Star Trek-themed Kirk ransomware has Spock decryptor, demands ransom be paid in Monero

While you may want to live long and prosper, you don’t want to be “kirked” – an extension added to files encrypted by the new Star Trek-themed Kirk ransomware.Kirk ransomware, which was discovered by Avast malware researcher Jakub Kroustek, doesn’t want the ransom to be paid in bitcoin; Bleeping Computer said it “may be the first ransomware to utilize Monero as the ransom payment of choice.”It is not known how the ransomware is being distributed, but researchers know that Kirk ransomware masquerades as the Low Orbital Ion Cannon network stress tool; LOIC was once favored for denial of service attacks. The fake version sports the LOIC slogan, “When harpoons, air strikes and nukes fail,” and claims to be initializing once executed.To read this article in full or to leave a comment, please click here

WD Green HDDs and excessive interrupts

Green as it’s cool, green as it’s quite, just like the trees. You’d think it’s all good and perfect. It’s also supposed to consume way less power. Yay, greener planet… Except…

When i started buying them in bulk, 500GB was a lot and a 32MB cache size seemed to be preferable to 16MB which the blue caviar offered at the time. From time to time when i was in hurry and couldn’t find a WD Green HDD, I’d settle with Blue. After couple of months a pattern started to emerge. Clients after clients started complaining about low performance. Their PCs would freeze. Sometimes as long as couple of minutes and then it would continue working again like nothing had happened. At the time I couldn’t quite figure out why after couple of months of usage, WD Green HDDs would start acting up like that.

The strange thing was that nothing was reported anywhere. Not a single suspicious system log or the so called SMART log. Even on couple of clients using Intel Raid, the “Intel RAID Chipset” seemed to be very happy with minutes of interrupts caused by the HDDs. And in a single case, one HDD suddenly died. Out Continue reading

Pranksters gonna prank

So Alfa Bank (the bank whose DNS traffic link it to trump-email.com) is back in the news with this press release about how in the last month, hackers have spoofed traffic trying to make it look like there's a tie with Trump. In other words, Alfa claims these packets are trying to frame them for a tie with Trump now, and thus (by extension) it must've been a frame last October.

There is no conspiracy here: it's just merry pranksters doing pranks (as this CNN article quotes me).

Indeed, among the people pranking has been me (not the pranks mentioned by Alfa, but different pranks). I ran a scan sending packets from IP address to almost everyone one the Internet, and set the reverse lookup to "mail1.trumpemail.com".



Sadly, my ISP doesn't allow me to put hyphens in the name, so it's not "trump-email.com" as it should be in order to prank well.

Geeks gonna geek and pranksters gonna prank. I can imagine all sorts of other fun pranks somebody might do in order to stir the pot. Since the original news reports of the AlfaBank/trump-email.com connection last year, we have to assume any further data Continue reading

VRF for Linux — a contribution to the Linux Kernel

If you’re familiar with Linux, you know how important and exciting it can be to submit new technology that is accepted into the kernel. If you’re not familiar with Linux, you can take my word for it (and I highly suggest you attend one of our bootcamps). Many networking features are motivated by an OS for switches and routers, but most if not all of those features prove useful for other use cases as well. Cumulus Networks strives for a uniform operating model across switches and servers, so it makes sense for us to spend the time and effort getting these features into upstream code bases. An example of this effort is VRF for Linux.

I joined Cumulus Networks in June 2015 to work on a VRF solution for Linux —to create an implementation that met the goals we wanted for Cumulus Linux and was acceptable to upstream maintainers for Linux as a whole. That solution was first available last year with Cumulus Linux 3.0 and because of the upstream push that solution is rolling out in general OS distributions such as Debian Stretch and Ubuntu 16.

This post is a bit long, so I start with a high Continue reading

F5 BIG-IP Plugin with Firefox 52 workaround

It’s not news anymore that Mozilla is stopping support for NPAPI (Netscape Plugin API). With the release of Firefox 52 version, I believe that only Flash plugin is enabled by default.

I’ll skip the discussion about NPAPI plugins and Mozilla’s decision to stop the support, however the reality is that for me it has a strong impact in certain areas. One of this areas is the F5 BIG-IP, specifically the APM and possibility to launch Application (like RDP) from the Webtop interface.

I’m relying heavily on a F5 BIG-IP VE machine to connect to my home lab when I’m remote. The Webtop functionality gives me the possibility to use only a Browser to connect to my applications at home, keeping me away from any F5 client installation on the machine that I use. Usually this machine is my MacBook or PC, and the F5 client installation should not be a big thing, however I like the clientless option.

The F5 Webtop functionality is possible due to a NPAPI plugin called “F5 Network Host Plugin” which usually installs in the browser when you access the F5 APM. So yes, you still need to install something, but this browser plugin is Continue reading

Some HTTPS inspection tools might weaken security

Companies that use security products to inspect HTTPS traffic might inadvertently make their users' encrypted connections less secure and expose them to man-in-the-middle attacks, the U.S. Computer Emergency Readiness Team warns.US-CERT, a division of the Department of Homeland Security, published an advisory after a recent survey showed that HTTPS inspection products don't mirror the security attributes of the original connections between clients and servers.HTTPS inspection checks the encrypted traffic coming from an HTTPS site to make sure it doesn't contain threats or malware. It's performed by intercepting a client's connection to an HTTPS server, establishing the connection on the client's behalf and then re-encrypting the traffic sent to the client with a different, locally generated certificate. Products that do this essentially act as man-in-the-middle proxies.To read this article in full or to leave a comment, please click here

Some HTTPS inspection tools might weaken security

Companies that use security products to inspect HTTPS traffic might inadvertently make their users' encrypted connections less secure and expose them to man-in-the-middle attacks, the U.S. Computer Emergency Readiness Team warns.US-CERT, a division of the Department of Homeland Security, published an advisory after a recent survey showed that HTTPS inspection products don't mirror the security attributes of the original connections between clients and servers.HTTPS inspection checks the encrypted traffic coming from an HTTPS site to make sure it doesn't contain threats or malware. It's performed by intercepting a client's connection to an HTTPS server, establishing the connection on the client's behalf and then re-encrypting the traffic sent to the client with a different, locally generated certificate. Products that do this essentially act as man-in-the-middle proxies.To read this article in full or to leave a comment, please click here

Worth Reading: Building better ransomware

This is kind of a funny post for me to write, since it ransomwareinvolves speculating about a very destructive type of software — and possibly offering some (very impractical) suggestions on how it might be improved in the future. It goes without saying that there are some real downsides to this kind of speculation. Nonetheless, I’m going ahead on the theory that it’s usually better to talk and think about the bad things that might happen to you — before you meet them on the street and they steal your lunch money. —Cryptography Engineering

The post Worth Reading: Building better ransomware appeared first on 'net work.

A cybersecurity risk assessment is a critical part of M&A due diligence  

This column is available in a weekly newsletter called IT Best Practices.  Click here to subscribe.  As of mid-February, the plan for Verizon Communications to acquire a majority of Yahoo’s web assets is still on, despite the announcement of Yahoo having suffered two massive breaches of customer data in 2013 and 2014. The sale price, however, has been discounted by $350 million, and Verizon and Altaba Inc. have agreed to share any ongoing legal responsibilities related to the breaches. Altaba is the entity that will own the portion of Yahoo that Verizon is not acquiring.To read this article in full or to leave a comment, please click here

A cybersecurity risk assessment is a critical part of M&A due diligence  

This column is available in a weekly newsletter called IT Best Practices.  Click here to subscribe.  As of mid-February, the plan for Verizon Communications to acquire a majority of Yahoo’s web assets is still on, despite the announcement of Yahoo having suffered two massive breaches of customer data in 2013 and 2014. The sale price, however, has been discounted by $350 million, and Verizon and Altaba Inc. have agreed to share any ongoing legal responsibilities related to the breaches. Altaba is the entity that will own the portion of Yahoo that Verizon is not acquiring.To read this article in full or to leave a comment, please click here

String of fileless malware attacks possibly tied to single hacker group

Several attacks observed over the past few months that rely heavily on PowerShell, open-source tools, and fileless malware techniques might be the work of a single group of hackers.An investigation started by security researchers from Morphisec into a recent email phishing attack against high-profile enterprises pointed to a group that uses techniques documented by several security companies in seemingly unconnected reports over the past two months."During the course of the investigation, we uncovered a sophisticated fileless attack framework that appears to be connected to various recent, much-discussed attack campaigns," Michael Gorelik, Morphisec's vice president of research and development, said in a blog post. "Based on our findings, a single group of threat actors is responsible for many of the most sophisticated attacks on financial institutions, government organizations, and enterprises over the past few months."To read this article in full or to leave a comment, please click here

String of fileless malware attacks possibly tied to single hacker group

Several attacks observed over the past few months that rely heavily on PowerShell, open-source tools, and fileless malware techniques might be the work of a single group of hackers.An investigation started by security researchers from Morphisec into a recent email phishing attack against high-profile enterprises pointed to a group that uses techniques documented by several security companies in seemingly unconnected reports over the past two months."During the course of the investigation, we uncovered a sophisticated fileless attack framework that appears to be connected to various recent, much-discussed attack campaigns," Michael Gorelik, Morphisec's vice president of research and development, said in a blog post. "Based on our findings, a single group of threat actors is responsible for many of the most sophisticated attacks on financial institutions, government organizations, and enterprises over the past few months."To read this article in full or to leave a comment, please click here

Dutch researchers pull almost 43Gbit per second over a ray of light

An experiment by scholars at the Eindhoven University of Technology in the Netherlands has demonstrated a wireless network based on infrared rays that can move data at speeds of 42.8Gbps.The system, which is the work of new Ph.D recipient Joanne Oh, uses light “antennas,” which don’t have any moving parts, translating signals from a fiber-optic cable into infrared light and beaming them to receivers in the same room, which can be tracked by their return signals – when a user’s device moves out of one beam’s area of function, another light antenna can take over.+ALSO ON NETWORK WORLD: Cisco security advisory dump finds 20 warnings, 2 critical + Raspberry Pi roundup: Pi Day, Remembrances of Pis Past, competitor corner, STEM and SKULLSTo read this article in full or to leave a comment, please click here

Dutch researchers pull almost 43Gbit per second over a ray of light

An experiment by scholars at the Eindhoven University of Technology in the Netherlands has demonstrated a wireless network based on infrared rays that can move data at speeds of 42.8Gbps.The system, which is the work of new Ph.D recipient Joanne Oh, uses light “antennas,” which don’t have any moving parts, translating signals from a fiber-optic cable into infrared light and beaming them to receivers in the same room, which can be tracked by their return signals – when a user’s device moves out of one beam’s area of function, another light antenna can take over.+ALSO ON NETWORK WORLD: Cisco security advisory dump finds 20 warnings, 2 critical + Raspberry Pi roundup: Pi Day, Remembrances of Pis Past, competitor corner, STEM and SKULLSTo read this article in full or to leave a comment, please click here

1 … 2,217 2,218 2,219 2,220 2,221 … 3,841