Cloud Hosting

ID 63400131 Gstockstudio1 | Dreamstime.com

With every passing holiday season, the number of Internet-connected, electronic devices that fill our homes continues to grow, from smart assistants like Amazon Alexa and Google Home, to the video-doorbell Ring, to the now-ubiquitous Nest thermostat. These Internet-of-Things (IoT) devices have quickly changed our daily lifestyles, and we dont expect this trend to slow down anytime soon.

As the number of consumer-focused IoT devices continues to expand, businesses are quietly increasing their use of Internet-connected devices as well. These devices include broadly used technology such as printers, security cameras, Bluetooth keyboards and HVAC systems, as well as industry-specific devices such as manufacturing sensors, MRI machines, metal detectors and more. And as the use of all these devices grows, the potential security threats associated with them increase as well. Simply put, more Internet connections and endpoints in a business means more opportunities for hackers to exploitbut unfortunately, many businesses are not set up to deal with this issue.

Its a growing concern for businesses in a diverse set of industries. Gartner predicts that the overall enterprise and automotive IoT market will grow to 5.8 billion endpoints in 2020 (growing 21% year-over-year). Enterprises in sectors including healthcare, manufacturing, hospitality, retail and others have realized that the number of unmanagedand sometimes even unknownIoT devices in their facilities continues to grow, raising management and security concerns.

A recent Forrester survey of 403 technology decision-makers in business found that 69% of them estimated that half of all devices on their enterprise networks were IoT devices that could not be managed via traditional security tools. As a result, 79% of these executives were very to extremely concerned about device security.

This new, hyper-connected environment has already spawned high-profile security attacks. The WannaCry ransomware crypto-worm famously infected more than 230,000 computers in 150 countries and took down half of the hospitals in the UK, after malware infected out-of-date Windows XP devices. The U.S., U.K. and Australia publicly said North Korea was behind the attack. There also have been more pointed, and creative IoT-related security incidents: Hackers stole a reported 40 million customer credit-card numbers from Target due to a breach of a third-party HVAC system used by the company, and security company Darktrace said last year that hackers stole a casinos database of high-roller gamblers via a thermometer in a lobby aquarium.

Often, device manufacturers do not develop their products with security in mind, which increases the need for companies to deploy technology and policies to discover, manage and enforce the use of IoT devices. We think there is a sizable market for such solutionswhich is one reason were excited to announce our investment today in Ordr*.

Ordr, based in Santa Clara, Calif., has an innovative approach to securing managed and unmanaged IoT devices. Taking a network approach by focusing at the device packet-flow level, Ordrs technology can take inventory of devices, monitor their behavior and create a device flow snapshot to understand vulnerabilities in a network and provide protection against intruders. By doing so, Ordr allows security teams to write policies for firewalls and to micro-segment devices on networks so they only connect with other devices and networks that they need to. The technology also provides insight into all devices across a network in a single view.

The company is led by experienced network-and-security executives including CEO Greg Murphy, the former CEO of Zenreach who was previously the VP of business operations at Aruba Networks; Chief Product Officer Pandian Gnanaprakasam, previously the chief development officer and VP engineering at Aruba; and Chief Scientist Sheausong Yang, the former chief architect and VP technology at Aruba.

Ordrs products help security personnel address a top budget priority while supporting the rapid expansion in IoT devices, which are increasingly needed by companies becoming more software-centric in this age of digital transformation. We are excited to partner with the Ordr team to help promote a more connected, but also secure, business environment.

More here:
How to Keep a Security Breach Out of your Internet-Connected Stocking this Christmas - Forbes

A top executive at the nonprofit entity responsible for doling out chunks of Internet addresses to businesses and other organizations in Africa has resigned his post following accusations that he secretly operated several companies which sold tens of millions of dollars worth of the increasingly scarce resource to online marketers. The allegations stemmed from a three-year investigation by a U.S.-based researcher whose findings shed light on a murky area of Internet governance that is all too often exploited by spammers and scammers alike.

There are fewer than four billion so-called Internet Protocol version 4 or IPv4 addresses available for use, but the vast majority of them have already been allocated. The global dearth of available IP addresses has turned them into a commodity wherein each IP can fetch between $15-$25 on the open market. This has led to boom times for those engaged in the acquisition and sale of IP address blocks, but it has likewise emboldened those who specialize in absconding with and spamming from dormant IP address blocks without permission from the rightful owners.

Perhaps the most dogged chronicler of this trend is California-based freelance researcher Ron Guilmette, who since 2016 has been tracking several large swaths of IP address blocks set aside for use by African entities that somehow found their way into the hands of Internet marketing firms based in other continents.

Over the course of his investigation, Guilmette unearthed records showing many of these IP addresses were quietly commandeered from African businesses that are no longer in existence or that were years ago acquired by other firms. Guilmette estimates the current market value of the purloined IPs hes documented in this case exceeds USD $50 million.

In collaboration with journalists based in South Africa, Guilmette discovered tens of thousands of these wayward IP addresses that appear to have been sold off by a handful of companies founded by the policy coordinator for The African Network Information Centre (AFRINIC), one of the worlds five regional Internet registries which handles IP address allocations for Africa and the Indian Ocean region.

That individual Ernest Byaruhanga was only the second person hired at AFRINIC back in 2004.Byaruhanga did not respond to requests for comment. However, he abruptly resigned from his position in October 2019 shortly after news of the IP address scheme was first detailed by Jan Vermeulen, a reporter for the South African tech news publication Mybroadband.co.za who assisted Guilmette in his research.

KrebsOnSecurity sought comment from AFRINICs new CEO Eddy Kayihura, who said the organization was aware of the allegations and is currently conducting an investigation into the matter.

Since the investigation is ongoing, you will understand that we prefer to complete it before we make a public statement, Kayihura said. Mr. Byauhangas resignation letter did not mention specific reasons, though no one would be blamed to think the two events are related.

Guilmette said the first clue he found suggesting someone at AFRINIC may have been involved came after he located records suggesting that official AFRINIC documents had been altered to change the ownership of IP address blocks once assigned to Infoplan (now Network and Information Technology Ltd), a South African company that was folded into the State IT Agency in 1998.

This guy was shoveling IP addresses out the backdoor and selling them on the streets, said Guilmette, whos been posting evidence of his findings for years to public discussion lists on Internet governance. To say that he had an evident conflict of interest would be a gross understatement.

For example, documents obtained from the government of Uganda by Guilmette and others show Byaruhanga registered a private company called ipv4leasingafter joining AFRINIC.Historic WHOIS records from domaintools.com [a former advertiser on this site] indicate Byaruhanga was the registrant of two domain names tied to this company ipv4leasing.org and .net back in 2013.

Guilmette and his journalist contacts in South Africa uncovered many instances of other companies tied to Byaruhanga and his immediate family members that appear to have been secretly selling AFRINIC IP address blocks to just about anyone willing to pay the asking price. But the activities of ipv4leasing are worth a closer look because they demonstrate how this type of shadowy commerce is critical to operations of spammers and scammers, who are constantly sullying swaths of IP addresses and seeking new ones to keep their operations afloat.

Historic AFRINIC record lookupsshow ipv4leasing.org tied to at least six sizable blocks of IP addresses that once belonged to a now defunct company from Cameroon called ITCthat also did business as Afriq*Access.

In 2013, Anti-spam group Spamhaus.org began tracking floods of junk email originating from this block of IPs that once belonged to Afriq*Access. Spamhaus says it ultimately traced the domains advertised in those spam emails back to Adconion Direct, a U.S. based email marketing company that employs several executives whoare now facing federal criminal charges for allegedly paying others to hijack large ranges of IP addressesused in wide-ranging spam campaigns.

Anyone interested in a deeper dive on Guilmettes years-long investigation including the various IP address blocks in question should check out MyBroadbands detailed Dec. 4 story, How Internet Resources Worth R800 Million (USD $54M) Were Stolen and Sold on the Black Market.

Tags: Adconion Direct, AFRINIC, Afriq*Access, Eddy Kayihura, Infoplan, ipv4leasing, ITC, Jan Vermeulen, Mybroadband.co.za, Ron Guilmette, The African Network Information Centre

This entry was posted on Wednesday, December 11th, 2019 at 5:31 pmand is filed under A Little Sunshine, Web Fraud 2.0.You can follow any comments to this entry through the RSS 2.0 feed.You can skip to the end and leave a comment. Pinging is currently not allowed.

See the original post here:
The Great $50M African IP Address Heist - Krebs on Security

Research

Half of all malware that tried to infect computers during the third quarter of 2019 was already known, according to a newreportfrom WatchGuard Technologies. The other half was "zero-day" malware, which bypassed (and therefore went undetected by) traditional signature-based security software. On its list of the top-10 malware attacks for a three-month period, WatchGuardidentified several Apache Struts vulnerabilities, which the cybersecurity company identified as the same type of malware used in the Equifax data breach. In its report, WatchGuard also highlighted an increase in the use of Microsoft Office exploits as well as "legitimate penetration testing tools" for delivering computer infections.

The bulk of the content for the latest "Internet Security Report" is generated and collected by willing participants using the company's products, including its Firebox firewall appliances and software, and DNS-level protection services.

Among the many findings shared in the report are these:

Overall network attacks rose by 8 percent quarter over quarter, the company found. Among them was the Apache Struts 2 Remote Code Execution (the one that hit Equifax), which allows attackers to install Python or make a custom HTTP request to exploit the vulnerability "with just a few lines of code and obtain shell access to an exposed system." Two additional Apache Struts were also on the top-10 list. As the security researchers pointed out, the continued use of this vulnerability "should serve as a reminder of how important it is for web admins to patch known flaws as soon as possible."

Also on the list: two malware flavors that hit Office products. Both were delivered via email, the report noted, pointing up the importance of training users in the art of being able to identify phishing attempts and potentially malicious attachments.

Two newly identified malware flavors incorporated penetration testing tools: Boxter, a "PowerSploit" script; and Hacktool.JQ, a password stealer. What researchers couldn't determine was whether these were being used by legitimate hackers for the purposes of testing enterprise networks or by cyber criminals "leveraging readily available open source tools."

Among top compromised websites was one legitimate site (an Arabic platform) for sharing photos and links, which also hosted "malicious payloads." While the site validates the file extension when accepting an image, it doesn't go beyond that, which means attackers can change the file extension to something friendly while uploads still carry malware that's activated when the files are clicked.

The dramatic increase in zero-day malware instances (up to 50 percent from 38 percent over the last several quarters) pointed up the need for a layered security approach that could use multiple services to defend against "advanced, ever-evolving threats."

"Our latest threat intelligence showcases the variability and sophistication of cyber criminals' growing playbook. Not only are they leveraging notorious attacks, but they're launching evasive malware campaigns and hijacking products, tools and domains we use every day," said Corey Nachreiner, the company's chief technology officer, in a statement. "As threat actors continue to modify their tactics, organizations of every size must protect themselves, their customers and their partners with a set of layered security services that cover everything from the core network to endpoints to the users themselves."

The security report, with more detailed findings, is availableon the WatchGuard website(registration required).

About the Author

Dian Schaffhauser is a senior contributing editor for 1105 Media's education publications THE Journal and Campus Technology. She can be reached at dian@dischaffhauser.com or on Twitter @schaffhauser.

See the original post:
Office and Penetration Testing Software Increasingly Becoming Vectors for Malware - Campus Technology

Want to know more about how to use a VPN on your Android device? Then youve found yourself in the right place. Using a VPN on your tablet, or smartphone is a great idea. But what exactly is a VPN used for on Android?

Whether youre sitting soundly in your local caf, or getting ready to board a flight from Budapest to Moscow, youre going to need to get a handle on your internet security. Those public networks can certainly be helpful, but they are also a danger to your information! Lets take a look at what you should know about VPNs and your Android device.

Your VPN, or Virtual Private Network, is a great way to keep your data and private information away from hackers. Lets say youre in a public space, a restaurant, or coffee shop, and you want to use their public network. Its not a bad idea, but it is potentially a very easy way for hackers to get ahold of your personal information.

A VPN makes it so your personal Android device can connect to the internet securely, while helping keep your personal data private. Not only that, but VPNs make it so your browsing activity cant be accessed on a public network as well! Finding the right VPN is easy, This is because a good Android VPN will be affordable and easy to access. But why should you use one?

Today, we use technology for such a wide variety of things. Whether youre sending important legal documents via email, or googling adorable cat videos, there are a lot of things that you may want to keep hidden.

Here are just a few things that a hacker can access from your Android on a Public Network:

However, there are ways to keep your private data, well private! Using a VPN on your smaller devices will help to not only keep hackers at bay, but also a wide array of other things. It is not as complicated as building new technology for NASA. But all things considered, finding internet safety shouldnt have to be!

A VPN will also allow you to operate online through a proxy IP Address. Meaning you can access websites, streaming platforms, and so many other things that may be limited in your region. You can access Japanese streaming platforms from the U.S., you can watch British television from North Africa, the world is pretty much your private oyster!

Your phone or tablet holds an enormous amount of personal data. In order to keep that information safe, you should definitely look into using a VPN. As these devices hold not only the information you put on there, but also the data from servers, your location, and so much more!

In order to help you keep your data secure on your phone, as well as your other Android devices, it is highly recommended that you access unknown networks through a VPN. Not only that, but you can even use your Android VPN at home as well! This can allow you a new wave of opportunities online.

Though they are helpful in keeping your internet information more private, VPNs are not perfect! VPNs may cause slower download speeds, or connectivity speeds, as well as cost more than you thought. There ARE free VPN services out there, but the best ones are going to have a price tag.

There are many pros to using a VPN on your Android device. From keeping your information safe and secure, to bypassing geo-blocking, youre well on your way to making the most of this internet platform. Secure your Android by signing up for a VPN.

Excerpt from:
What is a VPN Used for on Android? - eTurboNews | Trends | Travel News