Cloud Hosting

Amazon Web Services (AWS) Lambda, serverless computings poster child, is over seven years old. So, perhaps whats amazing isnt that the first malware specifically targeting Lambda, Denonia is here, its that it took so long for one to arrive.

Oh well. It had to happen eventually.

Its important to note, though, that while Denonia runs on Lambda, its not a Lambda-specific program. Instead, its a Linux 64-bit ELF executable, which uses several third-party libraries, including one that enables it to run inside AWS Lambda environments.

According to Matt Muir, a security researcher with Cado Security, a cloud-security company, who discovered it, while the program has the filename python, its actually written in Go. This nasty bit of software contains a customized variant of the open source XMRig mining software.

Denonia, Muir said, is clearly designed to execute inside of Lambda environments we havent yet identified how it is deployed. It may simply be a matter of compromising AWS Access and Secret Keys then manually deploying into compromised Lambda environments, as weve seen before with more simple Python scripts.

It appears that this is how Denonia is spread. It cant spread itself. It requires an already compromised user account.

As AWS pointed out in a statement, Denonia does not exploit any weakness in Lambda or any other AWS service. It gets through AWSs doors by relying on fraudulently obtained account credentials. Therefore, AWS concludes, Denonia isnt really malware since it lacks the ability to gain unauthorized access to any system by itself.

Actually, while malware that spreads itself is far more dangerous than malware that doesnt, most security experts would agree that its still malware. Still, AWS asserts that Calling Denonia a Lambda-focused malware is a distortion of fact, as it doesnt use any vulnerability in the Lambda service. That last part is certainly true. But you still dont want it running on your Lambda services.

Denonia can also run outside of Lambda. It will run on generic 64-bit Linux, as well.

Another factor that makes Denonia dangerous is that instead of using DNS to contact its controller, it uses DNS over HTTPS (DoH). DoH encrypts DNS queries and sends the requests out as regular HTTPS traffic to DoH resolvers. For attackers, Muir comments it provides two advantages:

There have long been serious security concerns with DoH. As Paul Vixie, DNSs creator tweeted in 2018, RFC 8484 (The Request for Comment that defined DoH) is a cluster duck for internet security. Sorry to rain on your parade. The inmates have taken over the asylum.

Vixies far from the only one. The SANS Institute, one of the worlds largest cybersecurity training organizations, said that the unmitigated usage of encrypted DNS, particularly DNS over HTTPS, could allow attackers and insiders to bypass organizational controls. Denonias use of DoH underlines that theres a real danger in what has heretofore been theoretical concerns.

Still, while Lambda itself is safer than other compute environments, keep in mind that as Amazon warns under the AWS Shared Responsibility Model, AWS secures the underlying Lambda execution environment but it is up to the customer to secure functions themselves. In other words, if you open the door to a program like Denonia, its your security problem, not AWSs.

So, as always, be careful out there people! AWS has an excellent white paper on securing Lambda environments, youd be well advised to use its recommendations. Lambda may well be safer than most compute platforms, but, as ever, security is a process, not a product. You must do your part as well.

Continue reading here:
First Malware Running on AWS Lambda Discovered The New Stack - thenewstack.io

An upcoming Windows 11 s feature will require the re-installation of the system for all PC users that have already upgraded to Windows 11. The underlying factor that prompted the invention of Windows 11 is security. Windows 11 will bring in more security features in the future that will add even more security from chip to the secure cloud by merging current hardware plus software.

One unique security feature that is a significant improvement of the Windows 11 is the Smart App Control. The smart App Control is akin to a smart screen as they operate using similar techniques. It is embedded in Windows 11 Operating System to protect by sounding an alarm when you are about to download malicious software into your device, not aware of its safety status. Thus, every application that runs through Windows 11 is put through the Smart App Control to ascertain their potential harm or safety.

Novel computers with already installed Windows 11, the smart app control gets automatically installed. However, old devices with the previous form of Windows 11 must be reset and a new Windows 11 reinstalled to benefit from the Smart App Control.

Another critical security measure against the invasion of privacy is the WireGuard VPN. It is a remarkable internet security feature, with a quicker communication procedure than an open VPN. Also, WireGuard is an extremely simple yet fast and modern VPN that utilizes 15% less internet data. It ensures zero data leaks and protection from cyberattacks.

In addition to the Smart App Control and WireGuard VPN, Windows 11 has other very unique security features, which are as follows.

The number of features that will be on by default has increased, which is an improvement from windows10 security, which incorporated options for security features such as VBS. Businesses were forced to set them on operation physically.

However, with windows 11, the manually turned on features in Windows 10 will be automatically turned on, which explains the heightened CPU requirement. Making security features on by default makes security somewhat less optional for all PC users.

Some of the windows 11 security features that will be automatically turned on include Virtual Based Security (VBS), windows sandbox, Kernel Data Protection (KDP), secure boot, Trusted Platform Module (TPM) encryption, and Mode-based execution control.

Microsoft has advertised windows 11 as being a zero-trust set. That means that cybersecurity incidences are bound to reduce significantly, hence improving response time by cyber security professionals.

Also, zero trust ready implies windows 11 affords the ability to ascertain whether a device has security structures enabled or not. Hence, a device must show it is safe before access to data. Windows 11 affords zero trust security to both the hardware and software thanks to the Microsoft Azure Attestation (MAA). MAA can remotely sanction the honesty of hardware and software wanting to access delicate cloud resources.

Virtualization is a significant security feature that enables Windows 11 developers to try out application features from their computers prior to rollout to the public. VBS utilizes virtualization to layer up more protection to security aspects and protect them from malware infection.

Windows sandboxing provides PC users with a secure environment distinct from their PC for running applications. Everything within the sandbox gets erased once the PC user closes the application. This layer of protection ensures that any malware within an application does not find its way to the files plus other applications within the computer.

Microsoft has witnessed a significant uptake of the sandboxing security feature by personal users and is currently still accessing the balance between usability and security.

Windows 11 provides passwordless right of entry for your devices, using only the PIN, fingerprint, or facial recognition. Passwordless access is by default for consumers, whereas businesses will have the ability to set up simple passwordless models.

The passwordless access heightens security and diminishes operating expenditures for IT operators since the time for helping with password set-up reduces.

Windows 11 uses at least 8th generation intel CPU to enable default security elements it wants to include. The 8th generation devices support the default features and optimize performance such that users do not trade in usability for security.

Windows 11 certified devices are equipped with TPM 2.0 chips, which guard credentials plus credential keys to the back of the hardware. Such protection is not hackable.

Windows 11 promises heightened security in todays world, where hacking, phishing, and ransomware are rampant. However, if you are using a previously installed Windows 11 and want to take advantage of new Windows 11 features, you will have to reinstall your system to benefit.

See the original post:
New Windows 11 Security Requires Reinstallation Of The System - KHTS Radio

Canberra is significantly boosting the cyber capabilities of the Australian Signals Directorate (ASD) the government agency responsible for signals intelligence, support to military operations, cyber warfare and information security. Project Redspice, announced in March, will increase ASDs budget by almost $10 billion over 10 years.

Unfortunately, ASDs 21-page Blueprint offers few insights into how the new money will be spent. In essence, we know only that the organisations staffing will almost double, its persistent cyber hunt activities will expand at the same rate, and its offensive cyber capability will grow even faster; tripling over the same period.

Hardly shy of criticising China, the government remains peculiarly leery of identifying Beijing as the source of constant cyber operations against Australia.

Prime Minister Scott Morrison has explained this move as necessary in order to be prepared for war: the first shot fired in any conflict that Australia might be involved in won't be in a metal casing, it'll be in bits and bytes. According to Defence Minister Peter Dutton, that was most recently demonstrated by offensive cyber activity against Ukraine.

Thats all true, but the cyber threat is more immediate and its coming from China. Hardly shy of criticising China, the government remains peculiarly leery of identifying Beijing as the source of constant cyber operations against Australia. Canberra joined allies to name China as the perpetrator of a Microsoft Exchange hack identified in January 2021, but still generally prefers euphemisms such as state-based actor (or allusions like Redspice).

Canberras focus on a future war is also misleading. Chinas aggressive actions in cyberspace are part of a growing competition short of war in what is often, if unhelpfully, described as the grey zone. Australias goal in this contest is not simply to win cyber battles by having superior offensive capabilities but to prevent cyberspace being transformed into a battlespace.

Australia wants an open and secure global internet in which states behave according to accepted rules. So Canberra must use its growing offensive cyber capability strategically to avoid undermining this greater goal.

Public messaging is an essential part of this strategic approach, not least because the opacity of cyberspace can foster misunderstanding. Clear communication is essential to both deter adversaries and reassure international partners.

There are, of course, limits on what the government can say about the activities its intelligence organisations perform. But in 2016, Australia was among the first countries to reveal its offensive cyber capability. In doing so, then Prime Minister Malcolm Turnbull said this would add a level of deterrence [and] adds to our credibility as we promote norms of good behaviour on the international stage.

ASDs leaders have since then slowly added to the picture. Theyve explained that offensive cyber (which doesnt include reconnaissance or espionage) encompasses anything from sabotage of critical infrastructure down to subtle manipulation of data. ASDs former Director-General Mike Burgess has emphasised that most of the agencys operations are low key: our targets may find their communications dont work at a critical moment rather than being destroyed completely. Burgess and his successor Rachel Noble have described ASDs operations against non-state actors (terrorists and criminals), but not other states.

Still, its clear that ASD is legally able to undertake offensive cyber activity against other states in situations short of war. ASD may conduct offensive cyber operations to disrupt criminal activity. Cybercrime is defined broadly enough to include other states cyber intrusions. ASD Director-General Rachel Noble last year underscored that we consider both state actors and serious and organised criminals to be undertaking criminal activity when going after Australian networks.

Canberra often emphasises that its offensive cyber operations accord with international and domestic law. The bigger question is whether Australia should use its offensive cyber capabilities against other states and, if so, how?

US public discussion of these issues has evolved faster than Australias in recent years. When Turnbull revealed Australias capability, President Barack Obama was still keeping tight control over US cyber operations. President Donald Trump reversed this approach in 2018, partly because that was his modus operandi and partly because cyber security agencies argued for a new approach.

Advocates argue that America can only counter its adversaries continual cyberattacks by operating in their networks.

President Joe Biden appears to have maintained the policy of defend forward, articulated in Trumps2018 Department of Defense Cyber Strategy. Washingtons current approach to competition in cyberspace is described as persistent engagement by Paul Nakasone, the dual-hatted head of the National Security Agency (NSA) and Cyber Command (both of which are ASDs close American counterparts.)

Still, the US debate about persistent engagement continues. Advocates argue that America can only counter its adversaries continual cyberattacks by operating in their networks. Opponents maintain that the risks of unintended consequences and escalation are too great. But most of them would acknowledge that those risks are at least mitigated by Washingtons relatively transparent discussion of cyber strategy.

Australias offensive cyber capability is now growing faster than its public discussion about why these tools are needed and how they should be used. Because Australian cyber competition with China will almost inevitably intensify, so too will the need to publicly air the complex questions of strategy and values that this raises. At minimum, Canberra should say whether ASD has also adopted persistent engagement.

Read more:
Australian cyber: What's Redspice for? | The Interpreter - The Interpreter

India ranks third in global data breaches in 2021, a 356% increase from the previous year. Since we do not currently have a national data protection or data privacy law, such cybersecurity failures pose massive threats of financial fraud and identity thefts on citizens. There needs to be a better mechanism that incentivises organisations that are collecting and storing citizen data to maintain stronger internet security measures.

Neither the proposed Data Protection Bill nor the amendment to the Information Technology Act, speaks about the responsibility of cybersecurity compromises. The Data Protection Bill mandates that companies need to report breaches within 72 hours of the occurrence, but there is no requirement for companies to secure citizen data. India had also introduced the National Cybersecurity Policy in 2013 which suggested several broad strategies including the provision of fiscal schemes and incentives to encourage entities to install, strengthen and upgrade information infrastructure for cybersecurity. As the government changed in 2014, not much has been done to implement the policy or to extend it to legal accountability and enforcement.

Indias e-commerce sector has witnessed tremendous growth in recent years. It is expected to grow to $188 billion by 2025. The Fintech market in the country is estimated to be the third-largest in the world. India is also the worlds second-largest telecommunication market.

This rapid and accelerated digitisation over the past few years has meant personal data collection at an equally rapid, yet unregulated, pace. The data collected online ranges from basic information (such as name, address, age, gender and phone number) to sensitive details (such as bank account numbers, credit/debit card numbers, government ID numbers, and so on). Added to this information that is directly collected and stored, there is metadata that can reveal deeper insights about customers (such as personality types, spending patterns, personal interests, political inclinations, food preferences, schedules, physical and mental health). However, other than the informal trust that the customer puts into these companies, there is no legal or policy promise requiring these companies to ensure customer data is safe, secure, and only used for purposes informed to the customer.

For a solution, we can look to banking regulation. There, policies of zero liability and limited liability for cards and online financial frauds made the banks responsible for unauthorised financial transactions. Similarly, we need to push accountability for data security on all companies collecting and storing citizen data.

The need for economic growth, and hopes for foreign investments, should not deter us from enforcing internet security. All companies, public and private, should be required to report to the government the measures taken by them to ensure data security and information regarding potential threats and targets. There needs to be a channel to facilitate information exchange between companies facing similar threats. For companies that fail to show serious efforts for internet security or lack compliance with standards set by the government, customers should be actively notified of the risks while sharing their data with them. The required standards of internet security measures can also vary basis the sensitivity of the data being collected.

This added accountability is often seen as an additional cost, especially for small and medium enterprises. But this can also be an opportunity where the government guides and assists SMEs to choose cloud services wisely, safeguard their websites and portals, and ensure that they are protected from ransomware attackers as well as other threats over the internet.

Over the last decade, many countries have established agencies to focus on cybersecurity and a safe national digital infrastructure: Singapore, the United States, and Israel are examples. India does have the National Cyber Coordination Centre, but this agency is an internet scanning agency for real-time assessments of cyber threats and report generation. It lacks real-time partnerships with domestic and international private and government agencies. It also does not act as a mentor on matters of cybersecurity or enforce guidelines around data protection and overreach. Without proactive measures, partnership with private enterprises, collaborative efforts and legal accountability, effective execution and results may prove difficult.

Government guidance and support are not interchangeable with government surveillance or government overreach. The Indian government needs to put in place standards to protect citizen privacy and digital security, from all domestic and international malicious players online, and itself.

Data is the new oil, the new weapon of war, and the new gold. 54% of Indias 1.2 billion population is estimated to have access to the internet. A large push to Indias growth has been from its accelerated development and adoption of digital public infrastructure and digital public goods. Internet security has been an elephant in the room and it's time it is seen as urgent and crucial for continued growth propelled by digitisation, internet penetration, and innovation.

Avni Sinha is at the Harvard Kennedy School of Government

The views expressed are personal

More:
Why legal intervention is the way forward for safe digital public infrastructure - Hindustan Times