• Search for:
    28Jul, 2022
    Microservices Challenges — Distributed Troubleshooting and Monitoring

    Microservices architecture brings us so many great benefits, as we discussed here. However, nothing comes free and so the benefits of micro services There are various challenges which are by-product of micro services, and it makes all sense to understand these well before beginning journey in new fancy world.

    One of these challenges is the complexity of troubleshooting that comes with micro service patterns. We shall discuss this with possible solution in this article.

    Challenge

    Troubleshooting is part of development life. Life is comparatively easy when debugging is for one monolithic system. But the micro services world has many smaller services, which interact with each other in a mix of combinations to support bigger application features.

    With such a dynamic interaction matrix, troubleshooting for any issue could span a multitude of services. Finding a trail of any request across multiple services and servers, which could again be dynamic based on the business logic of each service, could be fatal.

    This makes troubleshooting extremely complex, which needs deep system knowledge and persistence to walk through many many nodes.

    Once one has deep knowledge of the system, and its distributed architecture, debugging is possible. But it will still consume a lot of time and energy. Assume a scenario where this complexity could be multiplied with auto-scalable container-based deployment models, which means server nodes are changing dynamically based on need.

    It is not manageable without proper tooling in place. Even, then it is complex to understand the thousands of service request trails.

    Solution

    Distributed Tracing, Log Aggregation, and Visualization are the savior.

    Distributed tracing

    This enables to trace the related logs across services and nodes.

    It is implemented by adding an identifier to logs which can help trace (by correlating) the request across the services and server nodes.

    It is like adding one constant with the request at the beginning of the first service hit. This constant will then be passed to all subsequent service calls from there. Every service, if distributed tracing is enabled for these, automatically picks this constant trace id and uses it while logging respective data.

    In turn, it enables to correlate the data of the same request across the services and servers easily.

    Log Aggregator

    Now, we have an identifier that can help to identify any given request across the services.

    The next challenge is, that it is not practically possible to login into different servers and analyze the logs. Hence, we need a provision where all the logs from different services can be collated and presented in one place for easy and efficient reading.

    Log Aggregation tools help in this. Every service, while using trace id for logs, prepares the logging data, and sends this data to one centralized log aggregator service (mostly using one of the available tools/libraries).

    Log aggregator stores the logs in some optimized data structure, and search-friendly scalable database. Once all log data is available in one data store, it becomes possible to use this for different kinds of functions.

    Log Visualizer

    Log aggregators have all log data in one place. These tools/databases are meant to store the bulk log entries and to enable faster search on this.

    Now, this data can be used to present the whole request trail in some easily understandable format at UI or through API too.

    Once we have this aggregated data, it opens many opportunities, for example:

    • See request trails across the services for troubleshooting
    • Analyze the performance data i.e. time taken by each service/operation
    • Client usage patterns or user behavior, i.e. which service is used more and at what time.
    • Potential of connecting this data with context information to do even more deep analysis, for example, which service was used more on new year and so on. This can feed important information to system design decisions.

    Performance Impact

    It is an obvious question that logging data for each service call, and operation and then sending it to a centralized collector can add performance overhead. This is true to some extent, however, there are ways to optimize it.

    Adding distributed trace tokens and logging is usually managed by instrumentation-driven libraries, which add pre/post hooks for each method to log the basic information. The amount of information is configurable.

    As this logging is managed by libraries and mostly abstracted, these libraries are highly optimized to do this job.

    Sending logging data to a centralized collector (aggregators) can be optimized by making it asynchronous. For example, a logging client on each node can have a local in-memory (and physical too) storage which can collate all the logs. All these logs can later be sent to a centralized server asynchronously using HTTP requests or queues etc. This reduces the reporting overhead a lot, especially from service processing flow.

    Cost can not be zero for benefits, however, it can be contained in most cases. Most tracing libraries are highly configurable for log level and reporting mechanisms, these provide various options to optimize the process based on application-specific use cases.

    Tech to Support

    There are many libraries and tool options to enable these.

    Zipkin & Jaeger are the two most popular Distributed Tracing systems available as of now. Zipkin was developed by Twitter, and Jaeger by Uber.

    • Both were open sourced, once these reach to production readiness stage, by respective companies with their respective open source communities.
    • Both support the basic components of Distributed tracing / Log aggregator or collector / Visualizer, as described above. Additionally, these support many more useful features on top, which are specific to each tool.
    • Both are quite similar in architecture and usage. However, differs mostly in deployment style and plugins available for different languages and frameworks.

    Refer to respective websites for detailed information. These are well documented tools.

    Refer to open-tracing also, which is on a mission to standardize the tracing APIs and tools. This is also an incubating project in Cloud Native Computing Foundation.

    Conclusion

    The combination of these tools and design patterns makes distributed troubleshooting and monitoring possible in the microservice ecosystem.

    Keep in mind, that it is still more complex than monolith designs. It still needs deep system knowledge across the services and the ability to connect all the dots across. It needs experience in system design and system both. However, a combination of these tools makes it feasible.

    Hence, if you are not ready for an iota of extra complexity, it is recommended to stay away from microservices kind of distributed architecture patterns. The number of services could be overwhelming in such designs due to fine-grained structure.

    Or start with the right tooling in place to manage it well from the beginning. Don’t ever think to run the highly distributed microservice kind of system without these supporting tools. Otherwise you will be spending months of effort on troubleshooting, with a high potential to burn the teams physically and morally, and may lose productivity too.

    We shall discuss more challenges like distributed transactions, and managing failures in distributed environments in future articles.

    Resource : https://matrixexplorer.medium.com/microservices-challenges-distributed- troubleshooting-and-monitoring-b5129f56701f

    28Jul, 2022
    Info security – 7 Top Trends in Cybersecurity for 2022

    The ever-expanding digital footprint of modern organizations drives this year’s top cybersecurity trends.

    In short:

    • Rethink the security technology stack to address sophisticated new threats.
    • Push cybersecurity decision making out to the business units to improve your security posture.
    • Evolve and reframe the security practice to better manage cyber risk.

    Security and risk executives face a critical juncture, as the digital footprint of organizations expands and centralized cybersecurity control becomes obsolete.

    Hybrid work and digital business processes in the cloud have introduced new risks. At the same time, sophisticated ransomware, attacks on the digital supply chain and deeply embedded vulnerabilities have exposed technology gaps and skills shortages.

    “These disruptions don’t exist in isolation; they have a compound effect,” says Peter Firstbrook, VP Analyst at Gartner. “To address the risks, CISOs need to transition their roles from technologists who prevent breaches to corporate strategists who manage cyber risk.”

    Those who understand these seven trends will be better able to address new risks and elevate their role, but it requires reframing the security practice and rethinking technology, as well as preparing to respond to new threats.

    Trend No. 1: Attack surface expansion 

    Currently, 60% of knowledge workers are remote, and at least 18% will not return to the office. These changes in the way we work, together with greater use of public cloud, highly connected supply chains and use of cyber-physical systems have exposed new and challenging attack “surfaces.”

    This leaves organizations more vulnerable to attack. Gartner recommends security leaders look beyond traditional approaches to security monitoring, detection and response to manage a wider set of risks.

    Trend No. 2: Identity system defense 

    Identity systems are coming under sustained attack. Misuse of credentials is now a primary method that attackers use to access systems and achieve their goals. For example, in the SolarWinds breach attackers used a supplier’s privileged access to infiltrate the target network.

    Gartner uses the term identity threat detection and response (ITDR) to describe a collection of tools and processes to defend identity systems. In the longer term, more consolidated solutions will emerge.

    Trend No. 3: Digital supply chain risk 

    Gartner predicts that by 2025, 45% of organizations worldwide will have experienced attacks on their software supply chains, a three-fold increase from 2021.

    Security and risk management leaders need to partner with other departments to prioritize digital supply chain risk and put pressure on suppliers to demonstrate security best practices.

    Trend No. 4: Vendor consolidation 

    Security products are converging. Vendors are consolidating security functions into single platforms and introducing pricing and licensing options to make packaged solutions more attractive.

    While it may introduce new challenges such as reduced negotiating power and potential single points of failure, Gartner sees consolidation as a welcome trend that should reduce complexity, cut costs and improve efficiency, leading to better overall security.

    Trend No. 5: Cybersecurity mesh 

    The cybersecurity mesh is a modern conceptual approach to security architecture that enables the distributed enterprise to deploy and integrate security to assets, whether they’re on premises, in data centers or in the cloud.

    Gartner predicts that by 2024, organizations adopting a cybersecurity mesh architecture will reduce the financial impact of individual security incidents by an average of 90%.

    Trend No. 6: Distributed decisions 

    Executive leaders need a fast and agile cybersecurity function to support digital business priorities. However, as more aspects of the business are digitalized, the job is becoming too big for a centralized CISO role. Leading organizations are building the office of the CISO to enable distributed cyber judgment.

    The CISO and the centralized function will continue to set policy, while cybersecurity leaders are placed in different parts of the organization to decentralize security decisions. 

    Trend No. 7: Beyond awareness

    Human error continues to feature in most data breaches, showing that traditional approaches to security awareness training are ineffective. Progressive organizations are moving beyond outdated compliance-based awareness campaigns and investing in holistic behavior and culture change programs designed to provoke more secure ways of working.

    Resource : https://www.gartner.com/en/articles/7-top-trends-in-cybersecurity-for-2022?utm_source=Bambu&utm_medium=Social_Organic&utm_campaign=Stratascale%20 Strategic%20Update_SocialPost_June2022&blaid=3185810

    28Jul, 2022
    Security – Account lockout policy in Windows 11 is enabled by default to block brute force attacks

    Starting with Windows 11 Microsoft introduce by default an account lockout policy that can block brute force attacks.

    Starting with Windows 11 Insider Preview build 22528.1000 the OS supports an account lockout policy enabled by default to block brute force attacks. The lockout policy was set to limit the number of failed sign-in attempts to 10, for 10 minutes.

    “Win11 builds now have a DEFAULT account lockout policy to mitigate RDP and other brute force password vectors. This technique is very commonly used in Human Operated Ransomware and other attacks – this control will make brute forcing much harder which is awesome.” announced David Weston, Microsoft vice president for enterprise and OS security.

    The Account lockout threshold policy allows setting the number of failed sign-in attempts that will cause a user account to be locked. Once the account has been locked, it cannot be used until the admin reset it or until the number of minutes specified by the Account lockout duration  policy setting expires.

    account lockout policy

    The lockout policy is supported by Windows 10 and some Windows Server builds.

    A collateral effect is that threat actors can abuse this feature to launch denial-of-service (DoS) attacks, causing problems for the target organizations.

    Resource : https://securityaffairs.co/wordpress/133568/security/windows-account-lockout- policy.html

    28Jul, 2022
    Security – GitHub introduces 2FA and quality of life improvements for npm

    GitHub has announced the general availability of three significant improvements to npm (Node Package Manager), aiming to make using the software more secure and manageable.

    In summary, the new features include a more streamlined login and publishing experience, the ability to link Twitter and GitHub accounts to npm, and a new package signature verification system.

    At the same time, GitHub announced that the two-factor authentication program introduced in May 2022 is ready to exit beta and become available to all npm users.

    The npm platform is a subsidiary of GitHub and is a package manager and repository (registry) for JavaScript coders, used by developers’ projects to download five billion packages daily.

    It recently suffered large-scale security incidents that impacted hundreds of apps and websites, forcing GitHub to develop and urgently implement a security-boosting plan.

    New features in npm

    The new npm login and publishing system allows for authentication to be handled by the web browser, so valid authentication tokens can be retained on the same session for up to five minutes.

    This change is to reduce friction created by the introduction of the 2FA system, which forced developers to enter new one-time passwords on every action.

    The new option to connect GitHub and Twitter accounts to npm aims to help add credibility and serve as a form of identity verification so that npm accounts cannot impersonate creators of popular software.

    Moreover, this new system should help with account recovery when needed, making the process more reliable and less cumbersome and laying the ground for more automation in the future.

    Finally, there’s a new signature auditing system that replaces the previous multi-step, complex PGP process, allowing developers a much easier method to verify the signature of npm packages.

    Users will now be able to validate the source of the packages locally using the new “npm audit signatures” command in the npm CLI.

    Simultaneously, the platform re-signs all packages with the ECDSA (elliptic curve cryptography) algorithm and uses HSM for key management, further bolstering security.

    2FA on important accounts

    The next step in securing the npm registry is to enforce two-factor authentication on all accounts that manage packages with more than a million weekly downloads or 500 dependents.

    GitHub says this will be enforced only after the account recovery process is further improved with additional identity verification forms, so no strict timelines were provided besides that it’s coming next.

    Resource : https://www.bleepingcomputer.com/news/security/github-introduces-2fa-and- quality-of-life-improvements-for-npm/

    25Jul, 2022
    Tech News – Why Is It Called Roku?

    Roku is a name that has become so common to see that you probably don’t think much about where it came from. Roku devices can be found in millions of households, but what does “Roku” actually mean? Is it anything?

    The Origins of Roku

    Roku Inc. was founded all the way back in 2002 by Anthony Wood. Prior to Roku, Wood had founded Replay TV, a DVR company that attempted to compete with TiVo. After selling Replay TV, Wood started working at Netflix.

    In 2007, Wood became a VP at Netflix and worked on the “Netflix Player.” The idea was to create a device to allow people to stream Netflix on their TVs. However, CEO Reed Hastings decided to drop the project. The “Netflix Player” was then taken over by Roku.

    The first Roku was released in 2008. It was still developed in collaboration with Netflix. The original Roku device had support for Channels (apps) just like modern versions. You still had to use Netflix on a computer to add things to your “Instant Queue” to watch on the Roku.

    Since then, Roku has released new models nearly every year. The original  set-top box form factor has continued to be the company’s “flagship” product. It’s now joined by Roku Streaming Sticks, a soundbar, and TVs with Roku software built-in.

    As of January 2022, Roku has over 60 million active users. Roku is largely credited with popularizing the idea of a streaming device connected to your TV. It’s a very popular device category nowadays.

    What Does “Roku” Mean?

    So how about that name? “Roku” may sound like a typical Silicon Valley-sequel made up company name, but it actually has some real meaning.

    Roku (六) means “six” in the Japanese language. Wood chose the name as it was the sixth company he started. There’s not a lot of information about the previous five companies he founded.

    Wood also started the aforementioned ReplayTV, a mobile app developing company named iband, and a software development company named AW Software. Wood’s pre-Roku ventures were not as successful as the streaming media giant that Roku has become.

    That’s all there is to it. Roku was founder Anthony Wood’s sixth company, and Roku means “six” in Japanese. Now there are many devices bearing this name to choose from.

    22Jul, 2022
    Technology – How to Compress and Extract Files Using the tar Command on Linux

    The tar command on Linux is often used to create .tar.gz or .tgz archive files, also called  “tar balls.” This command has a large number of options, but you just need to remember a few letters to quickly create archives with tar. The tar command can extract the resulting archives, too.

    The GNU tar command, included with Linux distributions, has integrated compression. It can create a .tar archive and then compress it with gzip or bzip2 compression in a single command. That’s why the resulting file is a .tar.gz file or .tar.bz2 file.

    Compress an Entire Directory or a Single File

    Use the following command to compress an entire directory or a single file on Linux. It’ll also compress every other directory inside a directory you specify–in other words, it works recursively.

    tar -czvf name-of-archive.tar.gz /path/to/directory-or-file

    Here’s what those switches actually mean:

    • -c: Create an archive.
    • -z: Compress the archive with gzip.
    • -v: Display progress in the terminal while creating the archive, also known as “verbose” mode. The v is always optional in these commands, but it’s helpful.
    • -f: Allows you to specify the filename of the archive.

    Let’s say you have a directory named “stuff” in the current directory and you want to save it to a file named archive.tar.gz. You’d run the following command:

    tar -czvf archive.tar.gz stuff

    Or, let’s say there’s a directory at /usr/local/something on the current system and you want to compress it to a file named archive.tar.gz. You’d run the following command:

    tar -czvf archive.tar.gz /usr/local/something
    Run "tar -czvf" on the desired folder to bundle and compress all of the contents.

    Compress Multiple Directories or Files at Once

    While tar is frequently used to compress a single directory, you could also use it to compress multiple directories, multiple individual files, or both. Just provide a list of files or directories instead of a single one. For example, let’s say you want to compress the /home/ubuntu/Downloads directory, the /usr/local/stuff directory, and the /home/ubuntu/Documents/notes.txt file. You’d just run the following command:

    tar -czvf archive.tar.gz /home/ubuntu/Downloads /usr/local/stuff /home/ubuntu/Documents/notes.txt

    Just list as many directories or files as you want to back up.

    Ubuntu Terminal compressing multiple directories at once with the "tar" command.

    Exclude Directories and Files

    In some cases, you may wish to compress an entire directory, but not include certain files and directories. You can do so by appending an --exclude switch for each directory or file you want to exclude.

    For example, let’s say you want to compress /home/ubuntu, but you don’t want to compress the /home/ubuntu/Downloads and /home/ubuntu/.cache directories. Here’s how you’d do it:

    tar -czvf archive.tar.gz /home/ubuntu --exclude=/home/ubuntu/Downloads --exclude=/home/ubuntu/.cache

    The --exclude switch is very powerful. It doesn’t take names of directories and files–it actually accepts patterns. There’s a lot more you can do with it. For example, you could archive an entire directory and exclude all .mp4 files with the following command:

    tar -czvf archive.tar.gz /home/ubuntu --exclude=*.mp4
    The "tar" command can be tuned to selectively ignore some files.

    Use bzip2 Compression Instead

    While gzip compression is most frequently used to create .tar.gz or .tgz files, tar also supports bzip2 compression. This allows you to create bzip2-compressed files, often named .tar.bz2, .tar.bz, or .tbz files. To do so, just replace the -z for gzip in the commands here with a -j for bzip2.

    Gzip is faster, but it generally compresses a bit less, so you get a somewhat larger file. Bzip2 is slower, but it compresses a bit more, so you get a somewhat smaller file. Gzip is also more common, with some stripped-down Linux systems including gzip support by default, but not bzip2 support. In general, though, gzip and bzip2 are practically the same thing, and both will work similarly.

    For example, instead of the first example we provided for compressing the stuff directory, you’d run the following command:

    tar -cjvf archive.tar.bz2 stuff
    Terminal running bzip2 compression instead of gzip.

    Extract an Archive

    Once you have an archive, you can extract it with the tar command. The following command will extract the contents of archive.tar.gz to the current directory.

    tar -xzvf archive.tar.gz

    It’s the same as the archive creation command we used above, except the -x switch replaces the -c switch. This specifies you want to extract an archive instead of create one.

    You may want to extract the contents of the archive to a specific directory. You can do so by appending the -C switch to the end of the command. For example, the following command will extract the contents of the archive.tar.gz file to the /tmp directory.

    tar -xzvf archive.tar.gz -C /tmp

    If the file is a bzip2-compressed file, replace the “z” in the above commands with a “j”.

    Run "tar" with"-xzvf" instead of the "-czvf" argument to extract files from a tarball archive.

    This is the simplest possible usage of the tar command. The command includes a large number of additional options, so we can’t possibly list them all here. For more information. run the info tar command at the shell to view the tar command’s detailed information page. Press the q key to quit the information page when you’re done. You can also read tar’s manual online.

    If you’re using a graphical Linux desktop, you could also use the file-compression utility or file manager included with your desktop to create or extract .tar files. On Windows, you can extract and create .tar archives with the free 7-Zip utility.

    Linux Commands
    Filestar · pv · cat · tac · chmod · grep ·  diff · sed · ar · man · pushd · popd · fsck · testdisk
    · seq · fd · pandoc · cd · $PATH · awk · join · jq · fold · uniq · journalctl · tail · stat 
    · ls · fstab · echo · less · chgrp · chown · rev · look · strings · type · rename · zip 
    · unzip · mount · umount · install · fdisk · mkfs · rm · rmdir · rsync · df · gpg · vi 
    · nano · mkdir · du · ln · patch · convert 
    · rclone · shred · srm
    Processesalias · screen · top · nice · renice · progress · strace · systemd · tmux · chsh · history · at 
    · batch · free · which · dmesg · chfn · usermod · ps · chroot · xargs · tty · pinky · lsof 
    · vmstat · timeout · wall · yes · kill · sleep · sudo · su · time · groupadd · usermod 
    · groups · lshw · shutdown · reboot · halt · poweroff · passwd · lscpu · crontab 
    · date · bg · fg
    Networkingnetstat · ping · traceroute · ip · ss · whois · fail2ban · bmon · dig · finger · nmap 
    · ftp · curl · wget · who · whoami · w · iptables · ssh-keygen · ufw

    Resource : https://www.howtogeek.com/248780/how-to-compress-and-extract-files-using -the-tar-command-on-linux/

    21Jul, 2022
    Internet Of Things – Million of vehicles can be attacked via MiCODUS MV720 GPS Trackers

    Multiple flaws in MiCODUS MV720 Global Positioning System (GPS) trackers shipped with over 1.5 million vehicles can allow hackers to remotely hack them.

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published an advisory to warn of multiple security vulnerabilities in MiCODUS MV720 Global Positioning System (GPS) trackers, which are used by over 1.5 million vehicles.

    An attacker can exploit the flaws to remote disruption of critical functions of the impacted vehicles.

    “CISA has released an Industrial Controls Systems Advisory (ICSA) detailing six vulnerabilities that were discovered in MiCODUS MV720 Global Positioning System Tracker. Successful exploitation of these vulnerabilities may allow a remote actor to exploit access and gain control the global positioning system tracker.” reads the advisory published by CISA. “These vulnerabilities could impact access to a vehicle fuel supply, vehicle control, or allow locational surveillance of vehicles in which the device is installed.”

    The MiCODUS MV720 GPS Tracker is a popular vehicle GPS tracker manufactured in China, which is used by consumers for theft protection and location management, and by organizations for vehicle fleet management.

    The flaws were discovered by BitSight researchers, they have been tracked as CVE-2022- 2107; CVE-2022-2141; CVE-2022-2199; CVE-2022-34150; and CVE-2022-33944.

    Researchers from BitSight who discovered the issues reported that threat actors could hack into the tracker to potentially cut off fuel, physically stop vehicles, or track the movement of vehicles using the device.

    MiCODUS is used today by 420,000 customers in multiple industries, including government, military, law enforcement agencies, and Fortune 1000 companies.

    The list of the vulnerabilities discovered by the researchers in September 2021 is reported below:

    • CVE-2022-2107 (CVSS score: 9.8) – The use of hard-coded credentials may allow an attacker to log into the web server, impersonate the user, and send SMS commands to the GPS tracker as if they were coming from the GPS owner’s mobile number.
    • CVE-2022-2141 (CVSS score: 9.8) – Improper authentication allows a user to send some SMS commands to the GPS tracker without a password.
    • CVE-2022-2199 (CVSS score: 7.5) – A cross-site scripting vulnerability could allow an attacker to gain control by deceiving a user into making a request.
    • CVE-2022-34150 (CVSS score: 7.1) – The main web server has an authenticated Insecure Direct Object References (IDOR) vulnerability on parameter “Device ID,” which accepts arbitrary Device IDs without further verification.
    • CVE-2022-33944 (CVSS score: 6.5) – The main web server has an authenticated IDOR vulnerability on POST parameter “Device ID,” which accepts arbitrary Device IDs.
    • Experts found a sixth issued that has yet to receive a CVE (CVSS score: 8.1) – all devices ship preconfigured with the default password 123456, as does the mobile interface. There is no mandatory rule to change the password, nor is there any claiming process. The setup itself does not require a password change to use the device. We observed that many users have never changed their passwords.

    The analysis of the sector’s usage on a global scale revealed significant differences by continent in the typical user profile. Most North American organizations using flawed MiCODUS devices are in the manufacturing sector, while those in South America are government entities. MiCODUS users in Europe belong to diverse sectors, ranging from finance to energy.

    BitSight recommends users immediately cease using or disable any MiCODUS MV720 GPS trackers due to the severity of the flaw, at least until the vendor addresses the issue.

    “If China can remotely control vehicles in the United States, we have a problem,” said  Richard Clarke, internationally renowned national security expert and former presidential advisor on cybersecurity. “With the fast growth in adoption of mobile devices and the desire for our society to be more connected, it is easy to overlook the fact that GPS tracking devices such as these can greatly increase cyber risk if they are not built with security in mind. BitSight’s research findings highlight how having secure IoT infrastructure is even more critical when these vulnerabilities can easily be exploited to impact our personal safety and national security, and lead to extreme outcomes such as large-scale fleet management interruption and even loss of life.”

    Researchers highlighted the risks that a nation-state actor could potentially exploit the above vulnerabilities to gather intelligence on entities operating in the military or one of its supplies. Data such as supply routes, troop movements, and recurring patrols could be revealed by exploiting these flaws-

    “Although GPS trackers have existed for many years, streamlined manufacturing of these devices has made them accessible to anyone. Having a centralized dashboard to monitor GPS trackers with the ability to enable or disable a vehicle, monitor speed, routes and leverage other features is useful to many individuals and organizations. However, such functionality can introduce serious security risks. Unfortunately, the MiCODUS MV720 lacks basic security protections needed to protect users from serious security issues. With limited testing, BitSight uncovered a multitude of flaws affecting all components of the GPS tracker ecosystem.” concludes the report. “BitSight recommends that individuals and organizations currently using MiCODUS MV720 GPS tracking devices disable these devices until a fix is made available. Organizations using any MiCODUS GPS tracker, regardless of the model, should be alerted to insecurity regarding its system architecture, which may place any device at risk.”

    Resource: https://securityaffairs.co/wordpress/133445/hacking/micodus-tracker-flaws.html

    20Jul, 2022
    Tech News – Why is wireless technology important?

    Wireless technology has steadily become a bigger presence in most people’s everyday lives. Whether it’s at work, home, a stadium or even in cars, people rely on wireless technology for information, entertainment to communicate and more. It’s almost hard to imagine how so much got accomplished prior to wireless technology becoming a critical entity in so many different industries and places.

    Wireless is practically a given in everything we do now, but that does not make it any less important than it was during its early beginnings. In fact, wireless technology might be more important today than ever before. It does so much, from providing speed, flexibility and network efficiency to transferring information and enhancing productivity. As time goes on, dependency on wireless will only get stronger.

    Keep reading to get a better idea of why wireless technology is so important.

    What is wireless technology?

    Wireless technology is tech that allows people to communicate or data to be transferred from one point to another without using cables or wires. A lot of the communication is done with radio frequency and infrared waves.

    The importance of wireless tech

    As more people embrace a more flexible lifestyle, including working from home, wireless technology becomes that much more critical. Tech-savvy employees can share information instantly, allowing productivity levels to stay up, regardless of if workers are in the same office or not. All they need in an internet connection.

    Enhancing employees’ ability to work remotely is just one item on a very long list of the benefits of wireless, however. There’s also the cost factor—wireless networks are typically less expensive to install and maintain compared to other network options, according to AMS Technologies. Data moves faster over wireless networks, which can be accessed from any location at any time.

    There’s also the matter of safety. Medical professionals who work in remote areas can contact other medical centers through wireless without any issues. Plus, emergency situations can be addressed faster with wireless communication.

    Benefits of wireless technology

    No technological advancement is without its flaws, but wireless technology offers a number of plusses that outweigh the minuses. For starters, it makes users a lot more mobile. People can access whatever information or data they need in real time, courtesy of a wireless network. Wireless also makes for easier installation and a cleaner set up. There is very little, if any, cabling preventing safety hazards.

    Meanwhile, in-building wireless networks offer employees, tenants, and visitors connectivity throughout the entire property—as long as the network is reliable. Plus, many wireless networks today are “future proof”, meaning they can be easily updated to accommodate new technology as it becomes available.
    Deploying or upgrading an in-building wireless network might feel expensive initially, but it is worth having in the long run because the cost to maintain it over time will decrease. Meanwhile, networks can be tailored to a building owner or company’s specific needs.

    Why wireless technology is important to businesses

    It’s becoming harder for businesses to remain competitive if they don’t embrace technology, that includes a reliable, wireless network. In an office environment, wireless lets employees move around the building without losing connection to the company network. Meanwhile, everyone can access the same important data and applications across the network from any device.

    Wireless tech also allows businesses to remain nimble, according to internet provider Arvig. When a new employee starts, they can be added to the company network at no cost, and user requirements can be updated without much trouble. Without the hindrance of wires, employees can move from desk to desk with a laptop rather than unplug and set up a desktop computer all over again.

    As a business grows whether in personnel numbers, scale, or both, it will benefit from having a flexible wireless network where network services, applications, and bandwidth can be added easily.

    How wireless helps manufacturing

    There’s been somewhat of a domino effect within the manufacturing industry recently. People shop online more than ever before, which has led to an increased demand for industrial and warehouse commercial real estate space. As manufacturers gained access to these industrial spaces, it became critical that properties were equipped with a reliable, in-building wireless network.

    It would be very difficult to operate a warehouse without wireless connectivity today. Partly because consumer demand is so high, warehouses need to automate a lot of production to help get items out of the facility and on the way to customers as quickly as possible.

    “The global enterprise business in first-, second- and third-party logistics has a unique opportunity to deploy private wireless networks for seamless indoor and outdoor low-latency connectivity by leveraging all available spectrum assets,” Nokia Enterprise Campaign Strategist for Logistics David McKinley wrote last year. “This will help with automated storage and retrieval systems, industrial IoT sensors, robotic process automation, drone industrial inspection, and autonomous equipment or vehicles.”

    The warehouse tech McKinley mentioned is only as good as the wireless network it’s running on. Robots, automated warehouse transportation vehicles and devices that send reporting data all help make processes smoother in industrial spaces, but they can’t do their job without wireless. Additionally, wireless networks don’t just speed up production, they help keep workers safe. Warehouses often have a lot of internet-connected machines and sensors that can detect when equipment is broken or about to break and send a warning before someone uses it and gets hurt.

    “5G networks offer manufacturers and telecom operators the chance to build smart factories and truly take advantage of technologies such as automation, artificial intelligence, augmented reality for troubleshooting, and IoT,” Ericsson said in a report. “With 5G, operators can create new revenue streams. Alongside energy and utility, manufacturing represents one of the most significant sectors for new revenue potential for operators addressing industry digitalization with 5G technologies.”

    Why wireless is important to healthcare

    Wireless technology will always be critical to the healthcare industry, but its importance was front and center during the height of the COVID-19 pandemic. Patients still needed to see their physicians, but office visits became difficult to accommodate during the shutdown. Thanks to wireless technology, doctors could perform tele health visits, which many patients welcomed. The amount of tele health visits increased by 50% during the first quarter of 2020, compared to the same timeframe in 2019, according to the Centers for Disease Control and Prevention (CDC).

    Tele health visits are just the beginning of what wireless tech means to the healthcare industry, however. With wireless, physicians can leverage technology like smart sensors that can detect certain medical conditions and send that information to a receiving device and on to a central data base. Meanwhile, wearable technology remains one of the most significant advancements we have today. Sleep, heart rate, exercise steps taken and more can be tracked on these devices.

    Since wearables can be connected to smartphones, all of that information can be stored in a convenient location. Doctors can access that information to help them make more informed decisions about their patients’ care and treatment options.

    Wireless technology also allows patients with certain medical conditions to be monitored with implants that are connected to smartphone apps. For example, a patient with diabetes could have a smart sensor implanted in their skin to monitor their glucose level. The app can detect any changes to the baseline specifications a physician sets and send an alert if there’s an emergency. Additionally, wireless medical equipment allows patient information to be transferred quickly, accurately and in real time.

    What wireless technology means to CRE

    It’s been documented how important it is for commercial real estate owners to have a reliable, in-building wireless connectivity within their properties. These days, it’s almost impossible to retain or attract tenants without it. After location, a building’s connectivity is the next biggest factor a potential tenant will consider when deciding whether or not to lease space there. That’s how much importance tenants put on wireless technology. They want to know that they’ll be able to make calls on their cell phone without it dropping due to a bad connection and not have difficulty hosting a video conference because the network isn’t strong enough.

    Reliable wireless connectivity for CRE isn’t just about the ability to use mobile devices without issue, however. Wireless can also play a part in tenants’ health. For example, following the COVID-19 pandemic, indoor air quality has become a higher priority as workers return to their offices. CRE owners have turned to devices that can measure their building’s indoor air quality and deliver results in real time. Most of these devices are Internet of Things (IoT)-based and need a strong wireless connection to be effective.

    “For less than the price of a health-club membership, an IoT-based wireless IAQ node can deliver real-time IAQ measurements that assure occupants of levels of carbon dioxide, PM, VOCs, Formaldehyde, Ozone, Carbon Monoxide, and more,” the software company Sense ware said. “Ignorance is a thing of the past. IAQ monitoring will provide objective data to ensure that HVAC systems within the built environment provide healthy conditions for building occupants.

    Having a quality wireless network can also be the difference between life and death. It’s critical that CRE owners connectivity is reliable in the event of an emergency. Tenants must be able to make calls for help on their cell phones and first responders might be counting on the building’s network to communicate with one another. There are a lot of reasons why wireless technology is important, but ensuring the safety of tenants might be the biggest reason of them all.

    Recourse : http://connectedremag.com/das-in-building-wireless/wireless/why-is-wireless- technology

    19Jul, 2022
    Now offering cryptocurrency, ATMs targeted for crypto-fraud

    Automated teller machines have been a part of banking and financial services for more than half a century. But, until recently, they served mostly as a vehicle for receiving cash, depositing checks or reviewing balances.

    However, the addition of cryptocurrency to ATMs in recent years has added a new wrinkle to the basic card skimmers and over-the-shoulder, old-school PIN-snatchers. More and more cybercriminals are seeing the reliable, traditional ATM as a prime focal point for their cryptocurrency scams. Indeed, the ATM Industry Association (ATMIA) last month announced that it was launching a national program to educate “law enforcement and consumers … addressing cryptocurrency fraud schemes.”

    “Although the vast majority [about 99%] of cryptocurrency transactions represent legitimate activity, some consumers are falling victim to clever scam artists,” according to the ATMIA’s release. “People who would never hand over a blank check or their credit card to a stranger, are tricked into completing a cryptocurrency transaction for one. And these tend to be the type of romance, investment, and merchandise scams that have been around for decades. “

    In fact, the ATMIA created its own “ATM Cryptocurrency Deplorer’s Advocacy Group” in 2021, when leaders noted that “membership of crypto ATM deplorer’s really surged last year,” according to David N. Tente, executive director for U.S., Canada, and the Americas for ATMIA.

    Cryptocurrency new to ATMs, but old scams are still reliable for fraudsters.

    While the incidence of cryptocurrency scams per teller machine has not necessarily increased that much in recent months, “the problem has been growing as the number of crypto ATMs and kiosks has grown rapidly over the past couple of years,” Tented said.

    According to the ATMIA, there are more than 30,000 ATMs and kiosks worldwide that offer cryptocurrency services — mostly in the United States. While that’s less than 10% of the 500,000 traditional ATMs in operation today, the heightened interest in and usage of cryptocurrency (even in light of the recent crypto-crash) means that many of these conventional teller machines may be converted to accept cryptocurrency, according to Tente.

    As is common with financial fraud, many of the scams perpetrated on crypto-ATMs, issuers and users resemble the same “scams that have been around for decades,” Tente added. “These schemes always have some element of urgency attached. The payment has to be made now. “

    Tente pointed out that for many cyber thieves, “cryptocurrency is a more attractive payment method than a wire or mailed check,” because of its lack of audit trail and anonymity. “Criminals are simply changing how victims pay, using the same scheme,” Tente said, adding that oftentimes fraudsters will target elderly, isolated or naïve crypto-users, believing they are the least likely to push back.

    “People need to be suspicious about anyone they don’t know asking for money for any reason,” Tente said. “If any request for money is made of them, [they] should get a second opinion from someone they know and trust.”

    In its June release, ATMIA outlined six types of fraud schemes that it has seen emerge at teller machines in recent months, as cryptocurrency-enabled ATMs and related scams have risen, as well as recommendations to law enforcement on how to handle these suspected schemes.

    “The co-existence between cash, crypto, digital currencies, and ATMs has already been established,” said ATMIA CEO Mike Lee, in the June release. “But as an industry body, it is incumbent upon us to self-regulate at all times and do everything we can to ensure transactions are safe and legitimate, working with law enforcement to tackle all types of criminal attacks.

    Even without the influx of cryptocurrency, more than one-third of the $28 billion in worldwide credit card fraud losses in 2020 was lost by ATM acquirers and merchant acquirers [more than $10 billion].

    “Acquirers and payment processing companies have long relied on rules-based technology to prevent merchant fraud,” according to Amyn Dhala, chief product officer at Brighterion, a MasterCard company that focuses on technology and security. “The challenge? Legacy, rules- based systems don’t adapt as quickly as criminals.”

    Resources : https://www.scmagazine.com/analysis/cybercrime/now-offering-cryptocurrency- atm-machines-targeted-for-crypto-fraud

    18Jul, 2022
    Info Security News – Password recovery tool infects industrial systems with Salty malware

    Password Recovery Tool infects industrial systems with Salty malware.

    A threat actor is infecting industrial control systems (ICS) to create a botnet through password “cracking” software for programmable logic controllers (PLCs).

    Advertised on various social media platforms, the password recovery tools promise to unlock PLC and HMI (human-machine interface) terminals from Automation Direct, Omron, Siemens, Fuji Electric, Mitsubishi, LG, Vigor, Pro-Face, Allen Bradley, Weintek, ABB, and Panasonic.

    Security researchers at industrial cybersecurity company Dragos analyzed one incident impacting DirectLogic PLCs from Automation Direct and discovered that the “cracking” software was exploiting a known vulnerability in the device to extract the password.

    But behind the scenes the tool also dropped Sality, a piece of malware that creates a peer-to-peer botnet for various tasks that require the power of distributed computing to complete faster (e.g. password cracking, cryptocurrency mining).

    Dragos researchers found that the exploit used by the malicious program was limited to serial-only communications. However, they also found a way to recreate it over Ethernet, which increases the severity.

    After examining the Sality-laced software, Dragos informed Automation Direct of the vulnerability and the vendor released appropriate mitigations. The threat actor’s campaign is ongoing, though, and administrators of PLC from other vendors should be aware of the risk of using password cracking software in ICS environments.

    Regardless of how legitimate the reason for using them is, operational technology engineers should avoid password cracking tools, especially if their source is unknown.

    For scenarios where there is a need to recover a password (because you forgot it, or the individual that had it is no longer your colleague), Dragos recommends contacting them or the device vendor for instructions and guidance.

    Sality P2P botnet

    Sality is an old piece of malware that continues to evolve with features that allows it to terminate processes, open connections to remote sites, download additional payloads, or steal data from the host.

    The malware can also inject itself into running processes and abuse the Windows auto-run function to copy itself onto network shares, external drives, and removable storage devices that could carry it to other systems.

    The specific sample analyzed by Dragons appears to be focused on stealing cryptocurrency. The researchers say that the malware added a payload that hijacked the contents in the clipboard to divert cryptocurrency transactions.

    However, a more advanced attacker could use this point of entry to create more serious damage by disrupting operations.

    In this particular case, the victim grew suspicious after running the malicious software because the CPU usage level grew to 100% and Windows Defender issued multiple threat alerts.

    Recourse : https://www.bleepingcomputer.com/news/security/password-recovery-tool- infects-industrial-systems-with-sality-malware/