Recently, Microsoft published a fascinating blog post. In the blog post, they said they were experimenting with “novel approaches” when it comes to harnessing the power of AI to spot threats on the threat landscape before they become a problem.

In particular, the company is focused on stopping ransomware attacks while they’re still in their earliest stages.

To get even more fine-grained than that, they are specifically targeting human-operated ransomware campaigns. They note that there are certain indicators in common where human-operated ransomware campaigns are concerned, and these commonalities can be used to stop future attacks.

The example that Microsoft gives in their blog post is that of a hacker who has stolen the network credentials of a company.  They will first log in to test those credentials, and once inside, will almost certainly move about inside the network in ways that the proper owner of those credentials would not.

This creates specific data points that the AI can be on the alert for.

Broadly speaking, these fall into three categories:  Time based, Graph based, and device-based.

An example of a time-based data point would be if the hacker logged in to test the credentials at 3:00 in the morning and the owner of those credentials historically logs in at 8am.

Graph-based patterns are the graphical representation of physical moves across a network space, plotted against expected moves.

And device-based data points are exactly what they sound like.  The AI would expect that the owner of the stolen credentials would log in from his or her workstation and not a laptop hidden behind layers of proxies, which is suspicious in and of itself.

It’s a great idea, though Microsoft is quick to point out that it is still very much in its infancy.  Even so, it’s easy to see how this could become an indispensable tool.

Do you own one or more of the following products made by Cisco?

• The RV110W Wireless-N VPN Firewall
• The RV130 VPN Router
• The RV130W Wireless-N Multifunction VPN Router
• The RV215W Wireless-N VPN Router

If so, be advised that a new and critical security vulnerability has been found that impacts your equipment.  It is being tracked as CVE-2022-20825.  With a severity rating of 9.8 out of a possible 10, it’s about as serious an issue as it’s possible to have.

What is worse is that because the equipment referenced above is older and at the end of its service life, Cisco announced that there will be no patches to address this recently discovered security vulnerability.

Per a recent Cisco security advisory, the flaw exists because of insufficient user input validation of incoming HTTP packets on impacted devices.

It should be noted that this flaw only impacts devices that have their web-based remote management interface enabled on WAN connections.  If you’re not doing that, then even if you have an older piece of Cisco equipment, you’ve got nothing to worry about.

If you’re not sure whether remote management is enabled or not, just use the following steps. Log into the web management interface and make your way to “Basic Settings” and then “Remote Management.”  From there, just verify whether the box is checked or not and you’re all set.

In cases like these, we do wish companies were willing to be a bit more flexible. However, on the other hand, it’s easy to see how an offer of more time would be abused. So while we feel your pain if you own one of the impacted devices and we also understand why Cisco is taking a hard line and not granting any wiggle room.

All that to say, if you’re still using one of the devices referenced above, upgrade to a newer piece of equipment as soon as possible.

Unless you’re an IT Security Professional, you may never have heard of EnemyBot.  It is a bit like the Frankenstein of malware threats, a botnet that has borrowed code from multiple different sources.

While that’s not terribly original, it does make it dangerous. The hackers behind the code are actively adding new exploits as newly disclosed critical vulnerabilities come to light in content management systems, IoT devices, Android devices, and web servers.

The botnet was first seen in action in March and is currently being tracked by researchers at Securonix.  By April, newer code samples were acquired, and the researchers found that EnemyBot had already integrated capabilities to attack flaws in more than a dozen processor architectures.

The botnet doesn’t do anything fancy and it mainly relies on DDoS (distributed denial of service) attacks. The latest version spotted has the capability to scan for new target devices and infect them.

According to AT&T’s Alien Labs, the most recent code samples contain several new exploits, including those for:

• CVE-2022-22954: Critical (CVSS: 9.8) A remote code execution flaw impacting VMware Workspace ONE Access and VMware Identity Manager. PoC (proof of concept) exploit was made available in April 2022.
• CVE-2022-22947: Another remote code execution flaw in Spring, fixed as zero-day in March 2022, and massively targeted throughout April 2022.
• And CVE-2022-1388: Critical (CVSS: 9.8) Yet another remote code execution flaw impacting F5 BIG-IP, threatening vulnerable endpoints with device takeover. The first PoCs appeared in the wild in May 2022, and active exploitation began almost immediately.

Enemybot is a genuine threat and proof positive that you don’t have to be original or engage in out of the box thinking to engineer a serious piece of malware.  Watch out for this one because the developers behind it are clearly just getting warmed up.

Do you use Microsoft Teams?  If so, you’ll be thrilled to know that the Redmond Giant is continuing to pour resources into improving the software with a specific focus on audio and video quality.

Recently, the company announced a plan to add echo cancellation, which is a feature that legions of Teams users have been clamoring for.

When the company made the announcement, they also revealed that they’re using machine learning algorithms to “teach” Teams to learn the difference between the speaker’s voice and a background sound. The goal is that echo cancellation will never mute (or even partially mute) a human speaking, even in instances where several people are speaking at once.

The machine learning algorithm is being “trained” using a model that contains more than 30,000 hours of speech. To head off questions on the topic, Microsoft stressed that no customer data was collected for the data set used to train the new models under development.

Per Microsoft:

“Instead, we either used publicly available data or crowdsourcing to collect specific scenarios. We also ensured that we had a balance of female and male speech, as well as 74 different languages.”

Since the Pandemic, Teams has grown to be one of the most widely used virtual meeting platforms and we are thrilled to see Microsoft directing so many resources to making it better, both in terms of basic functionality and overall user experience.  The planned inclusion of Echo Cancellation is proof positive that the company listens and responds to customer requests.

Kudos to Microsoft for a great job in recent months, both here and on the Windows 11 development front.  While it’s true that the company has made more than its share of missteps over the years, their recent track record has been exemplary.

Corporate branding can be worth its weight in gold and certain images are absolutely iconic.  The Golden Arches, the Nike “swoosh,” and Apple’s Apple all come to mind.

Logo images give companies the means of offering a consistent brand image over time, and that  can be a very good thing.

Over time, tastes and styles change.  If your company presents itself as being on the bleeding edge of the technological curve, then your logo should almost certainly change with the times.  If you go back and look at Apple’s logo over the years, you’ll see that while it’s fundamentally the same, the company has made a few subtle modifications and adjustments over the years.

Changing your brand’s logo can be an expensive proposition so it’s not something you want to do at the drop of a hat. However, if you feel that it’s beginning to look a bit stale or dated, then there can be some real and tangible advantages to giving it an update. That is especially if you time the update with the release of a new product that offers tangible proof that your firm is headed off in some new and exciting direction.
a
The best brands tell a story and engage their customers.  Pictures are worth a thousand words, so branding images are  a big part of telling your brand’s story.  Ultimately then, the decision of if or whether to update your logo comes down to the following.

What kind of story do you want to tell your customers?  Do you want to offer them a tale of stability and rock-steady performance?  If so, then you’ll probably only want to update your logo rarely.  On the other hand, if you want to tell a story of momentum and velocity, the updating your logo more often would be a worthwhile endeavor.

Remember the Heartbleed scare we had a couple years back?  It was a nasty side-channel attack that was somewhat exotic and difficult to pull off, and it was absolutely devastating and sent shockwaves through the entire world.

Well, it’s back. In a way.

While this new side-channel attack isn’t identical, it’s similar enough that the researchers who discovered it gave it a similar sounding name:  Hertzbleed.  It allows remote attackers to pilfer full cryptographic keys by observing variations in CPU frequency enabled by dynamic voltage and frequency scaling, or DVFS for short.

In other words, hackers can monitor the electrical output of your PC and based on that, derive your cryptographic keys.

A team from the University of Texas at Austin, in collaboration with others from the University of Washington and the University of Illinois Urbana-Champaign are credited with the discovery of the new attack vector.

The team had this to say about their discovery:

“In the worst case, these attacks can allow an attacker to extract cryptographic keys from remote servers that were previously believed to be secure. [..] Hertzbleed is a real, and practical, threat to the security of cryptographic software.

First, Hertzbleed shows that on modern x86 CPUs, power side-channel attacks can be turned into (even remote!) timing attacks–lifting the need for any power measurement interface.

Second, Hertzbleed shows that, even when implemented correctly as constant time, cryptographic code can still leak via remote timing analysis.”

To be fair, this is an incredibly exotic attack that would be extremely difficult for even the most experienced hackers in the world to pull off.  Even so, there are hackers out there in the world who have the skills to do this. That is why it’s somewhat disturbing that neither Intel nor AMD have any plans to issue a fix for the issues that make Hertzbleed possible.

Per an Intel spokesman:

“While this issue is interesting from a research perspective, we do not believe this attack to be practical outside of a lab environment.”

While that’s true, hackers have always been known for being more interested in bragging rights than practicality. In our view, it’s just a matter of time before we see Hertzbleed in the headlines.

Microsoft Exchange servers are once more in the crosshairs of hackers around the world.  Most recently, hacking groups have been specifically targeting them to deploy BlackCat ransomware.

As is common among ransomware attacks, the hackers here first rifle through an infected network, looking for login credentials, proprietary information, and other sensitive files that they can copy and exfiltrate.  They exploit a target organization in two ways. They ultimately encrypt a target’s files and demand payment to unlock them and then ransom the copied files for additional payment.

This should be regarded as a serious threat.  Although Microsoft tries gamely to keep Exchange servers secure, there are several vulnerabilities in the code. An organization that doesn’t apply security patches as soon as they are available is incredibly vulnerable to these attacks.

It’s a sufficiently significant threat that in April, the FBI issued a Flash Alert about BlackCat, warning that the recent surge in attacks have compromised more than sixty different organizations worldwide.

Their alert reads, in part as follows:

“Many of the developers and money launderers for BlackCat/ALPHV are linked to Darkside/Blackmatter, indicating they have extensive networks and experience with ransomware operations.”

The FBI has also requested the assistance of any organization that becomes compromised so they can track the attacks back to their source and take action against them.

Again, per the recent FBI Flash Alert, the specific information they’re looking for is as follows:

“IP logs showing callbacks from foreign IP addresses, Bitcoin or Monero addresses and transaction IDs, communications with the threat actors, the decryptor file, and/or a benign sample of an encrypted file.”

Here’s hoping your organization doesn’t wind up in the crosshairs of the hackers. If you happen to, give the FBI a hand so they can shut these miscreants down.

If you grew up in the days before the internet, it’s absolutely staggering to think of all the ways that mobile technology has changed our lives (and mostly for the better).

Remember when you had to pay for long distance telephone calls?  That’s mostly a thing of the past.  In under a minute, you can install any number of messenger apps, most of which offer VOIP capabilities and make calls to just about anywhere for nothing.

Today’s youngsters might not believe this, but many of us remember a time when if we didn’t want to listen to the radio, our only musical option was to head home to our beloved record player and vinyl albums.

A bit later we got the 8-track and not long after that, the cassette tape which was later supplanted by the CD. Today, you can have access to literally millions of songs on your mobile device.  It is even better that the days of needing an entire wall devoted to your record/tape/CD collection are gone.  Every song you can imagine is digital these days.  You can even find apps that will add the “vinyl scratchiness” sound to your music if you miss it!

The same thing goes for movies.  There is no need for piles of VHS tapes or Blu-Ray discs.  Streaming services are plentiful and you can watch your favorite movies or TV shows literally anywhere that you can get a signal on your mobile device. That is, of course, virtually anywhere.

It’s not just fun and games that have changed though.  Mobile technology has forever changed how the world works, and we got to put that to the test during the Covid-19 pandemic.  Tens of millions of people fled home and worked from there, as often as not on their trusty laptop computers.

When you’re traveling for business, between your smartphone and your laptop, you can stay in constant contact with everyone you work with. You can get real, meaningful work done on the road.  That wasn’t always possible in the earliest days of the internet, but mobile devices and our internet infrastructure have come such a long way now that both are easily done.

It’s impossible to say where mobile technology will take us next, but one thing you can be sure of is that there are more benefits to be had that we haven’t even dreamed of yet.  Mobile technology has made life more convenient in almost too many ways to count!

It may seem as though Internet Explorer is the browser that will not die, but according to Microsoft, it is now a step closer to breathing its last virtual breath.

Microsoft has struggled in the browser wars for the entire existence of the internet.

They came late to the party. Although they did manage to beat out early dominant browsers like Opera and Netscape Navigator, their Internet Explorer was soon eclipsed by nimbler and better browsers. The company simply didn’t devote enough resources to the quest in a timely enough fashion to gain an iron grip on the market share.

Eventually, having lost ground to Firefox, Google’s Chrome, and others, the Redmond Giant gave up on Explorer and started from scratch with Edge.

Edge is unquestionably better. However, in the Enterprise ecosystem, several web-based applications had been developed by the time Microsoft decided to retire the browser. Given that, Microsoft continued supporting the code long after they had ceased active development on it.

All things come to an end however, and nearly 27 years after its initial launch, Microsoft has announced the end of support for Internet Explorer on most Windows versions as of June 15th. So, by the time you read these words, it will be all over for the ancient browser.

Even this isn’t the absolute end. The company’s new Edge browser has an “Edge IE Mode” which emulates the old Internet Explorer for the purpose of allowing Enterprise customers who haven’t upgraded their Legacy sites and web-based applications to continue using them under the new Edge umbrella.

According to Microsoft, Edge IE Mode will continue to be offered until at least 2029. If you still have Legacy code that hasn’t been updated at that point, all bets are off. Although few people will actually miss the old browser, its demise does feel a bit like the end of an era.