Digital transformation could be accelerated by COVID-19

The pandemic has highlighted the need for businesses to act with alacrity and prepare for the long haul – and to do so with cybersecurity in mind

By Tony Anscombe

The technology industry abounds with buzzwords and phrases, with digital transformation being one such term that many companies aspire to undertake; but when faced with reality it can be difficult to implement while conducting business as usual. There are, however, impressive examples where companies have changed course and transformed their businesses by integrating digital technology to fundamentally change how they operate and how they deliver value to customers.

Microsoft is a case in point. Under the leadership of Satya Nadella, the stock price – which had flatlined for nearly a decade – has tripled. Creating a collaborative working environment and focusing on the future and innovation, Nadella changed Microsoft’s fortunes from a ’90s technology company delivering similar products, to once more becoming a leading-edge organization delivering visionary products. Changing the culture of a company with over 120,000 employees at the time he took charge was no mean feat.

Transforming a business in this way is not simple and takes a tremendous amount of courage and visionary leadership. The core elements include: migrating from on-premises systems to hybrid clouds, modernizing financial and operational software, improving the customer experience using technology, and creating a more dynamic and flexible working environment. In response to ‘work from home’ and other lockdown measures due to the COVID-19 pandemic, many businesses have adopted some of these elements, using technology out of necessity; this departure from normal business may be the first significant step on the path to digital transformation.

When governments decide to end their lockdowns, will these businesses embrace the opportunity and continue digital transformation, or revert to the previous way of conducting business?

Enter cybersecurity

Digital transformation brings about additional considerations for cybersecurity and I recently delivered a presentation, virtually, at Segurinfo in Argentina on both the need to grasp the opportunity to transform and to do it with security in mind. Businesses all over the world have adapted their workforces during the current pandemic by embracing technology to provide connectivity to data and networks, videoconferencing, collaboration tools and cloud services. Prior to the lockdown, 16% of Argentinian workers infrequently worked from home – with under 3% doing so permanently, according to data from iProUP. In comparison, the numbers for the USA are 43% and 3.6%, respectively. While the proportion permanently working from home is similar, the ability of the general workforce to be flexible is clearly apparent and demonstrates that digital transformation has evolved further in the USA than in Argentina.

RELATED READING: Cybersecurity Trends 2020: Technology is getting smarter – are we?

While allowing the workforce to be flexible is only a small part of digital transformation, it carries with it the need to ensure that services are implemented securely. Devices need to be protected from many types of risks, including: theft and interference by using full disk encryption, strong multi-factor authentication, and the use of VPN technology to access data are just bare minimum considerations. Applications and tools to enable remote productivity need to be vetted and configured to protect customer data and sensitive company material, and employees need to be more aware of scams such as phishing and business email compromise, as these may be more exploitable among staff away from the workplace.

There are, of course, many more considerations to ensure that systems remain secure regardless of the location of the user. The rushed adaptation to relocate the workforce means that companies have expanded or implemented new systems to enable remote working and the ability to service customers remotely, without necessarily applying their normal considerations for security. The easy option, when all this is over, is to revert to the original scenario and talk fondly of the memories of the time we all needed to work from home. In reality, the decisions taken due to the pandemic have progressed the digital transformation of businesses all over the world, so rather than reverting to the previous status quo, perhaps they should embrace the changes of delivering services to customers and flexibility to the workforce.

Take an example of a small local business, a successful fitness studio providing group classes and personal training. The business was forced to cease in-person activities due to a ‘shelter in place’ order and needed to look for alternate methods of delivering services to customers to keep the business running. An entrepreneurial spirit quickly transformed the business from in-person to online classes for both one-to-one and group sessions. This also involved temporarily loaning and distributing equipment to customers so they could experience the same class as before, just in their home location.

Seizing the opportunity

What happens when there is a chance to switch back to in-person classes and for the equipment to be returned to the studio? It’s at this precise point where the opportunity exists – why revert to the previous method of doing business? The easy solution is to do business just as before the ‘shelter in place’ order; however, there is a tipping-point opportunity to deliver a mix of online and in-person classes and training. This also has the benefit that when customers travel or cannot attend a training session in person, it can be offered to them online – even asynchronously – so they never miss a week regardless of their schedules. The temporary solutions implemented to deliver online classes will need to be formalized for more scalable and robust systems.

The issue of equipment return could create an entirely new business opportunity to rent the equipment to the customer, who retains it for the duration of the online class. The business will need new systems to manage equipment leasing, which may involve credit scoring and long-term subscription payments. Examples of companies that have successfully transformed their businesses often have a common offering – subscription – this enables businesses to predict their revenue and to make longer-term decisions on investments.

The situation caused by the pandemic has forced short-term adaptation but should be viewed as a step, or leap, towards digital transformation, offering more flexibility to customers and employees and potentially opening new revenue opportunities.

ESET has been here for you for over 30 years. We want to assure you that we will be here in order to protect your online activities during these uncertain times, too.
Protect yourself from threats to your security online with an extended trial of our award-winning software.

Try our extended 90-day trial for free.

De toekomst van het wachtwoord ...

Hebt u ooit gedacht dat uw wachtwoord mogelijk kon gehackt zijn? U bent niet de enige. Het kan aanvoelen alsof u zich elke dag moet aanmelden voor een nieuw platform of nieuwe dienst en bijgevolg gebruikt u waarschijnlijk varianten van hetzelfde wachtwoord, door hier een nummer of daar een letter te veranderen en zo uw wachtwoorden veilig te houden en ze toch te onthouden.

Hoewel het knaplastig is om meerdere wachtwoorden te onthouden, kunnen de gevolgen van een zwak wachtwoord rampzalig zijn. Datalekken en grootschalige diefstal van persoonsgegevens zijn steeds frequenter en de huidige coronaviruspandemie heeft dit alleen maar verergerd. Begin april liet het populaire conferentieplatform Zoom weten dat een half miljoen gestolen wachtwoorden(half a million stolen passwords ) te koop waren op het dark web, en dat phishing scams exponentieel waren toegenomen.

Wachtwoorden zijn de sleutel die ons digitaal leven veilig houden, hoewel ze zelf toch niet erg veilig zijn. Zonder wachtwoordbeheer of tweefactoren-authenticatie (two-factor authentication) is het voor hackers relatief gemakkelijk om wachtwoorden te kraken, vooral omdat "123456", "qwerty", “azerty” en "wachtwoord" op wereldvlak nog steeds de meest gebruikte wachtwoorden zijn. Veel vooraanstaande techneuten willen in feite zelfs helemaal geen wachtwoorden meer gebruiken.

Het is nu vrij gebruikelijk om een telefoon te openen met een vingerafdruk of gezichtsherkenning en binnenkort zou biometrische identificatie de norm kunnen zijn om toegang te hebben tot allerlei persoonlijke gegevens.

Sinds 2015 werkt Google aan het beperken van zowel het gebruik van als de behoefte aan wachtwoorden op Android-telefoons. Microsoft lanceerde eveneens een eigen alternatief met de introductie van een biometrisch inlogsysteem om de noodzaak van conventionele wachtwoorden te vermijden. De strijd tegen de overdreven afhankelijkheid van wachtwoorden heeft zelfs een open sectororganisatie -  The FIDO Alliance - die de zaak behartigt. Deze telt onder haar leden bedrijven als Google, Facebook, PayPal, Visa en Amazon.

Met de creatie van de FIDO2-norm (vooral een middel om een browsergebaseerde wereld in staat te stellen de gebruiker te authentificeren met middelen die sterker zijn dan wachtwoorden die kunnen vergeten worden of per ongeluk aan iemand gegeven worden die als phisher werkt), is het duidelijk dat er technologieën bestaan om wachtwoorden te vervangen. Maar de adoptie ervan verloopt traag. Ondanks het feit dat sommige bedrijven zoals Dropbox deze vorm van gebruikersidentificatie gebruiken, wordt het als tweede beveiligingslaag voor wachtwoorden gebruikt, hoewel het echt als eerste verdedigingslijn bedoeld was.

Hoewel het onwaarschijnlijk is dat wachtwoorden binnenkort volledig zullen verdwijnen, kunnen ze achterop geraken wegens meer veilige vormen van identificatie zoals FIDO2, precies zoals men nog steeds een pincode kan gebruiken om een telefoon te openen als een vingerafdruk of gezicht niet wordt herkend. Ondertussen is er geen excuus om de veiligheid van wachtwoorden af te zwakken!

Zorg ervoor dat u sterke wachtwoorden gebruikt en investeer zowel voor uzelf als uw bedrijf  in een wachtwoordbeheerder zoals ESET Password Manager. Hoewel het terugwinnen van een persoonlijk wachtwoord misschien niet zo moeilijk is, kan het per ongeluk in gevaar brengen van bedrijfsgegevens veel lastiger zijn om te herstellen. Neem op deze World Password Day even de tijd om uw eigen wachtwoordbeveiliging na te kijken – in de toekomst kan het u misschien veel problemen besparen!

Près d’un million de sites WordPress ciblés par une campagne massive

Un acteur malveillant inconnu de la menace exploite des vulnérabilités de plugins pour lesquels des correctifs sont disponibles depuis des mois, voire des années.

Par  Amer Owaida 

Plus de 900000 sites web WordPress ont été ciblés par un acteur malveillant non identifié dans le cadre d’une campagne de piratage à grande échelle au cours de la semaine dernière. Defiant, qui fabrique les plugins de sécurité de Wordfence pour la plateforme de publication web, souligne avoir commencé à remarquer et à suivre un pic d’attaques ciblant en particulier les vulnérabilités du Cross-Site Scripting (XSS) le 28 avril. Cette campagne à grande échelle a finalement permis de multiplier par 30 le nombre d’attaques.

En se basant sur la charge utile malveillante, Defiant soupçonne que la plupart de ces attaques sont menées par un seul acteur malveillant. Selon Ram Gall, ingénieur de Wordfence QA, le cybercriminel a commencé par un petit volume d’attaques et n’a pas intensifié ses efforts jusqu’à la semaine dernière, la campagne ayant atteint un pic de 20 millions de tentatives d’attaques contre plus d’un demi-million de sites web le 3 mai.

« Au cours du mois dernier, nous avons détecté au total plus de 24 000 adresses IP distinctes envoyant des requêtes correspondant à ces attaques à plus de 900 000 sites », ajoute-t-il. L’acteur malveillant cible le Cross-Site Scripting (XSS) ainsi que d’autres vulnérabilités afin de tenter d’injecter du code malveillant dans les sites web qui redirigent ensuite les visiteurs vers des sites malveillants.

Il est à noter que des mises à jour de sécurité sont disponibles pour les failles exploitées, et que les correctifs ont été déployés il y a des mois et, dans certains cas, même des années.

Trois des cinq vulnérabilités ciblées sont liées au XSS. L’une d’entre elles affecte le plugin Easy2Map, qui a représenté plus de la moitié des attaques et est probablement installé sur moins de 3000 sites web. La deuxième faille de sécurité réside dans le Blog Designer et a été corrigée l’année dernière; elle a déjà été ciblée auparavant et Defiant estime qu’il y a environ 1000 installations vulnérables. La troisième vulnérabilité XSS se trouve dans le thème des journaux, qui a également été au centre des attaques dans le passé et a été corrigé depuis 2016.

Les deux dernières sont des options de mise à jour des vulnérabilités. L’une affecte le plugin de conformité WP GDPR qui a été patché depuis 2018 et nous avons déjà écrit à propos d’une campagne qui a tenté de prendre le contrôle de sites web utilisant ce plugin. L’autre affecte le plugin Total Donations qui a été définitivement retiré du marché Envato en 2019. Chacune de ces vulnérabilités permet aux pirates de modifier l’adresse web du site.

Les chercheurs pensent que l’attaquant est suffisamment compétent pour cibler d’autres vulnérabilités à l’avenir. Le meilleur conseil aux administrateurs de sites WordPress est vieux comme le monde : assurez-vous de toujours maintenir le logiciel WordPress de base et tous les plugins à jour. Il est également important de se débarrasser des plugins abandonnés ou inutiles, car ils ne font qu’augmenter la surface d’attaque d’une installation WordPress.

Ghost blogging platform servers hacked to mine cryptocurrency

Ghost wasn’t the only victim of break-ins over the weekend that exploited critical holes in infrastructure automation software for which patches were available

By Amer Owaida 

The popular blogging platform Ghost has found itself in the crosshairs of attackers who gained access to its IT infrastructure and installed cryptocurrency-mining malware on it over the weekend. The intrusion occurred in the early hours of May 3^rd and affected Ghost(Pro) websites and the platform’s billing services, reads a statement on Ghost’s website.

On the bright side, there’s no direct evidence to corroborate that any private customer data, including passwords, credit card information, or credentials, were compromised. The company immediately introduced a set of security measures to combat the breach, such as adding extra firewalls and cycling all sessions, passwords and keys on all of the affected services.

The attempt to mine cryptocurrency led to a spike in CPU usage and to the overloading of most of Ghost’s systems, which actually rang the alarm bells. “All traces of the crypto-mining virus were successfully eliminated yesterday, all systems remain stable, and we have not discovered any further concerns or issues on our network. The team is now working hard on remediation to clean and rebuild our entire network,” said Ghost’s developer.

The investigation also found that the attackers exploited critical vulnerabilities in Ghost’s server management infrastructure. The vulnerabilities resided in Salt, infrastructure automation software also known as SaltStack, and were used to take over the Salt master server. Patches for these vulnerabilities – indexed as CVE-2020-11651 and CVE-2020-11652 – were released by the software maker in late April, but apparently weren’t applied in due course. Exploitation of the flaws allows the attacker to bypass all authentication and authorization controls and gain full remote command execution as root.

RELATED READING: Rough patch, or how to shut the window of (unpatched) opportunity

The company also added that it will continue to investigate the issue until it’s completely resolved and will be contacting all of its customers about the incident. The platform is home to blogs for the likes of Tinder, Mozilla and DuckDuckGo.

More trouble

According to a story broken by ZDNet, cybercriminals have been particularly busy exploiting the vulnerabilities in SaltServer to breach other unpatched installations, including those used for LineageOS. The distributor of this open-source operating system suffered an attack on May 2^nd and notified its users about it within three hours. Although the company didn’t go into specifics, the statement said that an attacker used a CVE to gain access to its SaltStack master. Some were quick to point out that the vulnerability had been disclosed for over a week and systems should have been patched well before the attack happened.

Reports of similar attacks were being shared on a SaltStack GitHub thread, with some adding that they detected cryptocurrency miners on their machines. According to one user in the thread, there are more than 6,000 Salt servers still exposed online that can be susceptible to the vulnerability.

Sextortion scammers still shilling with stolen passwords

The email includes the potential victim’s password as evidence of a hack, but there is more than meets the eye

By Luis Lubeck

Earlier in April, a new sextortion scam campaign was detected making the rounds in countries on both sides of the Atlantic. The spam emails that were detected by ESET’s research laboratory have been trying to dupe unwitting victims by referring to old passwords that have been part of old data breaches.

The campaign is not altogether new, since it repurposes old scams. The first time that scammers made waves with these tactics was in 2018 with a campaign that also included the victim’s password in the subject line. The email itself claimed that the password was obtained by compromising one of the recipient’s devices using malware.

However frightening this may seem at first glance, these are just social engineering and scare tactics, employed by cybercriminals to generate panic in the recipients of these emails. To put it simply, it is highly unlikely that your computer has either been accessed or compromised, at least not by the method suggested in the email, so there is no need to panic.

In fact, a similar campaign has been spotted recently by ESET researchers: it rehashed the content to reflect the current pandemic situation and includes a threat to infect the victim’s whole family with coronavirus.

The new extortion campaign borrows, or rather builds upon, the previous versions. The scammers start with an alarming message right off the bat to get the victim’s attention, usually by including one of the victim’s old passwords that was probably stolen as part of a previous data breach.

Moving on, the fraudsters claim that the victim’s device was infected by some form of malware when visiting a porn website, and that allowed them to obtain both the victim’s password and access to their device. The scammers then purport to have made a video of the victim and the alleged “not safe for work” content.

Once the cybercriminals have scared their potential victims enough, they demand a sum to be paid within 24 hours or the embarrassing video will be released. They usually want the payment to be made in bitcoin.

Read the complete article on

https://www.welivesecurity.com/2020/04/30/new-sextortion-scam-claims-know-your-password/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29