The Federal Communications Commission (FCC) gets a lot of bad press. Sometimes there are good reasons for that but much of the time there are not really any good reasons. As the nation’s lead spectrum regulator their primary job is to balance all needs and factors. They are supposed to arrive at decisions that do the best for the greatest number of people.
Recently mobile carriers led by AT&T have been lobbying hard against a plan by the FCC to allow the 6GHz band to be used without a license. This means that consumers will be able to use wireless routers designed to take advantage of that band in their homes without headache or hassle.
AT&Ts position has been that their company and the other carrier companies would prefer to have exclusive access to a portion of the 6GHz band in order to minimize the interference of their existing network of cell towers. The towers rely on the 6GHz band to help smartphones maintain their connection to the internet.
Based on the FCC’s research such risks are minimal. The agency did not feel a great need to cater to big business for what amounts to a few highly improbable edge cases.
Recently the US Court of Appeals for the District of Columbia ruled in support of the FCC’s position. AT&T and the other carriers had no immediate comment on the ruling, but this must be seen as a big win for US consumers. Ultimately it will mean faster wireless connection speeds which will translate to greater convenience for end users.
Kudos to the FCC for fighting the good fight and for the Court of Appeals for not trying to second guess the FCC and their expertise. Although there may be a few isolated cases where existing cellphone operations are nominally impacted, the weight of the evidence suggests that the Court made the right call here.
Are you a Skype user? If so be aware that Microsoft (the company that owns Skype) just added a handy new feature you may want to start taking advantage of right away. The next time you update your software you’ll be able to zoom in on a screen shared by the user you’re communicating with.
To do so just hold down the Control key and press “+” or alternately hold down the Control key and use the mouse scroll. If you’re using a Mac, the combination is the Command key and “+” or the Command key and mouse scroll.
Microsoft hasn’t paid much attention to Skype in recent months. They were much more interested in extending and expanding the capabilities of their “Teams” product. This addition is an indication that Microsoft hasn’t forgotten about or abandoned Skype. If the company meant to scrap it, they certainly wouldn’t be expending resources to add new features including a recently redesigned interface.
According to the company Skype is “here to stay” because the company sees it as a good alternative for all those users who find Teams to be overkill for their needs.
It’s a wise decision because the world of messaging apps mirrors the broader world. There just aren’t any good one size fits all solutions.
Kudos to Microsoft for finally spending some time and effort on extending and enhancing Skype and for making the decision to offer a lighter weight alternative to Teams. As good as Teams is it really does wind up being too much for some users so there’s certainly space in the messaging ecosystem for both company’s offerings.
If you’re a Skype user rejoice! The company’s recent actions should provide you with all the reassurance you need that Skype isn’t going anywhere.
If you’re like most cellphone users, you absolutely love the automatic call blocking feature that most companies offer as part of their standard service. A call comes in from a “suspicious” number and the phone just blocks it.
That’s awesome and even better is you can add new numbers to it. So on those occasions when a spam call gets through it’s a simple matter to add the problematic number to the “don’t let through” list and you’ve got one less thing to worry about.
Since those calls are out of sight and out of mind however, it’s easy to lose sight of the fact that they’re still happening. In fact, according to data recently offered by telecom giant T-Mobile the company has blocked a staggering 21 billion scam, spam, and other unwanted robocalls so far this year.
Even more dismaying though is the fact that this year (2021) has seen scam call traffic jump by an almost unbelievable 116 percent compared with the data from last year. That amounts to more than 425 million scam calls attempted every week. It’s a mind-boggling crush of phone traffic thankfully blocked by the fine folks at T-Mobile and other carriers.
These calls run the gamut. According to the company’s data the calls were related to a broad range of topics including fake vehicle warranty scams, scams related to the Social Security office, package delivery, and insurance related scams to name a few.
The company had this to say about its “Scam Shield” service:
“T-Mobile Scam Shield has identified or blocked over 21 BILLION calls for T-Mobile and Metro by T-Mobile customers through early December 2021.
The lowest measured month for scam traffic was January 2021, identifying 1.1 billion calls as Scam Likely. By November, volume had increased exponentially, and T-Mobile identified double the January traffic at 2.5 billion calls as Scam Likely.”
Kudos to T-Mobile for fighting the good fight!
There’s a new malware strain you should make sure your IT staff is aware of. Called the Dark Watchman, it is a well-designed and highly capable RAT (Remote Access Trojan) paired with a keylogger written in C#.
First discovered by researchers at Prevailion this piece of malware likes to lurk in the Windows Registry and is used mainly by Russian-speaking threat actors for the purpose of (mostly) targeting Russian organizations. That’s good news for the rest of us but if you are based in or do business with Russian firms then this one should be of concern.
The malware strain was first spotted in the wilds in early November of this year (2021) when the threat actor behind the code began distributing it via phishing emails that contained a poisoned ZIP file. The ZIP of course contained an executable disguised as a text document.
If opened the victim gets a decoy popup message that reads “Unknown Format”, but the reality is that by the time the victim sees the message the malicious payload has already been installed in the background.
The malware itself is extremely lightweight measuring just 32kb in size. It is compiled in such a way that it only takes up 8.5kb of space. It does however incorporate code that allows it to “live off the land” so to speak. Here it borrows what it needs from other binaries scripts and libraries on the target computer. It uses the Windows Registry “fileless storage mechanism” for the keylogger.
In its current form the Dark Watchman can perform the following operations:
- Execute EXE files (with or without the output returned)
- Load DLL files
- Execute commands on the command line
- Execute WSH commands
- Execute miscellaneous commands via WMI
- Execute PowerShell commands
- Evaluate JavaScript
- Upload files to the C2 server from the victim machine
- Remotely stop and uninstall the RAT and Keylogger
- Remotely update the C2 server address or call-home timeout
- Update the RAT and Keylogger remotely
- Set an autostart JavaScript to run on RAT startup
- A Domain Generation Algorithm (DGA) for C2 resiliency
- If the user has admin permissions, it deletes shadow copies using vssadmin.exe
All that to say it can do quite a lot of damage if its controllers want it to. Be on the alert.
Surveys have long been a playground of hackers and scammers.
That’s true at any time of the year but it’s especially true around the Holidays when such scams seem to attract even more unwitting victims. In fact, some estimates place scammer profits revolving around fake surveys as being nearly $80 million a month. So it’s big business for them.
The particulars vary somewhat from one operation to the next.
Here’s how they work in general:
First the scammer targets a perfectly legitimate survey or giveaway offered by a big well-known company or brand.
They’ll copy the layout and format of this legitimate survey creating their own version of it. By all outward appearances from the perspective of a visitor to the survey site, they’re taking advantage of a legitimate offer.
Naturally there are some telltale signs. Most of these fake sites aren’t checked closely for quality control so you’re likely to catch spelling errors or grammatically incorrect phrases that could serve to give away the game. Of course there’s no hiding the URL but most of the people who land on a survey or giveaway page aren’t paying much attention to that.
Once on the page the victim is in the funnel. The survey proceeds as you’d expect with a request for personal information at the end. Sometimes they ask for a credit card (which the victim is assured won’t be billed – it’s merely being used for ‘verification purposes.’)
And you know how the story ends.
Armed with this freshly gleaned information the scammers make off with it either running up big bills on the victim’s card or selling the data to the highest bidder.
This is a global issue. It impacts people from all walks of life and from almost every country on the planet. Don’t fall for it. Do your due diligence or just say no to anything that looks like it’s too good to be true.
There’s a new strain of ransomware to be concerned about in the form of AvosLocker.
This is from security firm Sophos who warns that the new strain of human-operated ransomware is one to watch.
AvosLocker burst onto the scene over the summer of this year (2021). Having enjoyed some success with their product the gang behind the code is now on the hunt for partners in a bid to fill the gap left by REvil’s departure.
One of the key features of the malware’s design is the fact that it leverages the AnyDesk remote IT admin tool while running it in Windows Safe mode. We’ve seen malware that leverages Windows Safe Mode. Safe Mode loads with a minimal set of drivers and it is less well-protected but it isn’t exactly a common tactic.
AnyDesk is of course a perfectly legitimate tool used by thousands of professionals all over the world every day. Here however it is being put to nefarious use and by combining it with running in Safe Mode and it allows the hackers to deal serious damage to their targets.
Peter Mackenzie is the Director of Incident Response at Sophos. Mackenzie says the group behind this new strain relies on simple but very clever tactics and methodologies to get the job done. So far, they’ve been amazingly successful.
The company had this to say about the new strain:
“Ransomware, especially when it has been hand-delivered (as has been the case in these Avos Locker instances), is a tricky problem to solve because one needs to deal not only with the ransomware itself, but with any mechanisms the threat actors have set up as a back door into the targeted network. No alert should be treated as “low priority” in these circumstances, no matter how benign it might seem.”
Wise words indeed. Stay alert out there.
Do you own and operate a WordPress website? Do you also use the "All in One" SEO plugin?
If you answered yes to both of those questions, then be aware that you'll want to update that plugin as soon as possible.
Recently security researcher Marc Montpas from Automattic Security discovered and reported a pair of critical security flaws.
These flaws put any website using the non-upgraded version of that plugin at risk. The security flaws are being tracked as CVE-2021-25036 and CVE-2021-25037 respectively. The first is an Authenticated Privilege Escalation bug and the second an Authenticated SQL Injection bug.
The bad news is that there are currently more than 800,000 websites running the outdated and vulnerable version of the plugin. The good news is that the development team behind the All-in-One plugin responded very quickly and delivered an update to their product on December 7th of this year (2021) which addresses both issues.
The reason these flaws are so dangerous lies in the fact that all an attacker needs to be able to successfully execute an attack that leverages them is an authenticated account. That is generally a relatively easy thing to get. It doesn't have to have a lot of rights or privileges so a low-level permission group like "Subscriber" is sufficient.
Using that as a starting point it would be easy for an attacker to escalate his or her own privileges and cause all sorts of damage to the site itself or exfiltrate data from it. Not good.
In any case there's a simple solution ready and waiting. Just check to see what version of the All-in-One plugin you're using. If you don't already have it download and install the 4.1.5.3 patch. Stay safe out there. There may yet be a few additional surprises in store for us in what remains of the year.
Haven’t heard of Log4j before right now? If not, you’re certainly not alone but unfortunately it’s something you’re likely to hear more about in the weeks ahead. It may wind up being the cause of a few headaches for you.
“Log4j” is a Java library. Its function is to log error messages in applications. Consider it akin to an overworked clerk in the back office somewhere.
As is often the case with overworked clerks in back offices, it turns out that they’re important. If one of them starts having issues it can have gigantic ripple effects. That’s basically what’s happening here. This library is open source and is one of the bedrock components of the Java-logging framework.
Recently researchers found a remote code execution flaw in Log4j that is already being exploited in the wild.
The issue is being tracked as CVE-2021-44228 and has a severity score of 10/10 so this issue is as serious as they get. In fact, it’s such a major problem that the UK’s National Cyber Security Centre has already issued a bulletin about it.
This is a pervasive issue that impacts pretty much every device that’s exposed to or connected to the internet and that’s running Apache Log4j versions 2.0 to 2.141. Even worse is that there’s at least one group of hackers already abusing the flaw. The Mirai botnet targets mostly IoT devices and has been modified with a module that specifically exploits this flaw.
Fortunately, both Cisco and VMware have released patches that address the issue for their products that were affected by the issue. As a whole the industry is moving very slowly when it comes to responding to this threat.
That’s dangerous because the global economy absolutely depends on the internet these days. Anything that has a large-scale impact on the web will have enormous ripple effects that will be felt for months if not years.
Do you own a Lenovo Yoga or ThinkPad laptop? If so be advised that a pair of critical security flaws have recently been found that could allow an attacker Admin level access to your machine.
The flaws are centered in the IMControllerService and are being tracked as CVE-2021-3922 and CVE-2021-3969. They impact all Lenovo System Interface Foundations versions below 1.1.20.3.
According to the Windows description of the service:
“The Lenovo System Interface Foundation Service provides interfaces for key features such as: system power management, system optimization, driver and application updates, and system settings to Lenovo applications including Lenovo Companion, Lenovo Settings and Lenovo ID.”
Unfortunately, that means that simply disabling the service is not an option. Since it is so tightly woven into the fabric of these machines disabling it will essentially render your laptop nonfunctional. At the very least it may stop several key features of your machine from working properly.
Researchers from NCC Group who discovered the vulnerabilities explain them this way:
“The first vulnerability is a race condition between an attacker and the parent process connecting to the child process’ named pipe.
An attacker using high-performance filesystem synchronization routines can reliably win the race with the parent process to connect to the named pipe.”
They went on to explain that the second flaw was centered around a “time of check to time of use” vulnerability. That allows an attacker to interrupt the loading process of a validated ImControllerService plugin and replace it with a DLL of the attacker’s choosing.
The good news is that Lenovo moved quickly and as of December 14th, 2021 the issue has been resolved. If you have one of the laptops mentioned above or some other model that makes use of the ImControllerService be sure to download the latest updates from Lenovo in to plug the hole in your machine’s security. Kudos to Lenovo for their swift response!
