Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for System time jumps in ...

 News

Every now and then, Windows 10 users and administrators wonder why the time on their systems suddenly jumps by several weeks, months or even years (either forward or backward). What could be the cause of those jumps? Ars Technica journalists did a little research, and found that it might be linked to the Secure Time   show more ...  

Seeding feature. In this post I explain how this feature seems to work, and what can be done to prevent such unexpected jumps. What is Secure Time Seeding? Secure Time Seeding (STS) was added to Windows 10 in 2015. The feature is intended to correct discrepancies between the time set in the system and the actual time – primarily when a computers battery feeding the internal real-time clock dies and the time settings have nothing in common with reality. Most importantly, STS is able to correct the system time without accessing the current-time servers. But why is such a correction of time discrepancies even needed? Oddly enough, for security. Typically, client-server data exchange (including system connection to the internet time servers) is protected with SSL/TLS encryption protocols. To establish such a connection with the server, the client first needs to verify its digital certificate, and these certificates have a certain validity period. Therefore, if the time in the system is set with a significant error, the certificate may be considered expired, and a secure connection wont be established. So a vicious circle appears: in order to find out the current time, the computer needs to know the current time. It doesnt have to be perfectly accurate; the approximate time can work too. But the greater the difference between the system time and the actual time, the greater the chance the certificate will get flagged as expired. STS introduces (at least in its developers minds) a way for the system to automatically identify and correct major discrepancies, even when a secure connection cannot be established with any server. This is achieved by using current timestamps and digital-certificate expiry dates contained in the data sent by the servers to the client during the initial establishment of a secure connection (the SSL and TLS handshakes). The exact algorithm of STS is unknown. But the general idea is that Windows pulls data from the SSL handshake and uses it to compute a reliable range for the current time and assign it a probability. As new data becomes available, the range is updated, and the probability can gradually increase. When it reaches a certain threshold, STS decides to change the system time to the median time from the range it deems reliable. In theory, such precision should suffice to establish a secure connection, connect to a current time server, and get the precise time. Why you should disable Secure Time Seeding The main problem is that the feature is enabled in Windows 10 by default and operates regardless of whether the computers built-in clock has ever been out of sync. As a result, STS can reset the time at any moment when Microsofts secret algorithm decides that there are enough signs that the clock is telling the wrong time and needs fixing. The reason for such malfunctions in Secure Time Seeding isnt fully understood. One suggested cause is the significant rise in popularity of SSL/TLS implementations that send an incorrect timestamp during the handshake. The chief suspect here is the frequently used OpenSSL library (which, instead of the current server time, puts random values in the timestamp). Moreover, this bug can also occur in server versions of the operating system: Windows Server 2016, Windows Server 2019, and Windows Server 2022. And while for regular computer users the issue is little more than a nuisance, for servers it can be catastrophic, since their correct operation often relies on the time being accurate. Theres an unofficial piece of advice on this from a senior Microsoft technical support official for Active Directory Domain Controller Administrators: ? Hey people, if you manage Active Directory domain controllers, I want to give you some UNOFFICIAL advice that is solely my personal opinion: Disable Secure Time Seeding for w32time on your DCs. ? Unofficial advice from a Senior Windows Escalation Engineer: disable Secure Time Seeding Disabling Secure Time Seeding in Windows To disable STS, locate the following key in the Windows registry: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesW32TimeConfig Find the UtilizeSslTimeData value and set it to 0. ? Disabling Secure Time Seeding in the Windows registry Alternatively, you can run the following command as an administrator in the Windows command prompt (CMD): reg add HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesw32timeConfig /v UtilizeSslTimeData /t REG_DWORD /d 0 /f After changing the value, you need to reboot the system. If this is difficult or impossible, you can force the update with this command: W32tm.exe /config /update That done, the STS feature will stop bugging you. Now all that remains is to ensure that the system clock always stays accurate. On this point, the Ars Technica article gives a couple of helpful tips for server administrators.

 Incident Response, Learnings

The incident affected healthybydefault.hawaii.gov — a website created by the Hawai?i State Department of Health (DOH) in compliance with a 2020 state law that mandates healthy beverages be the default option in children’s meals.

 Trends, Reports, Analysis

Far fewer board members of UK companies are worried about cyber risk than their global peers, according to the second annual Cybersecurity: The 2023 Board Perspective Report from Proofpoint.

 Geopolitical, Terrorism

Russia has launched sympathetic media outlets, courted anti-French public support, and created fake civil society organizations in turbulent African states, according to an investigation by Microsoft.

 Govt., Critical Infrastructure

The UK’s National Cyber Security Centre (NCSC) has announced its new chief technology officer (CTO) will be Ollie Whitehouse. Whitehouse joins the NCSC from UK-headquartered information assurance firm NCC Group, where he worked for many years.

 Trends, Reports, Analysis

CISA Director Jen Easterly said in a statement that the goal of the pledge is to address K-12 cybersecurity issues and help ensure schools and administrators “have access to technology and software that is safe and secure right out of the box.”

 Govt., Critical Infrastructure

The U.S. government’s cybersecurity agency CISA on Monday confirmed the addition of Peiter ‘Mudge’ Zatko to its roster of prominent voices preaching the gospel of security-by-design and secure-by-default development principles.

 Companies to Watch

Exposure management solutions provider Tenable announced on Thursday that it has entered into a definitive agreement to acquire Israeli cloud security startup Ermetic for roughly $240 million in cash and $25 million in restricted stock and RSUs.

 Feed

Ubuntu Security Notice 6353-1 - Wooseok Kang discovered that PLIB did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted TGA file, an attacker could possibly use this issue to cause applications using PLIB to crash, resulting in a denial of service, or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 6352-1 - It was discovered that Apache Shiro incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to bypass security restrictions.

 Feed

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.

 Feed

Ubuntu Security Notice 6351-1 - It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service. Zi Fan Tan   show more ...  

discovered that the binder IPC implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Red Hat Security Advisory 2023-5019-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.15.0 ESR.

 Feed

Red Hat Security Advisory 2023-4991-01 - Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to   show more ...  

write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.

 Feed

Ubuntu Security Notice 6350-1 - It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service. Zi Fan Tan   show more ...  

discovered that the binder IPC implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 6349-1 - Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of service. Zi Fan Tan discovered that the binder IPC implementation in the Linux   show more ...  

kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Microsoft on Wednesday revealed that a China-based threat actor known as Storm-0558 acquired the inactive consumer signing key to forging tokens to access Outlook by compromising an engineer’s corporate account. This enabled the adversary to access a debugging environment that contained a crash dump of the consumer signing system that took place in April 2021 and steal the key. “A consumer

 Feed

By the end of 2024, the number of MSPs and MSSPs offering vCISO services is expected to grow by almost 5 fold, as can be seen in figure 1. This incredible surge reflects the growing business demand for specialized cybersecurity expertise and the lucrative opportunities for MSPs and MSSPs in vCISO services. Figure 1: Timeline for offering vCISO services The State of the Virtual CISO Survey Report

 Feed

Patches have been released to address two new security vulnerabilities in Apache SuperSet that could be exploited by an attacker to gain remote code execution on affected systems. The update (version 2.1.1) plugs CVE-2023-39265 and CVE-2023-37941, which make it possible to conduct nefarious actions once a bad actor is able to gain control of Superset’s metadata database. Outside of these

 Feed

A Mirai botnet variant called Pandora has been observed infiltrating inexpensive Android-based TV sets and TV boxes and using them as part of a botnet to perform distributed denial-of-service (DDoS) attacks. Doctor Web said the compromises are likely to occur either during malicious firmware updates or when applications for viewing pirated video content are installed. "It is likely that this

 Feed

A new malvertising campaign has been observed distributing an updated version of a macOS stealer malware called Atomic Stealer (or AMOS), indicating that it’s being actively maintained by its author. An off-the-shelf Golang malware available for $1,000 per month, Atomic Stealer first came to light in April 2023. Shortly after that, new variants with an expanded set of information-gathering

 Data loss

AI news is bad news, an online service to catch your cheating partner, and an IoT-enabled dick cage fails to keep a grip on its own security. All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined   show more ...  

this week by Mark Stockley. Plus don't miss our featured interview with Alex Lawrence, principal security architect at Sysdig.

 Threat Lab

Cybercrime is on the rise. The number of ransomware attacks has increased by 18%, while the worldwide volume of phishing attacks doubled to 500 million in 2022. Depending on the size of the business, one-third to two-thirds of businesses suffer malware attacks in any given year. And those attacks are costing   show more ...  

companies a lot of money. In 2022, American businesses lost $10.3 billion to data breaches and cybercrime. This is all happening while companies are spending trillions digitizing their business operations and trying to obtain secure cyber insurance while keeping up with regulatory changes in GDPR, HIPAA, and Sarbanes-Oxley. The best way to weather these challenges is to become a cyber resilient business. That means implementing a layered security and data management strategy that encompasses prevention, protection, and recovery so that your data, your bottom line, and your reputation remain secure. In this article, we’ll discuss the importance of data security and protection. How to protect your data A sophisticated, layered security strategy will already have prevention tools like endpoint and DNS protection in place as well as security awareness training to stop threats before they reach your network. Unfortunately, that’s not enough. Attacks are becoming increasingly sophisticated and complex, and that first line of defense may not catch them all. If a threat can penetrate the prevention layer, protection-layer tools kick in to neutralize the threat or minimize the damage of an attack. Here are two tools that can protect your data: 1.   Email threat protection and email continuity Email is one of the most common entry points for attacks, from phishing links to ransomware and business email compromise (BEC) to malicious attachments. Cyber criminals can mimic trustworthy senders so you need a tool that helps you tell the difference between a safe email and suspicious one. Tools like Webroot’s Advanced Email Threat Protection analyze the links and attachments in messages to detect malware and keep your systems secure against threats. Webroot Email Continuity can continue to send and receive emails for up to 30 days even if the infrastructure is down. 2.   Email encryption Companies rely on email to distribute important information, but when that information is confidential and sensitive, you need an encryption tool to protect it. If a cyber criminal gets access to emails, they won’t be able to access that sensitive data if it’s encrypted. Webroot Advanced Email Encryption powered by Zix is an industry-grade encryption tool that runs in the background, without disrupting workflows or requiring any input from the user. It’s invisible to the user and requires no extra training, while keeping your communications confidential. Also, default and customizable Data Loss Prevention (DLP) policies are available at no additional cost to prevent unauthorized users from emailing sensitive data to parties outside the organization. Customer stories When Spitzer Automotive’s new Chief Information Officer joined the company in 2019, he realized there was a big problem that affected the company’s security and employee productivity: employees were spending too much time reviewing emails for spam. One phishing attack slipping through human review could cause big problems for the company in downtime, financial loss, and reputational damage. Spitzer chose Webroot’s Advanced Email Threat Protection and Email Continuity as a cloud-based solution to pair with Microsoft 365. Not only were they able to save money by bundling the two together, but it also allowed the company to automate email protection by reducing the number of email threats and quarantining malicious emails. Allery, Asthma, and Sinus Center had a different reason for using Webroot Email Threat Protection and Email Continuity. As a healthcare group, they had sensitive patient data to protect and a ransomware attack from malicious emails could put that at risk. Once they put the Webroot system in place, they were able to focus on other IT matters while knowing that patient data was safe. It also allowed them to be HIPAA compliant. To learn more about building cyber resilience with layered security, download our guide. The post Building a Cyber Resilient Business: The Protection Layer appeared first on Webroot Blog.

 Threat Lab

When it comes to keeping sensitive data safe, email encryption is a necessity. But it doesn’t have to be a necessary evil. Too many employees and IT experts have experienced the pain of trying to use a needlessly complicated email encryption solution. There’s the endless steps, the hard-to-navigate portals, and   show more ...  

the time-consuming processes that add up to a frustrating experience for most. If this is the experience you’ve come to expect, Webroot Email Encryption powered by Zix is here to surprise you. Webroot simplifies, streamlines, and secures the encryption process making email security easier than ever. Transparent Delivery Simplifies the Recipient Process The recipient process has historically been one of the biggest pain points for email encryption software customers. It’s often complicated and cumbersome, filled with portals, secret passwords, and extra steps. It shouldn’t be that difficult just to read an email, and now it doesn’t have to be. Webroot Email Encryption drastically simplifies the email recipient process. When both the sender and the recipient are Webroot clients, the software will encrypt the outgoing email from one customer, and send it to the recipient completely transparently—regardless of the email content. No portal, no passwords, no extra steps – just a blue bar at the top of the email confirming it was sent securely. From there, the recipient can reply to the email exactly as they would a regular email. Even without transparent delivery, Webroot’s Email Encryption makes the recipient process intuitive for non-Webroot clients. The recipient secure email portal is designed for non-technical people to be able to access, read, and reply to encrypted emails easily. State of the Art Filters Enable Automatic Encryption Security tools only work when people use them, and even with the best IT policies in place, it’s difficult to stop employees from sending sensitive information without encryption. While many organizations have increased their employee training amid an increased threat landscape, training only goes so far. Exposing sensitive information isn’t just an organizational problem, it’s also a regulatory one. The Health Insurance Portability and Accountability Act (HIPAA) requires that all patient data is kept secure and private. With traditional email encryption solutions, this burden falls on employees every time. For healthcare organizations, this is an added layer of complication on top of an often hectic landscape for employees. Thankfully, Webroot’s Email Encryption offers automatic encryption, removing the burden from employees of having to remember to encrypt sensitive emails every time they send one. Webroot Email Encryption provides out-of-the-box automatic policies for HIPAA, Social Security numbers, and financial information. When a policy is triggered—whether the sender has elected to encrypt the email or not—emails can be encrypted, blocked or quarantined. The result? Any email containing sensitive information is automatically encrypted, saving both employees and the organization at large from the threat of a security breach. Purpose-Built Add-Ons Make Integration Seamless Email encryption is just one piece of the cybersecurity puzzle. Every organization has a unique set of security needs, and a threat could severely affect operations at any time. That’s why it’s important to ensure your email encryption solution comes along with purpose-built add-ons and can also seamlessly integrate with other security solutions. Webroot Email Encryption can be easily integrated and is also part of a larger network of threat protection that keeps your organization safe. OpenText Cybersecurity brings together a number of product families (Webroot, Carbonite and Zix) that can be brought in to improve and enhance the overall user experience, like: Single Sign-On with SAML 2.0: Allows a user to login to their Webroot Secure Message Portal with their own credentials they’ve already created through the customer’s website. Without having to login again, users click a link to be taken directly to their secure inbox. This feature is implemented in using SAML 2.0, which authorizes user access to web services across organizations. Webroot Email Threat Protection:  Email Encryption provides multilayered filtering for both inbound and outbound emails that lets the right emails through while blocking malicious threats such as phishing, ransomware, impersonation, business email compromise (BEC) and spam. It also offers attachment quarantine, link protections, message retraction, and a round-the-clock live threat analyst team. Ready to Learn More? Seeing how simple email encryption can be is surprising, we know. And we’ve only just scratched the surface. If you want to learn more about how OpenText Cybersecurity can help make email surprisingly secure and simple, you can request a demo here. The post How Easy is Email Encryption? You’d Be Surprised. appeared first on Webroot Blog.

2023-09
Aggregator history
Thursday, September 07
FRI
SAT
SUN
MON
TUE
WED
THU
SeptemberOctoberNovember