• Search for:
    26Sep, 2022
    ONLINE SAFETY CYBER SECURITY INTERNET PRIVACY

    What is Cyber-Security?

    Cyber-Security refers to the act of protecting and ensuring the safety of computer systems and electronic devices from targeted cyber-attacks, opportunist malware (- viruses, trojans and bugs) or accidental introduction of malware by users. The global scale of cyber-threats continues to rise rapidly. In the modern day and age, access to volumes of data has gained currency, and hence every year, numerous attempts are made to breach data, and/or sensitive, confidential or classified records to expose information for political or economic gains. Effective cyber-security practices as a countermeasure, thus have become important.  There are three types of cyber-threats –

    • Cyber-Crime: wherein single actors or group of actors target systems for financial gains or to cause disruption
    • Cyber-Attack: involves gathering information for political or economic means
    • Cyber-Terrorism: aims to undermine electronic systems with an intent to instill fear or to cause panic

    End-user Protection is an important aspect of cyber security. It is imperative to ensure that users are educated to protect their systems and themselves from cyber-threats. It is found that introduction to malware is (accidentally) often caused by users themselves. It is thus crucial that users are able to detect such malware, update their systems timely, and refrain from using unsecure networks.

    Cyber security issues in India

    India is home to a population which is rooted in diverse socio-economic backgrounds. As per the living standards of people, a wide range of devices are in use – from high-end secured electronic devices to low-cost mobile phones. This makes it difficult for authorities to set uniform legal and technical standards for regulating data-protection. Additionally, digital literacy and awareness among the population is also very low.

    Risks of harm and threats for Children in a Digital age

    Children and young people, globally, in an increasingly digitally connected world, are among the most active users of Internet and web-based services. It is estimated that 1 in 3 children worldwide use the internet, or, one can say that 1 in 3 internet users is a child under 18 years of age. Children tend to surf the web to access educational information and content for entertainment, to develop their digital skills to acquire new opportunities, or to maintain their online/digital identities and social relationships. However, increased access to information at various web-platforms also lead to increased exposure to materials which are neither age-appropriate nor suitable for children for viewing, and/or risks/threats that children face online. Owing to their young age and evolving development capabilities, children and young people are vulnerable to abuse and exploitation at the hands of cyber-predators and perpetrators.

     The COVID-19 pandemic, lockdowns and restrictions on mobility made digitization the need of the hour. Closure of schools and a shift from attending classes in person to technology-based remote learning through virtual/digital education platforms not only dehumanized learning environments and distorted social interactions for children, but also isolated them in navigating the digital space. This new development increased children’s exposure to internet, virtual/digital media, exponentially and brought forth additional stressors related to their safety and protection online, consequently impacting their mental health and well-being. In this changed paradigm, novel child protection concerns have emerged – such as – digital addiction, cyber-bullying, access to/exploitation for pornographic material, prevalence of Child Sexual Abuse Material online (CSAM) etc. Additionally, social media platforms, chat rooms, computer games etc. open a “Pandora’s-box” for children’s safety and security. Often, parents and guardians lack digital-literacy and in most cases are unaware of the ill-effects of such exposure on mental and emotional well-being of children.

    Resource : https://www.childlineindia.org/a/issues/online-safety?gclid=CjwKCAjw-L-ZBhB4EiwA76YzOT89IKxRC2LQJl1NKX3V5J5JIJ-4k1Ic9NXcn0k8IbBWR6l_h87Y9BoCGk4QAvD_BwE

    24Sep, 2022
    SEO poisoning campaign directs search engine visitors from multiple industries to JavaScript malware

    Researchers have discovered a high-effort search engine optimization (SEO) poisoning campaign that seems to be targeting employees from multiple industries and government sectors when they search for specific terms that are relevant to their work. Clicking on the malicious search results, which are artificially pushed higher in ranking, lead visitors to a known JavaScript malware downloader.

    “Our findings suggest the campaign may have foreign intelligence service influence through analysis of the blog post subjects,” researchers from security firm Deep Watch said in a new report. “The threat actors used blog post titles that an individual would search for whose organization may be of interest to a foreign intelligence service, e.g., ‘Confidentiality Agreement for Interpreters.’ The Threat Intel Team discovered that threat actors highly likely created 192 blog posts on one site. “

    How SEO poisoning works

    Deepwatch came across the campaign while investigating an incident at a customer where one of the employees searched for “transition services agreement” on Google and ended up on a website that presented them with what appeared to be a forum thread where one of the users shared a link to a zip archive. The zip archive contained a file called “Accounting for transition services agreement” with a .js (JavaScript) extension that was a variant of Gootloader, a malware downloader known in the past to deliver a remote access Trojan called Gootkit but also various other malware payloads.

    Transition services agreements (TSAs) are commonly used during mergers and acquisitions to facilitate the transition of a part of an organization following a sale. Since they are frequently used, many resources are likely available for them. The fact that the user saw and clicked on this link suggests it was displayed high in ranking.

    When looking at the site hosting the malware delivery page, the researchers realized it was a sports streaming distribution site that based on its content was likely legitimate. However, hidden deep in its structure were over 190 blog posts on various topics that would be of interest for professionals working in different industry sectors. These blog posts can only be reached via Google search results.

    “The suspicious blog posts cover topics ranging from government, and legal to real estate, medical, and education,” the researchers said. “Some blog posts cover topics related to specific legal and business questions or actions for US states such as California, Florida, and New Jersey. Other blog posts cover topics relevant to Australia, Canada, New Zealand, the United Kingdom, the United States, and other countries.”

    Furthermore, the attackers deployed a translation mechanism that automatically translates and generates versions of these blog posts in Portuguese and Hebrew. Some of the topics are highly specific and would lure victims from sectors that would be of interest to foreign intelligence agencies, for example bilateral air service agreements (civil aviation), intellectual property in government contracts (government contractors) or the Shanghai Cooperation Organization (individuals working in mass media, foreign affairs or international relations). The blog posts are not duplicates of other content from the web, which Google would likely catch and penalize in search results but are rather compiled from multiple sources giving the appearance of well-researched original posts.

    “Given the herculean task of researching and creating hundreds of blog posts, one may assume that many individuals are working together,” the researchers said. “However, this task may not be completely unfeasible for a lone individual despite the perceived level of effort needed to do this.”

    How TAC-011 and Gootloader enable SEO poisoning

    Deepwatch attributes this campaign to a group they track as TAC-011 that has been operating for several years and which has likely compromised hundreds of legitimate WordPress websites and may have produced thousands of individual blog posts to inflate their Google search rankings.

    Once a visitor clicks on one of the rogue search results, they’re not taken directly to the blog post but instead an attacker-controlled script collects information about their IP address, operating system and last known visit and then performs a series of check before deciding whether to show them the benign blog post or the malicious overlay that imitates a forum thread. Based on the researchers’ tests, users who received the overlay don’t get it again for at least 24 hours. Visitors using known VPN services or Tor are not directed to the overlay and neither are those using operating systems other than Windows.

    The zip file linked in the fake forum thread is hosted on other compromised websites that likely are controlled from a central command-and-control server. The researchers couldn’t determine what additional payloads Gootloader deployed on victim machines as these are likely selected based on the victim’s organization. The malicious JavaScript file also collects some information about the victim’s machine including the “%USERDNSDOMAIN% variable which could expose the internal corporate domain name of the organization.

    “For example, if a company with a Windows Active Directory environment and a computer logged into the organization’s network were compromised, the adversary would know that they have access to that organization,” the researchers said. “At this point, the threat actor could sell access or drop another post exploitation tool like Cobalt Strike and move laterally in the environment.”

    Mitigating SEO poisoning attacks

    Organizations should train their employees to be aware of these search result poisoning attacks and to never execute files with suspicious extensions. This can be enforced through Group Policy to force the opening of files with potentially dangerous script extensions such as .js, .vbs, .vbe, .jse, .hta and .wsf with a text editor such as Notepad rather than execute them with the Microsoft Windows Based Script Host program, which is the default behavior in Windows.

    Another non-technical guidance offered by Deepwatch is to make sure employees have the agreement templates they need available internally. Over 100 of the blog posts found on that one compromised sports streaming site were about some sort of business-related agreement template. Another 34 were about contracts. Law, purchase, tax, and legal were also common keywords. The fake forum thread technique has been in use since at least March 2021 and it still works, suggesting attackers still view it as viable and returning a high success rate.

    “Having a process where an employee can request specific templates may reduce their need to search for the templates and thus fall victim to these tactics,” the researchers said.

    Resource : https://www.csoonline.com/article/3674791/seo-poisoning-campaign-directs-search-engine-visitors-from-multiple-industries-to-javascript-malwar.html#tk.rss_all?&web_view=true

    20Sep, 2022
    Information Security vs Cyber Security: The Difference

    You’ll often see the terms cyber security and information security used interchangeably. That’s because, in their most basic forms, they refer to the same thing: the confidentiality, integrity and availability of information.

    But there’s a crucial difference between them that affects the way your organization operates. In this blog, we explain what information security and cyber security are, the differences between them and how they fit into your data protection practices.

    What is information security?

    Information is at the heart of any organisation, whether it’s business records, personal data or intellectual property.

    It can be kept in any number of places and can be accessed in many ways. You’re most likely to access data on your work computer or via paper records, but information can be found in many places.

    For example, data can be held on removable disks, laptops, servers, personal devices and physical records.

    It all needs to be kept safe, and the process of doing that is called information security.

    Specifically, organisations are protecting the confidentiality, integrity and availability of information.

    In this context, confidentiality refers to information being viewed by only by authorised parties, integrity to information being accurate, and availability to information being accessible when necessary.

    There are two sub-categories of information security. Organisations must protect physical assets including its premises, as well as anywhere else where sensitive information can be stored physically.

    The second sub-category of information security relates to the protection electronic information. This is cyber security.

    Examples of information security

    Information security covers any process or technology that’s used to protect the confidentiality, integrity and availability of information.

    This can include:

    • Anti-malware technology;
    • Information security policies;
    • Access controls;
    • Staff awareness training;
    • Data protection impact assessments;
    • Key cards to enter the office; and
    • Locks for cabinets containing sensitive information.

    What is cyber security?

    Cyber security is a particular type of information security that focuses on the protection of electronic data.

    It focuses on the measures that are used to prevent unauthorized access to an organization’s networks and systems.

    The term is often used to refer to information security generally because most data breaches involve network or system intrusion.

    Criminals are far more likely to compromise information with cyber attacks – such as malware intrusion or phishing scams – because it can be done online.

    Moreover, organisations typically store much more data online than in physical form, meaning there is more information to target. Additionally, technical vulnerabilities are easier to exploit and there is a much lower risk of being caught.

    As such, cyber security may only be one part of information security, but it is the most important.

    Examples of cyber security

    Cyber security covers any process or technology designed to protect electronic data. This can include;

    • Data encryption;
    • Passwords;
    • VPNs;
    • Spam filters;
    • Multi-factor authentication;
    • Secure code review; and
    • Anti-malware software.

    Where do cyber security and information security overlap?

    Although we distinguish between information security and cyber security in this blog, in practice there will be a significant overlap.

    For a start, any time of cyber security mechanism that’s designed to protect sensitive data can also be categorized as information security.

    Password-protecting a database, for example, protects the information held within but also prevents a cyber attack.

    There are also risks where physical and cyber security must be addressed. Take malicious insiders, for instance. Organizations must implement physical controls to prevent unauthorized personnel from reaching parts of the building where they shouldn’t be.

    This could be records room or a senior employee’s office where files might be left on the desk.

    But the organization must also consider the cyber security risks associated with this threat. Any digital records must be protected appropriately, such as with access controls or data encryption.

    Another overlap between information security and cyber security occurs with digital records that are held on physical devices – such as USB drives or laptops.

    Organisations must implement policies and processes to mitigate the risk of the device being used inappropriately. This could happen, for example, if an employee leaves their laptop unattended in an insecure location or if they used a removable device for personal and professional use.

    These measures should be complemented with cyber security mechanisms designed to protect the information on those devices. Organizations might encrypt sensitive files or implement a technology that enables them to remotely wipe a laptop if it’s lost.

    These are just a few examples. When you assess data protection risks, you will find countless instances where you must consider information security and cyber security.

    Resource : https://www.itgovernance.co.uk/blog/do-you-know-the-difference-between-cyber-security-and-information-security

    14Sep, 2022
    The Top Cyber Security Blogs and Websites of 2022

    If you work in the cybersecurity industry or are interested in pursuing a career in this vitally important field, it’s important to stay up to date on the latest trends and advancements.

    Must-Read Cyber Security Blogs

    1. Daniel Miessler
    @DanielMiessler
    An experienced cybersecurity expert, consultant and writer, Miessler takes a personal approach on his blog — greeting visitors with the words: “My name is Daniel Miessler… I explore the interesting and beautiful at the intersection of security, technology, and humans.” His offerings include curated newsletters, essays, podcasts and high-quality writing.

    2. Graham Cluley
    @gcluley
    A longtime industry expert who held senior roles with Sophos and McAfee before deciding to begin “working for myself” in 2013, one could say Graham Cluley is totally clued in to the cybersecurity scene — running a blog with an open, accessible style while continuing his work as a conference speaker, media pundit, podcaster and consultant.

    3. IT Security Guru
    @IT_SecGuru
    IT Security is a daily news digest of breaking news in the IT security industry. They offer articles, videos, webinars, analysis, case studies and even have a section devoted to the latest cybersecurity scams where they spotlight recent hacks.

    4. Security Weekly
    @securityweekly
    Featuring the work of industry veteran Paul Asadoorian, the blog features webcasts and a number IT Security video programs that you can listen to or watch on a number of channels including iTunes, YouTube, Google Play and many more.

    5. The Hacker News
    @TheHackersNews
    The Hacker News features the latest cybersecurity news and in-depth coverage of “current and future trends in Infosec and how they are shaping the cyber world.” Key areas of focus include data breaches, cyber attacks, vulnerabilities and malware. It claims 8 million monthly readers that include “leading security researchers, geeks, techies, business grads, CISOs, along with thousands of security professionals.”

    6. Infosecurity Magazine
    @InfosecurityMag
    Infosecurity Magazine has been delivering cutting-edge cybersecurity content to readers for the past decade, with both a print and online edition. In addition to its many articles, Infosecurity Magazine also offers regular (free) webinars, whitepapers and virtual conferences.

    7. CSO Online
    @CSOonline
    CSO provides news, analysis and research on a broad range of security and risk management topics. As its name suggests, it is geared toward enterprise security decision-makers and CSOs (chief security officers) as well as anyone interested in information security, identity and access management, loss prevention and more. It focuses on delivering “the critical information [needed] to stay ahead of evolving threats and defend against criminal cyber attacks.”

    8. The State of Security – Tripwire
    @TripwireInc.
    The State of Security offers news and opinions on the state of the industry, written by regular contributors as well as guest authors from throughout the cybersecurity industry. It is a past winner of “Best Corporate Blog” and “Most Entertaining Security Blog.” Here are its Top 10 posts from 2018.

    9. Troy Hunt
    @troyhunt
    A cybersecurity thought leader who travels the world speaking and training technology professionals, Troy Hunt is Microsoft Regional Director and Most Valued Professional (MVP) specializing in online security and cloud development. He also writes a blog with lengthy, comprehensive and thought-provoking posts.

    10. The Last Watchdog
    @byronacohido
    The Last Watchdog is written by Byron Acohido, a Pulitzer Prize-winning journalist, teacher and respected cybersecurity and privacy expert. His blog is video heavy and includes many interview-style posts as well as guest blog posts.

    11. Schneier on Security
    @schneierblog
    Bruce Schneier has been writing about security on his blog, Schneier on Security, since 2004. Dubbed a “security guru” by The Economist, he is a special advisor to IBM Security and the CTO at IBM Resilient, a Harvard fellow and the author of 13 books. Bruce Schneier knows security — and his blog proves it. This is definitely one to bookmark if you are interested in the security industry.

    12. The Akamai Blog
    @Akamai
    Akamai, a content delivery network services company, publishes The Akamai Blog — a compilation of news and perspectives from a host of technology and security professionals. Akamai describes itself as a “forum to discuss, share and reflect on the trends that are driving today’s businesses online.”

    13. Krebs on Security
    @briankrebs
    A former Washington Post reporter, Brian Krebs authors this in-depth blog covering security news and investigation. He is author of “Spam Nation” and has been profiled in The New York Times, Business Week and Poynter.org.

    14. Naked Security
    @NakedSecurity
    Published by Sophos, the Naked Security blog has won multiple awards for best corporate blog and best IT security blog among numerous others. The blog features multiple stories a day and covers every angle of computer security.

    15. TaoSecurity
    @taosecurity
    Written by Richard Bejtlich, TaoSecurity covers “digital security, strategic thought and military history” and specializes in Chinese online criminals. Bejtlich has authored multiple books on security. He is the Principal Security Strategist at Corelight Inc. and former Chief Security Strategist at FireEye.

    16. Dark Reading
    @DarkReading
    If you work in cybersecurity or have any interest in the field, you have likely visited the Dark Reading website. As one of the most popular websites among cybersecurity professionals, Dark Reading offers insight across a variety of topics from analytics and application security to mobile and cloud security, IoT and more. According to Dark Reading, “This is where enterprise security staffers and decision-makers come to learn about new cyber threats, vulnerabilities and technology trends.”

    17. PC World
    @pcworld
    PC World is a well-known online computer and technology magazine that offers news, reviews and how-tos, along with plenty of videos on topics that include not just PC-related issues but business and cybersecurity as well.

    18. Wired
    @WIRED
    Wired is another wildly popular website that covers an array of topics from business and culture to design, gear, science, security and transportation. Wired is popular not just with those in the cybersecurity world, but with anyone interested in how technology is affecting culture today. One of the site’s most interesting stories of 2018 was “The Untold Story of NotPetya, the Most Devastating Cyberattack In History.”

    19. CIO
    @CIOonline
    CIO is an online magazine geared toward those in technology and security leadership roles. Its Editorial focus includes content geared to helping C-suite executives confront the cybersecurity challenges faced by their organizations.

    20. CNET
    @CNET
    CNET is the go-to site for technology reviews, “how-to” tech content and the latest in tech news. They also have a shopping section on their site where they list the best deals on everything from TVs to laptops to web hosting. They also cover cybersecurity issues such as data breaches and defenses, and government efforts to establish a U.S. cyber doctrine.

    21. We Live Security
    @ESET
    WeLiveSecurity.com is an award-winning blog published by IT security firm ESET that features security news and insights from its researchers and security experts from around the world. Winner of the 2018 Best Corporate Security Blog award from InfoSecurity Magazine’s European Security Blogger Awards, it is a source trusted by journalists and industry experts for breaking cyber news. It also serves a as forum where some of ESET’s most high-profile cybersecurity discoveries have been published.

    22. Signal Magazine
    @signalmag
    Signal Magazine is truly one for the cyber security professional. It is the official publication of the AFCEA, a professional association focused on serving government and military since 1946. Signal produces a print and online magazine, a blog, newsletters, webinars, eBooks and more. Content is primarily focused around cyber, defense, homeland security, intelligence and technology — basically everything and anything security related.

    23. ThreatPost
    @threatpost
    ThreatPost is an independent news site that covers security from every angle. In addition to digital articles (here is its cybersecurity forecast for 2019), they are constantly publishing videos and podcasts as well.

    24. Computerworld
    @Computerworld
    Computerworld, which was established as a print magazine in 1967 and “went digital” in 2014, is now a global publication branded in 47 countries and a go-to for anyone in the tech world. The online magazine covers cloud computing, emerging technologies cybersecurity and much more.

    Resource : https://onlinedegrees.sandiego.edu/top-cyber-security-blogs-websites/

    13Sep, 2022
    Microsoft Teams Messages Not Sending? Try these 9 Fixes

    Are you getting the “Failed to send” error message every time you send a message in teams?  Or do you notice the “You can’t send a message because you are not a member of the chat” error?

    Such error messages most likely appear when there’s a bug on your device or the application. Similarly, slow internet connectivity can also be why the messages are not being sent. So, firstly check if you have a stable internet connection before we get into this article. 

    Table of Contents

    Why is Microsoft Teams Message Not Sending?

    Let’s look through the list of problems that can cause your MS Teams message to not send before jumping to the fixes. 

    • Connectivity issues
    • Too many apps running in the background
    • Outdated version of MS Teams application
    • Firewall security
    • Corrupted Cache Files
    • Outdated Operating System
    • MS Teams under maintenance

    Sometimes, the channel owner might not allow selective members to send a message in the channel. If you think selecting these members was an error, you can request the owner directly. 

    How to Fix Microsoft Teams Messages Not Sending?

    Restarting your device is always the best troubleshooting option to start. It tends to clear all the data from RAM and make your device perform much smoother. Glitches like not sending messages are common for big platforms such as Microsoft Teams. When this happens, we suggest you use the web version if you’re using the desktop/mobile app version. Following these methods should fix your issue. 

    Force Quit Microsoft Teams App 

    When your Teams app isn’t responding properly or showing glitches like a message not sending, we suggest you force quit the application. It shuts down the application and helps it function properly when reopened. 

    On Windows

    1. Place your cursor on the Taskbar and right-click it.
    2. Select the Task Manager option.
    3. Right-click on Microsoft Teams and press the End Task option. 
      end-taskbar-for-teams

    On Mac

    1. Click on the Apple Menu and open Force Quit.
    2. Search for the Microsoft Teams application, select it and click the Force Quit button.
      force-quit-teams

    On Android

    1. Long press on Microsoft Teams app on the homepage.
    2. Press the App Info and tap on the Force Stop button.
      force-stop-teams
    3. Tap Force Stop on the confirmation box too.

    Check For Updates

    If you’re using outdated versions of Teams, such errors may appear on your application. If that’s the case, updating the teams app by going to the respective store you got it from should fix this issue. 

    On PC

    Even though applications on the desktop get updated automatically, it is advised for you to check if any updates are available within the application.

    1. Open Microsoft Teams.
    2. Tap on Three Dots and click on Check for updates option.
      check-for-updates

    On Phone

    1. Go to the App Store/Play Store.
    2. Search for Microsoft Teams on the search bar.
    3. Tap on the Update button beside it.
      update-teams

    Similarly, you may also update the operating system of your device. Glitches like this are common when the app and your system aren’t updated.

    Re-Login

    When you log out and log back in, the glitches you were facing are likely to get solved. Here’s how you can log yourself out and log back in.

    On PC

    This is applicable for both application and web versions. 

    1. Launch Microsoft Teams.
    2. Tap on your Profile on the top right.
    3. Click on the Sign Out option.
      sign-out-of-teams
    4. Open Teams again and sign in with your login credentials. 

    On Phone

    1. Open Teams and tap on your Profile on the top left.
    2. Select the Settings option.
      settings-option
    3. Scroll down and tap Sign out.
    4. Select the Sign out option on the confirmation box.
      sign-out
    5. Similarly, sign in again with your login credentials. 

    Contact Channel Owner

    If you receive the “you can’t send a message because you are not a member of the chat” error while sending a message, you might not be allowed to send a message to that specific channel. 

    Only owners can make changes to the chat. When this happens, you can send them a message regarding this issue personally in a direct message. Address your situation, and they might make sending texts on that channel possible. 

    If you are the channel owner, here’s what you can do. You can only perform this for the desktop versions of Teams.

    1. Open Microsoft Teams and go to the Channel.
    2. Click on the Three dots on the left side beside the channel name.
    3. Select the Manage channel option. 
      manage-channels
    4. Under General Channel, on the Permission tab, select “Anyone can post messages.”
      anyone-can-post-message

    Clear Teams Cache Data

    Clearing Microsoft Teams cache data helps to solve glitches like not being able to send messages. This is because such data tends to take up a large amount of storage on your device. The data may turn corrupt, which can cause connectivity issues as well as the message not sending problem. 

    On Windows

    1. Click on the Search button on the taskbar and search for Run.
    2. Click Open and type %Appdata%\Microsoft\Teams on the search bar. 
    3. Click on the OK button.
      run-command-teams
    4. Select all the Cache Folders while holding down the Ctrl key.
      cache-files-teams
    5. Right-click it and select the Delete option on the menu. 

    On Browser

    1. Open your web browser and click on the Three Dots.
    2. Select the More tools option.
    3. Click on the Clear browsing data option. 
      clear-browsing-data
    4. Select Cookies and other site data, Cached images, and files, and click the Clear data button.
      clear-web-browser-data

    On Android

    1. Go to Settings.
    2. Select Apps option and search for Teams.
    3. Tap on storage and press Clear Cache.
      clear-cache-teams

    On Mac

    1. Open Finder and click on Go to Folder under the Go menu.
    2. Type ~/Library/Application Support on the search bar and press Go.
    3. Search for Microsoft Teams and open it.
    4. Select all the Cache Folders and press Command + Option + Delete keys.
    5. Click on the Delete button when the confirmation box appears. 
      delete-teams-cache-on-a-mac

    Type Instead of Using Dictation 

    Many iOS users seem to have an issue with dictation. The text appears to disappear even after hitting the Send button when users use dictation to send messages. This is a bug in the Teams app itself. In such cases, you could try typing instead of using spoken text. You may also try using the web version if there’s a rush. If this doesn’t work, follow the next step.

    Reinstall Teams App

    When you remove an app from your device, all the related files will get deleted from the computer’s hard drive. Similarly, when you install them back, all the files will get downloaded as new and fresh ones. Uninstalling and reinstalling the app might fix your messages not sending issues. 

    On Windows

    1. Click on the Start button and go to Settings.
    2. Click on Apps.
      apps
    3. Under Apps & Features and navigate to Microsoft Teams.
    4. Right-click on it and press the Uninstall button.
    5. Again, click the Uninstall button and select OK.
      uninstall-teams
    6. Now, go to Microsoft Store and install the App the same way you got it before.

    On Mac

    1. Click on Go and select Applications.
    2. Search for Microsoft Teams on the search bar.
    3. Right-click it, and press the Move to Trash option.
      move-to-trash
    4. Select the Delete option on the confirmation box. 
    5. Now, go to AppStore and install the App the same way you got it before.

    On Phone

    1. Long press on the Teams app on your homepage.
    2. Press the Uninstall / Delete App option.
      delete-teams-app
    3. Go to AppStore/Play Store and install it again.

    Allow Apps to Communicate Through Firewall

    A firewall is a security system between unauthorized network traffic and your computer. Turning this on prevents your device from viruses and threats. However, it might also prevent you from interacting with servers. The permission to allow apps to communicate through the firewall should be granted after installation. If it’s not permitted yet, here’s how you can do it.

    On Windows

    1. Click on the Search bar and search for “Allow an app through Windows Firewall.”
    2. Click the Open tab.
    3. Scroll down and select Teams.exe. 
    4. Press the Change Settings option and click Remove.
      remove-teams-exe
    5. Click on the Yes option in the confirmation box.
    6. Then, click on Allow another app right below it.
    7. Click on the Browse option and search
      C:\Users\[your device name]\AppData\Local\Microsoft\Teams\current
    8. Click on the Open button.
    9. Press the Add option and click on OK.
      add-an-app-option

    On Mac

    1. Go to the Apple menu and click on System Preferences.
    2. Click on Security & Privacy and open the Firewall tab.
    3. Click on the Lock icon on the bottom to enable making changes.
      lock-icon
    4. Type in your Username and Password to unlock the Security & Privacy preferences.
    5. Press the Unlock button and turn on the firewall by pressing the Turn On Firewall option beside it.
      turn-on-firewall-on-a-mac
    6. Then, click on Firewall Options.
    7. Press the Plus icon and search for Microsoft Teams under the Application tab.
      add-microsoft-teams
    8. Select it and click on the OK button.

    Troubleshoot the Internet Connection

    If you aren’t connected to the internet or don’t have a stable internet connection, messages won’t get sent. So, check your internet connectivity and make sure you have access to high-speed internet. 

    Firstly, reconnect your Wi-Fi or cellular data. You can also try replugging the cables of your router if the connectivity issue isn’t just on your device. 

    Alternatively, use an ethernet cable to connect your device directly to the router. Finally, you can contact your service provider and ask for professional help if no solutions work. 

    Resource : https://www.technewstoday.com/fix-teams-messages-not-sending/

    12Sep, 2022
    New Stealthy Linux Malware Targeting Endpoints & IoT Devices

    At AT&T Alien Labs researchers have discovered a new stealthy Linux malware called Shikitega that can infect Linux systems in a stealthy manner. With additional payloads, the primary target of this Linux malware is the Linux-based systems and IoT devices.

    In addition to exploiting vulnerabilities, the malware adds persistence to the host through crontab by exploiting exploits to elevate privileges. Later a cryptocurrency miner is installed on an infected device as a result of the infection.

    It is quite easy for Shikitega to escape detection by anti-virus software since it is a stealthy malware. This malware uses a polymorphic encoder to evade detection, which means that it is impossible for any static, signature-based analysis to be performed on it.

    Infection chain

    This malware is spread through the use of a very small file called ELF that acts as a main or primary dropper. In total, the code takes up about 300 bytes while the total size is about 370 bytes, so the program is quite small.

    At this point, we don’t know the exact method by which the infection spread for the first time. There are multiple steps in the malware infection process in which each layer only delivers a few hundred bytes to the target. 

    In order to activate a module, one must activate a simple module, then move on to the next module. There is a shell code encoded in the ELF file, which is the dropper file.

    An additive feedback encoder called Shikata Ga Nai is used for the encoding process. In order to decode the data, the malware runs through several decoding loops using the encoder.

    A dynamic substitution of instructions and a dynamic block ordering is used in order to generate the encoder stud. A dynamic selection of registers is also carried out in addition to this.

    A shellcode is executed following the decryption to intercommunicate with C2 of the malware. After receiving the shellcode (commands), they are used for running from memory additional shell code.

    A Metasploit Meterpreter payload known as “Mettle” is downloaded and executed via one of these commands. A host can then be remotely controlled and code executed by an attacker.

    The Mettle program is configured to fetch a smaller ELF file, and it exploits the following vulnerabilities:-

    • CVE-2021-4034 (aka PwnKit)
    • CVE-2021-3493

    As a result of these flaws, the following exploits have been carried out:- 

    • Elevate privileges
    • The payload for the final stage is downloaded here
    • Deploy a cryptocurrency miner as a root

    Scripts Used

    Here below we have mentioned all the scripts that are used to achieve persistence:-

    • unix.sh: Check if “crontab” commands exist in the system, if not install it and start the crontab service.
    • brict.sh: Adds crontab for the current user to execute crypto miner.
    • politrict.sh: Adds root crontab to execute cryptominer.
    • truct.sh: Adds crontab for current user to download cryptominer and config from C&C.
    • restrict.sh: Adds root crontab to download crypto miner and config from C&C.

    Recommendations

    Here below we have mentioned all the recommendations recommended by the cybersecurity analysts:-

    • Make sure that the software is updated with the latest security patches.
    • Make sure all endpoints have anti-virus software installed as well as EDR software.
    • To make sure that your server files are backed up, you should use a backup system.
    • Make sure to have a robust security strategy

    Resource : https://cybersecuritynews.com/new-stealthy-linux-malware-targeting-endpoints-iot-devices/

    25Aug, 2022
    New Air Gap-Jumping Attack Uses Ultrasonic Tones and Smartphone Gyroscope

    A researcher from the Ben-Gurion University of the Negev in Israel has shown how a threat actor could stealthily exfiltrate data from air-gapped computers using ultrasonic tones and smartphone gyroscopes.

    The attack method, named GAIROSCOPE, assumes that the attacker has somehow managed to plant malware on the air-gapped computer from which they want to steal data, as well as on a smartphone that is likely to go near the isolated device.

    According to researcher Mordechai Guri, the malware that is on the air-gapped computer can transmit ultrasonic tones using the device’s loudspeakers. These tones are inaudible and on a frequency that is picked up by a gyroscope.

    Gyroscope sensors in smartphones determine the direction of the device and they enable users to perform various actions by tilting the phone. This includes automatically rotating the screen and moving characters or objects in a game. Unlike the microphone, which is more difficult to access by a malicious application, a phone’s gyroscope can be accessed by iOS and Android malware that does not have as many permissions.

    The malware that is on the isolated device collects valuable data such as passwords and encryption keys, and encodes it using audio frequency-shift keying, where one specified frequency represents a ‘0’ bit and a different frequency represents a ‘1’ bit. The malware uses the device’s speakers to transmit inaudible sounds at those frequencies.

    On the phone side of the attack, the infected device’s gyroscope picks up those tones when it’s near the air-gapped computer. The method leverages previous research that showed how gyroscopes are vulnerable to acoustic attacks.

    The hacker’s mobile malware continuously samples and processes the gyroscope sensor output. When it detects an exfiltration attempt — a specific bit sequence is used to signal the start of data transmission — it demodulates and decodes the data. The exfiltrated data can then be forwarded to the attacker using the phone’s internet connection.

    Experiments conducted by Guri showed that the GAIROSCOPE method allows for a maximum data transmission rate of 8 bits/sec over a distance of up to 8 meters (26 feet).

    This is not the only air gap-jumping attack method presented by Guri this week. He has also published a paper demonstrating how hackers could silently exfiltrate data from isolated systems using the LEDs of various types of networked devices.

    In the past years, researchers from the Ben-Gurion University of the Negev have demonstrated several methods for covertly exfiltrating data from air-gapped networks, including by  using RAM-generated Wi-Fi signals, fan vibrations, heat emissions, HDD LEDs,  infrared cameras, magnetic fields, power lines, router LEDs, scanners, screen brightness,  USB devices, and noise from hard drives and fans.

    Resource : https://www.securityweek.com/new-air-gap-jumping-attack-uses-ultrasonic- tones-and-smartphone-gyroscope

    28Jul, 2022
    Microservices Challenges — Distributed Troubleshooting and Monitoring

    Microservices architecture brings us so many great benefits, as we discussed here. However, nothing comes free and so the benefits of micro services There are various challenges which are by-product of micro services, and it makes all sense to understand these well before beginning journey in new fancy world.

    One of these challenges is the complexity of troubleshooting that comes with micro service patterns. We shall discuss this with possible solution in this article.

    Challenge

    Troubleshooting is part of development life. Life is comparatively easy when debugging is for one monolithic system. But the micro services world has many smaller services, which interact with each other in a mix of combinations to support bigger application features.

    With such a dynamic interaction matrix, troubleshooting for any issue could span a multitude of services. Finding a trail of any request across multiple services and servers, which could again be dynamic based on the business logic of each service, could be fatal.

    This makes troubleshooting extremely complex, which needs deep system knowledge and persistence to walk through many many nodes.

    Once one has deep knowledge of the system, and its distributed architecture, debugging is possible. But it will still consume a lot of time and energy. Assume a scenario where this complexity could be multiplied with auto-scalable container-based deployment models, which means server nodes are changing dynamically based on need.

    It is not manageable without proper tooling in place. Even, then it is complex to understand the thousands of service request trails.

    Solution

    Distributed Tracing, Log Aggregation, and Visualization are the savior.

    Distributed tracing

    This enables to trace the related logs across services and nodes.

    It is implemented by adding an identifier to logs which can help trace (by correlating) the request across the services and server nodes.

    It is like adding one constant with the request at the beginning of the first service hit. This constant will then be passed to all subsequent service calls from there. Every service, if distributed tracing is enabled for these, automatically picks this constant trace id and uses it while logging respective data.

    In turn, it enables to correlate the data of the same request across the services and servers easily.

    Log Aggregator

    Now, we have an identifier that can help to identify any given request across the services.

    The next challenge is, that it is not practically possible to login into different servers and analyze the logs. Hence, we need a provision where all the logs from different services can be collated and presented in one place for easy and efficient reading.

    Log Aggregation tools help in this. Every service, while using trace id for logs, prepares the logging data, and sends this data to one centralized log aggregator service (mostly using one of the available tools/libraries).

    Log aggregator stores the logs in some optimized data structure, and search-friendly scalable database. Once all log data is available in one data store, it becomes possible to use this for different kinds of functions.

    Log Visualizer

    Log aggregators have all log data in one place. These tools/databases are meant to store the bulk log entries and to enable faster search on this.

    Now, this data can be used to present the whole request trail in some easily understandable format at UI or through API too.

    Once we have this aggregated data, it opens many opportunities, for example:

    • See request trails across the services for troubleshooting
    • Analyze the performance data i.e. time taken by each service/operation
    • Client usage patterns or user behavior, i.e. which service is used more and at what time.
    • Potential of connecting this data with context information to do even more deep analysis, for example, which service was used more on new year and so on. This can feed important information to system design decisions.

    Performance Impact

    It is an obvious question that logging data for each service call, and operation and then sending it to a centralized collector can add performance overhead. This is true to some extent, however, there are ways to optimize it.

    Adding distributed trace tokens and logging is usually managed by instrumentation-driven libraries, which add pre/post hooks for each method to log the basic information. The amount of information is configurable.

    As this logging is managed by libraries and mostly abstracted, these libraries are highly optimized to do this job.

    Sending logging data to a centralized collector (aggregators) can be optimized by making it asynchronous. For example, a logging client on each node can have a local in-memory (and physical too) storage which can collate all the logs. All these logs can later be sent to a centralized server asynchronously using HTTP requests or queues etc. This reduces the reporting overhead a lot, especially from service processing flow.

    Cost can not be zero for benefits, however, it can be contained in most cases. Most tracing libraries are highly configurable for log level and reporting mechanisms, these provide various options to optimize the process based on application-specific use cases.

    Tech to Support

    There are many libraries and tool options to enable these.

    Zipkin & Jaeger are the two most popular Distributed Tracing systems available as of now. Zipkin was developed by Twitter, and Jaeger by Uber.

    • Both were open sourced, once these reach to production readiness stage, by respective companies with their respective open source communities.
    • Both support the basic components of Distributed tracing / Log aggregator or collector / Visualizer, as described above. Additionally, these support many more useful features on top, which are specific to each tool.
    • Both are quite similar in architecture and usage. However, differs mostly in deployment style and plugins available for different languages and frameworks.

    Refer to respective websites for detailed information. These are well documented tools.

    Refer to open-tracing also, which is on a mission to standardize the tracing APIs and tools. This is also an incubating project in Cloud Native Computing Foundation.

    Conclusion

    The combination of these tools and design patterns makes distributed troubleshooting and monitoring possible in the microservice ecosystem.

    Keep in mind, that it is still more complex than monolith designs. It still needs deep system knowledge across the services and the ability to connect all the dots across. It needs experience in system design and system both. However, a combination of these tools makes it feasible.

    Hence, if you are not ready for an iota of extra complexity, it is recommended to stay away from microservices kind of distributed architecture patterns. The number of services could be overwhelming in such designs due to fine-grained structure.

    Or start with the right tooling in place to manage it well from the beginning. Don’t ever think to run the highly distributed microservice kind of system without these supporting tools. Otherwise you will be spending months of effort on troubleshooting, with a high potential to burn the teams physically and morally, and may lose productivity too.

    We shall discuss more challenges like distributed transactions, and managing failures in distributed environments in future articles.

    Resource : https://matrixexplorer.medium.com/microservices-challenges-distributed- troubleshooting-and-monitoring-b5129f56701f

    28Jul, 2022
    Info security – 7 Top Trends in Cybersecurity for 2022

    The ever-expanding digital footprint of modern organizations drives this year’s top cybersecurity trends.

    In short:

    • Rethink the security technology stack to address sophisticated new threats.
    • Push cybersecurity decision making out to the business units to improve your security posture.
    • Evolve and reframe the security practice to better manage cyber risk.

    Security and risk executives face a critical juncture, as the digital footprint of organizations expands and centralized cybersecurity control becomes obsolete.

    Hybrid work and digital business processes in the cloud have introduced new risks. At the same time, sophisticated ransomware, attacks on the digital supply chain and deeply embedded vulnerabilities have exposed technology gaps and skills shortages.

    “These disruptions don’t exist in isolation; they have a compound effect,” says Peter Firstbrook, VP Analyst at Gartner. “To address the risks, CISOs need to transition their roles from technologists who prevent breaches to corporate strategists who manage cyber risk.”

    Those who understand these seven trends will be better able to address new risks and elevate their role, but it requires reframing the security practice and rethinking technology, as well as preparing to respond to new threats.

    Trend No. 1: Attack surface expansion 

    Currently, 60% of knowledge workers are remote, and at least 18% will not return to the office. These changes in the way we work, together with greater use of public cloud, highly connected supply chains and use of cyber-physical systems have exposed new and challenging attack “surfaces.”

    This leaves organizations more vulnerable to attack. Gartner recommends security leaders look beyond traditional approaches to security monitoring, detection and response to manage a wider set of risks.

    Trend No. 2: Identity system defense 

    Identity systems are coming under sustained attack. Misuse of credentials is now a primary method that attackers use to access systems and achieve their goals. For example, in the SolarWinds breach attackers used a supplier’s privileged access to infiltrate the target network.

    Gartner uses the term identity threat detection and response (ITDR) to describe a collection of tools and processes to defend identity systems. In the longer term, more consolidated solutions will emerge.

    Trend No. 3: Digital supply chain risk 

    Gartner predicts that by 2025, 45% of organizations worldwide will have experienced attacks on their software supply chains, a three-fold increase from 2021.

    Security and risk management leaders need to partner with other departments to prioritize digital supply chain risk and put pressure on suppliers to demonstrate security best practices.

    Trend No. 4: Vendor consolidation 

    Security products are converging. Vendors are consolidating security functions into single platforms and introducing pricing and licensing options to make packaged solutions more attractive.

    While it may introduce new challenges such as reduced negotiating power and potential single points of failure, Gartner sees consolidation as a welcome trend that should reduce complexity, cut costs and improve efficiency, leading to better overall security.

    Trend No. 5: Cybersecurity mesh 

    The cybersecurity mesh is a modern conceptual approach to security architecture that enables the distributed enterprise to deploy and integrate security to assets, whether they’re on premises, in data centers or in the cloud.

    Gartner predicts that by 2024, organizations adopting a cybersecurity mesh architecture will reduce the financial impact of individual security incidents by an average of 90%.

    Trend No. 6: Distributed decisions 

    Executive leaders need a fast and agile cybersecurity function to support digital business priorities. However, as more aspects of the business are digitalized, the job is becoming too big for a centralized CISO role. Leading organizations are building the office of the CISO to enable distributed cyber judgment.

    The CISO and the centralized function will continue to set policy, while cybersecurity leaders are placed in different parts of the organization to decentralize security decisions. 

    Trend No. 7: Beyond awareness

    Human error continues to feature in most data breaches, showing that traditional approaches to security awareness training are ineffective. Progressive organizations are moving beyond outdated compliance-based awareness campaigns and investing in holistic behavior and culture change programs designed to provoke more secure ways of working.

    Resource : https://www.gartner.com/en/articles/7-top-trends-in-cybersecurity-for-2022?utm_source=Bambu&utm_medium=Social_Organic&utm_campaign=Stratascale%20 Strategic%20Update_SocialPost_June2022&blaid=3185810

    28Jul, 2022
    Security – Account lockout policy in Windows 11 is enabled by default to block brute force attacks

    Starting with Windows 11 Microsoft introduce by default an account lockout policy that can block brute force attacks.

    Starting with Windows 11 Insider Preview build 22528.1000 the OS supports an account lockout policy enabled by default to block brute force attacks. The lockout policy was set to limit the number of failed sign-in attempts to 10, for 10 minutes.

    “Win11 builds now have a DEFAULT account lockout policy to mitigate RDP and other brute force password vectors. This technique is very commonly used in Human Operated Ransomware and other attacks – this control will make brute forcing much harder which is awesome.” announced David Weston, Microsoft vice president for enterprise and OS security.

    The Account lockout threshold policy allows setting the number of failed sign-in attempts that will cause a user account to be locked. Once the account has been locked, it cannot be used until the admin reset it or until the number of minutes specified by the Account lockout duration  policy setting expires.

    account lockout policy

    The lockout policy is supported by Windows 10 and some Windows Server builds.

    A collateral effect is that threat actors can abuse this feature to launch denial-of-service (DoS) attacks, causing problems for the target organizations.

    Resource : https://securityaffairs.co/wordpress/133568/security/windows-account-lockout- policy.html