HERNDON, Va. (BUSINESS WIRE) #ITchannel ― OPAQ , the network security

Top

channel program innovations, new funding and seasoned executive team.

According to CRN, OPAQ stood out from the crowd this year with the

100

to efficiently deliver Fortune 100-grade security via the cloud to

FourV

and reporting capabilities, received $22.5M

of new funding, and announced the appointment of former CA Technologies,

Lynn

Tinney

“Network and security modernization is driving market demand for a

single, fully integrated WAN and security solution that service

providers can simply deliver from the cloud,” said Glenn Hazard,

Chairman and CEO of OPAQ. “We are honored by CRN’s recognition of the

value that our cloud platform is delivering to our partners and to the

customers that rely on them for cost-effective, on-demand

enterprise-grade security protection.”

About OPAQ

OPAQ is the premier network security cloud

company. OPAQ’s platform-as-a-service enables partners to deliver

Fortune 100-grade security-as-a-service to midsize enterprises on a

fully encrypted SD-WAN optimized for speed and performance. With OPAQ,

service providers are equipped with a simplified ability to centrally

monitor security performance and compliance maturity, generate reports,

manage security infrastructure, and enforce policies all through a

single interface. This empowers OPAQ partners to grow revenue and

margins, eliminate complexity and costs, and establish a competitive

advantage that helps them attract and retain customers. Based in

Northern Virginia, OPAQ is privately held and is funded by Greenspring

Associates, Columbia Capital, Harmony Partners, and Zero-G, Inc. To

learn more, visit www.opaq.com .

Contacts

Marc Gendron

Marc Gendron PR for OPAQ

781-237-0341

Cylance

solutions, today announced the availability of application programming

interfaces (APIs) as part of its leading endpoint detect and respond

offering, CylanceOPTICS .

Thousands of CylancePROTECT

and OPTICS customers around the world now benefit from automated,

repeatable tasks and the improved ability to identify and respond to

advanced threats without an increase in headcount or process complexity.

Extensive APIs enable security teams to more efficiently view, enrich,

and contextualize real-time intelligence collected at the endpoint to

keep critical systems secure.

CylanceOPTICS exposes field-tested artificial intelligence to detect and

prevent advanced threats, enabling organizations to use automated

analyses to disrupt attackers across their environments. It also builds

the policies for device control and memory exploitation protection that

prevent attacks from executing in the network.

“Our robust AI platform not only automatically prevents successful

attacks, but it also informs other security and IT systems that may need

Sasi

that data accessible in real time, we can absolutely improve threat

visibility, but we can also improve an organization’s ability to drive

policy compliance, monitor device health, and maintain situational

awareness across their vast and changing IT environments.”

The availability of powerful APIs increases the sophistication of

CylanceOPTICS by creating automated workflows to generate helpdesk

tickets, initiate data collection, quarantine files, or launch other

tasks in real time. Organizations large and small benefit from increased

flexibility in their security stack because of the interoperability with

existing technology investments such as security orchestration,

automation, response (SOAR) and security information and event

management (SIEM) tools.

Users of Cylance next-generation AI enjoy the ability to correlate

endpoint data against known and prospective threats, which provides

increased understanding of the attack surface. Security teams also

benefit from the speed and accuracy of bringing new devices online and

implementing changes across their ecosystems on the fly.

To learn more about CylanceOPTICS, visit https://www.cylance.com/en-us/platform/products/cylance-optics.html .

About Cylance Inc.

Cylance develops artificial intelligence to deliver prevention-first,

predictive security products and smart, simple, secure solutions that

change how organizations approach endpoint security. Cylance provides

full spectrum predictive threat prevention and visibility across the

enterprise to combat the most notorious and advanced cybersecurity

attacks. With AI-based malware prevention, threat hunting, automated

detection and response, and expert security services, Cylance protects

the endpoint without increasing staff workload or costs. We call it the

Science of Safe. Learn more at www.cylance.com

Contacts

KC Higgins

Cylance Media Relations

+1 303.434.8163

近日，知名问答平台 Quora 网站的 CEO Adam D’Angelo 发布了一则公告，内容显示：约有 1 亿用户的资料遭到泄露，起因是上周五来自第三方的一次网络攻击。目前 Quora 已经通知执法部门，并聘请了一家数字取证公司来调查这一事件。

我们最近发现，由于恶意第三方未经授权访问我们的某个系统，一些用户数据遭到入侵。我们正在迅速调查情况，并采取适当措施防止此类事件再次发生。

我们还希望尽可能保持透明，同时不影响我们的安全系统或我们正在采取的措施，在这篇文章中，我们将分享所发生的事情，涉及的信息，我们正在做的事情以及您可以做些什么。

对于由此引起的任何问题或不便，我们深表歉意。

上周五，我们发现一些用户数据遭到第三方的攻击，该第三方未经授权访问我们的某个系统。我们仍在调查确切的原因，除了我们内部安全团队正在开展的工作外，我们还聘请了一家领先的数字取证和安全公司来协助调查，并通知了执法官员。

虽然调查仍在进行中，但我们已采取措施控制此事件，保护用户并防止此类事件在未来发生仍是我们公司的首要任务。

受影响的大约有 1 亿 Quora 用户，以下信息可能已被泄露：

帐户信息，例如姓名、电子邮件地址、密码，以及用户授权时从其他网络导入的数据

公开发布的内容和社区活动，例如提问、回答、评论、赞数等

非公开内容和操作，例如回答邀请、踩、私信等

匿名撰写的问题和答案不受此次事件的影响，因为我们不存储发布匿名内容的用户身份。

绝大多数被访问的内容已经在 Quora 上公开了，但是账户和其他私人信息的泄露是严重问题。

在继续调查的同时，我们正在采取额外措施改善我们的安全等级：

我们正在通知数据遭到泄露的用户。

出于谨慎的考虑，我们正在注销可能受到影响的所有 Quora 用户，如果使用密码作为身份验证方法，我们会使他们的密码无效。

尽管我们还在进行调查及改进安全性，但我们相信我们已找到了根本原因并采取措施解决该问题。

我们将继续与内部和外部专家合作，以充分了解事情原委，并根据需要采取进一步行动。

我们在帮助中心中提供了有关您可能遇到的更具体问题的详细信息，您可以在此处找到这些问题：

https://help.quora.com/hc/en-us/articles/360020212652

如果您受到影响，我们将通过电子邮件向您提供相关信息。

虽然密码是加密的，但最好不要在多个服务中重复使用相同的密码，我们建议用户更改密码。

我们有责任确保这样的事情不会发生，但我们未能履行这一责任。我们认识到，为了维护用户的信任，我们需要非常努力地工作，以确保这种情况不再发生。如果用户不能感到安全，不相信他们的隐私信息得到保护，那么分享和增长世界知识的希望就微乎其微。我们将继续努力地进行补救，希望随着时间的推移，能够证明我们值得用户的信任。

查看原文：

https://blog.quora.com/Quora-Security-Update?share=1

Brace yourself for yet another massive data breach. Quora.com, a site where people ask and answer questions on a range of topics, said hackers breached its computer network and accessed a variety of potentially sensitive personal data for about 100 million users.

Compromised information includes cryptographically protected passwords, full names, email addresses, data imported from linked networks, and a variety of non-public content and actions, including direct messages, answer requests and downvotes. The breached data also included public content and actions, such as questions, answers, comments, and upvotes. In a post published late Monday afternoon , Quora officials said they discovered the unauthorized access on Friday. They have since hired a digital forensics and security firm to investigate and have also reported the breach to law enforcement officials.

“It is our responsibility to make sure things like this don’t happen, and we failed to meet that responsibility,” Quora CEO Adam D’Angelo wrote in Monday’s post. “We recognize that in order to maintain user trust, we need to work very hard to make sure this does not happen again.”

The service has logged out all affected users, and in the event they use passwords to authenticate, old passwords have been invalidated. Users who chose the same password to protect accounts on a different service should immediately reset those passwords as well. Quora has already begun emailing affected users.

“We believe we’ve identified the root cause and taken steps to address the issue, although our investigation is ongoing, and we’ll continue to make security improvements,” Monday’s post stated. “We will continue to work both internally and with our outside experts to gain a full understanding of what happened and take any further action as needed.”

The hackers were unable to access questions and answers that were written anonymously, because Quora doesn’t store the identities of people who post anonymous content. The decision not to tie anonymous content to the identities of the people posting it is a smart one that will protect the identities of many people who discussed sensitive personal matters. But it will do less to shield people who, despite a Quora policy to the contrary, may have used a pseudonym as their account name or who discussed sensitive matters in direct messages.

A less useful decision by Quora: the company didn’t elaborate on the format of the stolen password data except to say that it was “encrypted,” by which it probably means the passwords were passed through a one-way hash function. The specific hash function matters greatly. If it's one that uses fewer than 10,000 iterations of a fast algorithm such as MD5 with no cryptographic salt, hackers using off-the-shelf hardware and publicly available word lists can crack as many as 80 percent of the password hashes in a day or two. A function such as bcrypt , by contrast, can prevent a large percentage of hashes from ever being converted into plaintext.

Quora’s post is only the latest disclosure of a major breach. On Friday, hotel chain Marriott International said a system breach allowed hackers to steal passport numbers, credit card data, and other details for 500 million customers . In September, Facebook reported an attack on its network allowed hackers to steal personal details for as many as 50 million users . The social network later lowered the number of accounts affected to about 30 million .

Readers are, once again, reminded to use a long and complex password that’s unique to each site, ideally by using a password manager. Whenever multi-factor authentication is available, people should also use that protection as well.

最近比赛繁多，抽时间看了一下EdDSA签名的有关内容，正好碰到一道题目涉及了对其的故障攻击，确实非常有意思，就在这里记录一下

EdDSA也是基于ECC的签名算法，平常我们见的比较多的应该是ECDSA签名，比如比特币使用的基于曲线secp256k1的ECDSA签名，以及基于NIST选择的几条曲线的签名等等

不过NIST P-256曲线，也就是secp256r1，因为默认使用的Dual_EC_DRBG随机数生成器一直被怀疑存在NSA隐藏的后门，到了13年斯诺登的曝光更是将这件事推上了风口浪尖，所以大家也就失去了对这一算法的信任，所以当年比特币选择了比较小众的secp256k1曲线还是有自己的考量

另外，我想熟悉ECDSA签名的朋友应该也都知道ECDSA签名算法的安全性是比较依赖于安全的随机数生成算法的，如果随机数算法存在问题，使用了相同的k进行签名，那么攻击者是可以根据签名信息恢复私钥的，历史上也出过几次这样的事故，比如10年索尼的PS3私钥遭破解以及12年受java某随机数生成库的影响造成的比特币被盗事件，关于这部分内容我也写过相关的分析，可以参见 利用随机数冲突的ECDSA签名恢复以太坊私钥 ，所以说ECDSA签名在设计上还是存在一些问题的， 这也激励了新的EdDSA算法的出现

EdDSA签名算法由Schnorr签名发展变化而来，可以在 RFC8032 中看到它的定义实现，由曲线和参数的选择不同又可以划分为Ed25519和Ed448算法，顾命思义，它们两分别是基于curve25519和curve448曲线，一般用的比较多的是Ed25519算法，相比Ed448而言运算速度要更快，秘钥与签名空间也较小，二者的使用场景还是有点区别，下面我们主要讲的也是Ed25519

Ed25519所使用的曲线由curve25519变换而来，curve25519是蒙哥马利曲线，经过变换得到Ed25519使用的扭爱德华曲线edwards25519，curve25519曲线的安全性是非常高的，可以在 safecurves 查看各椭圆曲线的安全指标，curve25519是其中为数不多所有指标都达标的曲线，curve25519常用于密钥交换的DH算法

而且EdDSA的运算速度也比ECDSA算法要快很多，优势可以说是非常明显的，门罗币和zcash等加密货币已经将算法切换到了EdDSA了，目前其也被确认为下一代椭圆曲线算法

Ed25518所取的有限域P跟curve25519相同，都是2^255-19，这也是这一曲线的名字由来，还有很多其他参数如公私钥的长度，选取的基点B等，在不同情况下也有不同的选择，Ed25519中也可做进一步的划分，只要满足rfc文档的定义即可，更多参数的定义可以参考 rfc7748

下面我们来看看Ed25519的具体签名过程，相比ECDSA确实有很大区别

Ed25519的私钥k长度为b bit，一般是256，其使用的hash算法H的输出长度为2b bit，一般选择的是SHA512，对应b等于256

首先，对私钥k进行hash,得到

使用hash的结果我们可以计算得到参数a

这样我们就可以得到私钥k对应的公钥A，A=aB，B为选取的基点，下面我们准备对消息M进行签名，过程如下，其中l为基点B的阶

这样就得到了消息M的签名(R,S)，签名的验证则需满足下面的等式

观察整个签名过程，我们不难发现，一个私钥k，当对同一个消息M进行签名时R与S都是固定的，所以说EdDSA是一种确定性的签名算法，不像ECDSA那样每次签名都根据选取的随机送的变化而不同，所以EdDSA的安全性也就不再依赖于随机数生成器

Ed25519的实现程序可以参考这里， Ed25519 software ，用python实现的，还是挺有意思

下面我们简单介绍一下fault attack也就是故障攻击，更确切地说我们也可以叫它 差分错误分析(Differential fault analysis) ，算是侧信道攻击的一种，主要针对包含处理器的智能卡，手法是通过物理方法，如电磁辐射，激光等干扰密码芯片的正常工作，迫使其执行某些错误的操作，依据错误的信息能够有效推算出密码系统的密钥信息

其实故障攻击的出现也是一场意外，科学家在研究时发现一块芯片的敏感区域在遭受放射性的照射后出现了比特位翻转的现象，从而引发了故障，但是通过分析这些信息却给我们打开了新世界的大门

引发故障的手法有很多种，比较简单的像是改变电压与温度，修改时钟频率，高级点的像是电磁辐射，激光照射等，还有一些对应的防御手段及应对的算法，这里就不展开了，有兴趣的可以看看这篇论文， A SURVEY ON FAULT ATTACKS

相对而言比较出名的应该是针对RSA签名的故障攻击，为提高RSA处理数据的速度，Quisquater等人利用中国剩余定理改进了RSA算法的运算速度，即CRT-RSA算法，不过这也为故障攻击的分析提供了绝佳的入口，感兴趣的可以看看这篇文章， RSA 签名故障分析

另外，DES和AES也早已有对应的攻击方式被提出，对于ECC的故障攻击也已经有了很多的研究，fault attack的威胁还是非常大的，而且攻击的方式其实也是非常巧妙

因为ECC算法对应的密钥空间较小，加之新的EdDSA的运算速度也比较快，所以在智能卡领域ECC也已经有了很多的应用，对应的故障攻击的威胁也就需要得到重视

下面我们就来看看针对Ed25519的故障攻击

这部分内容主要是基于Kudelski的这篇研究， HOW TO DEFEAT ED25519 AND EDDSA USING FAULTS

前面我们也提到了EdDSA签名的特点是对于同一消息M，不论你对它签名多少次，得到的签名结果都是相同的，那么我们的fault attack也正是针对这一特性

在上面的前面过程中，假设我们针对第四步的hash过程进行攻击，这样就得到了一个错误的h值，即h’，由它计算得到的就是错误的签名值S’，那么根据关系我们就可以得到

要求出a，在上式中只有h’是未知的，那么我们如何知道h’的值呢，其实很简单，也就是爆破，关键在于我们要想办法在攻击时让hash计算得到的结果中某一位进行翻转，具体哪一位是未知的，翻转的结果也是未知的，所以我们就进行逐字节的爆破，在这里假设使用的算法中得到的h是32字节的，那么爆破过程可以用下面的伪代码表示，这也是借用了Kudelski的图

过程还是很好理解的，那么成功得到h’的值以后我们就可以计算得到a了，然而这时候你再看就会发现貌似知道了a也跟私钥没啥联系啊，进行签名的第一步我们得知道私钥的hash的后b位才能跟我们想签署的消息M生成新的h

其实这里利用的就是EdDSA签名的特点，也是这个故障攻击最巧妙的地方，我们不妨随机选择一个r值，不用管签名第一步计算的h，然后使用这个r完成下面的签名过程，得到了签名(R,S)，然后进行签名校验

仔细查看整个推导过程，我们不难发现哪怕我们选择的r只是个随机值，但是签名的验证仍然是可以通过的，也就是说只要知道了a的值我们就可以进行签名的伪造了，并不需要知道原本的私钥，其实这里a已经可以看作是私钥了

可以看到对EdDSA进行故障攻击的过程是非常有趣的，以前提出的很多针对ECDSA的故障攻击多是针对运算过程中的基点进行攻击，比如让它的坐标发生改变，这样对应的基点的阶也将发生改变，很可能从一个大素数变成了一个大合数，而椭圆曲线的安全性要求基点的阶是素数，所以攻击后算法所使用的椭圆曲线其实以及不再安全了，很可能遭受算法如Pohlig-Hellman的攻击，这个我之前也写过相关的介绍， 简析ECC攻击方法之Pohlig-Hellman

最近Kudelski自己举办了一场crypto的ctf，其中就有一道题目是关于Ed25519的fault attack，下面我们就一起来看看

比赛详情在这里， https://github.com/kudelskisecurity/cryptochallenge18

涉及的题目是challenge1，题目给了四个api，如下

sign将返回我们发送的data的签名，我们来看看签名的情况

很有意思，签名的值在变化，其中穿插着一些错误的签名，重复出现的应该就是正确的签名了，不过观察那些错误的签名我们发现它们跟正确签名的R与S都不同，如果按照我们前面介绍的故障攻击的结果，那么应该是R相同而S不同，那么显然这里跟前面是不一样的，此处使用的fault attack是签名过程中第一步的hash值h进行了攻击，这样后面得到的R与S都是错误的，其实这样反而更简单了

回顾前面a的计算，当时我们未知的数是h’，但是在这里h’我们是可以直接通过错误的签名中的R’计算出来，所以说直接是已知的，那么我们就可以直接计算得到a了

查看一下我们需要签名的消息

完整的脚本可以参考Ledger-Donjon团队的 脚本 ,以及他们的 write up ，其中的公钥可以通过计算得到的a跟基点B计算得到

这次的研究让我又学到了不少新的东西，深切体会到了知识面的重要性，以前对于EdDSA都没什么了解，不过目前的趋势已经是在转向确定性签名机制了，EdDSA作为其中的代表自然是非常重要的，毕竟它的安全性和速度有目共睹

文章参考了很多的资料，就不一一列举了，重要的资料我都在文中添加了链接，同时水平有限，可能有些地方没写好甚至是出现错误，还希望师傅们多多指教

Kubernetes 最近爆出特权升级漏洞，这是 Kubernetes 的首个重大安全漏洞。为了修补这个严重的漏洞，Kubernetes 近日推出了几个新版本。

谷歌高级工程师 Jordan Liggitt 在周一发布的 Kubernetes 安全公告中称，Kubernetes v1.10.11、v1.11.5，v1.12.3 和 v1.13.0-rc.1 已经发布了修复版本，修复了特权升级漏洞 CVE-2018-1002105（ https://access.redhat.com/security/vulnerabilities/3716411 ）。

这个错误的严重程度被指定为 9.8（满分 10 分），因为它可以远程执行，攻击并不复杂，不需要用户交互或特殊权限。

根据 Liggitt 的说法，恶意用户可以通过 Kubernetes API 服务器连接到后端服务器，利用 API 服务器的 TLS 凭证进行身份验证并发送任意请求。

API 服务器是 Kubernetes 的主要管理实体，它与分布式存储控制器 etcd 和 kublet 发生交互，这些代理会监视容器集群中的每个节点。

Rancher Labs 的首席架构师兼联合创始人 Darren Shepherd 发现了这个漏洞。

Red Hat OpenShift 是一个面向企业的容器平台，已经为所有产品打上了补丁。

Red Hat OpenShift 总经理 Ashesh Badani 在一篇博文中表示：“这是一个大问题。不法分子不仅可以窃取敏感数据或注入恶意代码，还可以从企业防火墙内破坏应用程序和服务”。

该漏洞主要有两个攻击媒介。

首先，默认情况下，拥有 Pod exec/attach/portforward 权限的个人可以成为集群管理员，从而获得对 Pod 中任意容器及潜在信息的访问权限。

第二种方法可以让一个未经身份验证的用户访问 API，创建未经批准的服务，这些服务可用于注入恶意代码。

Red Hat 产品安全保障经理 Christopher Robinson 在给 The Register 的一封电子邮件中解释说，“任何未经身份验证但有权限访问 Kubernetes 环境的用户都可以访问用于代理聚合 API 服务器（不是 kube-apiserver）的端点”。

“向 API 发送一个消息，造成升级失败，但连接仍然活跃，这个时候可以重用任意标头，获得集群管理员级别的访问权限来访问聚合 API 服务器。这可以被用于服务目录，进而创建任意服务实例。”

这个漏洞之所以令人如此不安，是因为未经授权的请求很难被检测到。根据 Liggitt 的说法，它们不会出现在 Kubernetes API 服务器的审计日志或服务器日志中。恶意请求在 kublet 或聚合 API 服务器日志中是可见的，但却难以将它们与经过授权的请求区分开来。

现在的修复办法只有一个，那就是升级 Kubernetes，就现在。 Kubernetes v1.10.11，v1.11.5，v1.12.3 和 v1.13.0-rc.1 已经发布了修补版本。

如果你仍在使用 Kubernetes v1.0.x-1.9.x，请更新到修补版本。 如果由于某种原因无法升级，还是有补救措施，但破坏性很大：必须暂停使用聚合的 API 服务器，并从不应有 kubelet API 完全访问权限的用户中删除 pod exec / attach / portforward 权限。Jordan Liggitt 表示，这些补救措施可能具有破坏性。

所以唯一的解决方法是升级 Kubernetes。

虽然现在还没有人利用这个漏洞进行共计，但是滥用漏洞会在日志中留下明显的痕迹。 而且，既然有关 Kubernetes 特权升级漏洞的消息已经公开，那么这个漏洞被滥用只是时间问题。

因此，在陷入困境之前，还是对 Kubernetes 系统进行升级吧。

参考链接：

https://www.theregister.co.uk/2018/12/03/container_code_clusterfact_theres_a_hole_in_kubernetes

https://www.zdnet.com/article/kubernetes-first-major-security-hole-discovered/#ftag=RSSbaffb68

本文将介绍BackSwap的进化过程、唯一性、成功性以及失败的地方。文中会介绍恶意软件不同版本和攻击活动的概览。

Zbot, Gozi, Dridex, Carberp等都是比较常见的银行木马。多年来，银行木马恶意软件找出高级以及复杂的方式来窃取银行木马和信用卡详情，并滥用这些信息来偷钱。

大多数银行木马会注入代码到受害者的浏览器内存中以达到窃取信息的目的。注入的代码会hook浏览器中的通信以拦截私有的银行数据。拦截的数据之后会发送给攻击者。但这种方法比较复杂和不稳定，因为注入的代码要适应不同的目标浏览器。而且攻击者必须追踪驻留浏览器快速变化的代码，这是一个非常大的挑战。

BackSwap是一个简单但是非常有效的银行木马，将自己隐藏在大量的主流和合法软件之中，比如7-Zip、FileZilla和Notepad++。从表面上看，该程序的可执行文件是非恶意的，但攻击者注入的代码最终会在用户启动前面提到的应用时执行。

过去几个月，研究人员发现了Backswap的上百个样本，并且看到这些样本中出现的很多的变化。通过分析这些数据，研究人员将样本进行分组并分析了恶意软件行为发生的变化。

BackSwap的第一批样本是2018年3月中旬出现的。样本中并没有对payload进行混淆，只是插入到原始程序（比如7-Zip、WinGraph和SQLMon）中去。根据恶意软件中的一些字符串，可以推断攻击目标是波兰，每个样本攻击目标是波兰的1到3家银行。最常见的目标银行网站是ipko.pl，24.pl和mbank.pl。

初始版本的另一个特征是对每个目标银行都保持一个加密资源，使用的加密方法就是使用0x9进行一个简单的XOR运算。虽然该加密方法非常弱，但BackSwap一直在使用。Web注入代码含有占位符“xxxxxxxxxxxxxxxxxxxxxxxxxx”，是恶意软件用来保存窃取的银行交易信息的IBAN。当受害者进入目标银行网站并且需要进行交易时，web注入代码就会用前面提到的IBAN替换目标IBAN，这样受害者就会把钱转入攻击者账户中。

2018年4月，更多的银行被加入成为目标，一些样本甚至含有最多6个不同的资源。Web-inject代码的JS实现使用浏览器窗口的标题改善了与PE二进制文件中代码交互的方式。Shellcode会检查浏览器标题文本的变化，并抓取这些信息发送WebInjects。恶意软件PE的后台线程会将窃取的信息保存到计算机的日志文件中，并发送给C2服务器。

4月中，BackSwap开始在目标网站的DOM中创建假的输入对象。这些假的输入域看起来和真的一模一样。但当用户填假的域时，原始域就会隐藏并包含攻击者的IBAN信息。同时，恶意软件使用新的注入技术将恶意JS传递到URL地址栏。

4月底，BackSwap第一次使用XOR key来加密资源，这次使用了0xb。这一变化使BackSwap的一大特性，最近出现的样本中每个都有一个不同的key。但使用的加密方法仍然是简单的XOR。除了XOR key的变化外，恶意软件开发者还将IBAN移到硬编码的web-injects javascript中了。

图3: 钱骡的硬编码信息

5月的web-injects中有一个负责复制特定字符串到剪贴板的函数copyStringToClipboard。复制的字符串中含有受害者填写的信息，由恶意软件PE中的线程负责读取和处理。

同月，研究人员发现BackSwap开始追踪受感染的机器数量，这是通过发送HTTP请求到主流的俄罗斯网站yadro.ru来实现的。该方法在从攻击者站点收集受害者位置信息非常有效和简单。而且安全产品很难将其标记为非法的。

2018年6月，BackSwap开发者引入了一个新的payload编码技术；在该技术中，的PIC是加密的，嵌入到一个BMP图片中，使用了BMP header的唯一性特征。

图4: 嵌入位置无关代码到图片中

BMP文件header是0x42，0x4D对应ASCII码的BM。这对十六进制数字也是有效的x86指令。下面是对这些字节的翻译：

BackSwap背后的攻击者就利用了BMP header来使其代码看似是无害的。指令执行后，JMP指令会开始PIC解密。解密路径非常简单，而且很容易分析。

第一个BMP图片非常抽象、很难理解，之后的都是基于真实图片的。第一个例子是著名电影Scarface中的一个场景。

2018年7月研究人员没有发现其攻击活动，8月新样本出现，这是恶意软件的一个拐点，因为攻击者利用这1个多月的时间加入了新的特征和功能：

首先，恶意活动转向攻击西班牙银行，彻底放弃了之前的波兰银行。

图5: BackSwap攻击的西班牙和波兰银行

8月份发现的样本还使用外部网站来保存javascript payload。虽然web-injects仍然保存在被劫持的程序的.rsrc区域中，但只是一个封装，并从其他服务器导入恶意JavaScript代码。将恶意代码保存在第三方服务器上不太稳定，因为安全供应商和网站本身都可以删除恶意页面。

BackSwap还在8月份引入了许多BMP图像。8月底，研究人员发现犯罪分子在普京的照片上加入了一些比较幼稚的文本内容来对抗杀毒软件。

图6: BackSwap的PIC嵌入在普京的照片中

图7: Backswap最新BMP图片

图8: 发送给杀毒软件的图片

虽然银行木马不再是网络犯罪分子偷钱的主要方式了，但BackSwap证明了这种获利方式还在进行中。事实上，恶意软件开发者还在不断在改善银行木马来避免被安全产品发现。

恶意软件证明了可以伪装为合法应用来绕过安全措施，因此用户应该注意不要从非授权的源去下载软件。因此，强烈建议用户从原发布商官网去获取软件。

机器速度带来扩展性，人类渗透测试员确保准确性。

公司企业知晓自身网络漏洞的最佳方法之一，就是聘用渗透测试员对自己的网络进行真实的攻击――去掉恶意攻击载荷的那种。军队所谓的红队演练说的就是这事儿。如果渗透测试员技术高超，或者根本就是前黑客，他们可以帮你找出网络上最脆弱的地方。

渗透测试存在两个主要问题和一个令人困扰的地方。第一个问题是渗透测试几乎无法扩展。人类测试员的速度就那么快，即便给他们较长的时间攻击客户网络，比如说一个星期，他们也只能触及大多数企业的一小部分网络。第二个问题在于人类测试员无法持续工作，公司企业在测试间隙就直面很多风险了。至于困扰，那就是太贵了――最好的测试团队开价可达 10万美元/次 。

ImmuniWeb套件旨在成为任何人都用得起的渗透测试平台，所用方法就是自动化渗透测试涉及的几乎所有过程，同时还有专家团队随时在线解决平台无法解决的新问题。而且，在人类专家解决问题的时候，平台会观察专家做法，运用机器学习训练自身，下次在遇到同样问题便不会卡住了。另外，当ImmuniWeb遇到疑似漏洞但无法完全确定的时候，也会呼叫人类专家参与判定，由人类专家做出是否确认为漏洞的决策。ImmuniWeb的出品公司 High-Tech Bridge 保证，测试绝不会出现误报。如果出现误报，测试费用如数奉还。

与聘用人类渗透测试团队相比，这个以按需服务的形式提供的平台定价相对合理：月订阅费用999美元起。

ImmuniWeb平台的安装过程几乎相当于不存在。潜在客户只需要访问 High-Tech Bridge 网站，回答几个关于自身网络和所需测试类型的问题，然后选择支付选项，再输入具体测试要求，比如特定日期不要测试、不测试SQL等等。也可以选择人工服务，但通常用不着麻烦客服小姐就能自己搞定。

用户在后端必须做的一件事情，是将用于发起探测和模拟攻击的IP地址列入白名单，以便 ImmuniWeb Continuous 渗透测试工作得以进行，不会受到防火墙之类边界防御措施的阻挡。通常往白名单中加入5个IP地址就足够了。

IP一设好，ImmuniWeb Continuous 就可以开工了。平台会开始查找并扫描大部分网络。不过，大多数公司都有从外部访问不到或者至少不应该能从外部访问到的内部资产。ImmuniWeb会查找意外暴露在互联网上的内部资产。但对于从外部绝对访问不到的真正内部资产，ImmuniWeb需要在网络内安装或虚拟安装一台linux机器作为代理，以便对内部程序执行扫描，并收集整理成结果报告发回。 这是ImmuniWeb提供的一个可选项，但如果公司对内部漏洞或威胁颇为担忧，也不失为一个很有用的功能。

ImmuniWeb Continuous 能够找到测试网络上所有面向公众的资产，然后对其执行一系列漏洞扫描。除了标准漏洞追捕引擎，该平台还囊括了常见的测试标准，比如HIPAA、PCI和GDPR合规等。如果客户有特定行业指南或政府监管需求要测，也可以很方便地添加上去。

对该平台的实际测试中，ImmuniWeb在某个实例上遇到了一个不能完全确定的漏洞。虽然置信度达到了70%，但仍不足以令该平台做出决定性判断。因此，该潜在漏洞最初并没有列入结果报告中。ImmuniWeb平台呼叫了人类渗透测试员。这一后端处理过程对用户不可见，不过，出于测评需要，测评人员全程跟踪了整个过程。人类渗透测试员接到平台的呼叫请求后进行了自己的测试，不仅仅是证实漏洞，也是对ImmuniWeb的再训练，让ImmuniWeb未来再碰到类似的防御缺陷时知道该怎么判断。1天之内，该漏洞便得以确认，添加到了总体结果报告中。

ImmuniWeb，尤其是 ImmuniWeb Continuous，是远超漏洞扫描器的健壮漏洞管理工具。ImmuniWeb以人类专家监管下的自动化方式提供真正的渗透测试，其机器速度带来了扩展性，同时人类专家的监管确保了准确性，不失为一款既经济节约又摒除了间断性人类渗透测试固有缺陷的优秀产品。

在Android开发中我们经常要把一些比较看重安全或者计算效率的东西通过JNI调用C/C++代码来实现，如果需要实现的功能简单或者你的C/C++代码能力比较强，但是目前还是有很多功能强大的第三方库的，比如openssl、FFmpeg等，调用这些第三方实现显然比重复造轮子实际的多。

本教程适合将原始的动态库（.so），即没有包含JNI方法因而java无法直接调用的库链接到自己的C/C++代码中，然后提供调用。

添加链接外部静态库和动态库的流程差不多，用 STATIC 和 SHARED 来区分

${CMAKE_SOURCE_DIR} 是CMake 中预定义的常量，指当前工程的 CMake 文件所在路径，其他比较有用的常量：

CMAKE_CURRENT_SOURCE_DIR ： 指当前 CMake 文件所在的文件夹路径

CMAKE_CURRENT_LIST_FILE ： 指当前 CMake 文件的完整路径

PROJECT_SOURCE_DIR ：指当前工程的路径

最后将所有库链接起来就行了：

openssl 是一款强大的加解密库，提供了RSA、AES、MD5等常用的加密算法，网上也有很多编译openssl动态库和静态库的方法。 项目的文件结构目录如下：

结果如下：

在app的 build.gradle 中指定第三方so文件目录，不然生成apk文件的时候不会包含这些so文件。

还记得1年半前，那个席卷全球的比特币勒索病毒“WannaCry”吗？

它通过加密你电脑里的重要文件来进行勒索，要求被害者支付比特币才能解锁文件。当时，我国多地的出入境、派出所等公安网疑似遭遇了病毒袭击，不得不一度暂时停办出入境业务；中石油旗下不少加油站也因遭受病毒袭击一度“断网”，使在线支付业务一度中断；勒索病毒在我国校园网内的肆虐，甚至还导致不少毕业生的毕业设计论文被锁。

一年半以后，当“WannaCry”逐渐被遗忘，却又有另一个勒索病毒闯进人们的视野。只不过，在互联网安全专家看来，这个勒索病毒的“技术水平”，比起“WannaCry”来，不知道差到哪里去了…

不要比特币，要微信支付

12月1日， 国内首次出现了要求微信支付赎金的勒索病毒 。

这款病毒的勒索方式和“WannaCry”一样，入侵电脑运行后会加密用户文件，但是它不收取比特币，而是 要求受害者扫描弹出的微信二维码支付赎金 。

“WannaCry”会扫描开放445文件共享端口的windows机器，无需用户任何操作，只要开机上网，不法分子就能在电脑和服务器中植入勒索软件、远程控制木马、虚拟货币挖矿机等恶意程序。

这类木马会加密受感染电脑中的docx、pdf、xlsx、jpg等114种格式文件，使其无法正常打开，并弹窗“敲诈”受害者，要求受害者支付比特币作为“赎金”，而当时比特币的价格约在10000元人民币左右。

本次的微信支付勒索病毒，在感染后会 加密txt、office文档等有价值数据 ，并在桌面释放一个“你的电脑文件已被加密，点此解密”的快捷方式，随后弹出解密教程和收款二维码，最后强迫受害用户通过手机转账缴付解密酬金。但此次勒索病毒没有修改文件后缀名。

勒索病毒勒索界面（图片来源：瑞星微信公众号）

该勒索病毒加密文件后会弹窗提示，要求用户在今年12月3日之前交付110元赎金解密，如果超出时间，则服务器会自动删除密匙。

“小学生”级别的病毒

乍一看这两种病毒都是来“要钱的”，但是一些互联网安全团队在经过分析后，发现要破解这个病毒其实“很简单”。

一些互联网安全团队发现， 该勒索病毒由易语言编写，易语言是一门以中文作为程序代码的编程语言，属于初级入门级语言 ，从这一点就可以看出勒索病毒作者代码水平还比较初级。而且病毒传播者使用的“账号操作 V3.1”等易语言工具会直接被杀毒软件查杀

其次，该勒索病毒作者居然采用“微信支付”的方式进行勒索，要求支付110元赎金。“WannaCry”以比特币作为赎金，这是因为黑客想利用比特币的隐匿性来躲避追踪。 而“微信支付”的方式，对于微信团队来说，极容易进行追踪 。（目前该二维码已经被微信冻结）。

同时，该勒索病毒采用简单异或加密，且解密密钥相关数据被存放在病毒文件中。所以 即使在不访问病毒作者服务器的情况下，也可以成功完成数据解密 。

国内杀毒软件瑞星的安全团队甚至称这个病毒为“小学生”级别的勒索病毒 。

尽管在安全专家看来，病毒的“水平”不怎么高，但是还是造成了不少麻烦。据环球网报道，该“微信支付”勒索病毒正在快速传播，感染的电脑数量越来越多。病毒团伙入侵并利用豆瓣的C&；C服务器， 除了锁死受害者文件勒索赎金外，还大肆偷窃支付宝等aPP的密码 。

首先，该病毒巧妙地利用“供应链污染”的方式进行传播，目前已经感染数万台电脑，而且感染范围还在扩大；其次，该病毒还窃取用户的各类账户密码，包括淘宝、天猫、阿里旺旺、支付宝、163邮箱、百度云盘、京东、QQ账号等。

据中国新闻网报道，腾讯公司表示，微信已第一时间对所涉勒索病毒作者账户进行封禁、收款二维码予以紧急冻结。 微信用户财产和账户安全不受任何威胁 。同时，提醒广大用户，该勒索病毒可能通过任何形式的支付方式索要转账， 若遭遇勒索，不要付款，及时报警 。

勒索软件每年造成上百万美元损失

在普通人的印象中，勒索软件好像是最近两年才开始出现，但实际上，勒索软件的出现距今已有近30年。

勒索软件（英文：Ransomware）最早出现在1989年，当年，哈佛大学毕业的Joseph L.Popp创建了第一个勒索软件病毒AIDS Trojan。

在1996年，哥伦比亚大学和IBM的安全专家撰写了一个叫Cryptovirology的文件，明确概述了勒索软件Ransomware的概念：利用恶意代码干扰中毒者的正常使用，只有交钱才能恢复正常。

首次采用比特币作为勒索金支付手段的加密勒索软件出现在2013年底――一种被称为CryptoLocker的病毒使用比特币现金交易平台收取赎金。这种方法在短短一个月内大获成功，感染了上百万台电脑，并对每台电脑收取27美元的勒索金。

根据美国联邦调查局（FBI）近几年发布的《互联网犯罪报告》（Internet Crime Report），2017年，勒索软件在美国造成了约234万美元的损失，2016年则为约243万美元，而 2015 年的损失为160万美元。

而这些数字仅仅是基于FBI收到的报案，还有很多受害者会出于“破财免灾”的心理，选择支付赎金，而不向警方报案。

From 2013-2014, Yahoo was breached by hackers and over 3 billion user accounts were compromised. Three billion. The fallout from the security breaches was estimated to have knocked off $350 million from Yahoo's sale price when it was ultimately acquired by Verizon in 2017.

While most businesses won't find themselves victims of breaches of similar magnitudes, every single company should still be concerned with information security. Moreover, one Ponemon Institute study shows that, on average, each stolen record containing sensitive information costs $148. The total cost, worldwide, was $3.86 million in 2017, according to that same report. Attacks are more common than you might think. According to Wombat's 2018 State of the Phish report, more than 76% of organizations surveyed reported phishing attacks in 2017.

Shifting businesses and data models to cloud solutions make businesses like startups, which usually can't afford private or dedicated cloud solutions, more prone to things like phishing attacks and malware. This is especially important if your business handles consumer data.

On top of the legal and financial ramifications that come with a data breach, consider the damage your business's reputation will also take. A data breach is costly, and a smart business owner would take every step possible to ensure that it doesn't happen.

Here are seven tips to help you get your (security) ducks in a row.

When it comes to IT security, start with the basics. Use complex passwords, don't open emails from suspicious addresses and don't open links from sources you don't recognize. While it may sound basic, even, the U.S. Department of Homeland Security talks about the importance of something as simple as using complex passwords .

Hackers will often look for the simplest ways into any system―and they start with these basics first. Firms may invest millions in sophisticated computer systems, outfitted with top-of-the-line antimalware systems. At the same time, the company will have an admin account that uses "123456" as their password. Make sure no one at your company uses any of the following passwords: "123456,” "123456789," "qwerty," "111111," "google."

As stated above, a heavy majority of businesses suffer from phishing attacks . These refer to instances when targets are contacted by thieves looking to steal valuable information. These often come in the form of emails, and these hackers can make themselves appear very real to recipients. Employees should all be trained on IT security and coached to never hand out sensitive information to anyone they don't recognize.

This goes double for senior level executives. A common form of phishing, referred to as "spear phishing," involves targeting a high-level employee with a lot of access to sensitive information. Unlike regular phishing attacks, spear phishing can be harder to detect. That's why it's crucial your employees are trained on how to detect such attempts.

Don't settle on just having a single username and password combination. Take it a step further by using two-factor authentication. Users will be tasked with a secondary authentication sequence like confirming an email or inputting a code sent to their phone. This can be used for both employees and consumers.

Know that two-factor authentication isn't foolproof. Again, training is crucial, and without it, two-factor authentication can fail. For example, an employee might see a request for access in an email and blindly click the link―allowing a fraudster to gain access.

Data encryption is key for sensitive information. Encryption simply means changing data into an unreadable state. Take it a step further by having encrypted data and keys on different servers. A startup most likely won't have an in-house encryption expert, but there are plenty of technology solutions that will encrypt data for you. Companies like IBM will often provide affordable prices backed with the expert of a large IT company that takes data security seriously.

Another tool available in the market is penetration testing. Tools that perform these sorts of tests will be able to identify weakness and vulnerabilities in your IT security measures. The comprehensiveness of these tests will vary as there are different price points for different companies. We highly recommend that these risk assessments be carried out on a regular basis. Be sure to check industry guidelines, since some industries like the health-care industry are required by law to conduct risk assessments on a regular basis.

Operating on an outdated version of operating software can be dangerous. Don't ignore software updates when they're rolled out since they can contain security patches to vulnerabilities that hackers exploit. The older the system is, the more serious this issue is. For example, it probably won't be too much of an issue if you miss the latest update for windows 10, but if you're still running on Windows 2000, we'd recommend you upgrade immediately.

As a small business or startup, you likely won't have the capital to construct an entire on-premise IT infrastructure. This is why most businesses house their data and information on cloud solutions. However, we recommend that businesses choose their cloud hosting solutions carefully. Cloud solutions are typically more prone to security breaches than on-premise solutions. This is why we'd recommend going with a cloud solution from a reputable IT company like Amazon, Microsoft, IBM or Salesforce. There are plenty of large IT companies that take data security very seriously and offer enterprise cloud solutions.

If hosting your IT infrastructure on a cloud-based solution isn't right for your business, and you absolutely need 100% availability at all times with no downtime, you'll have to utilize on-premise solutions. However, carefully consider the costs of on-premise solutions. Ignoring the space and energy consumptions costs, the physical servers themselves can get quite expensive. Servers are typically known to reach upward of $30,000 . If you can't yet afford a serious piece of equipment like that, consider a small-business loan to help finance your solution.

These security measures might seem overblown to some business owners, but we do stress the importance of them. Protecting your information is crucial to the survival of your business, and when measured against the cost of closure, we'd say these costs are pretty small.

Juniper Networks announced today it is extending the reach off the threat protection appliances it provides to include data from third-party sources using a set of custom data collectors.

Amy James, director of security product marketing at Juniper Networks, said previously Juniper Networks Advanced Threat Prevention (JATP) Appliances only collected data from Juniper firewalls and networking equipment. Now the threat protection appliance can be deployed alongside, for example, a third-party firewall.

Recent Articles By Author

In addition, Juniper Networks has added a higher-end JATP400 Advanced Threat Prevention Appliance for Distributed Enterprises to offload the processing of threat data and associated analytics.

James said once a dataset is defined using the custom data collector, the data gets incorporated into the JATP Appliances threat behavior timeline. This new capability supports multiple log format types, including XML, JSON and CSV.

The goal is to provide an open architecture that makes it possible for cybersecurity teams to more easily prioritize threats by enabling them to triage alerts being generated by any data source on the network, said James. In addition to reducing the amount of time and effort required to identify threats that might be most lethal to the organization, JATP appliances also reduces IT security fatigue, James said. As it turns out, most cybersecurity teams are alerted to a potential security breach. The trouble is that notifications get lost in a sea of alerts that often are more noise than signal.

To improve the overall cybersecurity posture of organization, Juniper Networks is trying to drive more automation into security management, she said. A recent survey of 1,859 IT and IT security practitioners conducted by The Ponemon Institute on behalf of Juniper Networks finds 63 percent find it difficult to integrate security automation platforms with existing legacy tools. The top four areas targeted for automation include incident response, security analytics, malware investigation and threat intelligence. The primary benefits of security automation are the ability to prioritize threats and vulnerabilities, increase in the speed at which threats are analyzed and reduce the false positive and/or false negative rate for alerts being generated.

Given the fact that there are a multitude of cybersecurity jobs that currently are vacant, it should be more than apparent there’s a need for much higher levels of automation. On top of that is the fact that size of the defensible attack surface continues to increase. It’s clear organizations need to enable the few cybersecurity resources they do have on hand to operate at much higher levels of scale. It may take a little longer to achieve that goal end to end, but with each passing day security automation is advancing.

In the meantime, organizations of all sizes need to re-engineer their security management processes. The problem is developers won’t know what to fix first unless cybersecurity teams can accurately rank potential threats as they become known. Analysis of critical threats needs to be fed back into a DevSecOps process in near real-time to make it possible to remediate vulnerabilities quickly before they are exploited. Otherwise, Murphy’s Law dictates developers will spend all their time fixing the wrong vulnerability at the expense of a threat that just might prove to be truly detrimental to the business.

Compliance is essential, and organizations need to get it right. Despite the importance of compliance, organizations often treat it as an afterthought, rather than a business driver. Some see it as a hurdle or uninvited challenge, even though it can have a significant positive impact on the business.

With the rise of new compliance frameworks like GDPR, the stakes are even higher. If you aren’t compliant, there are heavy fines. Now, more than ever, it’s time to ensure that your organization is adhering to the applicable compliance guidelines.

In this post, we show how SecOps teams can align with compliance roadmaps to drive a more continuous, proactive approach to meeting compliance objectives.

Unfortunately, many organizations don’t see compliance as a priority. They often take a reactive approach, and therefore aren’t able to demonstrate compliance to customers in a timely manner. As a result, there can be financial penalties, delays in the sales cycle, as well as other obstacles that get in the way of achieving strategic objectives. Deals can be lost or delayed, for example, because of a failure to meet compliance objectives.

When an organization sees compliance as a priority, on the other hand, they’re more likely to see the positive business outcomes that come from being compliant. Prioritizing compliance makes it easier to achieve, demonstrate, and maintain continuous compliance at scale. It can also increase market opportunity and sales velocity, especially in international markets where compliance requirements vary.

Compliance should be part of the everyday workflow. But how can SecOps teams achieve alignment with compliance objectives in their organizations? The following steps will put you on the right path:

Sometimes it can be difficult to see the issues from within your organization. That’s why it can be helpful to undergo an external audit to identify and analyze the gaps in your operations procedures, policies, or technologies. For example, here at Threat Stack, we completed a Type 2 SOC 2 examination to find and address the gaps in our own processes and workflows. Once you understand the gaps, you can create a roadmap to strengthen security, streamline operations, and become compliant in these areas.

Instead of taking piecemeal tactical steps or developing a technology-first approach, develop a cohesive strategic plan that, when implemented, will create visibility throughout your cloud infrastructure, enable cross-organization collaboration, and allow you to take advantage of the improved efficiencies and insights that are attainable through a coordinated approach to security and compliance. A failure to do this will likely result in a fragmented strategy, incomplete protection, and an inability to achieve continuous, scalable improvement throughout your organization.

Once you’ve completed an audit and created a strategic plan, you’ll need to start addressing areas where additional security controls are needed for compliance monitoring requirements. You’ll need to benchmark your infrastructure security and ask whether your organization is achieving the basics in a few key areas.

While you need to be guided by your audit and strategic plan, keep the following in mind as places where organizations often slip up:

You should also consider industry-specific breach disclosure timelines and identify areas where additional controls are required for industry-specific frameworks.

It’s one thing to be completely compliant today, but are you positioning your organization to remain compliant into the future? Now is the time to find areas where you can automate workflows for continuous compliance.

For example, when we conducted our SOC 2 audit, we did a thorough self-evaluation to identify areas where we could improve. One of the main pain points we discovered was a disconnect between our engineering teams’ tickets and the output or code associated with those tickets. We realized we would need to follow a defined ticketing and change management process and deploy code only when it was ready.

To help solve this issue, we developed sockembot ― an automated SOC 2 compliance checking bot ― to provide visibility into the entire SOC 2 change management process and to automate away some of the pain points that we found during our test period. The bot became a highly effective way to check compliance at every stage of our gating process.

Your SecOps journey is never over, as new, more sophisticated threats are emerging every day. That’s why it’s essential to make ongoing improvements to many areas of your business, from product, to operations, to security.

Stay abreast of the latest changes in the threat landscape, and make sure that you’re stepping back and looking at the big picture with regard to SecOps best practices on a regular basis. Seeing compliance as a business driver and taking a proactive approach to it could yield new revenue opportunities, while making your organization more secure in the process.

If you’re interested in evaluating and improving your organization’s cloud infrastructure security practices with an eye to strengthening security and streamlining operations, take a look at the Threat Stack Cloud SecOps Maturity Framework and complete a cloud SecOps Maturity Assessment today.

One of the biggest challenges the cryptocurrency industry faces today is mainstream, practical usage. People want to spend their cryptocurrency on everyday purchases but there simply aren’t enough viable options available.

BlocPal makes it easy to manage and spend digital assets like Bitcoin, Bitcoin Cash, Ethereum, and Litecoin. In addition to BlocPal’s own BPX token, BlocPal can even be used to manage CAD and USD making it one of the most convenient digital wallets around.

When people talk about managing digital assets, they often focus on the big-name cryptocurrencies like the ones mentioned above. For the most part, utility tokens only attract the attention of investors looking to back a specific blockchain project.

BPX is a little different than your average utility token. For starters, it’s actually a regulated security token. Unlike most other tokens, this means that BPX holders can earn profits in two ways:

When purchasing BPX tokens you enter into a contractual agreement with BlocPal. This agreement states that BlocPal will deliver a royalty payment equaling 33% of its net profit from the previous fiscal quarter. As such, funds are then airdropped into the token holder’s BlocPal wallet.

What’s more, BlocPal actively encourages individuals to use BPX token and even hosts routine buy-back events. These events encourage users to sell their BPX tokens, giving them easier access to widely-accepted currencies while allowing BlocPal to better manage their token supply.

In addition to offering a new way to manage digital assets, BlocPal’s security token allows holders the opportunity to earn more money as BlocPal grows without having to sell off their tokens beforehand.

At the moment, we’re eagerly awaiting the release of a recognized security token exchange. This service will allow BPX Token to be listed for trading. We’re excited to announce that a number of reputable groups in both Canada and the United States have applied for approval as a security token exchange, which means that trading BPX tokens may be on the horizon sooner than later. We will continue to monitor the progress of these platforms in order to help traders and investors get the most out of their BPX tokens.

Manage and spend your digital money through BlocPal’s innovative platform which supports a growing list of cryptocurrency, as well as Canadian and American dollars. Learn more about BlocPal and its innovative wallet for Android and iOS devices by visiting the official BlocPal website today.

The post Benefits of Owning BlocPal Tokens appeared first on Global Coin Report .

Read more at https://globalcoinreport.com/benefits-of-owning-blocpal-tokens/

Sennheiser（森海塞尔）在最近修复了其耳机软件的一个严重漏洞。研究人员发现，这个漏洞允许攻击者干扰HTTPS请求，将用户暴露给恶意网站。需要指出的是，该漏洞并不涉及硬件，而是影响到了Sennheiser官方提供的HeadSetup音乐服务软件。

Sennheiser耳机中的这个严重漏洞是由德国网络安全公司Secorvo的研究人员发现的，导致windows和Mac用户都容易遭受黑客攻击。该漏洞可能允许黑客实施中间人（MITM）攻击，以在用户访问某些网站时嗅探流量。

正如Secorvo在其 漏洞报告 中所描述的那样，这个漏洞存在于与Sennheiser耳机配套的HeadSetup和HeadSetup Pro软件中。研究人员表示，Sennheiser耳机通过软件电话与HTTPS网站建立连接，攻击者可以利用TLS证书和相关的私钥欺骗真正的加密网站，而这些私钥在每次安装时都是保持不变的。

“我们发现，由于一个严重的漏洞，攻击者能够很容易获得HeadSetup软件根证书的私钥，从而允许攻击者签署和发布欺诈性证书。受该漏洞影响的用户可能成为此类证书的受害者，因为攻击者能够生成一个证书适配来自Sennheiser官方网站，或其他部分耳机制造商网站的流量。”

这种伪造为攻击者提供了多种攻击选择，如使用虚假的HTTPS Web服务器来跟踪和修改受害者的会话、实施网络钓鱼和恶意软件攻击。另外，即使用户卸载HeadSetup，虚假证书将继续存在，攻击者依然可以通过自己拥有的私钥来继续实施攻击。

Secorvo的研究人员表示，Sennheiser HeadSetup软件中的这个证书管理漏洞（CVE-2018-17612）是他们在今年的7月份发现的。在发现之后，他们与Sennheiser进行了联系，以确保该软件能够被尽快修复。

目前，Sennheiser已经为HeadSetup和HeadSetup Pro发布了修复补丁。修补版本包括HeadSetup 8.1.6114（适用于Windows）和 5.3.7011（适用于Mac）。正如Sennheiser在其安全公告中所解释的那样：“在使用管理员权限运行该脚本之后，Sennheiser证书被滥用的风险将被消除。该咨询还包括有关用户如何手动验证证书是否已被删除的说明。”

此外，微软方面也发布了它的一些安全建议，并更新了Windows的证书信任列表。因此，各位Sennheiser用户应及时更新自己的计算机系统，以保护自己免受这个Sennheiser耳机漏洞的影响。

声明：本文来自黑客视界，版权归作者所有。文章内容仅代表作者独立观点，不代表安全内参立场，转载目的在于传递更多信息。如需转载，请联系原作者获取授权。

前不久百度宣布PC版杀毒软件及百度卫士下线，只保留移动版安全软件，百度的退出一方面是因为自己的占用率偏低，另一方面也是因为免费杀软不赚钱。这几年来网络病毒事件总体而言少了很多，不过特定目的的恶意软件可没减少，火绒安全今天发表报告称12月1日爆发的“微信支付”勒索病毒正在快速传播，已经感染了数万台电脑，它不仅会加密用户的文件勒索用户，还会窃取用户的各种账号密码，包括淘宝、天猫、支付宝、京东、QQ等等。目前火绒安全软件已经可以还原被加密的文件，微信支付方面也宣布封禁了勒索账号的支付通道。

根据火绒安全发布的详细报告 ，12月1日爆发的“微信支付”勒索病毒正在快速传播，感染的电脑数量越来越多。病毒制作者利用豆瓣等平台当作下发指令的C&C服务器，除了锁死受害者文件勒索赎金（支付通道已经关闭），还大肆偷窃支付宝等密码。首先，该病毒巧妙地利用“供应链污染”的方式进行传播，目前已经感染数万台电脑，而且感染范围还在扩大；其次，该病毒还窃取用户的各类账户密码，包括淘宝、天猫、阿里旺旺、支付宝、163邮箱、百度云盘、京东、QQ账号。

据火绒安全团队分析，病毒作者首先攻击软件开发者的电脑，感染其用以编程的“易语言”中的一个模块，导致开发者所有使用“易语言”编程的软件均携带该勒索病毒。广大用户下载这些“带毒”软件后，就会感染该勒索病毒。整过传播过程很简单，但污染“易语言”后再感染软件的方式却比较罕见。截止到12月3日，已有超过两万用户感染该病毒，并且被感染电脑数量还在增长。

此外，火绒安全团队发现病毒制作者利用豆瓣等平台当作下发指令的C&C服务器，火绒安全团队通过解密下发的指令后，获取其中一个病毒后台服务器，发现病毒作者已秘密收取数万条淘宝、天猫等账号信息。

现火绒已经可以查杀此类被感染的易语言库文件，请装有易语言编译环境的开发人员下载安装火绒安全软件后全盘扫描查杀。查杀截图，如下图所示：

微信支付方面也公告称第一时间对所涉勒索病毒作者账户进行封禁、收款二维码予以紧急冻结。微信用户财产和账户安全不受任何威胁，并表示，微信对任何形式的网络黑产犯罪“零容忍”。

微信支付提醒用户，该勒索病毒可能通过任何形式的支付方式索要转账，若遭遇勒索，不要付款，及时报警。同时，腾讯电脑管家提供解密工具和人工服务，协助用户处理相关情况。

Improved data security, faster transactions and cost savings are some of the many reasons that make Blockchain so attractive.

So what is Blockchain really about?

In the Blockchain ecosystem, a “block” refers to a “data container” of digital records (also known as “transactions”). These blocks are linked together in a chronological order to form a continuous chain, hence the term “Blockchain.”

Each block contains a timestamp and all the blocks are interlinked with each other using “hashes” generated by cryptographic algorithms. Any changes made to the information recorded in a particular block is not rewritten. Rather, it is stored in a new block which indicates that “A changed to B” at a specific date and time.

A new block does not merely contain a list of new records but also contains the block’s timestamp and a unique digital (cryptographic) signature of the previous block. As old blocks are preserved forever and new blocks are added to the chain irreversibly, altering and manipulating the data in a particular block without detection becomes virtually impossible.

Since the blocks are distributed (and maintained) across multiple computers at the same time, Blockchain is also known as a “distributed ledger”.

Unlike traditional approaches, Blockchain eliminates the need for any centralized control instead, all the transactions (records) are decentralized and verified by the Blockchain participants themselves in the distributed ledger, thereby bringing in a sense of “trust” in the data.

In a Blockchain network, whenever a new transaction (record) is created, a new block is automatically generated stating the date and the time (known as a “timestamp”) when the record was entered in the block.

Whenever a new transaction is recorded, or an existing transaction is updated, another new block gets created (with its own timestamp) and so on, thereby creating a single, forward pathway of increasing blocks.

Each new block is automatically linked to its previous block, all the way to the originating block, using the previous block’s “hash”.

Every time a new block is created, it is broadcasted in real-time to all Internet-connected computers that participate in the Blockchain network. These computers are known as “nodes.”

Nodes are primarily responsible for maintaining the most updated (current) copy of the transaction logs (history) which play a crucial role in maintaining the integrity of the Blockchain network as no Node can ever make any changes to an existing block, without regenerating all its previous blocks.

While creating a new block, the Node uses the hash of the previous block, its own Private Encryption (Crypto) Key and the Public Crypto Key of the next Node that is a participant in the Blockchain network. Without its Private Key, no node can create a new record (block).

Blockchain the underlying technology behind the world’s first cryptocurrency, the “Bitcoin”, has disrupted the IT landscape in a manner that was not witnessed since the advent of the Internet.

While the Financial Services industry has been the most prominent industry to harness the power of Blockchain, there are diverse sets of Blockchain platforms today that have cross-industry use cases. Below are some industry-leading examples:

Specializing in the execution of “Smart Contracts” (contracts that automatically execute when certain conditions are met from all the interested parties), Ethereum is a public Blockchain platform that allows Software Developers to build decentralized applications on it and use the platform’s cryptocurrency the “Ether” for financial transactions. As on date, Ether is the world’s second largest cryptocurrency by value.

Specifically designed for cross-border financial transactions, Ripple uses a consensus process that allows for payments, exchanges and remittances in a distributed process through its cryptocurrency the “XRP”, which is the world’s third largest cryptocurrency today.

Founded by the linux Foundation in 2015, Hyperledger is a collaborative, open source hub for Software Developers to build diverse Blockchain frameworks and platforms to advance cross-industry Blockchain technologies.

Hyperledger Fabric is one of the most prominent Blockchain projects in the Hyperledger suite, which like other Blockchains, employs a distributed ledger, uses smart contracts and allows Blockchain participants to seamlessly manage their transactions.

However, Hyperledger Fabric is contrastingly different from other Blockchains. While other Blockchains are open, permission-less systems that allow unknown identities (Nodes) to participate in the network (by requiring protocols like ‘Proof of Work’ to validate transactions and secure the network), Hyperledger Fabric is a private and “permissioned” Blockchain network that needs its participants to enroll only through a Membership Service Provider (MSP).

Gemalto’s Blockchain Solution has been seamlessly integrated and successfully tested with Hyperledger Fabric.

A Hyperledger Fabric network consists of three key participants Peers, Orderers and Users. To ensure foolproof verifiability from a trusted authority, the MSP’s Fabric Certificate Authority (CA) adopts the traditional Public Key Infrastructure (PKI) hierarchical model and issues a unique digital identity in the form of a X.509 digital certificate to each network participant.

These identities are pivotal to the “trust factor” of the entire Blockchain network as they determine the participants’ access to the information in the network and the exact permission each participant has over the network’s resources.

Integrated within Hyperledger Fabric, Gemalto’s SafeNet Hardware Security Modules (HSMs) play the critical role in generating and protecting the crypto key pairs for the participants’ digital identities and the transactions that they perform in the Hyperledger Fabric network.

Here is a quick architectural overview of a Hyperledger Fabric Blockchain network using SafeNet HSMs:

To ensure Blockchain security, Gemalto secures the entire network in the following 3 ways:

Gemalto provides strong identities to devices and participants that use permissioned Blockchains like the Hyperledger Fabric where the identities of all participants are known.

For devices that are a part of the Blockchain network, Gemalto’s PKI solutions provide digital identities (certificates) that play a critical role in providing strong authentication and data encryption.

New Zealand-headquartered and Australian-listed accounting software provider Xero is claiming one million-plus subscribers signed up in the combined ANZ regional market and using its cloud accounting technology.

According to Xero (ASX:XRO) with one million subscribers across ANZ, it has become a “major conduit for economic activity”, with the data showing, over the past 12 months, that in ANZ there were:

“In Australia and New Zealand the penetration of cloud accounting sits around 40 percent, more than double what it is worldwide, which shows clear leadership and uptake,” says Craig Hudson, Xero’s Managing Director of New Zealand & Pacific Islands.

“This is exciting, because while both New Zealand and Australia are geographically distant, the innovation we see coming from our region is powered by cloud technology and global connectivity.

“Xero’s next opportunity for growth centres on the continued evolution of cloud technology and together, with our small business customers and partners, we are paving the way to extend business offerings on the Xero platform.

“Our purpose is to have a positive impact on the world by helping small businesses grow. Cloud technology has revolutionised the way small businesses operate. They are now working anytime from anywhere, with 24/7 real-time access to their financial position.”

Trent Innes, Xero’s Managing Director of Australia & Asia, says: “Our growth is an indication of the strength of the small business economy across Australia and New Zealand. Our data shows there is a direct correlation between digital connectivity and positive business outcomes for small business. We believe that best-in-class cloud technology positively drives economic prosperity for small business and as a result - the broader economy.”

Xero says it has established a significant partner community of accountants and bookkeepers in the ANZ region, attracting more than 3,500 attendees to Xerocon Brisbane this year and registrations of over 13,000 for New Zealand and Australia’s partner roadshows.

With 4 keynotes + 33 talks + 10 in-depth workshops from world-class speakers, YOW! is your chance to learn more about the latest software trends, practices and technologies and interact with many of the people who created them.

Speakers this year include Anita Sengupta (Rocket Scientist and Sr. VP Engineering at Hyperloop One), Brendan Gregg (Sr. Performance Architect Netflix), Jessica Kerr (Developer, Speaker, Writer and Lead Engineer at Atomist) and Kent Beck (Author Extreme Programming, Test Driven Development).

Register now for YOW! Conference

Sydney 29-30 November

Brisbane 3-4 December

Melbourne 6-7 December

Register now for YOW! Workshops

Sydney 27-28 November

Melbourne 4-5 December

REGISTER NOW!

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

How does business security get breached?

What can it cost to get it wrong?

6 actionable tips

DOWNLOAD NOW!

Organizations can start today to protect against 2019's threats. Look out for crooks using AI "fuzzing" techniques, machine learning, and swarms.

To manage increasingly distributed and complex networks, organizations are adopting artificial intelligence (AI) and machine learning to automate tedious and time-consuming activities that normally require a high degree of human supervision and intervention. To address this transformation of the security ecosystem, the cybercriminal community has now clearly begun moving in the same direction.

My threat predictions, taken from Fortinet's Threat Landscape Predictions for 2019 , reveal five emerging malicious trends:

1. AI Fuzzing:Because they target unknown threat vectors, exploiting zero-day vulnerabilities is an especially effective cybercrime tactic. Fortunately, they are also rare because of the time and expertise needed by cyber adversaries to discover and exploit them. The process for doing so involves a technique known as fuzzing.

Fuzzing is a sophisticated technique generally used in lab environments by professional threat researchers to discover vulnerabilities in hardware and software interfaces and applications. They do this by injecting invalid, unexpected, or semirandom data into an interface or program and then monitoring for events such as crashes, undocumented jumps to debug routines, failing code assertions, and potential memory leaks. Though using fuzzing to discover zero-day vulnerabilities has, so far, been beyond the scope of most cybercriminals, as AI and machine learning models are applied to this process it will become more efficient and effective. As a result, the rarity of zero-day exploits will change, which in turn will have a significant impact on securing network devices and systems.

2. Continual Zero-Days:While a large library of known exploits exists in the wild, our cyber adversaries are actually only exploiting less than 6% of them. However, to be effective, security tools need to be watching for all of them as there is no way to know which 6% they will use. Alsok as the volume of potential threats continues to grow, performance requirements will continue to escalate as the scope of the potential exploit landscape continues to expand. To keep up, security will tools need to be increasingly more intelligent about how and what they look for.

While there are some frameworks like zero-trust environments that may have a chance at defending against this reality, it is fair to say that most people are not prepared for the next generation of threats on the horizon ― especially those that AI-based fuzzing techniques will soon begin to uncover. Traditional security approaches, such as patching or monitoring for known attacks, will become nearly obsolete as there will be little way to anticipate which aspect of a device can be potentially exploited. In an environment with the possibility of endless and highly commoditized zero-day attacks, even tools such as sandboxing, which were designed to detect unknown threats, would be quickly overwhelmed.

3. Swarms-as-a-Service:Advances in swarm-based intelligence technology are bringing us closer to a reality of swarm-based botnets that can operate collaboratively and autonomously to overwhelm existing defenses. These swarm networks will not only raise the bar in terms of the technologies needed to defend organizations, but, like zero-day mining, they will also have an impact on the underlying criminal business model, allowing them to expand their opportunity.

Currently, the criminal ecosystem is very people-driven. Professional hackers build custom exploits for a fee, and even new advances such as ransomware-as-a-service requires black-hat engineers to stand up different resources. But when delivering autonomous, self-learning swarms-as-a-service, the amount of direct interaction between a hacker-customer and a black-hat entrepreneur will drop dramatically, thereby reducing risk while increasing profitability.

4. A la Carte Swarms:Dividing a swarm into multiple tasks to achieve a desired outcome is very similar to virtualization. In a virtualized network, resources can spin up or spin down virtual machine as needed to address particular issues such as bandwidth. Likewise, resources in a swarm network could be allocated or reallocated to address specific challenges encountered in an attack chain. In a swarm-as-a-service environment, criminal entrepreneurs should be able to preprogram a swarm with a range of analysis tools and exploits, from compromise strategies to evasion and surreptitious data exfiltration that are all part of a criminal a la carte menu. And because swarms by design include self-swarms, they will require nearly no interaction or feedback from their swarm-master or need to interact with a command and control center, which is the Achilles' heel of most exploits.

5. Poisoning Machine Learning:One of the most promising cybersecurity tools is machine learning. Devices and systems can be trained to perform specific tasks autonomously, such as baselining behavior, applying behavioral analytics to identify sophisticated threats, or taking effective countermeasures when facing a sophisticated threat. Tedious manual tasks, such as tracking and patching devices, can also be handed over to a properly trained system. However, this process can also be a two-edged sword. Machine learning has no conscience, so bad input is processed as readily as good. By targeting and poisoning the machine learning process, cybercriminals will be able to train devices or systems to not apply patches or updates to a particular device, to ignore specific types of applications or behaviors, or to not log specific traffic to better evade detection.

Preparing for Tomorrow's Threats

Related Content:

7 Real-Life Dangers That Threaten Cybersecurity

Rise of the 'Hivenet': Botnets That Think for Themselves

Derek Manky formulates security strategy with more than 15 years of cyber security experience behind him. His ultimate goal to make a positive impact in the global war on cybercrime. Manky provides thought leadership to industry, and has presented research and strategy ...View Full Bio

The DNC email leak in 2016 revealed just how insecure email communications can be. It should be no surprise that government officials have been turning to other, more secure mediums, to communicate. White House staffers have reportedly used the encryption app Confide to communicate, French president Macron’s inner circle has relied onTelegram, and former Australia Prime Minister Malcom Turnbull turned to Wickr and Whatsapp. But as government messaging solutions go, such tools are limited, and in most cases not as secure as one might think. They may offer encryption but they fail to secure messages on devices and don’t address critical compliance issues related to government communication.

Comprehensive Government Messaging Solutions Require More than Just Encryption

It should be simple―using an end-to-end encryption app should ensure that your messages are secure, right? But while the messages are protected from the time the user presses send and is in transit, once it’s on the recipient’s device that’s a whole different story.

Encryption can’t protect you from certain human behaviors. One of the recipients in a conversation may choose to share sensitive messages with others via screenshots, cut and paste or simply by forwarding information that you never intended to go outside your circle of original recipients. In addition, someone may save the conversation for an indefinite amount of time, increasing the risk that it will be shown―either by purpose or inadvertently―to a third party or breached. And then there’s the issue of how data is backed up. As an example, Whatsapp has cloud back up enabled by default , risking exposure of decrypted messaging. And if you have multiple devices that sync chats, the risk of sensitive conversations being exposed increases X fold.

Again it ‘should’ be simple but it isn’t always straight forward.

Recent news attests to these risks. During their ongoing investigation , the FBI obtained Whatsapp messages sent by Paul Manafort. In another investigation, the FBI was able to obtain messages sent over Signal by White House staff and a New York Times reporter. While these are examples where people were using encrypted messaging for questionable purposes it points to a larger problem. Anyone who uses these platforms face the same risks―their conversations could be accessed by a third party.

Think Beyond Encryption

When it comes to government messaging solutions, government officials need to think beyond encryption. Government officials frequently need to communicate critical sensitive information―and it’s imperative that such conversations are not seized by or leaked to third parties with bad intentions. For these reasons, safety mechanisms need to be in place once messages reach the recipient. This means that a secure, ephemeral communication platform that ensures that messages cannot be screenshotted, forwarded, printed or saved to the device must be in place.

Think Compliance

The problem with such features, however, is that they can be at odds with compliance. Government Messaging Solutions must comply with the relevant data protection government requirements, especially with regards to classified information.

Apps like Confide, for example, which was reportedly used by Republican operatives and White House staffers pose issues because there is no record of the messages sent. End-to-end encryption poses no problem for government messaging solutions, however ephemeral messages or messages that disappear do. Utilizing a secure, ephemeral communication platform that provides compliance capabilities (i.e. the ability to archive a single copy to a repository of record) in addition to advanced security and ephemerality capabilities, is required.

Finding the Balance between Content Control and Compliance

To recap, end-to-end encryption is an important first step for secure government communication. It is far from the final step however. Even with encryption, there is the question of both protecting the message once it reaches the device and is in the recipients’ hands and with complying with regulation. When considering secure messaging solutions, you should look for the following:

End-to-end encryption

Content control features that ensure messages can’t be screenshotted, forwarded, printed or stored on the device.

Compliance with regulations through secure archival of messages to a client designated repository.

To learn how Vaporstream can help you with content control and compliance when it comes to government messaging solutions contact us today.

Contributor: Kristi Perdue Hinkle