BACKSTORY - A cloud-based enterprise-level threat analytics platform from Chronicle (Google company). Sounds interesting so, The most important question is , Are you ready to store your security logs on Google cloud platform?

Backstory converts log data—such as DNS traffic, NetFlow, endpoint logs, proxy logs—into meaningful, quickly searchable and actionable information to help companies gain insights into digital threats and attacks on their networks, but at scale to offer a more complete picture of the threat landscape.

Backstory also compares data against "threat intelligence" signals collected from a variety of partners and other sources, including the Alphabet-owned VirusTotal, Avast, Proofpoint and Carbon Black.

It also continuously compares any new piece of information against your company's historical activity, to notify you of any historical access to known-bad web domains, malware-infected files, and other threats

https://thehackernews.com/2019/03/backstory-cybersecurity-software.html

"Frequency Hopping" Transmitter (MIT Invention) could secure, among other products, "medical devices, such as insulin pumps and pacemakers, that could be attacked if a hacker wants to harm someone."

Traditional frequency hopping breaks data down into large packets, but the process is just slow enough for adept hackers to still attack them. However, the new transmitter hops each individual "1" or "0" bit to a unique, random frequency every microsecond. Attackers simply cannot keep up with such a frenetic pace, the release explains.

The transmitter works by leveraging bulk acoustic wave (BAW) resonators, which can quickly shift between RF channel frequencies. Although BAW resonators typically only span four-to-five hegahertz of frequency channels, the researchers were able to divide their resonator's frequencies into about 80 channels, thereby making the technology viable.


https://www.scmagazine.com/mit-researchers-develop-frequency-hopping-transmitter-that-fends-off-attackers/article/772638/

You can't grow a new fingerprint or iris if that information is divulged so, next solution (??) "Brain Password" - Sounds Strange?

Smartphones will be unlocked only by recognizing the brainwaves in response to a series of pictures - an advance that could better protect devices from hackers. According to the scientists at Buffalo University, electroencephalography (EEG) is currently a very easy system, through which the waves of the brain can be recorded.

http://www.ehackingnews.com/2018/06/no-more-need-to-remember-passwords.html

Dark Side of Technology - Sound based hacks (CovertBand)

• Detect people’s activities
• Induce false readings in a phone’s accelerometer
• balancing gyroscopes like drones and hoverboards could be similarly disrupted
• remotely hacking into air-gapped computers
• Covert Sonic Weapon

More details here:
https://www.fastcompany.com/40455626/hack-music-can-watch-you-through-your-devices

Tracking you with audio signals your phone can hear, but you can’t???

The technology, called ultrasonic cross-device tracking, embeds high-frequency tones. 

These ultrasound “beacons” emit their audio sequences with speakers, and almost any device microphone—like those accessed by an app on a smartphone or tablet—can detect the signal and start to put together a picture of what ads you’ve seen, what sites you’ve perused, and even where you’ve been

For More Info:
http://arstechnica.com/security/2016/11/how-to-block-the-ultrasonic-signals-you-didnt-know-were-tracking-you/

SDP for IaaS

SDP (Software-Defined Perimeter)  by itself is a new approach , now it is moving to Cloud

(Keeping my fingers crossed  )

Solution:  is still evolving but the ideas are mentioned in the article.

From the Article:

The problem is that traditional security tools are unable to cope with the speed, scale, and complexity of this new, dynamic world, especially if organizations embrace dynamic release systems such as DevOps. As a result, security teams are unfortunately encountering familiar problems in their IaaS environments, including an inability to keep pace with a dynamic environment, users with over-privileged network access, and an inability to easily perform compliance reporting. Cloud service providers are facing similar challenges with IaaS management access.

For more details:

https://blog.cloudsecurityalliance.org/2016/03/02/the-software-defined-perimeter-and-iaas-a-new-initiative/

Human vulnerability scanner ?? - AVA (Free, open-source) - To identify employees most vulnerable to social engineering attacks

Interesting idea and takes a different approach

From the article:

She realized there’s no real way of knowing whether such training is effective until it’s too late.

First, a hypothetical example of social engineering at work. Imagine you’re a junior help desk technician at a large company. You’re low on the corporate ladder, and constantly worried about keeping your job. One night you get a text from a number you don’t recognize. “It’s Ted,” the message reads. “I need my password reset immediately. Lots of money riding on this deal.”

1. AVA works in three “phases” to prevent this sort of thing. First, it integrates with corporate directories such as Active Directory and social media sites like LinkedIn to map the connections between employees, as well as important outside contacts.
2. AVA users can craft custom phishing campaigns, both in email and Twitter, to see how employees respond. 
3. Most importantly, it helps organizations track the results of these campaigns. 

You could use AVA to evaluate the effectiveness of two different security training programs, see which employees need more training, or find places where additional security is needed.

AVA users can craft custom phishing campaigns, both in email and Twitter, to see how employees respond. Finally, and most importantly, it helps organizations track the results of these campaigns. You could use AVA to evaluate the effectiveness of two different security training programs, see which employees need more training, or find places where additional security is needed.

For more information:

http://www.wired.com/2015/08/ava-human-vulnerability-scanner-finds-your-weakest-security-link/

Windows 10 - Has WiFi Sense

Makes life little easier for users but, how secure will it be?

My concern is that it is enabled by default, I prefer the opposite.

From the Article:

If you wander close to a wireless network, and your friend knows the password, and you both have Wi-Fi Sense, you can now log into that network

Wi-Fi Sense doesn’t reveal the plaintext . The password must be stored centrally by Microsoft, and is copied to a device for it to work.

The password is sent over an encrypted connection and stored in an encrypted file on a Microsoft server, and then sent over a secure connection to your contacts' phone

In theory, someone who wanted access to your company network could befriend an employee or two, and drive into the office car park to be in range, and then gain access to the corporate wireless network.

Microsoft enables Windows 10's Wi-Fi Sense by default, and access to password-protected networks are shared with contacts unless the user remembers to uncheck a box when they first connect.  

For More information:

http://www.theregister.co.uk/2015/06/30/windows_10_wi_fi_sense/

Windows 10 adds new Antimalware Scan Interface (AMSI)

Nice to know Microsoft is getting better with security



From the article:

The goal of the new Antimalware Scan Interface (AMSI) is to let applications send content to the locally installed antivirus product to be checked for malware.

According to Microsoft, this can have important benefits when dealing with script content in particular, because malicious scripts are commonly obfuscated to bypass antivirus detection. Scripts also typically get executed in the memory of the applications that are designed to interpret them, so they don't create files on disk for antivirus programs to scan.

Scripting is not the only type of content that can be scanned with this new feature. Communication apps could scan instant messages for viruses before displaying them to users and games could scan plugins before installing them

For more info:
http://www.csoonline.com/article/2934872/application-security/windows-10-will-allow-apps-to-actively-scan-their-content-for-malware.html

Finally - Microsoft adds HSTS support for IE in Windows 7 and 8.1

Better late than never.
This feature was made available in other browsers a few years back.


From the article:

Short for HTTP Strict Transport Security, HSTS is a browser header that forces any sessions sent over HTTP to be sent instead over HTTPS based on a preloaded list of sites supporting the protocol. HSTS encrypts communication to and from a website, and puts a dent in attempts to man-in-the-middle web sessions. According to OWASP, HSTS also stops attackers who use invalid digital certificates. The protocol denies users the ability to override invalid certificate messages. HSTS also protects users from HTTPS websites that also may include HTTP links or serve content unencrypted.

The addition of HSTS was included in a cumulative update for Internet Explorer released yesterday. 


Click below for more info:
https://threatpost.com/microsoft-brings-hsts-to-windows-7-and-8-1/113258

USB KillSwitch - Interesting idea , maybe useful

From the article:

"USBKill" is a script that turns an innocent-looking thumb drive into a kill switch that, when unplugged, forces computers to shut down.

"USBKill waits for a change on your usb ports, then immediately kills your computer," Hephaestos says in a Github document.

For More details check the link below:

http://www.theregister.co.uk/2015/05/05/usbkills_laptops_to_beat_the_heat/

HTTP/2 - What is it and what is new?

9 Things To Expect

1. Same HTTP APIs

Making HTTP/2 succeed means that it has to work with the existing Web. So, this effort is about getting the HTTP we know on the wire in a better way, not changing what the protocol means.

2. Cheaper Requests

The Web performance community’s mantra is “avoid HTTP requests” because HTTP/1 make them expensive. This has given rise to techniques like inlining, concatenation and spriting to reduce the number of requests on a page.

With HTTP/2, these techniques shouldn’t be necessary

3. Network- and Server-Friendliness

HTTP/2 allows the use of a single connection per host, and encourages sites to consolidate their content on one host where possible.

4. Cache Pushing

HTTP/2’s “server push” allows a server to proactively send things to the client’s cache for future use.

5. Being Able to Change Your Mind

HTTP/2 adds the RST_STREAM frame to allow a client to change its mind; if the browser navigates away from a page, or the user cancels a download, it can avoid having to open a new connection without wasting all of that bandwidth.

6. More Encryption

HTTP/2 doesn’t require you to use TLS (the standard form of SSL, the Web’s encryption layer), but its higher performance makes using encryption easier, since it reduces the impact on how fast your site seems.

7. No More Text

One of the nice things about HTTP/1 is the ability to open up telnet, type in a request (if the server doesn’t time out!) and then look at the response. This won’t be practical in HTTP/2, because it’s a binary protocol. Why?

While binary protocols have lower overhead to parse, as well as a slightly lighter network footprint, the real reason for this big change is that binary protocols are simpler, and therefore less error-prone.

8. It’ll Take Some Time to Get it Right

HTTP/2 isn’t magic Web performance pixie dust; you can’t drop it in and expect your page load times to decrease by 50%.

It’s more accurate to view the new protocol as removing some key impediments to performance; once browsers and servers learn how and when to take advantage of that, performance should start incrementally improving.

9. HTTP/3 and Beyond

HTTP/1.x has lasted for more than fifteen years; why would we be even considering HTTP/3 before HTTP/2 is done?

One of the big reasons that HTTP/2 took so long to get to is that upgrading the protocol in the deployed infrastructure is really hard; there are lots of boxes out there that assume HTTP/1 will never change.

So, if the transition from HTTP/1 to HTTP/2 goes well, it should be a lot easier to introduce the next version, because we can use the same mechanism that we used for the first big hop.

The link below has more information:-

https://www.mnot.net/blog/2014/01/30/http2_expectations

The most important Internet security group you’ve never heard of

Interesting....

From the Article

The FIDO Alliance includes technology heavyweights like Google, Lenovo, Microsoft and Samsung; payments giants Discover, MasterCard, PayPal and Visa; financial services companies such as Aetna, Bank of America and Goldman Sachs; and e-commerce players like Netflix and Salesforce.com. 

FIDO was founded by Lenovo, PayPal, and security technology companies AGNITiO, Nok Nok Labs and Validity Sensors

Two new authentication standards have been published for peer review, half a dozen companies showcased FIDO-Ready solutions at the 2014 Consumer Electronic Show (CES)

Follow this link for additional details:

http://www.zdnet.com/the-most-important-internet-security-group-youve-never-heard-of-7000033537/

MPTCP - New concern for security folks? ;

I guess the security tools have a lot to catch up

(From the article)

If any of your security decisions, tools, thought-processes, manual processes, if they rely on any of... these four things, then something in those is going to break," he says. 

1. If you expect to see all app layer data within a TCP stream; 
2. if you expect to differentiate clients from servers based on the connection direction; 
3. if you expect to tamper with or close bad connections midstream; 
4. if attempt to associate logical connections to IP addresses. 

If you make any security decisions based on any of those, then those security mechanisms are going to break in the face of MPTCP.

The link below has more information:-

http://www.darkreading.com/analytics/security-monitoring/some-security-tools-fail-with-multipath-tcp/d/d-id/1297733

Firefox OS - Now available on 7 devices in 15 countries

Not the greatest of news but something good about my favorite company



The link below has more information:-

http://www.theregister.co.uk/2014/07/17/firefox_os_global_expansion/

Apple + IBM - What happens when a giant in Consumer Mobile computing space joins hands with Enterprise computing space.

Apple and IBM are coming together. Which is good news for Enterprise admins.

Apple devices have been the favorites of upper management but there were not many players who would integrate them well with the IT space.

Now that IBM is here we can expect something.

Since, Apple is not cheap, I presume IBMs  offering will not be either (was IBM ever less expensive?)

(From the article)

The joint statement offered more detail, saying the partnership will provide:

• More than 100 industry-specific enterprise solutions including native apps, developed exclusively from the ground up, for iPhone and iPad;
• IBM cloud services optimized for iOS, including device management, security, analytics and mobile integration;
• New AppleCare service and support tailored for the enterprise;
• New "packaged offerings" from IBM for mobile device activation, supply and management

The link below has more information:-

http://www.computerworld.com/s/article/9249748/Update_Apple_and_IBM_team_up_on_historic_enterprise_push?source=CTWNLE_nlt_datamgmt_2014-07-16

FYI - 1 TB data in postage stamp sized memory device.- RRAM

(From the article)

Rice University’s breakthrough silicon oxide technology will allow manufacturers to fabricate “resistive random-access memory” (RRAM) devices at room temperature with conventional production methods, the researchers say. In a new paper in Nano Letters, a Rice team led by chemist James Tour compared its RRAM technology to more than a dozen competing versions.



The link below has more information:-

http://www.kurzweilai.net/rices-silicon-oxide-memories-catch-manufacturers-eye

Would you believe this - NSS Labs claims IE better than other browsers in Malware detection

Fact is stranger than fiction

According to the article:- 

Microsoft's combination of application reputation technology and URL filtering gave Internet Explorer a malware block rate that blew pass Google Chrome, Mozilla Firefox and Apple Safari.

The latest tests from NSS Labs showed IE with a 99.9 percent block rate for what the security tester calls socially engineered malware (SEM). Chrome had a rate of 70.7 percent while Firefox and Safari hovered around 4 percent.

Microsoft and Google use a combination of application reputation technology and URL filtering in detecting malware. The difference is Microsoft relies more on URL filtering, while Google does the opposite

NSS Labs also tested three leading browsers from China. The Liebao Browser, developed by anti-virus vendor Kingsoft, came in second behind IE with a block rate of 85.1 percent.

Liebao surpassing Chrome is unexpected because most browser makers have turned toward application reputation, also called content-agnostic malware protection (CAMP), because it is believed to be the most effective.

The link below has more information:-

http://www.csoonline.com/article/2138463/data-protection/ie-easily-beats-chrome-firefox-safari-in-malware-detection.html#tk.rss_applicationsecurity

Interesting - Contact lens with Infrared vision -

Sounds good but, would people take the pain of wearing contact lens , instead of a regular goggles?

According to the article:- 

Seeing the infrared spectrum has a number of applications that go beyond the nighttime war games glamorized in adventure flicks. Doctors can use the wavelengths to monitor blood flow, and civil engineers can use them to identify heat or chemical leaks

And it’s so thin that it could be integrated in cell phones, eyeglass-mounted computers and even contact lenses to provide an infrared-vision mode

The link below has more information:-

http://singularityhub.com/2014/03/29/contact-lenses-with-infrared-vision-ultra-thin-graphene-opens-up-the-possibilities/

Technology - MYLAR - Build online services that can never decrypt or leak your data.

Another layer of security for data protection.

The idea looks good and it will need a good password escrow/vaulting (which requires additional Auditing)  solution to reduce accidental loss  of passwords.

Will this reduce the NSA and other snooping related fears?

According to the article:- 

Your data gets encrypted using your password inside your browser before it goes to the server,” Popa says. “If the government asks the company for your data, the server doesn't have the ability to give unencrypted data.” 

Popa developed the software with colleagues from MIT and a Web development software company, Meteor Development Group. A paper on Mylar will be presented at the Usenix Symposium on Networks Systems Design and Implementation next month.

The software is designed to work with a popular Web service building tool called Meteor, to make it easy for Web developers to use. Mylar’s design has code running inside a person’s browser take on most of the processing and presenting of information—work that a conventional service would do on its servers. But Mylar also includes some new cryptographic tricks that allow a server to do useful things with user data without having to descramble it.

Mylar also lets individuals share data with other users, thanks to a system that can distribute the necessary encryption key in a way that protects it from ever being disclosed either to the server or to someone monitoring communications. 

A big usability challenge is that if anyone loses their password, they can permanently lose access to their information. 

The links below has more information

http://www.technologyreview.com/news/525651/new-approach-could-stop-websites-from-leaking-or-stealing-your-data/