the importance of cyber resilience. Vincetic discusses the evolving cloud landscape, with a focus on data centre optimisation and the increasing influence of hybrid cloud models. Ciabotti predicts a significant surge in the use of generative AI, underscoring the necessity of robust data strategies to fuel AI advancements. Collectively, these perspectives paint a picture of a year marked by technological advancements, heightened security measures, and an ever-growing reliance on AI and cloud technologies.
Sandeep Parande, Resiliency Practice Leader, Kyndryl Australia and New Zealand
Cyberattacks will become more sophisticated than ever in 2024, which means organisations need to become ever more sophisticated at defending against them. This will require implementing enhanced zero trust architecture and quantum encryption, because unlike conventional techniques, quantum encryption creates uncrackable keys using its proprietary quantum key distribution technology.
But while you can increase your defence with best of the solutions in the market, they are no good unless you have constant vigilance to detect cyber incidents. You cannot have an effective defence if you are not consistently keeping up to date on how cyber threats are morphing: in 2024 that will include more AI and machine-learning enabled cyberattacks, which means we will see more use of AI-driven automated threat detection.
We will also see a big push for cyber education to be rolled out more deeply across all functions of an organisation. An employee does not need to have intrusive credentials or super admin credentials to be a target for hackers: they may in fact be the low hanging fruit that gets hackers into the system.
It will be incumbent on organisations to empower their people with the knowledge and capabilities required to know how to spot unusual or suspicious activity, and to raise the alert. Ultimately, the most significant development for me in 2024 will be organisations recognising - and acting upon - their need to develop greater cyber resilience so they are ready not only to anticipate, protect and detect cyber threats but to recover when the gates are breached.
Increasingly, organisations will run regular tabletop exercises with more employees involved so that when a cyber incident inevitably happens, muscle memory kicks in, calm heads prevail and the organisation recovers quickly and efficiently with minimal damage.
Michael Vincetic, Cloud Practice Leader,KyndrylAustralia and New Zealand
2024 marks an inflection point for the C-suite when it comes to cloud. Many enterprises have already moved up to half their workloads to public cloud.
In turn, IT leaders are either asking themselves how do I optimise my investment and/or realise full value from my cloud investment? or are focused on what to do with the residual, unused technology and technical debt that is left over.
Almost all enterprises have already moved the less complex workloads to public cloud through treatments like lift and shift and rehosting, so in 2024 we will see a renewed focus on data centre optimisation as organisations try to realise cloud-like features within their data centres without having to move their more complex, mission critical assets.
Meanwhile, 5G is enabling computing to stay closer to the edge, which has led hyperscalers to extend their services to exist right within the data centre. All of that means hybrid/distributed cloud is now becoming the norm, and in 2024 we'll see a far more balanced view of cloud usage rather than quickly moving everything to the public cloud.
In 2024 we will see a continued shift towards multiple stakeholders influencing technology buying decisions. What was predominantly the domain of the CIO now includes other key parties, such as CFOs, who are asking important questions about realising the full value of cloud.
CFOs naturally focus on ROI, but we will also see even greater focus on ESG metrics with investment decisions impacted by environmental concerns such as the level of CO2 emissions generated from cloud migrations.
Finally, businesses will focus more on managing service levels to elevate customer experiences, by using automation and AI IT operations (AIOps) to reduce manual processes, improve the developer experience and create a seamless experience and unified observability for the end user.
Justin Ciabotti, Applications, Data & AI Practice Leader,Kyndryl Australia and New Zealand
As widely expected, I anticipate significant growth in the use of generative AI amongst enterprises in 2024. Whilst generative AI is in the news and on the top of everyones mind, only a very small percentage of enterprises currently use it productively.
We expect that to drastically change in 2024 and have prepared ourselves by expanding our partnerships with both Microsoft and AWS to bring generative AI to the enterprises.
AI is as good as the data you have available for it, so we also anticipate seeing further growth in customers investing to prepare their data strategy and foundations in 2024. This includes building more robust and modern data fabrics to have all the right data available for generative AI and large language models.
Finally, I expect to see more application modernisation and migration amongst mature enterprises with legacy infrastructure estates, particularly in industries such as banking, finance, and the public sector. Many have moved the easier workloads and applications to cloud but many of these legacy estates are still running business-critical applications that need modernisation before moving to the cloud and leveraging cloud native technologies.