Is Microsoft or CrowdStrike to blame for the global IT outage of Windows-based systems?! Take a look at the viral claims, and find out what the facts really are!
Claim : Microsoft Is Responsible For Global IT Outrage, Not CrowdStrike!
On Friday, 19 July 2024 – a day that will live in digital infamy, businesses and organisations worldwide were hit by an IT outage on their Windows-based systems. Inevitably, some people are blaming Microsoft for this debacle…
Circulating on WhatsApp : Very interesting to see how the media is playing down on the disaster.
Question remains “Not sure how microsoft is going to rollback the update or to install the patch as affected pcs have locked themselves out.”
S.L. Kanthan : Blue screens of death all over the world, from airports and ATM machines to grocery stores and even vending machines!
Thanks, Microsoft! 🤡 #outage
BRICS should create alternative operating systems. Very dangerous for the world to rely on one company.
Max Tegmark : With their impeccable safety culture, never letting things get deployed before they’re properly tested, I’m confident that @Microsoft is ready to safely handle the smarter-than-human AI that they’re trying to build with @OpenAI
Sumit Singh Rajput : This is serious! How a single tech outage can bring the world economy to its knees.
A glitch in Microsoft’s server caused a computer failure around the world. Today, everything is blue
Truth : CrowdStrike, Not Microsoft, Is Responsible For Global IT Outrage!
This appears to be complete misunderstanding of the global IT outage that’s happening only to systems and cloud services based on Microsoft Windows, and here are the reasons why…
Fact #1 : Global IT Outage Caused By CrowdStrike, Not Microsoft
Let me start by simply pointing out that the global IT outrage that started on Friday, 19 July 2024, was caused by CrowdStrike, not Microsoft.
Soon after the outage occurred, CrowdStrike announced (and again) that it was caused by a bug in an update to its Falcon threat detection system.
The IT outage notably did not affect all Microsoft customers and users, only those who purchased and installed CrowdStrike Falcon, which is an “endpoint detection and response” software. This kind of software is designed for large organisations, and that is why this global IT outage is mainly affecting those organisations.
The scale is massive, because CrowdStrike is a leading provider of Endpoint Detection and Response (EDR) software. However, home users and small business users are not affected, because they rely on the built-in Windows Defender software, or consumer-grade software from the likes of Norton and McAfee.
Blaming Microsoft for the buggy update that CrowdStrike issued would be like blaming BMW for defective third-party tyres that leak air, and asking the automotive company to replace or fix those tyres.
Fact #2 : Microsoft Denies Responsibility For Global IT Outage
A Microsoft spokesperson has officially denied responsibility for the global IT outage caused by the CrowdStrike update:
CrowdStrike update was responsible for bringing down a number of IT systems globally. Microsoft does not have oversight into updates that CrowdStrike makes in its systems.
Fact #3 : Global IT Outage Caused By Bug In CrowdStrike Update
As CrowdStrike explained (and again), the infamous Windows Blue Screen of Death (BSOD) that is caused by a bug in an update meant for Windows-based systems.
The outage was caused by a defect found in a Falcon content update for Windows hosts. Mac and Linux hosts are not impacted. This was not a cyberattack.
We are working closely with impacted customers and partners to ensure that all systems are restored, so you can deliver the services your customers rely on.
CrowdStrike further confirmed that the buggy code was introduced in a single channel file – C-00000291.sys, with the timestamp of 0409 UTC.
As former Google engineer Arpit Bhayani explained, the buggy code was trying to access an invalid memory location, triggering a panic and causing the BSOD.
I saw many engineers blaming the outage on Microsoft 🤦♂️ SWEs blaming without knowing the root cause is concerning.
It is not Microsoft, it is Crowdstrike who released an update for Windows that had a bug. The patch runs in Kernel mode to monitor system activity at a low level.
Because it was running in Kernel mode, the buggy code was trying to access an invalid memory location that triggered a panic and which showed Blue Screen of Death.
The name of the driver file that had the buggy update is “C-00000291.sys”, deleting it fixes the issue and unfortunately this needs to be done manually.
Microsoft has nothing to do with it.
Deleting the file, or replacing it with the previous or newer version, fixes the problem. However, it has to be done manually, as the affected computers and servers have “bricked” and cannot be remotely accessed.
Fact #4 : Microsoft Is Supposed To Vet Driver Updates
While Microsoft may not be responsible for the bug in the CrowdStrike update, some cybersecurity experts believe that it may hold some responsibility.
Costin Raiu who worked at Kaspersky for 23 years and led its threat intelligence team, says that Microsoft is supposed to vet the code and cryptographically sign it. This suggests that Microsoft may have also missed the buggy code in the CrowdStrike Falcon kernel driver update.
It’s surprising that with the extreme attention paid to driver updates, this still happened. One simple driver can bring down everything. Which is what we saw here.
Raiu also noted that past updates to Kaspersky and Microsoft’s own Windows Defender antivirus software have also triggered similar Blue Screen of Death crashes in previous years.
Please help us FIGHT FAKE NEWS by sharing this fact check article out, and please SUPPORT our work!
Please Support My Work!
Support my work through a bank transfer / PayPal / credit card!
Name : Adrian Wong Bank Transfer : CIMB 7064555917 (Swift Code : CIBBMYKL)
Credit Card / Paypal : https://paypal.me/techarp
Dr. Adrian Wong has been writing about tech and science since 1997, even publishing a book with Prentice Hall called Breaking Through The BIOS Barrier (ISBN 978-0131455368) while in medical school.
He continues to devote countless hours every day writing about tech, medicine and science, in his pursuit of facts in a post-truth world.
The US just announced a ban of Kaspersky Lab software, over national security concerns! Here is what you need to know!
US Bans Kaspersky Software Over National Security Risk!
On Thursday, 20 June 2024, the Biden Administration announced a ban of the sale of software made by Kaspersky Lab in the US, due to national security concerns. Unfortunately, this will also cut off updates for users who have already purchased Kaspersky software.
Kaspersky will generally no longer be able to, among other activities, sell its software within the United States or provide updates to software already in use.
US Commerce Secretary Gina Raimondo stated that Russia’s influence over the Russian company posed a significant security risk:
Russia has shown time and again they have the capability and intent to exploit Russian companies, like Kaspersky Lab, to collect and weaponise sensitive US information.
In response, Kaspersky issued a statement to AFP, denying the claim and saying that the US Commerce Department “made its decision based on the present geopolitical climate and theoretical concerns” and vowed to “pursue all legally available options to preserve its current operations and relationships”.
Kaspersky does not engage in activities which threaten US national security and, in fact, has made significant contributions with its reporting and protection from a variety of threat actors that targeted US interests and allies.
In addition to banning its software, the US Commerce Department also added two Russian and one UK-based unit of Kaspersky Lab to its Entity List, for allegedly cooperating with Russian military intelligence to support Moscow’s cyber intelligence goals. US companies are forbidden from providing goods or services to companies on the Entity List.
This is the most serious sanction affecting the Russian company after the US Department of Homeland Security banned its flagship antivirus software from federal networks in 2017, alleging ties to Russian intelligence. The DHS also pointed out that Russian law lets intelligence agencies compel assistance from Kaspersky and intercept communications using Russian networks.
While the US has publicly announced its ban of Kaspersky Labs software, it doesn’t go into effect immediately.
The ban on sales of Kaspersky Lab software will only kick in on 29 September 2024 – 100 days after publication, to give businesses time to switch to alternative software. The ban also bars resales, and licensing of Kaspersky products in the US.
New US business for Kaspersky will also be blocked 30 days after the restrictions are announced. Sales of white-labelled products – software products sold or packaged under a different brand name, will also be banned.
Under the new rules, sellers and resellers who violate these restrictions will face fines from the US Commerce Department. Software users won’t face legal penalties, but are strongly encouraged to stop using Kaspersky software. However, critically – users will stop receiving updates for their software from 29 September 2024 onwards.
Russian companies are already subject to US export sanctions, but the UK-based unit of Kaspersky Lab will now be banned from receiving goods and services from US companies.
Please Support My Work!
Support my work through a bank transfer / PayPal / credit card!
Name : Adrian Wong Bank Transfer : CIMB 7064555917 (Swift Code : CIBBMYKL)
Credit Card / Paypal : https://paypal.me/techarp
Dr. Adrian Wong has been writing about tech and science since 1997, even publishing a book with Prentice Hall called Breaking Through The BIOS Barrier (ISBN 978-0131455368) while in medical school.
He continues to devote countless hours every day writing about tech, medicine and science, in his pursuit of facts in a post-truth world.
Vitaly Kamluk, Kaspersky Director of Global Research and Analysis for APAC, explores the impact of social media activities on our digital reputation, as well as those of brands and companies!
Digital Reputation : What Is It?
Digital reputation is the online version of good old fashion reputation. The only difference is that it is defined by our online behaviour and what people are saying about us, or the brand.
In short, our digital reputation is a combination of our digital footprint, and the impact it has on how other people perceive us, or the brand.
As the world becomes more connected, digital reputation is becoming more than just important – it is now critical to the future and success of any individual or corporation.
This has led to a shift in how people and brands behave online these days…
As Jesmond Chang, Head of Corporate Communications for Kaspersky APAC, shared above :
32% of social media users in APAC use anonymous accounts
50% of social media users in APAC avoid companies that are involved in a scandal, or had received negative news coverage online
40% also stopped using a company’s or brand’s products once they are embroiled in some kind of online crisis.
Kaspersky on APAC Digital Reputation Threats!
At the 6th Vitaly Kamluk, Kaspersky Director of Global Research and Analysis for APAC, shared the latest threats to digital reputation in the APAC region, which is precipitated by the COVID-19 pandemic.
“One of the most visible effect of this pandemic is how it forced everyone, from individuals to the biggest companies, to shift a lot of their activities online.
This dependence, triggered by our need to secure our physical health, also pushed us to increase our social media use, either to connect with our distant loved ones, to give support to our community, to entertain ourselves, or to get hold of products and services that we need.
Parallel to this trend is the opening of wider doors for cybercriminals to exploit”
With many employees working from home, cybercriminals have found new ways to exploit this situation :
brute force attacks on database servers increased 23% in April 2020
Malicious files planted on websites increase 8% in April 2020
Network attacks and phishing emails also rose
Kaspersky themselves reported an increase of unique malware samples from 350,000 per day pre-COVID, to 428,000 per day!
With the increased reliance on online services, including remote work and learning, e-commerce purchases and a greater adoption of e-wallets, the 2020 threat landscape appears to favour cybercriminals.
If you like our work, you can help support us by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Kaspersky just announced the first integration of their new automotive KasperskyOS into the ECU of an advanced driver assistance system by AVL SFR. Here are the details…
Automotive KasperskyOS : What Is It?
Modern vehicles are complex systems, which makes it hard to manage the security of its components.
KasperskyOS for automotive ECUs combines a secure microkernel operating system, with a security policy enforcement engine (Kaspersky Security System), and a trusted channel encrypted framework.
It is designed to secure onboard systems and communications, ensuring safer OTA updates, fleet management and safer autonomous driving.
KasperskyOS Integration Into AVL ADAS ECU
The new AVL Software and Functions GmbH (AVL SFR) ADAS ECU features two high-performance SoCs (system-on-a-chip), and a safety controller..
This new ECU platform also supports Controller Area Network, and automotive Ethernet standards, allowing for secure communications between devices in the vehicle – including cameras and LIDARs.
The integration of KasperskyOS into the ECU guarantees that undeclared functionality – either unnoticed at launch, or inserted through system updates – cannot be exploited. This is especially important in the safety of autonomous vehicles.
All interactions between electronic components is controlled by the Kaspersky Security System, the security policy engine within KasperskyOS. It monitors the launch of processes, as well as communications between those components and the operating system.
This new ADAS ECU by AVL SFR is ready for prototyping projects by OEMs and Tier-1 suppliers.
Kaspersky Automotive Adaptive Platform for KasperskyOS
Kaspersky is also a new associate partner of AUTOSAR, a consortium aimed at developing mutual standards for automotive software architecture.
To that effect, they developed a software development kit (SDK) called Kaspersky Automotive Adaptive Platform.
With this SDK, AVL SFR can develop applications for automated and even driverless vehicles – such as delivering auto-piloting features, controlling safety systems and monitoring their health.
This set of libraries also allows for other software to be adopted, which follow AUTOSAR Adaptive requirements, and work on KasperskyOS without additional changes.
Kaspersky Automotive Adaptive Platform is ready to be delivered and AVL SFR is showcasing its auto-piloting application to several automotive customers.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
INTERPOL and Kaspersky are urging organisations to protect their data against ransomware, because 1 in 3 attacks target business users!
Ransomware Warning : 1 in 3 Attacks Target Business Users!
Recent Kaspersky research revealed that in 2019, WannaCry is still the most prevalent ransomware circulating, and some 30% of people targeted by ransomware were business users!
30% of ransomware attacks targeted business users
Organisations lost, on average, US$1.46 million in costs, fines and repetitional damage in 2019
WannaCry attacked 164,433 users in 2019, and accounted for 21% of all ransomware attacks.
GrandCrab accounted for 11% of attacks, while Stop accounted for 4%.
WannaCry, arguably the world’s most famous ransomware, reached its peak 3 years ago – on 12 May 2017 – but continues to wreak havoc on unsuspecting victims.
GrandCrab is famous for its ransomware-as-a-service model, rented out to cybercriminals by its developers. Meanwhile, Stop spreads through compromised software and websites, as well as adware.
Ransomware : How To Protect Your Business
Here are some tips that Kaspersky is recommending to stay protected against ransomware :
Explain to employees how following simple rules can help a company avoidransomware incidents.
Always have fresh back-up copies of your files so you can replace them in case they are lost (e.g. due to malware or a broken device).
Don’t just rely on a physical backup, but also store your backup in the cloud for greater reliability.
Always update your operating system and software to eliminate recent vulnerabilities.
Use anti-ransomware software, which will prevent ransomware from exploiting vulnerabilities in software and applications – especially important for customers who continue to use Windows 7.
And if a corporate device is encrypted by ransomware, please remember that the attack is a criminal offence. You should NOT pay the ransom.
Instead, report the ransomware attack to your local law enforcement agency, and find a decryptor that may work for you. Some are available for FREE.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
As the COVID-19 coronavirus spreads across the world, so are COVID-19 email scams and malware!
Tatyana Shcherbakova tells us what she and her team discovered!
Warning : COVID-19 Email Scams Are Spreading!
As the COVID-19 coronavirus spreads, fake information is being created and distributed at a very high rate, confusing people all over the world.
Cybercriminals are taking advantage of the confusion, creating various email scams, with some realistic ones pretending to be from the WHO.
Tatyana Shcherbakova, a senior web content analyst, details how her team looked at the COVID-19 email scams, and came across the realistic ones from WHO…
WHO Is Warning You? These Are COVID-19 Email Scams!
At first, we found emails offering products such as masks, and then the topic became more commonly used in Nigerian spam emails. We also found scam emails with phishing links and malicious attachments.
One of the latest spam campaigns mimics the World Health Organization (WHO), showing how cybercriminals recognize and are capitalizing on the important role WHO has in providing trustworthy information about the coronavirus.
Users receive emails allegedly from WHO, which supposedly offer information about safety measures to be taken to avoid a COVID-19 infection.
Once a user clicks on the link embedded in the email, they are redirected to a phishing website and prompted to share personal information, which ends up in the hands of cybercriminals.
This scam looks more realistic than other examples we have seen lately, such as alleged donations from the World Bank or IMF for anyone who needs a loan.
In order to stay safe, we advise users to carefully study the content of the emails they receive and only trust reliable sources.
If you are promised a vaccine for the virus or some magic protective measures, or content of the email is making you worried, it has most likely come from cybercriminals.
This is especially true if the sender suggests clicking on a link and sharing your personal data or opening an attachment.
You should not donate any real money or trust information with promises to help those affected by the virus, even if the email comes from someone who introduces themselves as an employee of a trusted organization.
Finally, double check the email address, as scammers often use free email services or addresses that have no relation to the organization mentioned.
Malware Masked As COVID-19 Coronavirus Documents!
They also found malicious files disguised as documents related to the COVID-19 coronavirus. The malicious files were masked under the guise of pdf, mp4 and docx files about the COVID-19 coronavirus.
The names of files imply that they contain video instructions on how to protect yourself from the virus, updates on the threat and even virus detection procedures, which is not actually the case.
In fact, these files contained a range of threats, from Trojans to worms, which are capable of destroying, blocking, modifying or copying data, as well as interfering with the operation of computers or computer networks.
Some malicious files are spread via email. For example, an Excel file distributed via email under the guise of a list of coronavirus victims allegedly sent from the World Health Organization (WHO) was in fact a Trojan-Downloader, which secretly downloads and installs another malicious file.
This second file was a Trojan-Spy designed to gather various data, including passwords, from the infected device and send it to the attacker.
COVID-19 Email Scams + Malware : How To Avoid
As governments and businesses are forced by the COVID-19 coronavirus to encourage their employees to work from home, it is critical that they employ these cybersecurity practices to reduce risk of falling for phishing attacks, or malware :
Provide a VPN for staff to connect securely to the corporate network
All corporate devices – including mobiles and laptops – should be protected with security software
The operating system and apps should be updated with the latest patches
Restrict the access rights of people connecting to the corporate network
Ensure that the staff are aware of the dangers of unsolicited messages
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
An Android malware called Shopper is actively taking over smartphones, to post fake reviews on Google Play.. and worse!
Find out what’s going on, and how to prevent your smartphone from being hijacked by Shopper!
Shopper : What Does It Do?
Shopper (Trojan-Dropper.AndroidOS.Shopper.a) is an Android trojan that uses the Google Accessibility Service to take over your smartphone.
It is not yet known how users are being infected, but researchers suspect that it may be downloaded through fraudulent ads, or third-party app stores when they try to download legitimate apps.
The malware masks itself as a system application, and uses a system icon called ConfigAPKs to hide itself from the user.
After the user unlocks the screen, the Shopper trojan launches and gathers information about the device, which is then sent to the attacker’s servers.
The attacker’s servers will then send commands to the Shopper trojan to execute one or more of these actions :
Check the rights to use the Accessibility Service. If permission is not granted, it will send a phishing request until it gets it
Turn off Google Play Protect, a safety check on Google Play Store apps before they’re downloaded
Post fake positive app reviews in Google Play, for those apps
Open links received from the remote server in an invisible window
Download and install advertised apps from Google Play Store
Download and install apps from the Apkpure third-party app store
Show ads when the smartphone screen is unlocked
Create labels to advertised ads in the app menu
Replace the labels of your installed apps with labels of advertised websites
Use your Google or Facebook account to register on popular shopping and entertainment apps, like AliExpress, Lazada, Zamora, Shein, Joom, Likee and Alibaba
Shopper : Who’s Getting Infected?
Right now, Kaspersky researchers say that it is most widespread in Russia (28.46%), following by Brazil (18.70%) and India (14.23%) :
Shopper : How To Block It?
To reduce the risk of being infected by Trojan-Dropper.AndroidOS.Shopper.a, take these actions :
Do NOT install apps from untrusted sources
Block the installation of apps from unknown sources in your smartphone settings
Be wary of apps that require the use of the Google Accessibility Service, especially if the app is not meant to offer accessibility features to the disabled
Always check application permissions to see what your installed apps are allowed to do
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Kaspersky just made Kaspresso, their automated testing framework for Android apps publicly available for FREE!
Find out what Kaspresso is all about, and how it is superior to automated tests like Espresso and Appium!
Android App Testing Tools
One of the key challenges that mobile developers have is choosing the right automated testing tool to look for bugs, and reduce the lead time for their app’s release.
There are a number of existing frameworks and tools for conducting such automated tests, like Espresso and Appium. However, these frameworks do not adequately address issues like readability, flakiness, logging and UI test architecture.
Flakiness refer to unpredictable test results, with different reasons behind each failure, despite the app working without malfunctions on the developer’s device.
Those issues prevent mobile developers from writing clean, stable and easy-to-maintain UI-tests that are also easily understood. To solve those problems, Kaspersky introduced a new Android app testing tool called Kaspresso.
Kaspresso is based on two libraries for creating automated Android tests – Espresso and Kakao. Hence, the name – Kaspresso – which coincidentally rhymes with Kaspersky.
With the inclusion of the Kakao library, serving as a DSL wrapper over Espresso, Kaspersky improves the readability of UI-tests, making them more understandable.
Kaspresso also solves the problem with flaky tests and logging – Espresso does not log its own actions. It also provides a rich set of default interceptors for handling flaky tests and improving the logging process.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Kaspersky recently discovered a Google Chrome zero day exploit that was being used in Operation WizardOpium.
Here are the full details, but the TLDR message is – make sure you update Google Chrome ASAP!
The WizardOpium Exploit : What Is It?
Kaspersky’s automated Exploit Prevention subsystem detected the exploit, which they dubbed WizardOpium. It used a zero day vulnerability that had hitherto not known to developers.
The WizardOpium Exploit : How Does It Work?
The attacks, which Kaspersky called Operation OpiumWizard, began with an infiltration at a Korean news website, where attackers managed to inject malicious code.
It loads a script from a third-party site that first checks if the system is suitable for infection – they were interested only in Chrome for Windows, not older than version 65.
If the operating system and browser requirements are met, the script downloads the WizardOpium exploit piece by piece, reassembles and decrypts it.
The script then runs another check on the version of Google Chrome, working exclusively with Chrome 76 or 77.
After verifying that it has the right Chrome version, the script then leverages the use-after-free vulnerability CVE-2019-13720, based on the improper use of system memory.
By manipulating the system memory, the exploit gains permission to read and write data, which it immediately uses to download, decrypt and run the malware package.
The WizardOpium Exploit : Solution
Kaspersky cybersecurity products will detect the exploit, and identify it as Exploit.Win32.Generic.
On discovering it, they reported it to Google with the identifier CVE-2019-13720.
Google fixed the bug in Chrome 78.0.3904.87 for Windows, macOS and Linux. Just make sure you update to that version, or newer… ASAP!
To make sure you have the update, follow these steps :
Click on the 3 vertical dots at the upper right corner of Chrome (Customise and control Google Chrome)
Select Help > About Google Chrome.
In the About Chrome page, it should say that you have Version 78.0.3904.87 or higher
If not, Chrome will automatically start looking for, and installing the latest update
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Kaspersky just announced that they have selected Malaysia as the site for their APAC Transparency Center!
Here is everything you need to know about the third Kaspersky Transparency Center, and why they chose Malaysia.
The Kaspersky Global Transparency Initiative
The Kaspersky Global Transparency Initiative began in October 2017, as a way to allay fears that Kaspersky Lab products and services had backdoors built-in.
Kaspersky Global Transparency Initiative APAC Update
The Managing Director for Asia Pacific at Kaspersky, Stephan Neumeier, kicked off the launch with an update on the Kaspersky Global Transparency Initiative, with a focus on the APAC region.
Started relocating customer data storage and processing infrastructure for European users from Russia to Zurich, Switzerland, to be completed by the end of 2019.
Opened two Transparency Centers in Europe – in Zurich (November 2018) and Madrid (June 2019). The Spanish Center also serves as a briefing center for key company stakeholders.
Successfully completed the Service Organization Control for Service Organizations (SOC 2) Type 1 audit. The final report, issued by one of the Big Four accounting firms, confirms that the development and release of Kaspersky’s threat detection rules databases (AV databases) are protected from unauthorised changes by strong security controls.
Since announcing the Bug Bounty program’s extension, Kaspersky resolved 66 bugs reported by security researchers and awarded almost $45,000 in bounty rewards.
Kaspersky also supports the io framework which provides Safe Harbor for vulnerability researchers concerned about potential negative legal consequences of their discoveries.
[adrotate group=”1″]
Why Kaspersky Selected Malaysia For The APAC Transparency Center
Kaspersky revealed that their APAC Transparency Center will be located in Cyberjaya, in partnership with CyberSecurity Malaysia.
Cyberjaya was selected because of its central location and close proximity to many key Kaspersky clients in APAC, as well as other security- and infrastructure-related reasons.
What Is The Kaspersky APAC Transparency Center For?
The new Kaspersky APAC Transparency Center in Malaysia will serve as the third trusted code review facility, after Zurich and Madrid.
Government regulators and Kaspersky enterprise clients can request to come to the Kaspersky APAC Transparency Center to examine or review :
source code of Kaspersky consumer and enterprise solutions, like Kaspersky Internet Security (KIS), Kaspersky Endpoint Security (KES) and Kaspersky Security Center (KSC)
Kaspersky’s threat analysis, secure review and application security testing process
all versions of Kaspersky software builds, and AV database updates
data feeds that are sent by Kaspersky products to the cloud-based Kaspersky Security Network (KSN)
It will also function as a briefing centre, where guests will be able to learn about Kaspersky’s engineering and data processing practises.
This new Kaspersky Transparency Center is slated to open for its first visitors in early 2020. Like the other Transparency Centers, access is available only upon request.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Yeo Siang Tiong, the General Manager of Kaspersky Southeast Asia, recently shared with us why cybersecurity is critical for Industry 4.0 initiatives to succeed.
While he uses Malaysia’s drive to implement Industry 4.0 as an example, the lessons are universal and apply across the world.
Let’s hear it from Mr. Yeo Siang Tiong!
Why Cybersecurity Is Critical For Industry 4.0 Success
The term Industry 4.0 was first used at the Hanover Fair, as a reference to the latest industrial strategy which has been termed the fourth industrial revolution.
According to the explanation by Ministry of International Trade and Industry Malaysia [1] I have read months ago, Industry 4.0 is referred to as production of manufacturing based industries digitalization transformation, driven by connected technologies.
Together with autonomous robots, big data analytics, cloud computing, Internet of Things, additive manufacturing, system integration, augmented reality and simulation, in my opinion, cybersecurity is among the main pillars of Industry 4.0.
Why? Because while the cyber-physical systems connected without wires, automated and with lesser human touch points promise more efficient processes and communications, this also exposes systems to potential cyberattacks.
Greater connectivity brought about by Industry 4.0 will require greater security attention for ICS security because the Fourth Industrial Revolution is a double-edged sword which countries and companies should use wisely.
It is great to note that Malaysia is currently ranked third globally among 193 International Telecom Union members, in terms of the level of national commitment to addressing cybersecurity risks.
In 2018, Ministry of International Trade and Industry Malaysia launched INDUSTRY 4WRD, a national policy on Industry 4.0, to place policies and guidelines in place to ensure Malaysian manufacturing industry and its related services would be ready, to be smart, systematic and resilient.
The policy has the overarching philosophy – A-C-T, Attract, Create and Transform.
The government’s efforts are indeed being commended worldwide. Proof is the Readiness for the Future of Production Report 2018 [2] which put Malaysia in the “Leader” quadrant, positioned well for the future. Malaysia and China are the only two non-high-income countries in this coveted quadrant.
One important area for improvement that I know if will be the human force. Malaysia has shortage of required talents, skills and knowledge for Industry 4.0, particularly in the areas of IoT, robotics and AI. The lack of talents in the fields of IoT is hypocritical for Malaysia Industry 4.0 especially in the areas of exposure to cyber threats.
However, let us not miss the commitment uttered by the Ministry of Education Malaysia [3] saying that cybersecurity must be introduced at the grassroot level, especially among the schoolchildren. The department of Polytechnic and Community College Education and Politeknik Mersing in Johor is also off to set up the Cyber Range Academy, which provides the students with an authentic learning environment in the threat landscape.
For our part, Kaspersky understands the cyber security needs in ensuring the success of Industry 4.0 and have solutions in place – Industrial CyberSecurity (ICS), with the aim to protect companies from three main risks [4].
Firstly, unintentional infection of an industrial network. In theory, industrial information networks should not be connected to office networks, and should also not have direct access to the internet. However, sometimes without intending to cause any harm, staff will connect infected removable drives to industrial computers or access the internet to update software on the server, resulted malware manages to penetrate the network.
Secondly, it is not unusual for people who are professionally versed in industrial systems to try and use that knowledge to trick their employer, which cause serious harm to the business.
Thirdly, cyberwar, targeted actions that are intended to cause damage. Two years ago, a massive data breach saw more than 46 million mobile subscribers in Malaysia leaked on to the dark web.
For companies to reach their Industry 4.0 goals, all components have to be protected.
Remember ShadowHammer [5] which Kaspersky team highlighted in the research back in March? Executable files, found in reputable and trusted large manufacturer, contained malware features, which upon careful analysis confirmed been tampered by malicious attackers.
To avoid being victims and ensuring a clearer path to achieving Industry 4.0 [6], we suggest to:
Regularly update operating systems, application software, and security solutions
Apply necessary security fixes andaudit access control for ICS components in the enterprise’s industrial network and at its boundaries
Provide dedicated training and support for employees as well as partners and suppliers with access to your network
Restrict network traffic on ports and protocols used on edge routers and inside the organization’s OT networks
Use ICS network traffic monitoring, analysis and detection solutions for better protection from attacks potentially threatening technological process and main enterprise assets
Deploy dedicated securitysolutions on ICS servers, workstations and HMIs, such as Kaspersky Industrial CyberSecurity. This solution includes network traffic monitoring, analysis and detection to secure OT and industrial infrastructure from both random malware infections and dedicated industrial threats
Form a dedicated security team for both IT and OT sectors
Equip these security teams with proper cybersecurity training as well as real-time and in-depth threat intelligence reports
Industrial Revolution 4.0, also known as the Fourth Industrial Revolution or Industry 4.0, is a term that is applied towards the current trend of intelligent automation that is enabled by information technology, interconnectivity and data analytics.
Industry 4.0 employs a wide range of technologies to achieve those aims, such as mobile devices, Internet of Things, smart sensors, big data analytics, augmented reality, cloud computing, and more.
Countries and corporations that successfully make use of these technologies will greatly improve their productivity. Hence, there is great interest by governments and companies to develop and accelerate their IR 4.0 capabilities.
In his first prediction for Earth 2050, Eugene Kaspersky believes that AI digital intuition will deliver cyberimmunity by 2050. Do YOU agree?
What Is Earth 2050
Earth 2050 is a Kaspersky social media project – an open crowdsourced platform, where everyone can share their visions of the future.
So far, there are nearly 400 predictions from 70+ visionaries, from futurologist Ian Pearson, astrophysicist Martin Rees, venture capitalist Steven Hoffman, architect-engineer Carlo Ratti, writer James Kunstler and sci-fi writer David Brin.
Eugene himself dabbles in cyberdivination, and shares with us, a future of cyberimmunity created by AI digital intuition!
Eugene Kaspersky : From Digital Intuition To Cyberimmunity!
In recent years, digital systems have moved up to a whole new level. No longer assistants making life easier for us mere mortals, they’ve become the basis of civilization — the very framework keeping the world functioning properly in 2050.
This quantum leap forward has generated new requirements for the reliability and stability of artificial intelligence. Although some cyberthreats still haven’t become extinct since the romantic era around the turn of the century, they’re now dangerous only to outliers who for some reason reject modern standards of digital immunity.
The situation in many ways resembles the fight against human diseases. Thanks to the success of vaccines, the terrible epidemics that once devastated entire cities in the twentieth century are a thing of the past.
However, that’s where the resemblance ends. For humans, diseases like the plague or smallpox have been replaced by new, highly resistant “post-vaccination” diseases; but for the machines, things have turned out much better.
This is largely because the initial designers of digital immunity made all the right preparations for it in advance. In doing so, what helped them in particular was borrowing the systemic approaches of living systems and humans.
One of the pillars of cyber-immunity today is digital intuition, the ability of AI systems to make the right decisions in conditions where the source data are clearly insufficient to make a rational choice.
But there’s no mysticism here: Digital intuition is merely the logical continuation of the idea of machine learning. When the number and complexity of related self-learning systems exceeds a certain threshold, the quality of decision-making rises to a whole new level — a level that’s completely elusive to rational understanding.
An “intuitive solution” results from the superimposition of the experience of a huge number of machine-learning models, much like the result of the calculations of a quantum computer.
So, as you can see, it has been digital intuition, with its ability to instantly, correctly respond to unknown challenges that has helped build the digital security standards of this new era.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Kaspersky Lab just issued a travel scam alert and advisory for this holiday season. Pay attention, so you will enjoy a great holiday!
Travel Scam Operations On The Rise!
Kaspersky Lab researchers have uncovered several travel scam operations last month, seeking to trick holiday-goers looking for great bargains.
Fraudsters Are Phishing For Unwary Victims
There were more than 8,000 phishing attacks, disguised as offers from popular lodging platforms. In fact, 7,917 of those phishing attacks specifically targeted people looking for Airbnb rentals.
In one example, fraudsters created a phishing page that look like an Airbnb page, and pretended to offer cheap city-centre rentals with high review scores. Once the victim confirmed and paid for the booking, both the fraudsters and the offer disappeared.
Spam Is Still Effective!
In just one day, the researchers detected 7 different fake email blasts that are very convincingly disguised as offers from popular booking platforms for airline tickets and accommodation.
Three of those spam emails actually offered FREE FLIGHTS in return for the completion of a short online survey, and sharing the link with other people. After answering just three questions, victims were asked to enter their phone numbers, which were then used to subscribe to paid mobile services.
Travel Scam Methods
Spam and phishing attacks were amongst the most effective attack vectors. They use social engineering to manipulate and exploit human behaviour.
Fake Websites
These travel scam operations are often very sophisticated, using fake sites that are almost identical to the legitimate websites.
They, therefore, easily trick unwary victims into handing over their credit card details, or pay for a product or service that does not exist.
Mobile Booking Risk
More people are booking their flights and accommodations on a mobile device, which makes it harder to spot fake links. This makes mobile users particularly vulnerable to both spam and phishing attacks.
Kaspersky Travel Scam Advisory
To avoid these travel scams, Kaspersky Lab recommends taking these security measures :
If an offer seems too good to be true, it probably is. AVOID IT!
CHECK the link in the browser’s address bar before you key in sensitive information like your login and password.
If it is misspelled (e.g. airbnb.com.room.online), or does not match the page you are visiting (like this example below), or uses special symbols instead of letters, don’t key in any information. CLOSE THE PAGE!
An Expedia page with a Booking.com address??? Something’s NOT right…
Book your stay and tickets only with trusted providers.
Make sure you are on their actual websites by typing in their address in the browser’s address bar.
NEVER click on links that come from an unverified source, whether it’s in an email, an instant message or through social networks.
Use a security solution with behaviour-based anti-phishing technologies like Kaspersky Security Cloud, or Kaspersky Total Security, which will warn you if you get tricked into visiting a phishing web page.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Maxim Frolov, Vice President of Global Sales, Kaspersky Lab, speaks about Incident Response, a critical tool of every cybersecurity team to respond to, and manage cyberattacks.
Here are five key factors he believes every CISO (Chief Information Security Officer) should consider while formulating their companies’ Incident Response process.
They also believe that the speed and quality of their incident response are the most important factors in measuring their performance.
Hence, IT security departments are now focused, not just on preventing attacks, but also on identifying the issues in time to minimise damage.
What Is Incident Response?
Incident Response (IR) is the methodology a cybersecurity team uses to respond to, and manage cyberattacks. It aims to reduce damage and recover from an attack as quickly as possible.
A good incident response plan also includes a thorough investigation to learn from an attack, in order to prepare for and prevent a repeat attack in the future.
The Five Key Factors CISOs Should Consider About Incident Response
While CISOs understand that a well-developed, repeatable incident response plan is critical, they face five major issues in developing a good plan.
Factor #1 : Shortage Of Qualified Professionals
Incident response does not mean jumping into the remediation phase when an incident happens. It actually starts before an attack has occurred, and does not stop after the attack ends. In general, it consists of four stages :
Stage 1 : All responsible employees are prepared, so they know how to act when an attack happens
Stage 2 : Detection of an ongoing cybersecurity incident
Stage 3 : The incident response team eliminates the threat and recover affected systems
Stage 4 : The incident response strategy is reviewed based on this experience, to mitigate against a future attack
Such diversified activities require different types of professionals, who are in short supply. According to a Kaspersky Lab survey, CISOs find it quite impossible to find malware analysts (43%), specialists that can respond to an attack (20%) and threat hunters (13%).
The other issue is employee retention. Specialists know that they are in great demand, and easily switch to a rival organisation for a higher salary. It is, therefore, increasingly hard for companies to employ and retain a team to conduct the entire incident response process.
Factor #2 : Choosing Suitable Outsourcers
Because of the difficulties in forming an internal Incident Response team, many companies opt to outsource the job. However, it is no trivial task to choose a suitable third-party IR team.
A good outsourced Incident Response team should be proficient in the important IR competencies, namely threat research, malware analysis and digital forensics.
Their capabilities should be ascertained through vendor-neutral certification, and past experience. The diversity of their client base is also important – working in a variety of industries will allow them to find similarities in seemingly disparate cybersecurity cases.
Companies in strictly-regulated industries will have additional restrictions when they are considering outsourcing candidates. They can only choose from IR teams that meet specific compliance requirements.
Factor #3 : Cost Of Incident Response
Establishing and maintaining an in-house Incident Response team is costly. Not only are full-time specialists expensive, companies also need to purchase solutions and threat intelligence services their IR team will need for threat hunting, data analysis and attack remediation.
Yet they cannot afford not to have an IR strategy in place. The average cost of a data breach is on the increase, now amounting to US$1.23 million on average. This is an increase of 24% from US$992,000 in 2017.
Some organisations may find the outsourced model to be more cost-effective and flexible. However, enterprises that deal with numerous incidents will find it necessary to have an in-house IR team.
To save costs, organisations can employ a hybrid approach – forming an internal team of first-level responders, with external experts on retainer.
Factor #4 : Synergy With IT Department
Both the Incident Response team and the IT department must understand their respective roles and work together. After all, they have conflicting objectives when a cybersecurity incident occurs.
The IT team will want to shut down infected machines to reduce or prevent data loss, and stop the malware from spreading. On the other hand, the IR team will want to collect evidence, which would mean leaving the “crime scene” untouched even after the incident is over.
If the IT team disconnects the machines, and/or stores the logs for only three months; that would make the IR team’s work a great deal more difficult.
To avoid such issues, the internal IR team should provide tailored guidance or training for their IT colleagues. This would ensure that both teams are on the same page when an attack happens.
Factor #5 : Delays In Responding
Organisations that rely on outsourced IR teams can quickly get their incident response processes in place, because the external IR team is always at hand to step in and help resolve an incident.
However, this can only happen after contracts are signed, and agreements ratified; leading to a delay in incident response.
In Maxim’s experience, an organisation often comes back to work on Monday to discover that they were breached during the weekend. They will try to handle the incident for several days, before turning to external experts.
However, it’s usually Friday by the time they start seeking help. Even if they have a pre-vetted contractor to turn to, and rush the approval of an agreement; it will take several more days before the external IR team can get to work.
Hence, it is a good idea for organisations to have an internal Incident Response team (even if they are just first-level responders) that can quickly evaluate the incident and delegate responsibility.
The Most Effective Incident Response Strategy
For most large organisations, the hybrid approach to Incident Response is perhaps the most effective.
Combining a small in-house team with third-party responders will help them maintain an effective IR strategy, without the problems associated with maintaining a dedicated internal team or outsourcing the job completely.
Even though outsourcing incident response is attractive financially, it doesn’t mean the organisation can hand over the reins and absolve all responsibility for incident response. Having a suitable IR plan for their particular organisation is still important, as well as the need for the external IR team to liaise with the organisation’s IT team.
There should be a proper process for when employees should ask for external assistance, and what it will address. An employee should also be tasked with prioritising actions and coordinating between the external IR team and internal departments.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
The 2019 Kaspersky Lab year-on-year cybersecurity report is here, and it revealed a number of interesting changes in cyberthreats. Here is a quick primer on what the Kaspersky Lab team discovered!
The 2019 Kaspersky Cybersecurity Report
The 2019 Kaspersky cybersecurity report is based on the Kaspersky Security Network (KSN) data from 2017 and 2018.
This report saw an appreciable drop in local infections in Malaysia, but it’s not all roses. The same report noted massive increases in web threats and malware hosting during the same period!
Web Threats
Web Threats, also known as Online Threats, are malware that attack users through the Internet. It can be in the form of a browser-based attack which hijacks the victim’s computer.
The 2019 Kaspersky Lab cybersecurity report reported that they detected over 42 million web threats in 2018 – a shocking 2.5X increase over 2017.
No of Detections
Users Attacked
Rank
2017
2018
2017
2018
2017
2018
16,740,303
42,052,261
33.2%
37.7%
25th
25th
Local Threats
Local Threats are infections or malware that attack the victim’s computer through infected media (like a USB drive), or initially gets into the computer in an encrypted format.
This is the silver lining in the report. The Kaspersky Security Network recorded a 17.4% drop in local threats in 2018, compared to 2017. Even so, that was still way over 67 million detections, and local threats remain a serious cybersecurity threat.
No of Detections
Users Attacked
Rank
2017
2018
2017
2018
2017
2018
82,026,205
67,739,963
605%
56.5%
74th
86th
Malware Hosting
Malware Hosting in the report refers to malware that was detected to be hosted on servers or websites based in Malaysia.
The team reported a massive 3.4X increase in servers or websites hosting malware in Malaysia. Over 1.6 million servers or websites!
No of Incidents
Share of Incidents Hosted
Rank
2017
2018
2017
2018
2017
2018
480,090
1,640,611
0.03%
0.05%
37th
39th
2019 Kaspersky Lab Cybersecurity Advice
Kaspersky Lab security experts advocate the following basic but important steps to protect yourself against cyberthreats in 2019 :
Carefully check the link before visiting a site, especially for misspelling or other irregularities, even if you think it’s a site you’ve visited regularly before.
Enter your username and password only over a secure connection. Avoid logging in to online banks and similar services via public Wi-Fi networks.
Be aware that URLs that begin with the “https” may not always be secure.
Don’t trust emails from unknown senders until you can verify the authenticity their origins.
Always run a system with a quality, up-to-date anti-malware program such as Kaspersky Internet Security.
The Kaspersky Security Network
The 2019 Kaspersky Lab cybersecurity report relied on data collected by the Kaspersky Security Network (KSN).
KSN is a distributed infrastructure dedicated to intelligent processing cybersecurity-related data streams from millions of voluntary participants around the world. By analysing these data streams automatically in the cloud, KSN delivers much faster reaction times to new and yet unknown cyberthreats.
KSN also employs Kaspersky Lab’s HuMachine principle ~ both Kaspersky Lab expert knowledge and next-generation machine learning capabilities are merged, allowing Kaspersky Lab to spot patterns, changes and new threats in the cyber landscape with greater accuracy and skill.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
The 2019 Kaspersky ICS CERT Report just revealed that almost half of the Industrial Control System (ICS) computers they protected were attacked in the second half of 2018. This is a wake-up call to industries large and small.
They also shared with us some technical measures that can help companies ward off these cyberattacks.
The 2019 Kaspersky ICS CERT Report
The 2019 Kaspersky ICS CERT report is based on the industrial threat landscape the team experienced in H2 2018.
In that period, they noted that almost half of the ICS computers they were protecting were attached in some form.
These attacks could have crippled these industrial facilities if they resulted in an actual breach. That would have caused great material and production losses.
Here is the summary of their report :
47.2% of ICS computers were attacked in 2018, slightly more than the 44% they encountered in 2017.
Vietnam was the top country, with 70.90% of their ICS computers attacked
Algeria was second, with 69.91%; and Tunisia was third with 64.57% attacked.
The least impacted countries were Ireland (11.7%), Switzerland (14.9%), and Denmark (15.2%).
Mass-Distributed Malware Is The Greatest Threat
Mass-distributed malware such as phishing emails are the most common way used by hackers to infiltrate industrial companies throughout the Asia Pacific region and the world.
“Despite the common myth, themain source of threat to industrial computers is not a targeted attack, but mass-distributed malware that gets into industrial systems by accident, over the internet, through removable media such as USB-sticks, or e-mails.
However, the fact that the attacks are successful because of a casual attitude to cybersecurity hygiene among employees means that they can potentially be prevented by staff training and awareness – this is much easier than trying to stop determined threat actors,” said Kirill Kruglov, security researcher at Kaspersky Lab ICS CERT.
Knowledge And Training Are Essential To Combating Malicious Cyber Attacks
According to Yeo Siang Tiong, General Manager for Southeast Asia at Kaspersky Lab,
“Our researchers are seeing many carefully crafted phishing emails, sent purportedly by real companies and masked as business correspondence, commercial offers, invitations to tender and so on, which could be very commonly faced by many enterprises in Malaysia.
We recommend all companies to warn their staff of this real threat and to train them to recognize signs of an attack, to not open suspicious files or click on links, and to inform their IT department of any potential incidents,” Yeo said.
“H2 2018 saw a decline in ICS infections in Malaysia, 41.1% versus H1 2018 of 50.8%. It is a good sign that users are more aware of the cyber risks, and are becoming careful about it,” Yeo added.
How To Safeguard Industrial Computer Systems (ICS)
The 2019 Kaspersky Lab ICS CERT recommends the following measures to protect Industrial Computer Systems (ICS) :
Regularly update operating systems, application software on systems that are part of the enterprise’s industrial network.
Apply security fixes to PLC, RTU and network equipment used in ICS networks where applicable.
Restrict network traffic on ports and protocols used on edge routers and inside the organization’s OT networks.
Audit access control for ICS components in the enterprise’s industrial network and at its boundaries.
Deploy dedicated endpoint protection solutions on ICS servers, workstations and HMIs.
Make sure security solutions are up-to-date and all the technologies recommended by the security solution vendor to protect from targeted attacks are enabled.
Provide dedicated training and support for employees as well as partners and suppliers with access to your network.
Use ICS network traffic monitoring, analysis and detection solutions for better protection from attacks potentially threatening technological process and main enterprise assets.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
The Momo challenge and hype continue to create panic and hysteria over the Internet for more than a year now. Here is a short guide on what Momo is all about, and how to deal with the Momo challenge and hype!
What Is Momo?
Momo is actually a photo of a sculpture of the Ubume ghost by a Japanese artist Keisuke Aizawa that some pranksters use to create the Momo hype.
Using WhatsApp, these pranksters use the Momo picture to scare people, and spread hysteria, by sending victims horror pictures, claims of knowing everything about their contacts, and so on.
The Momo Challenge
The same Momo accounts are also said to also challenge people to harm themselves or others. They are said to be presented as a series of challenges or initially benign tasks, that culminates in demands of violent acts or suicide.
Although no actual cases have been confirmed, the Momo challenge created a hysteria, thanks to the media and Internet trolls.
The media failed to verify facts before presenting the Momo challenge as a genuine threat, while Internet trolls take opportunity of the public’s fear and ignorance to spread more false stories about the Momo challenge or hype.
Momo Is NOT A Virus, But It Is Dangerous
Although it has been claimed that Momo can add itself to contact lists using a virus, this is not true. There is no virus that spreads Momo, or a Momo virus.
Momo is not a cybersecurity threat – it cannot steal or damage your data. Yet it is still a threat to both parents and children.
Children don’t know better that Momo is not real, and may be enticed by pranksters using the Momo avatar to trick them into doing something wrong or unsavoury.
Parents, on the other hand, can be overwhelmed by the media onslaught about Momo, and over-react because they don’t know what to do.
How To Deal With The Momo Challenge
David Emm, Principal Security Researcher at Kaspersky Lab, shared with us some ways to deal with the Momo challenge.
Have regular conversations with your child(ren) – make them aware of how to be safe online. Agree which sites are appropriate for them and ensure they understand the reasoning behind this. They also need to know that they can – and should – confide in a trusted adult if they experience something upsetting whilst online.
Make sure your child understands they should not ‘friend’ anyone online they don’t know in real life, or add unknown numbers to their contacts – people online are not always honest about who they are and what they want
Activate safety settings – settings such as auto-play should be disabled and parental controls can be installed to help prevent children from viewing inappropriate content.
Make use of the mute, block and report features – This will protect them from a lot of harmful content.
Never share personal information such as phone numbers, address, etc with people you don’t know.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Tech ARP is now 20 years old! To celebrate, we partnered up with many of the world’s TOP BRANDS to thank you all for your loyal support with a TWENTY-WEEK GIVEAWAY! 😲 😲 😲
Tech ARP Is 20 Years Old & Going Strong!
Time sure FLIES when you are having fun! Twenty years ago, Ken, Chai and I got together to rebrand Adrian’s Rojak Pot as Tech ARP. We were having trouble explaining what rojak was, and that pot did not refer to marijuana / cannabis! 😂😂😂
That was in the good old days of sawing off pipe end caps to turn into CPU water coolers, and modifying SLAB (sealed lead acid batteries) into the world’s first power bank for our PDAs (remember those?).
Those sure were CRAZY DAYS! 😂😂😂
Somehow, we worked our way to the forefront of motherboard technology with our seminal BIOS Optimization Guide, which later got published as Breaking Through The BIOS Barrier : The Definitive BIOS Optimization Guide for PCs.
I don’t know how I did it, but somehow, we did all those crazy stuff while I was still in medical school! CRAZY days indeed!
Over the years, we moved from strength to strength, with Ken hand-developing our own backend, and Chai nurturing our budding forums.
Somehow, we persevered and by the miracle of surviving the passage of time, Tech ARP is Malaysia’s oldest tech website!
Today, we are still pretty much the same team, with Falcone, Dashken, Carolyn, Hui Xin, Alyssa, Kar Hoe and Brian Chong helping us out here and there. Thank you, guys!
The Tech ARP 20-Week Giveaway
To thank you all for sharing our crazy journey over the years, we have prepared a 20-week giveaway contest. Actually, a series of twenty weekly giveaway contests.
We worked with many of the world’s TOP BRANDS to bring you all some goodies. We are also sponsoring some of these giveaways ourselves. Here are some of the brands that will be sponsoring their own giveaways here soon :
[adrotate group=”2″]
Acer – Special Edition Laptop!
AMD – AMD Ryzen CPUs!
BenQ – MONITOR!
Cooler Master – CPU coolers, gaming keyboards and more!
Dell – POWER COMPANIONS, speakers and more!
Edifier – Headphones!
GIGABYTE – Motherboards!
TP-LINK
Western Digital – SSDs + HDDs!
Where possible, we are opening up the giveaways WORLDWIDE. But where our brand partners wish to restrict their giveaways to certain regions or countries, we will notify you of that.
All we ask is that you use your genuine personal Facebook account in our Facebook contests. We will automatically disqualify anyone who uses a Facebook account that is primarily used for contests.
Crowdfunding Tech ARP
As we have been for the last twenty years, Tech ARP is a crowdfunded website. We do NOT charge for our articles. So if you wish to help us out, please feel free to donate to our cause. Thank you!
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
20th Anniversary Week 1 Giveaway
To kick things off, we are giving away the following prizes for the first week!
The Awesome Prize : Microsoft Lumia 950 Smartphone + Microsoft Display Dock + Tempered Glass Screen Protector
Cool Prize #1 : TP-Link Groovi Ripple Portable Bluetooth Speaker
Cool Prize #2 : TP-Link Groovi Ripple Portable Bluetooth Speaker
Cool Prize #3 : Olike Qualcomm Quick Charge 3.0 Car Charger with two USB ports
Cool Prize #4 : Olike Qualcomm Quick Charge 3.0 Car Charger with two USB ports
Contest Period :31 August to 7 September 2018
Eligibility :WORLDWIDE *
* Tech ARP will pay for standard shipping, but you may opt to pay for expedited or express shipping services.
Everyone definitely wants The Awesome Prize, but we want to know which of the Cool Prizes you prefer – the Groovi Ripple, or the Olike QC 3.0 car charger.
So post a comment in our official Facebook post on the Week 1 Giveaway, and tell us which you prefer :
a) TP-Link Groovi Ripple, or
b) Olike QC 3.0 Car Charger
BONUS :Liking and sharing our posts, or commenting and tagging your friends, will give you a higher chance of winning The Awesome Prize or the prize you want!
That’s it! It’s THAT simple!
Contest Mechanics
[adrotate group=”2″]
At the end of the contest, we will randomly select FIVE contestants.
If any contestant fails to meet any of the rules above, another contestant will be randomly selected.
The Likes, Shares, Comments and Tags of the five verified contestants in the Tech ARP Facebook page will be calculated.
The Awesome Prize winner will be randomly selected from that pool.
The subsequent winners will be randomly selected from that pool, with prize preference given to those who are selected first.
Each contestant may only win one prize, so if his/her number is selected again, it will be discarded and a new number randomly selected.
Got it? Go and try it out!
Note On Gaming Accounts : Contestants who use gaming accounts will be automatically disqualified. Please use your personal Facebook accounts.
Week 1 Giveaway Winners!
We are very excited to announce the winners for the Week 1 Giveaway!
Mohd Fahmi wins the Microsoft Lumia 950 Smartphone + Microsoft Display Dock + Tempered Glass Screen Protector!
Faridah Akmal wins a TP-Link Groovi Ripple Portable Bluetooth Speaker!
Alister Lok wins a TP-Link Groovi Ripple Portable Bluetooth Speaker!
Mohd Khairul Zaman wins an Olike Qualcomm Quick Charge 3.0 Car Charger!
Ivan Ng wins an Olike Qualcomm Quick Charge 3.0 Car Charger!
Winners, please send your full details to contest @ techarp.com.
Full Name : Full Address : Mobile / Contact Number : Email Address :
LAST CALL : Those who do not submit their details by 12 PM, Friday, 19 October 2018 will forfeit their prizes.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
20th Anniversary Week 2 Giveaway
This week, Dell will be giving away prizes worth more than RM 2,000 / $500!
The Awesome Prizes : Dell PW7015M Power Companion (2 units)
Great Prizes : Dell AE215 Speaker System (2 units)
Meet the Dell Power Companion – a handy device that powers select Dell notebooks and ultrabooks, as well as up to two smartphones, tablets or other USB-enabled devices, ensuring users can be more productive on-the-go.
Lightweight and compact, and featuring a 12,000 mAh 4-cell battery that provides reliable power, this compact power solution is designed to deliver in-bag charging so you can stay powered without adding bulk to your bag.
The Dell 2.0 Speaker System (AE215) provides high quality sound experience that fits neatly into almost any desktop setup. With premium sound professionally tuned by award-winning Waves Maxx Audio and a compact and modern design, the speakers deliver a surprising amount of full, deep bass without adding clutter to your desk.
In addition, the Dell AE215 speakers also feature a headphone jack so you can plug in your favourite headphones for a private listening experience without interruptions.
The Dell WM514 Wireless Laser Mouse is a stylish, high-precision wireless mouse with long battery life. Its laser tracking feature allows for smooth tracking on virtually any surface, and provides quick response times and accurate clicking.
There is no greater option for a clutter-free workspace with its compact size, and unrestricted performance that allows mobile professionals to have all of the expected conveniences of a wireless mouse. The WM514 is also designed for comfort, allowing users to work or play for longer periods without the usual stress on the wrists or hands.
Dell’s AX210 offers great sound for a PC desk with little room. These speakers are a true upgrade in audio quality and functionality. Designed to complement any Dell computer, the speakers give users a unified aesthetic at home or in the office.
Whether you’re enjoying the latest movie, playing an action-packed game, or participating in a video conference, you will be at the center of excellent sound.
Contest Period :8 to 21 September 2018
Eligibility :WORLDWIDE *
* Tech ARP will pay for standard shipping, but you may opt to pay for expedited or express shipping services.
Tell us the sequence of the Great, Cool or Nice prizes that you prefer!
If you want a shot at winning the Awesome Prize, you will need to share our contest post in Facebook. If you want more chances to win the Awesome Prize, tag your friendsin our our contest post, or comment or like it.
Two winners will be randomly selected out of that poolto win an Awesome Prize each.
The subsequent winners will be randomly selected from contestants who correctly answered all five questions, with prize preference given to those who are selected first.
Each contestant may try multiple times but can only win one prize. If he/she has already won, a new contestant will be randomly selected.
Got it? Go and try it out!
Week 2 Giveaway Winners!
Here are the correct answers :
How many cells are there in the Dell PW7015M Power Companion?
– 4 Cells
What kind of sensor does the Dell WM514 wireless mouse use?
– Laser
How many models are in the 2018 Dell Precision 3000 Series Workstation family? See https://is.gd/ZM3mPj
– 4
Which Australian university uses Dell Precision workstations for all its engineering requirements? See https://is.gd/Uwpn5w
– Monash University
What Corning technology is used in the Dell S2719DM monitor? See https://is.gd/5YcTTD
– Iris Glass
We are very excited to announce the winners for the Week 2 Giveaway!
Dell PW7015M Power Companion Winners
– zy****@gmail.com
– forbi****2k@yahoo.com
Dell AE215 Speaker System – vee***@hotmail.com
– wchian****@hotmail.com
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
20th Anniversary Week 3 Giveaway
For the third week, Tech ARP will be sponsoring these awesome prizes!
Awesome Prize #1 : honor Band SS smartwatch
Awesome Prize #2 : honor Band SS smartwatch
Cool Prize #1 : VR Box virtual reality glasses
Cool Prize #2 : VR Box virtual reality glasses
Cool Prize #3 : Kaspersky Foldable Bluetooth Keyboard
Cool Prize #4 : Kaspersky Foldable Bluetooth Keyboard
Cool Prize #5 : Honor Tripod Selfie Stick
Cool Prize #6 : Honor Tripod Selfie Stick
Contest Period :17 September to 30 September 2018
Eligibility :WORLDWIDE *
* Tech ARP will pay for standard shipping, but you may opt to pay for expedited or express shipping services.
SHARE the main contest post, and the prizes you want to win on your Facebook wall. Please make sure it is PUBLIC, so we can verify.
BONUS :Liking and sharing our posts, or commenting and tagging your friends, will give you a higher chance of winning The Awesome Prize or the prize you want!
BONUS :Likes, shares, comments or tags on our many Samsung Galaxy Note9 posts will give you a higher chance of winning The Awesome Prize or the prize you want!
That’s it! It’s THAT simple!
Contest Mechanics
[adrotate group=”2″]
At the end of the contest, we will randomly select TEN contestants.
If any contestant fails to meet any of the rules above, another contestant will be randomly selected.
The Likes, Shares, Comments and Tags of the ten verified contestants in the Tech ARP Facebook page will be calculated.
The two Awesome Prize winners will be randomly selected from that pool.
The subsequent winners will be randomly selected from that pool, with prize preference given to those who are selected first.
Each contestant may only win one prize, so if his/her number is selected again, it will be discarded and a new number randomly selected.
Got it? Go and try it out!
Note On Gaming Accounts : Contestants who use gaming accounts will be automatically disqualified. Please use your personal Facebook accounts.
Week 3 Giveaway Winners!
We are very excited to announce the winners for the Week 3 Giveaway!
Awesome Prize #1 Winner : Isaac Lee Eng Quin
Awesome Prize #2 : Ken-Boon Teoh
Cool Prize #1 : Yee Mee Chan
Cool Prize #2 : Thomas George
Cool Prize #3 : Jireh Phan
Cool Prize #4 : Spectre Phang
Cool Prize #5 : Vicky Loo
Cool Prize #6 : Ilrelda Koh
Winners, please send your full details to contest @ techarp.com.
Full Name : Full Address : Mobile / Contact Number : Email Address :
Note :Please submit your details by 12 PM, Wednesday, 14 November 2018 or you may forfeit your prize! 😀
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
20th Anniversary Week 4 Giveaway
For the 4th week, BenQ and Tech ARP will be sponsoring these awesome prizes!
The BenQ EW277HDR Eye-Care monitor is part of a new range of BenQ Eye-Care monitors that feature the new Eye-Care technologies like Brightness Intelligence Plus and Low Blue Light.
BenQ specifically highlighted these HDR monitors (including the BenQ EW277HDR) as the best choices to be paired with the PlayStation 4 Pro or PlayStation 4. Here are their key specifications :
BenQ EW3270U
4K UHD resolution – 3840 x 2160 pixels, HDR
31.5-inch VA panel with 95% DCI-P3 colour gamut
Brightness Intelligence Plus, Low Blue Light, Flicker-free
Would you like to own the BenQ EW277HDR Eye-Care monitor? Here’s how!
Contest Period :24 September to 25 October 2018
Eligibility :Malaysia Only *
* Because it is large and fragile, we require the winner to collect the monitor from us in Selangor or Kuala Lumpur, with Penang as a possibility too. If necessary, the winner may send a representative. We will require a photo to be taken with the winner or representative, with some social media posts.
You can then :
a) Post a comment in the contest post, and tag your friends. Make sure you also use the #BenQPS4Monitor hashtag. You can tell us which Cool Prize you prefer, for example, or why you want to win the BenQ monitor.
b) Sharethecontest post on your Facebook wall publicly, and use the #BenQPS4Monitor hashtag. You can tag your friends too for extra credit.
c) Sharethecontest post in a relevant group, using the #BenQPS4Monitor hashtag.
BONUS :Likes, shares, comments or tags on our many Samsung Galaxy Note9 posts will give you a higher chance of winning The Awesome Prize or the prize you want!
That’s it! It’s THAT simple!
Contest Mechanics
[adrotate group=”2″]
At the end of the contest, we will randomly select TEN contestants.
If any contestant fails to meet any of the rules above, another contestant will be randomly selected.
The Likes, Shares, Comments and Tags of the ten verified contestants in the Tech ARP Facebook page will be calculated.
The Incredible Prize winner will be randomly selected from that pool.
The subsequent winners will be randomly selected from that pool, with prize preference given to those who are selected first.
Each contestant may only win one prize, so if his/her number is selected again, it will be discarded and a new number randomly selected.
Got it? Go and try it out!
Note On Gaming Accounts : Contestants who use gaming accounts will be automatically disqualified. Please use your personal Facebook accounts.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
20th Anniversary Week 5 Giveaway
For the fifth week, Tech ARP and Dotty’s will be sponsoring these awesome prizes!
Awesome Prizes #1 : 5 x iflix Subscription (1 Year)
Awesome Prizes #2 : 5 x Dotty’s RM 100 voucher
Contest Period :19 September to 29 October 2018
Eligibility :Malaysia Only (for Dotty’s) / Countries that iflix supports *
* The dotty vouchers are only valid in Malaysia. The iflix subscriptions are valid in Malaysia, Indonesia, Philippines, Brunei, Thailand, Vietnam, Cambodia, Myanmar, Pakistan, Nepal, Bangladesh, Sri Lanka, Maldives, Saudi Arabia, Kuwait, Bahrain, Jordan, Iraq, Lebanon, Egypt, Sudan, Nigeria, Kenya, Ghana, Zimbabwe, Tanzania, Morocco and Uganda.
You can then :
a) Post a comment in the contest post, and tag your friends. Make sure you tell us which prize you prefer using these hashtags – #IWantFREEiflix or #IWantFREEDottys.
b) Sharethecontest post on your Facebook wall publicly, and use either hashtags. You can tag your friends too for extra credit.
c) Sharethecontest post in a relevant group, using either hashtags..
BONUS :Likes, shares, comments or tags on any of our many Facebook posts will give you a higher chance of winning one of the Awesome prizes!
That’s it! It’s THAT simple!
Contest Mechanics
[adrotate group=”2″]
At the end of the contest, we will randomly select TEN contestants.
If any contestant fails to meet any of the rules above, another contestant will be randomly selected.
The Likes, Shares, Comments and Tags of the ten verified contestants in the Tech ARP Facebook page will be calculated.
The Incredible Prize winners will be randomly selected from that pool, with prize preference given to those who are selected first.
Each contestant may only win one prize, so if his/her number is selected again, it will be discarded and a new number randomly selected.
Got it? Go and try it out!
Note On Gaming Accounts : Contestants who use gaming accounts will be automatically disqualified. Please use your personal Facebook accounts.
Week 5 Giveaway Winners!
We are very excited to announce the winners for the Week 5 Giveaway!
Awesome Prize #1 Winner : Franco Kailsan
Awesome Prize #1 Winner : Liza Lee
Awesome Prize #1 Winner : Mohd Fahmi
Awesome Prize #1 Winner : Siew Hong Go
Awesome Prize #1 Winner : Haqeem Norazli
Awesome Prize #2 Winner : Vee Fah
Awesome Prize #2 Winner : Steven Khoo
Awesome Prize #2 Winner : Chai Ser Loon
Awesome Prize #2 Winner : Falcone
Awesome Prize #2 Winner : Cyrus Varrus
Winners, please send your full details to contest @ techarp.com.
Full Name : Full Address : Mobile / Contact Number : Email Address :
Note :Please submit your details by 12 PM, Wednesday, 28 November 2018 or you may forfeit your prize! 😀
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
20th Anniversary Week 6 Giveaway
For the sixth week, Pocophone be sponsoring these awesome prizes!
Awesome Prize : Pocophone F1
Cool Prize : Mi Band 2
Contest Period :1 November to 14 November 2018
Eligibility :Malaysia only for Pocophone F1, Worldwide for Mi Band 2
You can then :
a) Post a comment in the contest post, and tag your friends. Make sure you tell us which prize you prefer using these hashtags :
– #FreePocophoneF1 and #XiaomiMY, OR – #FreeMiBand2 and #XiaomiMY.
b) Sharethecontest post on your Facebook wall publicly, and use either hashtags. You can tag your friends too for extra credit.
c) Sharethecontest post in a relevant group, using either hashtags..
BONUS :Likes, shares, comments or tags on any of our many Facebook posts will give you a higher chance of winning one of the prizes!
Note : Use #FreePocophoneF1 if you are residing in Malaysia. It will qualify you for both the Pocophone F1 and the Mi Band 2. Use #FreeMiBand2 if you are residing outside of Malaysia. It will qualify you for the Mi Band 2.
That’s it! It’s THAT simple!
Contest Mechanics
[adrotate group=”2″]
At the end of the contest, we will randomly select FIVE contestants.
If any contestant fails to meet any of the rules above, another contestant will be randomly selected.
The Likes, Shares, Comments and Tags of the five verified contestants in the Tech ARP Facebook page will be calculated.
The Incredible Prize and Cool Prize winners will be randomly selected from that pool, with prize preference given to those who are selected first.
Each contestant may only win one prize, so if his/her number is selected again, it will be discarded and a new number randomly selected.
Got it? Go and try it out!
Note On Gaming Accounts : Contestants who use gaming accounts will be automatically disqualified. Please use your personal Facebook accounts.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
20th Anniversary Week 7 Giveaway
For the seventh week, Western Digital be sponsoring these awesome prizes!
The WD Black NVMe SSD is dedicated for PC gamers who are looking to boost the performance of their gaming rigs.
Featuring sequential read/write speeds up to 3,400/2,800 MB/s, and the innovative Western Digital NVMe SSD storage architecture, it’s where blazing speed and top-tier performance combine to keep up with even the most demanding workloads. Innovative power management and thermal throttling consistently help prevent overheating to deliver smooth, fast performance.
With up to 600TBW, 1.75M hours MTTF and an amazing 5-years limited warranty, the WD Black NVMe SSD is the virtually invincible SSD you can rely on.
You can then :
a) Post a comment in the contest post, and tag your friends. Please let us know if you can self-collect the HDD using the hashtag #FreeHDD.
b) Sharethecontest post on your Facebook wall publicly, and use the #FreeHDD hashtag if you can self-collect the HDD. You can tag your friends too for extra credit.
c) Sharethecontest post in a relevant group. Please let us know if you can self-collect the HDD using the hashtag #FreeHDD.
BONUS :Likes, shares, comments or tags on any of our many Facebook posts will give you a higher chance of winning one of the prizes!
Collection : Winners of the HDDs must self-collect the WD Red hard disk drives in person, as we want to avoid the risk of damage during delivery. We can arrange to meet with the winners at these locations :
Selangor : Mutiara Damansara
Kuala Lumpur : TTDI
Penang : Seberang Jaya
Warranty : The drives are also provided as-is, without warranty from Western Digital or Tech ARP.
That’s it! It’s THAT simple!
Contest Mechanics
[adrotate group=”2″]
At the end of the contest, we will randomly select TWENTY contestants who used the #FreeHDD hashtag.
If any contestant fails to meet any of the rules above, another contestant will be randomly selected.
The Likes, Shares, Comments and Tags of the twenty verified contestants in the Tech ARP Facebook page will be calculated.
The Cool Prize winners will then be randomly selected from the pool of verified contestants.
Each contestant may only win one prize, so if his/her number is selected again, it will be discarded and a new number randomly selected.
Got it? Go and try it out!
Note On Gaming Accounts : Contestants who use gaming accounts will be automatically disqualified. Please use your personal Facebook accounts.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Kaspersky Lab joined forces with digital youth charity The Mix to launch the AndOwningIt campaign for Generation Z! Here is everything you need to know about the #AndOwningIt campaign for youths!
Kaspersky Lab Reports Anxiety Among Generation Z!
Kaspersky Lab reports that the majority of Generation Z do not seek professional advice to help them cope with anxiety issues.
In line with its global commitment to turn insecurity into security, Kaspersky Lab has joined forces with digital youth charity The Mix to help young people from around the world embrace their own insecurities. The objective is to show them that anxiety issues are not barriers to achieving happiness.
The new campaign is called #AndOwningIt.
Who Are Generation Z?
Generation Z are young people aged between 13 to 23 years old. With their world dominated by online news and social media, nearly half of Generation Z said they feel more anxious about their appearance than about their career prospects, money, terrorism and being bullied.
The report revealed that these anxious feelings, or worries, can impact young people’s behavior including how they approach social media.
It is quite common for Generation Z to create a more manufactured perception of how they look. Most young people also spend up to half an hour editing their images or videos prior to posting them on social media platforms. The reason is to create a flawless image.
What Are The Findings Of The Report?
It was reported that girls are more insecure than boys. They feel much more anxious about their appearance than their male counterparts.
Nearly double the number of female Gen Z-ers compared to male Gen Z-ers admit to changing their eating habits (such as overeating or refraining from eating) because of appearance-related anxieties.
Body improvement and fitness content on social media makes young women feel worse than young men. Females have admitted to skipping a social event in the past year due to social anxiety.
What’s more worrying is that Generation Z does not seek help on what to do when they are feeling anxious. The majority young people do not visit a doctor for advice on how to cope with their anxieties.
This meant that many young people are struggling and they are unsure about how to deal with their feelings.
How are Kaspersky Lab And The Mix Helping The Generation Z?
Kaspersky Lab has joined forces with The Mix, a digital youth charity that supports people under the age of 25 to launch a new campaign to help turn Generation Z insecurities into securities. The campaign #AndOwningIt aims to empower them to embrace the very things that make them feel insecure and allowing them to realize that insecurities are not barriers to happiness.
The first step to turn an insecurity into a strength is by admitting/owning it.
The campaign will be supported by custom t-shirts featuring the most common insecurities young people have, thus encouraging them to accept their insecurities and start a conversation. All of the profits from the sale of the t-shirts will go to The Mix.
How Can You Help The AndOwningIt Campaign?
Kaspersky Lab and The Mix are urging Generation Z to join the conversation across social media with the #AndOwningIt hashtag. They could also purchase a t-shirt to show their support.
Do Your Part Now!
Support the worthy cause by purchasing the AndOwningIt t-shirts here. For specific help in tackling anxiety or other mental health challenges, please reach out to The Mix.
The information and support offered is universal and can be accessed internationally.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Kaspersky Lab is warning of malicious cryptocurrency mining powered by pirated software and content. Learn more about this new online threat!
Kaspersky Lab Warns Of Malicious Cryptocurrency Mining!
Kaspersky Lab has warned that the global outbreak in malicious cryptocurrency mining in 2018 has increased by more than 83%! 5 million users were attacked online in the first three quarters of 2018 compared to 2.7 million users in 2017.
The major driver behind the malicious cryptocurrency mining was the use of unlicensed software and content.
Malicious Cryptocurrency Mining
Malicious cryptocurrency mining has prevailed over the main threat of ransomware in recent years. The number of attacks had increased steadily during the first half of 2018. It peaked in March with about 1.2 million users attacked.
Kaspersky Lab experts have investigated the regulatory landscape and electricity prices in the top 10 countries targeted by crypto miners and main infection vectors for the popular malware families.
The investigation of malware families revealed that they mainly infected devices by duping users into installing pirated software and unlicensed content.
“Our analysis of the economic background of malicious crypto mining and the reasons for its widespread presence in certain regions revealed a clear correlation: the easier it is to distribute unlicensed software, the more incidents of malicious crypto miner activity were detected. In short, an activity not generally perceived as dangerous: the downloading and installation of dubious software, underpins what is arguably the biggest cyberthreat story of the year – malicious crypto mining,” notes Evgeny Lopatin, security expert at Kaspersky Lab.
Other Key Findings From The Report
The total number of users who encountered miners rose by more than 83% from 2,726,491 in 2017 to 5,001,414 in 2018
The share of miners detected increased from 5% in 2017 to 8% in 2018
The share of miners detected from the overall risk tool detections has risen from 9% in 2017 to 17% in 2018
The total number of users who encountered mobile miners also grew by over 5 times from 1,986 in 2017 to 10,242 in 2018.
Steps To Reduce Risk Of Infection
Always update software on all your devices to prevent miners from exploiting vulnerabilities.
Use tools that can automatically detect vulnerabilities and download and install patches.
For personal devices, use a reliable consumer security solution and remember to keep key features such as System Watcher switched on.
Don’t overlook less obvious targets such as queue management systems, POS terminals and even vending machines.
Use application control to track malicious activity in legitimate applications.
Specialized devices should be in Default Deny mode.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Here is a short guide by the Kaspersky Lab team on how to stay safe while shopping online during the holiday sales, whether it’s for Black Friday, Cyber Monday or Christmas! Bookmark it for reference, and share this with your friends!
Kaspersky Lab Tips On Staying Safe While Shopping Online!
Why Is This Important?
14 families of malware targeting 67 different popular consumer brands around the world were recently detected. It caused the exposure of a large amount of client emails from a popular online shop.
Emails may seem a small matter but this sort of information is in fact precious to scammers. Any personal data can be used by cybercriminals to target their victims.
Increase in the share of financial phishing in the last years
How Do Scammers Compromise Your Personal Data?
If a company is compromised and scammers get hold of customer’s email addresses, they can create an automatized spam mailout that mimics an authentic email. This would entice users to follow a malicious link or download a malicious file onto their devices.
What Should You Do?
Be very careful as we head into the holiday sales season, from Black Friday till Christmas and Boxing Day sales – the busiest time of the year. Do not compromise your bank accounts by following a phishing link and entering your bank credentials. Research shows that malware designed to steal data from online banking and payment accounts has extended its reach to target online shoppers.
Amazon sent out a warning as soon as the leak was exposed. And, although Amazon’s actions have been criticized for a lack of technical detail and a recommendation not to change users passwords, it’s great that company’s representative’s didn’t hesitate to warn their customers about possible threats, asking them to be on the lookout to minimize possible damage,” said Tatyana Sidorina, security researcher at Kaspersky Lab.
Tips On Staying Safe While Shopping Online
To keep yourself safe from fraudsters while shopping online during this holiday season, Kaspersky Lab recommends taking the following precautionary measures:
Always check the link address and the sender’s email to find out if they are genuine before clicking anything – very often phishers create URLs and e-mails that are are very similar to the authentic addresses of big companies, yet differ from them with one or two letters.
To make sure you follow a correct link, do not click on it, but type it into your browser’s address line instead.
Do not enter your credit card details in unfamiliar or suspicious sites and always double-check the webpage is genuine before entering any personal information (at least take a look at the URL). Fake websites may look just like the real ones.
If you think that you may have entered your data into a fake page, don’t hesitate. Change your passwords and pin-codes ASAP. Use strong passwords consisting of different symbols.
Never use the same password for several websites or services, because if one is stolen, all of your accounts will be put at risk. To create strong hack-proof passwords without having to face the struggle of remembering them, use a password manager such as Kaspersky Password Manager.
To ensure that no one penetrates your connection to invisibly replace genuine websites with fake ones, or intercept your web traffic, always use a secure connection – only use secure Wi-Fi with strong encryption and passwords, or apply VPN solutions that encrypt the traffic. For example, Kaspersky Secure Connection will switch on encryption automatically, when the connection is not secure enough.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Predators including cyber predators are everywhere, and too often we don’t see them coming. With Kaspersky Lab you could catch THE PREDATOR and possibly some cyber predators and win some prizes too!
Catch The Predator With Kaspersky Lab and Win Prizes!
THE PREDATOR directed and co-written by Shane Black (whose previous directorial credits include Iron Man 3 and Kiss Kiss Bang Bang) see a new group of humans take on the predators again in a setting, and with a story line that echoes many of the top cyber predator protection tips that have been shared by Kaspersky Lab.
Kaspersky Lab’s role in protecting the world from cybercriminals by hunting the cyberpredators ties in with the hunt-the-hunters cat and mouse game of The Predator’s protagonists led by Narcos‘ Boyd Holbrook and Moonlight’s Trevante Rhodes.
“Being cybersecurity experts, we want to make sure that the cyberworld is safe for everyone from all kinds of threats. Our job is pretty much parallel to the role of the good guys in the Predator movie as we are hunting the hunters to make the world a little safer from cybercriminals,” Yeo Siang Tiong, General Manager, SEA, Kaspersky Lab.
Kaspersky Lab in partnership with 20th Century Fox has an exciting promotional campaign for the “The Predator”. A total of USD 81,000 in FOX Studio Tours in Hollywood and special edition promotional merchandise are up for grabs in Kaspersky Lab’s ‘The Predator Promo’ in the Asia Pacific.
Catch The Predator Contest
The Catch The Predator promotion is open 11 countries in the APAC region including Australia, Hong Kong, Indonesia, Malaysia, New Zealand, the Philippines, Singapore, South Korea, Taiwan, Thailand and Vietnam.
Seven winners from the participating countries will get an experience of a lifetime to go on a VIP Hollywood FOX Tour for two worth more than USD 8000 each to view where the movie was filmed. This is an extremely rare opportunity as Fox Studios no longer offers studio tours, and the prizes are inclusive of airfare for two and three nights hotel accommodation.
There are also 1000 Limited Edition Predator Gift Sets of a military cap and thermal flash worth USD 25 per set to be won for a total of USD81,000 in prizes.
To participate in this promotion purchase any of these selected Kaspersky Lab products from an official Kaspersky online e-store or retail store between 9.July and 31 October 2018. :
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
We just tried our hand at the first KIPS (Kaspersky Initeractive Protection Simulation) Online training and simulation session! Find out what it’s all about!
KIPS – Not Your Average Monopoly Game
KIPS Online is the online version of the KIPS Live offline cybersecurity training game. Based on 20 years of Kaspersky Lab’s experience in corporate cybersecurity, it instills cybersecurity awareness in players, and offers real, actionable cybersecurity insights to top-level business executives.
Both the Online and Live versions aim to help managers understand cybersecurity threats and how they can affect the performance of the company. It will help them work better with their cybersecurity counterparts, both internal and external, to better and quickly deal with cybersecurity attacks and threats.
KIPS Helps Bring Down Recovery Cost
According to Kaspersky Lab’s Corporate IT Security Risks survey, 51% of enterprises agreed that it is difficult to demonstrate the ROI (Return on Investment) when it comes to IT security. One of the goals of the KIPS Online and KIPS Live games is to demonstrate to senior management officials that quick and coordinated action can help save IT security costs.
During the game, participants are tasked with operating an interactive cybersecurity facility, with the goal of maintaining the company’s financial health while managing cybersecurity challenges. These are based on real-life challenges that have afflicted Kaspersky customers, so this is as real world as it gets!
Trying Out KIPS For Yourselves
Unfortunately, you cannot just download and try the Kaspersky Initeractive Protection Simulation for yourselves, because it needs a short training session, followed by a debriefing session in which Kaspersky Lab (or its partner) will explain the facts behind that particular game scenario.
Companies that are interested to try either games should contact Kaspersky Lab and their resellers globally. Both KIPS Online and KIPS Live are part of the Kaspersky Lab family of Security Awareness Training services.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
The upcoming Trump-Putin summit aside, Kaspersky Lab is pushing forward with their Global Transparency Initiative. What is the Kaspersky Global Transparency Initiative?And how does it help guarantee that Kaspersky Lab products and services are safe to use?
We explain it all, with a little help from Stephan Neumeier and Oleg Abdurashitov from Kaspersky Lab!
The Kaspersky Global Transparency Initiative
The Kaspersky Global Transparency Initiative began in October 2017, as a way to allay fears that Kaspersky Lab products and services had backdoors built-in.
July 2017 : Eugene Kaspersky Offers Source Codes To US Government
In response to the US government’s prohibition on the use of Kaspersky Lab products, Eugene Kaspersky offered to make Kaspersky Lab source codes available to the US government for inspection.
make their source codes available for independent review and evaluation,
conduct an independent assessment of their software development and supply chain,
establish three Transparency Centers in Asia, Europe and the US.
increase bug bounty awards to US$100,000
We immediately pointed out that it did not address a major concern of the US government – that data is still being routed through Russian Internet service providers that are subject to the Russian intelligence surveillance system called SORM (System of Operative-Investigative Measures).
Kaspersky Lab maintained that customer data sent to their Russian servers are encrypted, and they do not decrypt them for the Russian government. But it would be impossible for them to prove that to anyone’s satisfaction.
May 2018 : Core Operations Moves To Switzerland
Last month, Kaspersky Lab announced that they are establishing a data center in Zurich by the end of 2019. This facility will store and process all information for users in Europe, North America, Singapore, Australia, Japan and South Korea, with more countries to follow.
The Kaspersky Switzerland facility will :
store and process customer data of select countries outside of Russia
host Kaspersky’s software build conveyer that will assemble and digitally-sign the final executable files and updates
serve as the first Kaspersky Transparency Center.
In addition, Kaspersky will be arranging for a qualified and independent third-party to review and supervise the data storage, processing, software assembly and source codes at this Zurich facility.
The very act of moving their customer data out of Russia to a neutral country finally removes our main criticism of their initial transparency initiative. Now, no one has to worry about sensitive data being transmitted through the Russian SORM intelligence surveillance system.
The Kaspersky Global Transparency Initiative Going Forward
The establishment of the Swiss datacenter is merely another phase in the long process of “earning trust”, as Stephan Neumeier called it. Eventually, customer data from most countries outside of Russia will move to that datacenter.
By the end of 2018, all Kaspersky Lab products and threat detection rule databases (AV databases) will be assembled and signed with a digital signature in Switzerland, before being distributed to customers worldwide. All newly assembled software will also be verified by an independent organization, certifying that software builds and updates received by customers match the source code provided for audit.
The next step would be the establishment of two more Transparency Centers – one in Asia, and another one in North America. Singapore and Canada are probable favourites.
Perhaps A Backdoor Bounty?
We would suggest that perhaps Kaspersky Lab should establish an independent backdoor bounty program, separate from their current bug bounty.
A large sum of money could be placed in escrow, under an independent and competent third-party, which can freely investigate and reward security researchers who can successfully prove the existence of a backdoor in any Kaspersky product or service.
That would go a long way into shoring up trust of those who have neither the financial nor the technical capabilities to visit a Kaspersky Transparency Center and peruse millions of lines of code.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Kaspersky Lab discovered than more than 22% of the World Cup 2018 WiFi hotspots lack encryption, making them quite unsafe for use by football fans. They share some useful tips on how to stay safe while using these World Cup 2018 WiFi hotspots!
Many World Cup 2018 WiFi Hotspots Are Unsafe!
According to Kaspersky Lab research, 7,176 of approximately 32,000 public Wi-Fi networks in FIFA World Cup 2018 host cities do not use traffic encryption. This makes them potentially unsafe for use by football fans visiting the cities. The results suggest that fans should take care of their personal data, especially while using open Wi-Fi connections around the FIFA World Cup games.
Global events always result in a concentration of people connecting to networks to upload posts, stay in touch with loved ones, and share the fun with others. However, at the same time, these networks can be used to transfer financial and other valuable information across the Internet. And it’s this information that third parties – not necessarily criminals – can intercept and use for their own purposes.
Kaspersky Lab’s findings are based on an analysis of public Wi-Fi spots in 11 FIFA World Cup 2018 host cities, including Saransk, Samara, Nizhny Novgorod, Kazan, Volgograd, Moscow, Ekaterinburg, Sochi, Rostov, Kaliningrad, and Saint Petersburg. The results show that so far not all wireless access points have encryption and authentication algorithms – aspects that are essential for Wi-Fi networks to remain secure. This means that hackers only need to be located near an access point to intercept network traffic and get confidential information from unwitting or unprepared users.
[adrotate group=”2″]
The three cities with the highest percentage of unreliable Wi-Fi networks are :
Saint Petersburg (37%),
Kaliningrad (35%), and
Rostov (32%).
In contrast, the safest places were relatively small towns – including :
Saransk (only 10% of Wi-Fi spots are open), and
Samara (17% of Wi-Fi spots are open).
Almost two-thirds of all public Wi-Fi networks in these locations use the Wi-Fi Protected Access (WPA/WPA2) protocol family for traffic Still, it should be noted that even reliable WPA/WPA2 networks can allow brute-force and dictionary attacks, as well as key reinstallation attacks, meaning they are not absolutely secure.
How To Use World Cup 2018 WiFi Hotspots Safely!
If you are going to visit FIFA World Cup 2018 host cities, remember to follow several simple rules to help protect your personal data if you plan to use these World Cup 2018 WiFi hotspots :
Whenever possible, connect via a Virtual Private Network (VPN). With a VPN, encrypted traffic is transmitted over a protected tunnel, meaning criminals won’t be able to read your data, even if they gain access to it.
Do not trust networks that are not password-protected, or have easy-to-guess or easy-to-find passwords.
Even if a network requests a strong password, you should remain vigilant. Fraudsters can find out the network password at a coffee shop, for example, and then create a fake connection with the same password. This allows them to easily steal personal user data. You should only trust network names and passwords given to you by employees of the establishment.
To maximize your protection, turn off your Wi-Fi connection whenever you are not using it. This will also save your battery life. We also recommend disabling automatic connections to existing Wi-Fi networks.
If you are not 100% sure the wireless network you are using is secure, but you still need to connect to the Internet, try to limit yourself to basic user actions such as searching for information. You should refrain from entering your login details for social networks or mail services, and definitely do not perform any online banking operations or enter your bank card details anywhere. This will avoid situations where your sensitive data or passwords are intercepted and then used for malicious purposes later on.
To avoid being a target for cybercriminals, you should enable the “always use a secure connection” (HTTPS) option in your device settings. Enabling this option is recommended when visiting any website you think may lack the necessary protection.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
In a move to allay fears of collusion with Russian authorities, Kaspersky Lab announced on 15 May 2018 that they will be moving a number of their core Russian operations to Switzerland. This would include their customer data storage and processing for most regions, as well as software assembly and threat detection updates.
To ensure full transparency and integrity, they are also arranging for this activity to be supervised by an independent third party, also based in Switzerland. Here are the full details!
Customer Data Storage & Processing
Kaspersky Lab will establish a data center in Zurich by the end of 2019. This facility will store and process all information for users in Europe, North America, Singapore, Australia, Japan and South Korea, with more countries to follow.
This information is stored and processed at this facility will be voluntarily shared by users of the Kaspersky Security Network (KSN) – a cloud-based system that automatically processes cyberthreat-related data.
Relocation of software assembly
Kaspersky Lab will relocate to Zurich its ‘software build conveyer’ — a set of programming tools used to assemble ready to use software out of source code.
Before the end of 2018, Kaspersky Lab products and threat detection rule databases (AV databases) will start to be assembled and signed with a digital signature in Switzerland, before being distributed to the endpoints of customers worldwide.
The relocation will ensure that all newly assembled software can be verified by an independent organization and show that software builds and updates received by customers match the source code provided for audit.
[adrotate group=”1″]
First Kaspersky Lab Transparency Center
Kaspersky Lab first announced their Global Transparency Initiative in October 2017. One of their initiatives include the creation of three Kaspersky Transparency Centers – one each in Asia, Europe and the US.
The first Transparency Center will be in Switzerland, and is expected to open this year. It will allow organisations and governments to inspect and review the source code of Kaspersky Lab products and software updates in a secure facility.
Independent supervision and review
Kaspersky Lab is arranging for the data storage and processing, software assembly, and source code to be independently supervised by a third party qualified to conduct technical software reviews. They are also calling for the creation of a new, non-profit organization to take on this responsibility.
Don’t forget to read our interview with Eugene Kaspersky on his alleged ties with Russian President Vladimir Putin and the Kremlin.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
To help companies improve their investigation and response to complex threats, Kaspersky Lab just launched a new service called Kaspersky Cloud Sandbox. It gives businesses the opportunity to take advantage of sandboxes without any additional investments into hardware infrastructure.
The Kaspersky Cloud Sandbox solution is available by subscription as part of the Kaspersky Threat Intelligence Portal. Allowing customers to ‘detonate’ suspicious files in a virtual environment with a full report on the file’s activities, it is designed to boost the efficiency of incident response and cybersecurity forensics without any risks to the company’s IT systems.
The Kaspersky Cloud Sandbox Revealed!
Exploiting legitimate software flaws became an efficient commodity for cybercriminals in 2017, as malicious activities can be easily hidden behind trusted processes. Even an experienced cybersecurity team can’t always be sure if it has spotted all the malware using such concealment techniques.
To achieve that, teams have to be equipped with advanced detection technologies, including sandboxing, which often requires significant hardware investments that are not easily feasible for many IT Security teams.
With Kaspersky Cloud Sandbox, advanced detection and forensic capabilities are available as a service within the Kaspersky Threat Intelligence Portal, allowing cybersecurity teams to ensure they meet their budget requirements while also benefitting from advanced technology.
The service enables cybersecurity teams and security operations center (SOC) specialists to obtain deep insights into malware behavior and design, detecting targeted cyberthreats that were not identified in the wild.
Advanced anti-evasion techniques: revealing a hidden truth
To lure malware into revealing its harmful potential, sandbox technology performance should possess advanced anti-evasion techniques. A malicious program, developed to run in a certain software environment, will not explode on a ‘clean’ virtual machine, and will most probably destroy itself without a trace.
To avoid this, Kaspersky Cloud Sandbox applies the user’s various emulation techniques, such as Windows button clicking, document scrolling, special routine processes giving malware an opportunity to expose itself, the randomization of user environment parameters and many others.
Logging system: nothing gets missed in the noise
Once a piece of malware starts running its destructive activities, another innovative Kaspersky Cloud Sandbox technology comes to force: its logging subsystem intercepts malicious actions non-invasively.
When a Word document starts to behave suspiciously – for example, if it starts building a string in the machine memory, executing Shell commands, or dropping its payloads (all abnormal activities for a text document) – these events are registered in the Kaspersky Cloud Security logging subsystem.
It has extensive functionality able to detect a vast spectrum of malicious events including DLLs, registry key registration and modification, HTTP and DNS requests, file creation, deletion and modification etc. The customer is then provided with a full report containing data visualization graphs and screenshots, as well as a readable sandbox log.
Detection and incident response performance: second to none
Kaspersky Cloud Sandbox detection performance is backed up with big data of real-time threat intelligence from Kaspersky Security Network (KSN), providing customers with immediate status on both known and new threats discovered in the wild.
Advanced behavioral analysis based on more than 20 years of Kaspersky Lab threat research experience of fighting the most complex threats, allows customers to detect previously unseen malicious objects.
[adrotate group=”2″]
As well as getting advanced detection capabilities, SOC experts and researchers can amplify their incident response activities with other services available through the Kaspersky Threat Intelligence Portal.
When performing digital forensics or an incident response, a cybersecurity officer can receive the latest detailed threat intelligence about URLs, domains, IP addresses, file hashes, threat names, statistical/behavior data and WHOIS/DNS data, and then link that knowledge to the IOCs generated by the sample that was analyzed within the cloud sandbox.
APIs to automate its integration into customer security operations are also available, allowing cybersecurity teams to boost their incident investigations in a matter of minutes.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
March 15, 2018 – Kaspersky Lab’s researchers have discovered evidence of Chinese APT teams using the PlugX malware in attacks against the healthcare sector. The infamous PlugX malware has been detected in pharmaceutical organizations in Vietnam, aimed at stealing precious drug formulas and business information.
What Is PlugX?
The PlugX malware is a well-known remote access tool (RAT). It is usually spread via spear phishing and has previously been detected in targeted attacks against the military, government and political organizations.
The PlugX RAT allows attackers to perform various malicious operations on a system without the user’s permission or authorization, including – but not limited to – copying and modifying files, logging keystrokes, stealing passwords and capturing screenshots of user activity.
PlugX, as with other RATs, is used by cyber criminals to discreetly steal and collect sensitive or profitable information for malicious purposes.
PlugX In Attacks On Big Pharma
The PlugX RAT has been used by a number of Chinese-speaking cyber threat actors, including Deep Panda, NetTraveler or Winnti.
In 2013, it was discovered that Winnti – responsible for attacking companies in the online gaming industry – had been using PlugX since May 2012.
[adrotate group=”2″]
Interestingly, Winnti has also been present in attacks against pharmaceutical companies, where the aim has been to steal digital certificates from medical equipment and software manufacturers.
RAT usage in attacks against pharmaceutical organizations indicates that sophisticated APT actors are showing an increased interest in capitalizing on the healthcare sector.
Other key findings for 2017 in the research include:
More than 60% of medical organizations had malware on their servers or computers;
Philippines, Venezuela and Thailand topped the list of countries with attacked devices in medical organizations.
Stay Protected Against PlugX
In order to stay protected, Kaspersky Lab experts advise businesses to take the following measures:
Remove all nodes that process medical data from public and secure public web portals;
Automatically update installed software using patch management systems on all nodes, including servers.
Perform network segmentation: refrain from connecting expensive equipment to the main LAN of your organization
Use a proven corporate grade security solution in combination with anti-targeted attack technologies and threat intelligence, such as Kaspersky Threat Management and Defense solution. These are capable of spotting and catching advanced targeted attacks by analyzing network anomalies and giving cybersecurity teams full visibility over the network and response automation
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Kaspersky Lab researchers discovered multiple security vulnerabilities in popular smart cameras made by Hanwha Techwin that are frequently used as baby monitors, or for internal home and office security surveillance.
According to their research, the uncovered flaws could allow attackers to obtain remote access to video and audio feeds from the cameras, remotely disable these devices, execute arbitrary malicious code on them and do many other things.
Security Holes In Hanwha Techwin Smart Cameras
Modern smart cameras contain an advanced number of functions, providing users with various opportunities: people can use them as advanced baby monitors or for surveillance systems which spot intruders while no one is home or in the office.
But, are these cameras secure enough by design and what if such a smart camera started watching you, instead of watching your home? Previous analysis conducted by many other security researchers has shown that smart cameras in general tend to contain security vulnerabilities at different levels of severity.
In their latest research, Kaspersky Lab experts uncovered something extraordinary: not just one, but a whole range of smart cameras was found to be vulnerable to a number of severe remote attacks. This was due to an insecurely designed cloud-backbone system that was initially created to enable the owners of these cameras to remotely access video from their devices.
By exploiting these vulnerabilities, malicious users could execute the following attacks:
Access video and audio feeds from any camera connected to the vulnerable cloud service;
Remotely gain root access to a camera and use it as an entry-point for further attacks on other devices on both local and external networks.
Remotely upload and execute arbitrary malicious code on the cameras;
Steal personal information such as users’ social network accounts and information which is used to send users notifications.
Remotely “brick” vulnerable cameras.
Following the discovery, Kaspersky Lab researchers contacted and reported the vulnerabilities to Hanwha Techwin, the manufacturer of the affected cameras. At the time of publication, some vulnerabilities had already been fixed, and the remaining vulnerabilities are set to be completely fixed soon, according to the manufacturer.
Thousands Of Hanwha Techwin Cameras Are Accessible Online
All these attacks were possible because experts found that the way the cameras interacted with the cloud service was insecure and open to relatively easy interference. They also found that the architecture of the cloud service itself was vulnerable to external interference.
\It is important to note that such attacks were only possible if attackers knew the serial number of the camera. However, the way in which serial numbers are generated is relatively easy to find out through simple brute-force attacks: the camera registering system didn’t have brute force protection.
[adrotate group=”2″]
While doing their research, Kaspersky Lab experts were able to identify almost 2,000 vulnerable cameras working online, but these were only the cameras that had their own IP address, hence were directly available through the internet. The real number of vulnerable devices placed behind routers and firewalls could actually be several times higher.
In addition, researchers found an undocumented functionality, which could be used by the manufacturer for final production test purposes. However, at the same time criminals could use this hidden avenue to send wrong signals to any camera or change a command already sent to it.
Besides that, the feature itself was found to be vulnerable. It could be further exploited with a buffer overflow, potentially leading to the camera’s shutdown. The vendor has now fixed the issue and removed this feature.
Hanwha Techwin Official Statement
The security of our customers is the highest priority for us. We have already fixed the camera’s vulnerabilities, including the Remote Upload and Execution of arbitrary malicious code. We have released updated firmware available to all our users. Some vulnerabilities related to the cloud have been recognized and will be fixed soon.
Kaspersky Lab’s Recommendations
In order to stay protected, Kaspersky Lab strongly advises users to do the following:
Always change the default password. Use a complex one instead and do not forget to update it regularly.
Pay close attention to security issues of connected devices before purchasing yet another smart device for homes or offices. Information on discovered and patched vulnerabilities is usually available online and is often easy to find.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
Every festive season turns into a shopping frenzy, and the action has moved increasingly online. With the convenience of online payment and in-app purchases, with delivery to your door, comes the very real risk of cybercrime, with you as the target. So here are some online shopping tips from Kaspersky!
Everyone loves a great deal during the Lunar New Year, and throughout the year. For cyber criminals, your frenzied shopping to get all the items you need delivered before the festivities begin is a prime opportunity. This is because in the euphoria and adrenaline rush of shopping, you will be more likely to make basic mistakes that can expose your personal data.
General Manager for Kaspersky Lab Southeast Asia, Sylvia Ng explained that the brand understands festive season shopping is a priority for consumers but reminds that it is also a prime opportunity for cyber criminals.
“Get your shopping done safely. Sipping on an espresso at a local coffee house and doing your Internet shopping does seems convenient. However, you open yourself up to criminal activity by doing so. Public Wi-Fi networks are often less secure than private ones, and you risk the possibility of logging onto a phantom network instead of the real one, opening you up to potential identity theft”.
Everyone needs to be wary of public Wi-Fi when using your smartphones and tablets. If you have to do your shopping on any Wi-Fi network, you first need to ensure that it is secure and a network you can trust. Cyber criminals know consumers are more likely to visit sites with login accounts or financial information during busy shopping times.
They can easily monitor all the information sent across public Wi-Fi networks, which can include your bank account or credit card number. Is that deal really so attractive that you are willing to put your online identity and finances at risk? Probably not.
Lunar New Year Online Shopping Tips
This year, don’t let your last minute shopping frenzy lead you down a path of bad security decisions. Here are some common mistakes, and how you can avoid them.
Check that you are using the authentic website of your bank or payment system – this should be obvious, but it is a common mistake that can be very costly!
Pay attention to the https prefix, which indicates an encrypted connection – makes a world of difference.
Check the spelling of the website – a misspelled address is an obvious sign of a fake phishing page.
Use that virtual keyboards to protect your password from being intercepted by key loggers.
Also, consider the following when shopping online:
Avoid ransomware — don’t open email attachments from unknown shopping sites, and always back up your files.
Be aware of phishing links — don’t click on unexpected links sent via email, SMS, or messengers.
[adrotate group=”2″]
Create strong passwords — combine letters, number and special characters to make them harder to hack.
Shop at safe sites — browse reviews before trusting online shopping sites with your credit card info.
Avoid shopping on public Wi-Fi — criminals love to snoop for your credentials in unsecured wireless networks.
Turn off Bluetooth, connect via cellular — these simple steps will make your smartphone connection much more secure.
Deny suspicious freeware — these ‘gifts’ might include adware or something even worse.
Avoid forged shipping confirmation emails — it could be a phishers’ bait for a quick click.
“These tips that we share are culled from real-life experiences of people. So, before you click on any deal, make sure that you are going to trusted sites. If you find a deal that seems too good to be true, it probably is,” added Sylvia Ng.
If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!
