#itmagazine

The Indian Computer Emergency Response Team (CERT-In), after discovering vulnerabilities has now issued an advisory to update the Google Chrome browser to the latest version. The last version which is older than 88.0.4324.146 for Mac, Linux and Windows systems has come up with a lot of challenges and issues.

In its advisory, CERT-In said, “Multiple vulnerabilities have been reported in Google Chrome which could be exploited by an attacker to execute arbitrary code on the targeted system.”

According to Google blog, the security vulnerabilities are not being disclosed “until a majority of users are updated with a fix.” This could have a drastic effect on the user as it could help an attacker to execute arbitrary code, could view, change or delete data in the targeted system.

Further explaining the problem, CERT-In revealed, “Multiple vulnerabilities exist in Google Chrome due to Use after free in payments, Heap buffer in extensions, Heap buffer in Tab Groups, Use after Free in Fonts, Use after Free in Navigation, Inappropriate implementation in Skia and Heap buffer overflow in V8. An attacker could exploit these vulnerabilities by persuading the victims to persuade a specially crafted website.”Google has already rolled out the beat version of Chrome 89 and it is going to come up with further updates over the coming weeks and days.

Veeam Software reported results for its fiscal year 2020. Veeam kicked off 2020 with the completion of its acquisition by Insight Partners, which was announced on Jan. 9 at a valuation of $5 billion, setting the pace for a year of substantial growth and expanded success across all market segments, culminating with Veeam’s acquisition of Kasten, the market leader for Kubernetes Backup and Disaster Recovery (DR), in Q4’20.

“Even with the unforeseen challenges and circumstances that began in early 2020, Veeam continued its rapid growth with its second consecutive year of bookings over $1 billion and a 22% year-over-year (YoY) increase in annual recurring revenue (ARR),” said William H. Largent, chairman and CEO at Veeam.

"2020 was a defining moment for data protection and management. More than ever, we are seeing our customers looking for reliability and ease of use in their Cloud Data Management solutions, and in Q4, APJ demonstrated another quarter of double-digit growth with an annual recurring revenue (ARR) increase of 24 percent year-over-year (YoY). This is a testament to our ongoing commitment to our customers and partners, enabling them to unleash the power of digital and data mobility," said Shiva Pillay, Vice President, Sales and Field Operations, Asia Pacific and Japan.

"APJ is growing around 10 times the market average and the exceptional growth would not be possible without the support of our customers and partners. We welcomed over 400,000+ customers globally, including APJ customers such as Kintetsu in Japan and Gammon Construction and Jebsen in Hong Kong last quarter. As a 100% channel organization, we would not have been able to garner these results without the constant support and hard work with our partners - over 1700 transacting partners in Q4. We continue to focus and invest in our relationships with existing and potential partners, which has been well received and backed with strong results. In Q4, we had investment of 200 partners to undertake the highest level of accreditation which gives them to the ability to design, build and deploy Veeam Solutions which in turn supports this customer growth. This year, businesses will be put to the test in achieving business growth while keeping up with the rapid pace of innovation and digital transformation. Veeam's priorities remain clear and focused on helping our customers and partners build the best data protection platform for virtual and modern data infrastructures, and at the same time, protect workloads on-premises and across multi-cloud environments. We continue to execute well and plan to continue our growth momentum in APJ, backing that up with hiring across all functions to support our customer and partners.”

During 2020, Veeam’s vision for hybrid cloud drove the company to continued growth, surpassing 400,000 customers. Specifically, Veeam Backup for Microsoft Office 365, Veeam’s fastest growing product for the past two years, reported 73% growth YoY. Veeam Backup for Microsoft Office 365 has now been downloaded by more than 154,000 organizations, representing over 15 million user mailboxes. Version 5, released in December 2020, adds purpose-built backup and recovery for Microsoft Teams, making it easier than ever for users to quickly find and restore Teams data, including entire groups, specific channels and settings. Protecting this data is more critical than ever, as the shift to remote working has created an explosion in Microsoft Teams adoption over the past year, with 115 million daily active users last month, up 475% from 20 million daily active users almost 12 months ago.

Q4 & 2020 Customer, Product and Partner Highlights

· Veeam was positioned by Gartner, Inc. in the Leaders quadrant of the 2020 Magic Quadrant for Data Center Backup and Recovery Solutions[ii]. Not only does this mark the fourth time Gartner has recognized Veeam as a category Leader, but it is the first time Veeam is positioned highest overall in ability to execute. Veeam was also the only vendor to move higher in both ability to execute and in the completeness of vision categories.

· Further proof of Veeam’s growth trajectory was displayed in the most recent IDC Semi-Annual Software Tracker for Data Replication & Protection 1H’20[iii] which showed that Veeam has delivered the fastest revenue growth year-over-year in 1H’20, among the top five vendors, the combined revenues of non-top 5 vendors and overall market average. Veeam’s YoY growth in the first half of 2020 was more than 8 percentage points above the market average.

· Veeam announced 16 major releases (25+ including updates) in 2020, with hundreds of new capabilities. This includes Veeam Backup & Replication v10, Veeam ONE™ v10, Veeam Backup for Nutanix AHV v2, Veeam Service Provider Console v4, Veeam Backup for Microsoft Azure v1, Veeam Availability Orchestrator v3, Veeam Backup for Microsoft Office 365 v5 and Veeam Backup for AWS v3.

· With more than 650,000 unique downloads of Veeam Backup & Replication v10 since general release in late February 2020, the product averages more than one download per minute, a testament to the product’s simplicity, flexibility and reliability. With more than 150 new features and enhancements, including powerful NAS support, multi-VM Instant VM Recovery® and heightened ransomware protection, v10 includes data protection capabilities that increase availability, portability, and extensibility for Cloud Data Management.

· Veeam continues to release new features and enhancements ideal for enterprise environments, which has resulted in +250% growth YoY in large-deal transactions.

· Veeam now counts 82% of the Fortune 500 and 69% of the Global 2000 as customers. Key customers include Airbus Defence & Space, Alpha Bank, Avnet, Broward County Schools (FL), Dassault Aviation, Datev, Deloitte, Engie, Hero MotoCorp, Hertz, IBM Cloud, Pernod Ricard, Penske Australia and New Zealand, Puma, Quinnipiac University, Rabobank, Royal Dutch Shell, Siemens and Wenatchee Valley College.

· Veeam Universal License (VUL), the industry’s first portable license that enables IT agility and workload mobility for multi and hybrid cloud enterprises, accounted for 56% growth YoY.

Veeam’s technology alliance resell agreements with Hewlett Packard Enterprise (HPE), Cisco, NetApp, and Lenovo reported 16% YoY growth.

HCL Technologies (HCL) announced it has entered into a Memorandum of Understanding (MoU) with Indian Institute of Technology Kanpur (IITK) to collaborate in the area of cybersecurity. As part of the MoU, HCL will work with C3iHub, a specialized cybersecurity research center at IITK.

This collaboration will bring together the country’s brightest minds, advanced research capabilities and global resources to develop advanced solutions in the area of cybersecurity. HCL and IITK will bring in real world industry exposure to carry out joint initiatives and research.

The teams will develop a security framework and solutions for cybersecurity challenges in current and future operational technologies as one of the first areas of interest. They will also work together to discover and manage cyber threats, vulnerabilities, and risks for critical infrastructure.

HCL will also work with IITK to identify selective research projects in order to bring them to scale. The projects will be tested on international benchmarks for potential commercialization to products and services, with testing and development performed in a special HCL environment.

Sophos, a global leader in next-generation cybersecurity, today published its latest findings into real world attacks investigated by its Rapid Response team. The article, “Nefilim Ransomware Attack Uses ‘Ghost’ Credentials,” details how a failure to keep close tabs on “ghost” account credentials facilitated two recent cyberattacks, one of which involved Nefilim ransomware.

Nefilim, also known as Nemty ransomware, combines data theft with encryption. The target hit by Nefilim had more than 100 systems impacted. Sophos responders traced the initial intrusion to an admin account with high level access that attackers had compromised more than four weeks before they released the ransomware. During this time, the attackers were able to quietly move through the network, steal credentials for a domain admin account, and find and exfiltrate hundreds of GB of data, before unleashing the ransomware that revealed their presence.

The hacked admin account that enabled this belonged to an employee who had sadly passed away around three months previously. The company had kept the account active because it was used for a number of services.

In the second, unrelated attack, Sophos responders found that intruders had created a new user account and added it to the target’s domain admin group in Active Directory. With this new new domain admin account, the attackers were able to delete approximately 150 virtual servers and encrypt the server backups using Microsoft Bitlocker – all without setting off alerts.

“If it wasn’t for the ransomware that flagged the presence of intruders, how long might the attackers have had domain admin access to the network without the company knowing?” said Peter Mackenzie, manager, Sophos Rapid Response. “Staying on top of account credentials is basic, but critical cybersecurity hygiene. We see far too many incidents where accounts have been set up, often with considerable access rights, that are then forgotten about, sometimes for years. Such ‘ghost’ accounts are a prime target for attackers.

“If an organization really needs an account after someone has left the company, they should implement a service account and deny interactive logins to prevent any unwanted activity. Or, if they don’t need the account for anything else, disable it and carry out regular audits of Active Directory.

“The danger is not just keeping outdated and unmonitored accounts active; it is also giving employees greater access rights than they need. Fewer accounts need to be a domain admin than most people think. No account with privileges should be used by default for work that doesn't require that level of access. Users should elevate to using the required accounts when needed and only for that task. Further, alerts should be set so that if the domain admin account is used or if a new admin account is created, someone knows.”

Nefilim ransomware was first reported on in March 2020. Like other ransomware families such as Dharma, Nefilim mainly targets vulnerable Remote Desktop Protocol (RPD) systems as well as exposed Citrix software. It is one of a growing number of ransomware families, alongside DoppelPaymer and others that engages in so-called “secondary extortion,” with attacks that combine encryption with data theft and the threat of public exposure.

Further information on the incidents, including Indicators of Compromise (IoCs) and tactics, techniques and procedures (TTPs) for the Nefilim attack, can be found in “Nefilim Ransomware Attack Uses ‘Ghost’ Credentials.”

IDEMIA has partnered with Federal Bank in India to improve their existing access control and employee management systems with contactless biometric access control. Based on IDEMIA’s SmartBio SDK, this solution leverages facial and iris verification to authenticate employees for attendance and for access to the Core Banking System (CBS).

The shift to contactless solutions is underway globally, with biometric technology being increasingly explored as an alternative to touch-based authentication methods (such as fingerprint authentication). In this regard, Federal Bank solicited IDEMIA to help them implement a new access control system leveraging facial and iris verification to enable touchless access control at various points. To complete enrolment, employees register their iris using a dedicated device plugged into a laptop. Once registered, the employee’s biometric template is registered to Federal Bank’s database and is used as a reference when access is requested to its secure systems.

Shalini Warrier, Executive Director, Federal Bank said, “Federal Bank is constantly on the lookout for innovative solutions and new technologies that will drive improvements for our employees and customers. The introduction of face authentication techniques is one more step in this direction, and we are delighted to be a pioneer in this capability in India. We are excited to partner with IDEMIA to help implement this new biometric access control system and are confident their expertise in the fields of identity and security will make this a great success.”

In addition to providing additional levels of security, the augmented biometric templates will also enable Federal Bank to extend the capabilities of its multi-biometric system in a post-COVID work scenario.

“IDEMIA is proud to partner with Federal Bank to design and implement a secure biometric system that offers a smarter and more efficient working environment for employees,” says Pankaj Kundra, Digital Business Regional Head for India, Middle East & Africa at IDEMIA. “Together, our partnership will address a key operational challenge of the pandemic by reducing contact points. Implementation of this robust, reliable, and powerful access control system reaffirms IDEMIA’s leadership in contactless biometrics for a secure, convenient and hygienic access control in India.”

ESET researchers have discovered Kobalos, a malware that has been attacking supercomputers – high performance computer (HPC) clusters. ESET has worked with the CERN Computer Security Team and other organizations involved in mitigating attacks on these scientific research networks. Among other targets was a large Asian ISP, a North American endpoint security vendor as well as several privately held servers.

ESET researchers have reverse engineered this small, yet complex malware that is portable to many operating systems including Linux, BSD, Solaris, and possibly AIX and Windows. “We have named this malware Kobalos for its tiny code size and many tricks; in Greek mythology, a kobalos is a small, mischievous creature,” explains Marc-Etienne Léveillé, who investigated Kobalos. “It has to be said that this level of sophistication is only rarely seen in Linux malware,” adds Léveillé.

Kobalos is a backdoor containing broad commands that don’t reveal the intent of the attackers. “In short, Kobalos grants remote access to the file system, provides the ability to spawn terminal sessions, and allows proxying connections to other Kobalos-infected servers,” says Léveillé.

Any server compromised by Kobalos can be turned into a Command & Control (C&C) server by the operators sending a single command. As the C&C server IP addresses and ports are hardcoded into the executable, the operators can then generate new Kobalos samples that use this new C&C server. In addition, in most systems compromised by Kobalos, the client for secure communication (SSH) is compromised to steal credentials.

Sophos, a global leader in next-generation cybersecurity, today published new research into Agent Tesla, “Agent Tesla Amps Up Information Stealing Attacks,” which details new evasive techniques attackers are using to disable endpoint protection before they deliver the malware and install and run the payload.

The techniques feature a multi-stage process where a .NET downloader grabs chunks of malware from legitimate third-party websites such as pastebin and hastebin – where they are hosted in plain sight – and then joining, decoding and decrypting the chunks to form the loader that carries the malicious payload.

At the same time, the malware attempts to alter code in Microsoft’s Anti-Malware Software Interface (AMSI) – a Windows feature that enables applications and services to integrate with installed security products – so that AMSI-enabled endpoint security protection doesn’t work, and the payload can download, install and run without being blocked.

Agent Tesla is a widely used information stealer and Remote Access Tool (RAT), known since 2014. The creators advertise it for sale on dark-web forums and constantly update it. Attackers generally distribute the malware through malicious spam emails as an attachment.

The new Sophos research looks in-depth at the two versions of Agent Tesla that are currently circulating. Both feature recent updates, such as the number of applications targeted for credential theft, including web browsers, email clients, virtual private network clients, and other software that store usernames and passwords. They also have the ability to capture keystrokes and record screenshots.

However, differences between the two versions demonstrate how attackers have recently evolved the RAT by employing multiple types of defense evasion and obfuscation to avoid detection. These include options to install and use the Tor anonymizing network client, as well as the Telegram messaging API for command and control (C2) communications and the targeting of Microsoft’s AMSI.

“Agent Tesla malware has been active for more than seven years, yet it remains one of the most common threats to Windows users. It has been among the top malware families distributed via email in 2020. In December, Agent Tesla payloads accounted for around 20% of malicious email attachment attacks intercepted by Sophos scanners,” said Sean Gallagher, senior security researcher, Sophos. “A variety of attackers use the malware to steal user credentials and other information from targets through screenshots, keyboard logging and clipboard capture.

“The most widespread delivery method for Agent Tesla is malicious spam—such as the emails we highlighted in our RATicate research. Sophos believes that cybercriminals will continue to update the malware and modify it to evade endpoint and email protection tools. The email accounts used to spread Agent Tesla are often legitimate accounts that have been compromised. Organizations and individuals should, as always, treat email attachments from unknown senders with caution, and verify all attachments before opening them.”

Recommended IT admin checklist for email security

· Install an intelligent, security solution that can screen, detect and block suspicious emails and their attachments before they reach users

· Implement the recognised authentication standards to verify emails are what they claim to be

· Educate employees to spot the warning signs of suspicious emails and what to do if they encounter one

· Advise users to double check that emails come from the address and the person they claim to

· Advise users to never open attachments or click on links in emails from unknown senders

Sophos endpoint protection, Intercept X, detects Agent Tesla’s installer malware and the RAT itself, both through machine learning and the signatures Troj/Tesla-BE and Troj/Tesla-AW.

Indicators of compromise for Agent Tesla are posted on SophosLabs’ GitHub page.

Further information on Agent Tesla and other cyberthreats is available on SophosLabs Uncut where Sophos researchers regularly publish their latest research and breakthrough findings. Threat researchers can follow SophosLabs Uncut in real time on Twitter at @SophosLabs.

Fortinet has announced continued customer momentum of Fortinet Secure SD-WAN and the official completion of the roll-out of Fortinet’s SD-WAN ASIC-based FortiGate Next-Generation Firewalls with the FortiGate 200F series.

Enterprise customer deployments of Fortinet Secure SD-WAN average a 70 percent return on investment (ROI) in three years and 100 percent ROI in five years. Fortinet attributes this to its ability to consolidate SD-WAN, advanced routing, a wireless controller, and in many cases built-in LTE connectivity, on Fortinet’s industry-leading next-generation firewall built around a common operating system and centralized management and orchestration system.

Rajesh Maurya, Regional Vice President, India & SAARC, at Fortinet, says, “Fortinet delivers the industry’s only SD-WAN ASIC-powered WAN edge solution to deliver better performance, reduce point products and achieve unmatched ROI for our customers. Recently joining this line-up is the FortiGate 200F, which completes Fortinet’s portfolio of SD-WAN ASIC-based appliances, enabling us to provide flexibility of both WAN edges and thin edges using the same platform to help large enterprises secure any edge at scale.”

FortiGate 200F Delivers Flexible Support for Both Converged and Thin Edges

The recently announced FortiGate 200F Next-Generation Firewall completes the roll-out of FortiGate appliances to include the latest version (SOC4) of Fortinet’s SD-WAN ASIC, built to accelerate the performance of WAN Edge deployments. The FortiGate 200F showcases Fortinet’s ability to support both WAN edge and thin edge deployments.

· WAN Edge: FortiGate 200F integrates industry-leading SD-WAN and next-generation firewall capabilities to allow enterprises to consolidate point products and secure the WAN edge.

· Thin Edge: For enterprises with thin branch offices, FortiGate 200F allows the easy replacement of legacy routers in favor of an SD-WAN appliance with integrated advanced routing capabilities and support for diverse network topologies. This allows organizations to move from traditional IP routing to application-centric networks and reduce costs.

Fortinet Delivers SD-WAN Anywhere

Thousands of customers around the world have chosen Fortinet Secure SD-WAN to accelerate their digital innovation goals. Fortinet attributes this success to its security-driven networking approach allowing enterprises to combine SD-WAN and network firewall in one unified solution that is scalable across branch, campus, home and multi-cloud deployments. Going well beyond simply connecting branch offices to cloud services or the core network, Fortinet Secure SD-WAN runs natively in every major public cloud environment, scales to support large data centers, is the only SD-WAN appliance suitable for harsh operational technology environments, and comes in a form factor small enough to fit on a home office desktop. This can ensure and enable a wide range of fast and secure connections from anywhere to anywhere, from the WAN Edge to the LAN Edge (SD-Branch), Home Edge, Operational Technology (OT) Edge, Data Center Edge, and Cloud Edge (SASE).