Partnerships that escalate entrepreneurship and innovate the corporation: Ten Wayra startups that do business with Vivo

Innovation Marketing Team    24 May, 2021

With 10 years of operations, Wayra has transformed the entrepreneurial ecosystem in Brazil and worldwide. Since its launch in 2011, when it was created to support entrepreneurship, Wayra has invested in more than 800 startups and almost 10% of them are in Brazilian territory. In addition to investments, one of the main values of Vivo’s hub is to escalate new business opportunities, whether direct or indirect, of its startups with the Telefónica/Vivo group.

In this first decade alone, more than 250 startups took advantage of this opportunity, becoming suppliers or partners of the company. “Connecting entrepreneurs with the corporation has always been one of our main goals; it is something we want to keep happening from now on,” promises Livia Brando, Wayra’s country manager in Brazil.

The partnership with startups has allowed the Telefónica group to improve its processes and develop a series of projects using technologies such as 5G, Internet of Things (IoT), Artificial Intelligence (AI), data analysis, robotics and cloud computing, generating over R$1.9 billion in revenue for the startups. This alignment between corporation and entrepreneurship is made possible by means of open innovation projects, which provides mutual benefits: in addition to collecting more than 75 successful exists, Wayra saw its Corporate Venture Capital investments value more than 70%.

More than celebrating its 10 years of life, Wayra also celebrates the success of so many projects implemented between the Brazilian portfolio startups and the company. See below some of these partnerships between the corporation and Wayra’s entrepreneurs.

1. Ativa

In partnership with Vivo, Ativa is responsible for the development of Vivo Clima Inteligente, a service that takes climate information and provides automated control to field irrigation systems. The data passed on to rural producers through the IoT services of Vivo Clima Inteligente include rain, wind speed and direction, solar radiation, temperature, among others. “We are able to connect what seemed unconnectable and to manage what seemed unmanageable. We are heading towards business scalability, also taking advantage of the momentum of growth in IoT opportunities,” celebrates Edson Ribeiro, CEO of Ativa.

2. Iotag

This startup is responsible for the backstage of the Vivo Maquinário Inteligente solution, which couples telemetry devices in farm heavy vehicles, such as tractors and harvesters. The idea is to bring connectivity for a more efficient management of field operations, monitoring more than 150 machinery parameters in order to reduce fuel consumption and perform preventive maintenance. “Because of the partnership with IoTag, we have expanded our portfolio of IoT field applications, transforming a startup solution into a Vivo product”, explains Rodrigo Gruner, Vivo’s innovation leader.

3. Gupy

By digitizing the recruitment and selection process, Gupy is able to bring more than 70% assertiveness in the search for new talents for job opportunities in the companies. “We are able to make our customers 60% more efficient in their hiring process by making use of our Artificial Intelligence (AI) as part of the procedure,” points out Mariana Dias, CEO of Gupy. In addition to providing more efficient selection processes, applicants also started to have a better quality experience, which made Gupy to quickly become a provider of recruitment and selection services at Vivo.

4. OvermediaCast

Some startups have services that complement each other, forming an “innovation double” for corporations. This is the case with OvermediaCast, which offers the solution of intelligent video bots with several fronts. At Vivo, the solution is being applied in both digital and intelligent recruitment processes. “We have replaced those long phone calls to extend the job offer with a video proposal. From an AI-based virtual personal assistant, we guide each applicant selected by their job proposal, explaining the proposed salary, bonuses and benefits through voice and visual commands. We are also able to collect the acceptance of the proposal without the new employee having to leave the video,” explains Daniel Uchôa, CEO and founder of OvermediaCast. In addition to being more efficient for the hiring company, it provides a more immersive and integrative experience, with extremely high levels of satisfaction among new hires

5. Trocafone

If you have already used your old cell phone as part of the payment on a new device in the Vivo Renova program, then you have already used the services of Trocafone. This startup specializes in the resale of smartphones, which are collected at Vivo stores and resold through the Trocafone website after a rigorous evaluation and remanufacturing process. “We are a smarter and more economical alternative to consumption. Buyers can use their old device in the negotiation to obtain a discount on the purchase of a new model, thus recovering part of the amount invested in that device,” describes Guille Freire, CEO of Trocafone.

6. Alicerce

Dedicated to transforming Brazilian education, Alicerce is a supplementary education solution, which takes place in person or online, using a teaching methodology totally focused on students’ learning needs. In partnership with Vivo, the intention is to promote the platform so that more and more young people can have a solid basic education and be ready to develop themselves in the job market and in the academy. “Our purpose is to change Brazil, as we were created to solve a real problem,” highlights Paulo Batista, CEO of the startup.

7. Docket

Imagine that you could digitize all the paperwork that goes around the offices. That would be quite some help, wouldn’t it? Docket supports corporations in this process, by managing documents for better control of their flows and deadlines. Today, Docket services are used by the Vivo team to manage documentation, which has allowed to reduce costs and increase the efficiency of bureaucratic processes. “Our goal is to continue growing and launching new products that can bring more efficiency to departments that deal with documentation,” reinforces Pedro Roso, CEO of Docket.

8. Voll

Managing travel and transfers made during the employees’ workday is a challenge for corporations. That is why Voll is an excellent partner for companies. The startup offers a platform dedicated to corporate mobility management, providing visibility to managers about the trips made and bringing practicality to employees. Today, Voll’s platform can reduce employee mobility costs by more than 30%, becoming a provider of corporate mobility services at Vivo. “Telefônica/Vivo was our first major client. I remember that moment very well, because we integrated thousands of employees from one day to the next, and we didn’t have any stability or adaptation problems with the tool,” recalls Jordana Souza, CRO of Voll.

9. RankMyApp

From a proprietary platform, RankMyApp streamlines application management, helping to improve its performance on mobile devices as well as the communication between developers and app users. The platform caught Vivo’s attention: the startup’s services are used internally to improve its proprietary applications, further refining digital communication with Vivo customers. “We deliver intelligence and performance to Vivo’s apps, as well as results in sentiment analysis from app reviews in app stores”, describes Juliana Assunção, CMO and founder of RankMyApp.

10. Netshow.me

With the growing need to communicate internally in an engaging way, corporations are increasingly looking for video streaming solutions, whether live or asynchronous. In this sense, Netshow.me has become an important partnership for several corporations, including Vivo, which makes use of the startup’s professional digital content transmission solutions internally for events that require live transmission, such as employee training. “It is not the same experience because there is no networking and people getting together, but it is still a way of sharing information and converging ideas,” ponders Rafael Belmonte, co-founder and head of growth of Netshow.me.

Cyber Security Weekly Briefing May 15-20

ElevenPaths    21 May, 2021

​​​​​​​​QNAP Security Advisory

QNAP has issued two security advisories to alert its clients about:

  • The detection of recent eCh0raix ransomware attacks targeting its Network Attached Storage (NAS) devices. The firm is urging clients to protect themselves from such attacks immediately by using stronger passwords, enabling IP access protection to prevent brute force attacks, and avoiding the use of default ports 443 and 8080. This alert comes just a few weeks after security researchers already warned about the detection of AgeLocker (aka Qlocker) ransomware attacks against their devices.
  • The active exploitation of a 0-day vulnerability in Roon Server, specifically affecting Roon Labs in Roon Server 2021-02-01 and earlier versions. QNAP recommends disabling Roon Server and not exposing the NAS to the internet to protect against these attacks until a security update is released.

More details: https://www.bleepingcomputer.com/news/security/qnap-warns-of-ech0raix-ransomware-attacks-roon-server-zero-day/

​​​​​​Bizarro banking trojan extends to Europe

Security researchers have identified new campaigns of the Brazilian banking trojan known as Bizarro in several European countries such as Spain, France, Portugal and Italy. As usual with Brazilian trojans, it is distributed via spam campaigns that force the download of a ZIP file from a compromised website, with infrastructure identified in AWS, WordPress or Azure, both for hosting the initial malicious files and for hosting the C2 files. It is a stealer that collects information about the infected computer, the session, the antivirus used or browser data. Once in the browser, the malware causes the closing of open sessions in digital banking services in the browser to force the user to re-enter credentials in order to capture them. In addition, it has other capabilities typical of this type of trojan such as mouse and keyboard hijacking, resolving two-factor authentication (2FA), logging keystrokes, sending fake system messages, or inducing the installation of malicious applications, among others.

Learn more: https://securelist.com/bizarro-banking-trojan-expands-its-attacks-to-europe/102258/

Four Android vulnerabilities exploited in the wild

Android has updated information regarding four vulnerabilities fixed on 3 May in its May security bulletin. It has specifically changed the information related to their exploitation and claims that they could currently be exploited.  Two of the vulnerabilities, identified as CVE-2021-1905 and CVE-2021-1906, affect Qualcomm GPU drivers, while the other two, CVE-2021-28663 and CVE-2021-28664, affect Mali Arm GPU drivers. According to Google’s Project Zero team, all four vulnerabilities were being exploited by attackers even before the patches were released and could have been used in targeted attacks.

More info: https://twitter.com/maddiestone/status/139500434699624

​​​​​​​New double encryption trend with multiple ransomware variants

A new trend has recently come to light, which has been analysed by Emsisoft researchers, in which malicious actors are reportedly using multiple ransomware variants to double-encrypt their victims’ data, with the aim of complicating possible recovery and increasing the chances of obtaining a ransom. It is worth mentioning that this is not double extortion but double encryption, where the same operators decide to use different ransomware variants in the same attack. In the analysis, we have observed attacks using REvil and Netwalker together, as well as attacks using MedusaLocker together with GlobeImposter. In some cases, a sample was shared through the portal of one group when the encrypted files had been sent through the portal of the other group, so it is even possible that the operators of the different families are working together. It has also been observed that sometimes data is encrypted first with one ransomware and then re-encrypted with the second one, while in others, part of the system is encrypted with one variant and part with another. This new trend is in addition to others observed recently, such as the triple extortion method, which, in addition to encrypting data and threatening to make it public, contacting clients or third parties who may be affected by the attack to ask them for a ransom, with the same objective of increasing financial gain.

All the details: https://blog.emsisoft.com/en/38554/psa-threat-actors-now-double-encrypting-data-with-multiple-ransomware-strains/

STRRAT malware distribution campaign

Microsoft’s security team reports the detection of a new mass email distribution campaign of the latest version of the STRRAT malware. The attackers are reportedly making use of previously compromised email accounts to send the messages, which contain an attached image pretending to be a PDF attachment. When clicking on the image to open the supposed document, the image downloads the STRRAT malware. The first detections of this family date back to 2020. It is a malware programmed in Java and has a diverse range of functionalities, from stealing credentials from different email clients, logging keystrokes, executing arbitrary commands, or the ability to install the open-source tool RDWrap to gain remote access via RDP sessions, among others. It is also worth mentioning the “rw-encrypt” function, which only adds the extension “. crimson” to the files, without modifying their content. In other words, the user could think that the files are encrypted, as happens in ransomware attacks, since the extension has been changed to “. crimson” and the user cannot open them; however, it would be enough to restore the original extension to be able to recover the information. Microsoft has published advanced search queries to facilitate the identification of indicators and malicious behavior related to STRRAT.

More: https://twitter.com/MsftSecIntel/status/1395138347601854465

The Future of University Credentials Points Towards Blockchain And Open Badges

Gonzalo Álvarez Marañón    21 May, 2021

Do you want a university degree within 48 hours and without having to open a book, for less than €1,000? No problem. You don’t even need to go to the Darknet. Google “buy fake university degree” or “fake diplomas market” and you will find dozens of suppliers who guarantee you a replica of the degree of the course and university of your choice, for a modest price, variable depending on the prestige you are looking for. They can even falsify degrees issued by fictitious universities, some as illustrious as Miskatonic University. Anything will do because their vocation of service is to “help you find a better and faster job”. And why don’t police close any of them down? Because it is not a crime to sell them, but to use them. 

False documentation in the field of education is becoming a real social and economic scourge. It is trivial to put anything on a CV and very cheap to back it up with a fake degree, but very expensive to verify it. That’s why most talent recruiters don’t even bother to try and swallow it all. We need something better than paper degrees and diplomas! 

Digital credentials represent the natural evolution of traditional credentials to eliminate fraud. But a PDF with a digital signature is not enough. Enabling an agile and secure exchange of credentials that facilitates the verification and contracting process requires much more sophisticated cryptographic protection. Two technologies need to be brought together: 

  • Credentials beyond academic qualifications issued by traditional educational institutions: they will cover all types of knowledge, skills and abilities reflecting an individual’s lifelong learning achievements. Moreover, this will be digitally encapsulated using a standard vocabulary to describe such learning achievements that is universally recognised and easily interchangeable. 
  • A storage system for digital credentials that is transparent, immutable, unforgeable, and publicly accessible, to provide a secure and verifiable account of the academic history for anyone to verify. 

Hmmmm, how do these two requirements sound like? More and more people think Open Badges and Blockchain. What are they and how would they together solve the limitations of current titles? 

Open Badges, A Verifiable, Portable, Digital Badge Format, Packed with Information on Skills and Accomplishments 

To understand the purpose of Open Badges, it is first important to understand the limitations of current degrees, diplomas and certifications: 

  • Traditional titles, such as “Telecommunications Engineer”, do not say much about the specific knowledge, skills and capabilities of the owner. “OK, yes, so-and-so has an engineering degree, but does he have advanced Python programming skills, does he have the ability to lead a corporate network security project, does he have some working knowledge of ISO 27001, does he have some working knowledge of ISO 27001? The titles lack the granularity required by today’s job market. They tell an incomplete story about who holds them. Not to mention that many degrees and programmes are clearly outdated. 
  • There is education outside the confines of the university. There is a huge offer of non-formal training, currently served by a myriad of e-learning platforms, with real quality proposals, but it is not easy to validate the knowledge and skills acquired, which makes it difficult to recognise and compare them. 
  • There are many other places to learn beyond university and business schools and online courses: workshops, self-learning, personal or community projects, the workplace… How to make the knowledge and skills acquired in this way visible and relevant in terms that are recognised by formal educational institutions and by the training and career ecosystems? 

Today’s market requires a credential system that can capture knowledge, skills and competences in a granular way, in many different contexts, and associate them with the applicant’s digital identity. These credentials should be able to be displayed to stakeholders to demonstrate the capabilities. These credentials should enable learning to be connected across formal and informal learning contexts, allowing each individual to build their own learning pathways, at their own pace, based on their own interests and learning styles.   

Badges are the proposed solution to meet all these requirements. A badge can represent a micro-credential, but also any other type of credential, including official titles and manufacturer certifications. Undoubtedly, the most advanced and promising initiative in this line is the Open Badges project, initially driven by the Mozilla Foundation and currently under the leadership of the IMS Global Learning Consortium. 

In essence, an open badge is a standardised and open format for representing verifiable and sharable educational credentials, with detailed information about the achievement and what the owner did to earn it. Many Learning Management Systems (LMS) already incorporate them natively. In fact, open badges can coexist seamlessly with traditional qualifications and professional accreditation, complementing (or potentially replacing) them, with the advantage of allowing portability of skills and knowledge. 

Each Open Badge may communicate a qualification, skill or achievement by providing a visual symbol with verifiable data and evidence that can be shared digitally to facilitate access to employment and further learning cycles. To ensure that the value of each Open Badge is safeguarded, a number of criteria must be met: name of the issuing organisation, eligibility requirements, assessment criteria, date of issue, etc. 

 

Illustration 1. Example of an Open Badge.

Open Badges can be issued, earned and managed using one of the many certified Open Badge platforms. Stakeholders can be confident that an Open Badge represents a legitimate and authenticated achievement, the nature of which is described on the badge itself, which is also linked to the issuing organisation. Open Badges are verifiable, so that an employer can confirm the issuer of the badge and its expiry date, if applicable. 

In short, Open Badges provide the following advantages over the traditional credentialing system: 

  • Less fraud. 
  • Easier to list and find skills. 
  • Permanent record without fear of loss or dependence on the issuer. 
  • A more detailed and dynamic display than a traditional CV. 

However, an obstacle that Open Badges encountered in their early days was how to store and share them securely. And this is where the second main character of this story comes into the equation. 

When Open Badges and Blockchain Blend In Perfection 

Briefly, a blockchain acts as a distributed ledger open for anyone to read and write with the property that once a block has been added to the blockchain it is very difficult (ideally impossible) to change it. For more information on Blockchain, I recommend reading The CIO’s Guide to Blockchain. 

Storing badges on a Blockchain has several advantages: 

  • The student takes control of his or her official academic achievements (degrees and diplomas), rather than solely in the hands of the awarding institutions. 
  • Education does not end with formal training. Badges on a blockchain allow the student to add all kinds of credentials outside the academic walls, some that have nothing to do with the training itself, such as work experience validated by the employer. 
  • Open Badges + Blockchain = Trusted Credentials. All intermediaries are eliminated, as the credentials are signed by the issuing institution and anyone can verify their validity. 
  • Unlike a website hosted on an institutional server, Blockchain offers permanence and immutability: you have the guarantee that the data will neither disappear (as long as there is a node in the P2P network) nor be modified, whatever happens to the entity that issued it. 
  • Fraud disappears. 

Many projects are emerging to offer Open Badges on Blockchain, among which are: 

  • Blockcerts: In 2016, the MIT Media Lab proposed an open, tamper-proof standard for writing credentials on Blockchain, called Blockcerts, which allows credentials and their interoperability with other systems to be checked and verified. Not to be outdone, MIT has incorporated it into its digital diplomas. 
  • EKO: The EKO Blockchain platform is a public blockchain service built on Ethereum. It is fully compatible with EVM-based Solidity smart contracts and offers some innovative features, such as confidential contracts. 
  • Accredible: If you prefer to have it all done, Accredible is offered as a SaaS, including features such as credential creation and management, branding, integration with major LMS, full analytics and native tools to easily embed credentials into any channel. 
  • OpenBlockchain: This is an initiative of the Knowledge Media Institute (KMI) of the UK’s Open University, with several experiences with digital credentials. 
  • Bestr: Is the Italian platform for digital credentials, implemented on Blockcerts . 

Towards an Open, Transparent, Decentralised, Permanent, Immutable and Verifiable Credential System 

The digital credential market is in full swing: new technologies and standards are being explored, new commercial or open approaches are emerging, and many educational institutions are experimenting with alternatives. The combination of open badges and Blockchain enables digital credential systems that could prevent fraud, open new perspectives on how credentials are used and offer new mechanisms for communities to share knowledge. 

However, the real challenge is not technological but political. A cooperative effort will be needed to ensure that standards for digital credentialing systems are open and responsive to the needs of all stakeholders (learners, educational institutions, employers and governments), without prioritising the interests of one organisation over others. 

The future of verifiable digital credentials is yet to be written. These are just the first lines. 

Using DIARIO Through FOCA For Malware Analysis

Carlos Ávila    19 May, 2021

Web servers are one of the main channels for the spread of malware on the internet. They are frequently attacked in search of security flaws that allow them to be infected, so that they, in turn, serve as agents for spreading malware, controlling botnets and mining cryptocurrencies, among other malicious activities.

For this purpose, one of the moves made by attackers is to upload infected files to servers in order to deploy such malicious code to users. In this article we focus on files (office and pdf) that could be infected and hosted on compromised web servers.

This is where, through the FOCA tool (opensource), we can use the DIARIO plugin to analyse whether or not these files contain malware in embedded macros and thus prevent the spread of such files on the internet or to your own users.

DIARIO, How to Detect Malware While Protecting Your Privacy

But what is DIARIO? DIARIO is a platform that incorporates Artificial Intelligence specifically trained to detect malware that generally eludes traditional antivirus solutions and, to do so, performs a process of analysis of the documents without the need to access the content of the same, which is essential in the case of files of a private or sensitive nature.

Through the FOCA tool (opensource), and after searching the documents on the web server, you can use DIARIO to periodically analyse the files uploaded to your web servers to find out whether they contain malware or not (at macro level) so that you can carry out some mitigation and control action on this risk.

The analysis can be run individually or for all the files crawled or found by FOCA and its search methods. At the end, you can also get a tabulated summary of the results.

The truth is that these files should not even be on web servers, as they should be checked before they reach the server. But criminals keep updating and improving their techniques, so in case you want to give it a try, you have one more tool to analyse your documents from a different perspective in order to defend yourself against this type of threat.

Mobile Malware, part of the Generation Z

Gabriel Bergel    18 May, 2021

Generation Z or “post Millenials” is the demographic group born between 1994 and 2010, mobile malware was born in 2004 with Cabir, the first virus to affect Symbian Series 60 phones. At the time, Nokia was the market leader in mobile phones, and this malware spread from phone to phone via the Bluetooth OBEX insertion protocol. 

I personally believe that mobile malware was born deliberately with a criminal objective and focused on obtaining money illegally, not like computer malware which is considered to have a link to old school and in particular to electronic disobedience, digital revolution, fame or peer recognition. 

Mobile Malware History 

Once this first malware, known as Cabir, was “released”, it only took a year for virus developers to adapt their malicious techniques for mobile use, and progress was very rapid: 

  • 2005: the first trojan. 
  • 2006: the first data theft. 
  • 2008: the first fake antivirus. This would mark the beginning of the main vector of compromise: fake applications. 
  • From 2012 onwards: mobiles start to be used for cyber-espionage and Android becomes the main target for malware. 
  • In 2013: 98.1% of malware was already targeting Android.
  • In this area, in 2020 an interesting botnet called Terracotta, based on Android and hosted (of course) on Google Play, perpetrated traffic attacks and fake ads in a peculiar way in both its tactics and techniques. In June, it achieved 2 billion fake requests, with 65,000 phones infected. For more information on what happened in 2020, see the 2020 H2 State of Security Report. 
  • In 2020, we also learned what happened to Jeff Bezos via WhatsApp on his mobile phone, with a simple message and a malicious RAT file that compromised his mobile phone.  
Figure 1: infographic, history of mobile malware

Mobile Security, The Big Challenge 

Today the mobile phone is the most used, most popular and “most important” technological device in our lives, even more so in pandemic times. However, there is still little awareness when it comes to installing applications, sharing information, connecting to public Wi-Fi networks, etc. Furthermore, we can still find mobile spying applications or services that are marketed completely openly, such as FlexiSpy. Therefore, there is a great challenge and responsibility that requires a lot of attention from people. 

At this point, you must be wondering, what is the main vector that could compromise the security of your mobile phone? The answer is the applications that you install, as you can see in figure 2 below. 

Figure 2: Infographics, main vector used (Source: Pradeo)

Main Mobile Malware 

  • Adware: malware that automatically delivers unwanted or misleading ads, present in websites, applications, pop-up ads, in order to generate profit for its authors or worse. 
  • RAT (Remote Administration Tool): it is a tool for remote administration, but it is also used for non-legitimate purposes, which is why it was renamed Remote Access trojan. 
  • Spyware: Malware that collects information and then transfers this information to an external entity without the owner’s knowledge or consent. 
  • Trojans: malicious software that presents itself as a seemingly legitimate and harmless application, but when executed, performs its malicious action. They are usually hidden. 

Mobile Security Recommendations 

  • Do not jailbreak or root the phone. 
  • Avoid installing third-party applications (validate sources). 
  • Block the installation of programs from unknown sources. 
  • Check the list of applications to find out if suspicious programs have been installed without our consent. 
  • Install an Antivirus and/or Antimalware. 
  • Do not click on or download files from masked, unknown links sent by strangers. 
  • Beware of phishing, smshing, phishing in RRSS, etc. 
  • Read the terms and conditions as if you were a lawyer before accepting them and stop the download process if anything looks like permission to load adware. 
  • Perform security scans and keep updates up to date. 

If you also like to research and analyse malware, I recommend our CARMA platform, a free service provided by our Innovation and Lab area. It provides a free set of samples of malware, adware and other potentially dangerous files collected for the Android operating system. These samples may be used exclusively for research or academic purposes, and their use for any other purpose is strictly prohibited. These sets are intended to provide quality samples that can be used for analysis within expert systems such as Machine Learning, Artificial Intelligence or any method to improve future detection of these types of threats. 

Cyber Security Weekly Briefing May 8-14

ElevenPaths    14 May, 2021

Ransomware attack on a main US oil pipeline

US energy company Colonial Pipeline was hit by a ransomware attack on Friday, causing the shutdown of around 8800km of pipelines supplying crude oil to the East Coast. This measure was reportedly taken to prevent the spread of the malware but, according to the company, the attack only affected its corporate IT network, not OT systems. Several specialised sources attribute the incident to the ransomware family known as DarkSide, who were already responsible for the attack on the Escuela de Organización Industrial (EOI) in Spain. This ransomware adheres to the current trends of double extortion (exfiltration of data and its open publication) and business model through affiliations (Ransomware-as-a-Service). As a result, the US government declared a state of emergency in order to move the crude oil needed by the population through roads. This incident’s impact forced the operators of the DarkSide ransomware to issue a press release, where they claim to be apolitical and not related to any government. They also indicated that from now on they will review their targets before perpetrating their attacks, as the aim of their organisation is to make money and not to “create social problems”. DarkSide operates as Ransomware-as-a-Service, this model consists of two groups of people: the ransomware developers and their affiliates who provide access to the victim networks. Following the Colonial Pipeline incident, it is expected that the DarkSide developers will have more control over this second group. In relation to the attack, it is estimated that the ransomware operators exfiltrated around 100GB of data from the systems before the network was encrypted, although these files have not yet been made public. The affected company continues to mitigate the incident and has not yet returned to full operational normality. In the last hours, Bloomberg media affirms that the company would have formalized the requested payment to recover normality; however, no confirmation has been made from Colonial Pipeline.

More: https://www.bleepingcomputer.com/news/security/largest-us-pipeline-shuts-down-operations-after-ransomware-attack/

Microsoft fixes three 0-day vulnerabilities and four critical vulnerabilities

Microsoft has published its security newsletter for the month of May, in which three 0-day vulnerabilities are corrected, with no evidence of active exploitation, despite the fact that they were disclosed before their correction was made public.

  • CVE-2021-31204: Scalation of privilege vulnerability in .NET and Visual Studio.
  • CVE-2021-31207: security feature bypass vulnerability in Microsoft Exchange Server. This security flaw was discovered in the 2021 edition of Pwn2Own that took place at the beginning of April.
  • CVE-2021-31200: Remote code execution vulnerability in the common utilities of Microsoft’s NNI (Neural Network Intelligence) toolkit. 

This update covers a total of 55 vulnerabilities, 4 of them critical (CVE-2021-31166 in HTTP Protocol Stack, CVE-2021-26419 in Internet Explorer, CVE-2021-28476 in Hyper-V and CVE-2021-31194 in Windows OLE), 50 important and finally, one of moderate criticality. None of them under active exploitation.

Full info: https://msrc.microsoft.com/update-guide/

Adobe fixes actively exploited 0-day vulnerability

Adobe has patched multiple vulnerabilities affecting twelve of its products: Adobe Experience Manager, InDesign, Illustrator, InCopy, Genuine Service, Acrobat, Magento, Creative Cloud Desktop Application, Media Encoder, After Effects, Medium, and Animate. These sum up to a total of 43 vulnerabilities, including a 0-day vulnerability that affects Adobe Acrobat Reader, and is catalogued as CVE-2021-28550. Adobe indicates that this security flaw has been actively exploited in limited attacks against Windows devices. It should be noted that this use-after-free vulnerability allows remote code execution, which could allow attackers to execute commands, install malware or even the possibility of gaining access to victims’ devices that use Windows as their operating system and have a specially crafted malicious PDF file opened. Adobe warns customers to update vulnerable versions as soon as possible.

All the details: https://helpx.adobe.com/security.html

FragAttacks: 12 new vulnerabilities in the Wi-Fi standard and its implementations

A Belgian researcher has discovered a series of 12 new vulnerabilities affecting Wi-Fi devices, collectively referred to as FragAttacks.  These vulnerabilities could be used by attackers within the Wi-Fi range to inject frames into a protected Wi-Fi network, getting the victim to use a DNS server controlled by the threat actor and intercepting the traffic. It would also allow, in the case of a router, circumvention of the firewall/NAT, allowing attackers to communicate directly with devices on the Wi-Fi network, potentially resulting in subsequent attacks on vulnerable services. Among the identified flaws, CVE-2020-24588, CVE-2020-24587 and CVE-2020-24586 are caused by flaws in the design of the Wi-Fi standard, affecting most devices; while CVE-2020-26145, CVE-2020-26144, CVE-2020-26140 and CVE-2020-26143 reside in implementation flaws, allowing trivial frame injections into protected Wi-Fi networks. An additional 5 less trivial vulnerabilities also reside in implementation flaws. The researcher said that every Wi-Fi product is affected by at least one vulnerability, and most products are affected by more than one. For those not yet patched, a number of mitigation recommendations have also been provided.

Learn more: https://www.fragattacks.com/

FiveHands: double extortion ransomware attacks targeting organisations

The US Cybersecurity Agency (CISA) has issued a warning about a new ransomware variant called FiveHands, which was identified in January this year.Its operators use the double extortion technique, already present in many ransomware families, in which threat actors demand a ransom to decrypt compromised systems and not leak the organisation’s stolen data.  In their intrusions, they exploit publicly available tools such as SoftPerfect Network Scanner for Discovery and Microsoft’s remote administration program, PsExec.exe, along with ServeManager.exe. It is also common to see the SombRAT malware deployed, which is capable of collecting data from the compromised system, as well as allowing DLLs to be downloaded and executed on affected systems via a protected SSL session. FiveHands also has the ability to delete system backups and/or any recovery files. In April, FireEye identified the FiveHands operators as UNC2447, linking them to the exploitation of a 0-day vulnerability in SonicWall VPN (CVE-2021-20016) for which patches have been available since February.

More information: https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a

4 Tips for a Safe Return to the Workplace

ElevenPaths    14 May, 2021

It has now been a year since many of us left our physical office behind to embrace remote working.

Living rooms and bedrooms became our new offices and meeting rooms, and the work environment had to be combined with the home environment and our routines. But it seems that, little by little, we are seeing the light at the end of the tunnel and the return to the office is getting closer and closer, even if it won’t be like it used to be.

We know that following all the health regulations that have been in place for months is the first step in protecting ourselves as we return to the office, but what about our systems and devices? Do we know how to protect them? Will they remember how to get back to work?

Therefore, from ElevenPaths, in addition to reminding you that we must follow all the established health regulations, we want to help you refresh your memory with these 4 basic tips to keep your security on the network as well.

Turn to Professionals

Do you remember your first day at work after the summer holidays, that moment when your mind is still on the road, but you’re back in the office and it’s time to focus, even if your head doesn’t want to? Well, the same thing happens to your devices when, after a year, they have to reconnect to your office network.

Therefore, turn to professionals. Every company has a specialised technical team that will connect your devices with great care and, above all, knowing how and where to do it. Remember that there are many networks lurking among them. Trusting those who know is a guaranteed way to be secure and save time on your first day back at the office.

Be 100% Sure Before Clicking “Accept”

We are often overwhelmed by our desire and the screens that pop up to take us to the next level are not the most reliable. Remember that, even if you want to start as soon as possible, you should not accept conditions if you do not know what they entail. So, wait, be cautious, ask the experts and act with knowledge.

Whoever Has A Password, Has A Treasure

Yes, we know we repeat it a lot, but it’s true. Passwords are the gateways to your most private information. A treasure chest of information that many cybercriminals seek to take advantage of. That is why, in the office, always remember to avoid post-it notes where you can write them down or paper diaries that can be easily seen by anyone. It is better to use a password manager and validate two-step verification (2FA). 

Catch Up with The Changes

All the information and notifications you have been receiving over the last few months about the return to the office are now a real bible to you. Read them and keep up to date with the changes, especially when it comes to cyber security. Being informed is one of the best ways we have to anticipate possible attacks on our systems and have a completely secure working day.

Unravelling the Quantum Tangle of Cybersecurity: Quantum Computers, Quantum and Post-Quantum Cryptography

Gonzalo Álvarez Marañón    13 May, 2021

Do you know what’ s the difference between quantum computing, quantum cryptography and post-quantum cryptography? Because to be honest, they have (almost) nothing to do with each other. They are terms that keep coming up in conversations about cybersecurity. In this article, I will tell you what every CIO/CISO should know about these three terms in order to participate in the conversation without screwing up. Let’s unravel this quantum mess! 

Quantum Computers and The Power of Massive Parallelism 

Let’s start with quantum computing. As we all know, classical computers use classical physical phenomena to represent bits: an electric current passing or not passing through a transistor, a magnetic dipole pointing up or down, a plastic disc with or without holes in the range of a laser beam, and so on. They are well-defined states, allowing unambiguous representation of ones and zeros: a one is a one and a zero is a zero. 

In contrast, quantum computers use quantum particles, such as photons or electrons, to represent quantum bits or qubits. And here the astonishment bursts in: a qubit can be in either a zero state or a one state, or in all states between zero and one. This amazing property of quantum physics, known as superposition of states, allows for massively parallel computations. 

For instance, imagine that you want to calculate the results of a function f (x) for all the possible values of x. If the input x is two bits long, on a classical computer you would have to try sequentially the four possible values: first 00, then 01, then 10 and finally 11. Whereas a quantum computer will perform all four calculations simultaneously. But there is a trick: the two qubits store all four possible results at once, but the readout only returns one of those four values and you can’t choose which one – it happens randomly. 

Therefore, quantum algorithms must cleverly and skilfully exploit this feature so that the probability that you will randomly read the result you are looking for is as close to 100% as possible. And this is not easy. That is why there are only very few quantum algorithms. The two best-known in the cyber security field are Shor’s, which is capable of wiping out the public-key cryptography in use today, and Grover’s, which simply weakens secret-key cryptography and hashes, with the simple solution of doubling the size of the key or hash. 

In addition to breaking today’s cryptography, quantum computers will have many other more constructive uses, such as, for example, the following uses outlined by Gartner in its highly recommended report  The CIO’s Guide to Quantum Computing: 

  • Machine Learning: improving ML through faster structured prediction. 
  • Artificial Intelligence: faster computations to improve perception, understanding and fault diagnosis of binary circuits/classifiers. 
  • Chemistry: new fertilisers, catalysts and battery chemistry to drive improvements in resource efficiency. 
  • Biochemistry: new drugs, personalised medicines and perhaps even hair restorers. 
  • Finance: faster and more complex Monte Carlo simulations, e.g., trading, trajectory optimisation, market volatility, price optimisation and hedging strategies. 
  • Health: genetic sequencing of DNA, optimisation of radiotherapy treatment/detection of brain tumours in seconds instead of hours or weeks. 
  • Materials: highly resistant materials; anti-corrosion paints; lubricants; semi-conductors. 
  • Computing: faster multidimensional search functions, e.g., query optimisation, mathematics and simulations. 

Much Better Quantum Key Distribution Instead of Quantum Cryptography 

Quantum cryptography does not exist. What has existed since 1984 is “Quantum Key Distribution” (QKD). In other words, (misnamed) quantum cryptography has nothing to do with quantum computation, but is in fact, a brilliant exercise in quantum communication, applied to the distribution of random keys. 

Historically, the biggest obstacle in cryptography has been the problem of key distribution: if the channel is insecure and you need to encrypt the information, which channel do you send the encryption key through? In 1984, researchers C. Bennett and G. Brassard came up with the first method for sharing keys over a quantum communications channel using suitably polarised single photons, known as BB84. This protocol has the interesting property that, if an attacker intercepts bits of the key, he will inevitably be detected, since, in the quantum world, one cannot observe without leaving a trace. Subsequently, other QKD protocols have been presented, such as E91, proposed by researcher A. Ekert in 1991, based on the “entanglement” or “quantum entanglement” between two particles, and many others. 

Do not believe that QKD is the Holy Grail of cryptography either. In fact, some of the world’s largest intelligence agencies have pointed out that it is far from solving our secrecy problems. What theoretical physics can propose is one thing; what engineers can build is quite another. Although the gap between theory and practice is closing by leaps and bounds since that humble PoC in 1984, the implementation of QKD is not yet as secure as it will undoubtedly become with technological advances. 

Post-Quantum Cryptography or How to Resist A Future Dominated by Quantum Computers 

Finally, we get to post-quantum cryptography, which has little or nothing to do with the previous two. Post-Quantum Cryptography (PQC) or Quantum-Safe Cryptography brings together those cryptographic algorithms capable of resisting Shor’s and Grover’s algorithms, mentioned above. These are classical mathematical algorithms, some of them more than 40 years old. The three best-studied alternatives to date are hash-based cryptography, cryptography based on ciphers and lattices-based cryptography. 

According to the recent report Post-Quantum Cryptography (PQC): A Revenue Assessment, the market for post-quantum cryptography software and chips will soar to $9.5 billion by 2029. While PQC capabilities will be embedded in numerous devices and environments, according to the report, PQC revenues will be concentrated in web browsers, the Internet of Things (IoT), 5G, law enforcement (police, military, intelligence), financial services, healthcare services, and the cyber security industry itself. 

NIST has initiated a process to request, evaluate and standardise one or more PQC algorithms for digital signature, public key encryption and session key establishment. After three years of analysis of the proposed candidates, NIST announced the winners of the second round for the selection of the new post-quantum cryptography standard in July. In the third and final round, NIST will specify one or more quantum-resistant algorithms for 1) digital signature, 2) public key encryption and 3) cryptographic key generation. The algorithms that will proceed to the third round in the public key encryption and key management categories are Classic McEliece, CRYSTALS-KYBER, NTRU and SABER; and in the digital signature category, CRYSTALS-DILITHIUM, FALCON and Rainbow. 

Do Not Get Tangled Up in Quantum Science 

Nowadays, only 1% of organisations are investing in quantum computing and quantum computers. This is an area in full swing, consuming budgets in the billions, within the reach of only the most sophisticated R&D teams. Europe is navigating the second quantum revolution through its European Quantum Flagship programme, although there is no doubt that China has taken the lead. It is expected that in a decade or two we will be enjoying error-free quantum computers of thousands of qubits. When that day comes, if it does come, it will be a profound change in technology as we know it today. 

On the other hand, the area of quantum communications is much more mature, with a multitude of fully operational proposals, available at a wide range of prices and performance. In 3 years time, the development and certification of quantum random number generation (QRNG) and key distribution (QKD) devices and systems is expected. This will address high speed, high TRL, low deployment costs, novel protocols and applications for network operation, as well as the development of systems and protocols for quantum repeaters, quantum memories and long-distance communication. All of this would lead in 10 years to a “Quantum Internet”.

As for post-quantum cryptography (PQC), it is nothing more than traditional cryptography, based on classical mathematical algorithms, but with the peculiarity of resisting quantum computing. If your organisation currently handles encrypted information which needs to be kept confidential for more than 10 years, you better start analysing the PQC product offerings on the market to start the transition.

The future will either be quantum or it won’t be or it will be something in between or, it will be and won’t be at the same time or… Do not get tangled up in quantum science! 

Tips to Download Apps Securely

ElevenPaths    11 May, 2021

The arrival of smartphones brought about a paradigm shift in the way we use and consume content through mobile devices. So much so that, from that moment on, they went from being conceived solely as mobile phones to real pocket computers. This revolution opened up a new world that today extends to other devices such as tablets, televisions and even some wearables such as smartwatches. 

Whether you use Android or iPhone, in this article we bring you some useful tips on how to download apps safely so you can make the most of them without losing awareness on your cybersecurity. 

Use Official Sources

When downloading an app, always download it from the official markets: Play Store for Android devices and Apple Store for Apple devices. Do not trust apps that come from unknown websites or channels. If in doubt, go to the official website of the company whose app you are going to download and from there you will be redirected to the download site, which is sure to be the Play Store or Apple Store!

Read User Reviews

Just like when you are booking accommodation or shopping online, reading reviews and comments from other users can help you clear up doubts about whether to download an app or not, what its functionalities are, etc. 

On the other hand, consulting specialised forums is a good idea if you are interested in finding out more details about their specifications and operation. 

Check the Data and Permissions Requested

Before you start using an application, it is important that you check its configuration in your phone’s settings. In fact, you can usually access these configurations directly from the download site of the Play Store or Apple Store as soon as it finishes downloading.

Activate or deactivate the permissions you consider necessary and when everything is in order, it is time to start using the app. 

Keep Your Software Up to Date

Update your devices regularly. As well as increasing your protection against cyber threats such as ransomware, they help to improve the compatibility and performance of the applications you download. 

We hope you find these tips useful and recommend that you also have security systems installed on your smartphone. Remember that smartphones are pocket computers with which we carry out more and more tasks and activities at any time and from anywhere. If you install an antivirus on your computer, do the same on your mobile phone. 

Follow us on our social networks (Twitter, Facebook, LinkedIn, Instagram, YouTube and Twitch) and visit our website for more cyber security tips, products and tools. 

Cyber Security Weekly Briefing May 1-7

ElevenPaths    7 May, 2021

Apple fixes four 0-day vulnerabilities in WebKit

Apple released yesterday a security update to fix four 0-day vulnerabilities that could be actively exploited, according to Apple itself. These four flaws were found in Webkit, the rendering engine used by Safari browser, but also by different components of its systems to display web content without using a browser. While Apple has not shared full details of these vulnerabilities, they claim that processing specially crafted malicious web content would allow an attacker to execute arbitrary code remotely. The flaws have been identified as CVE-2021-30663, CVE-2021-30665, CVE-2021-30666 and CVE-2021-30661, all of which are under possible exploitation. The affected products are iOS, macOS, iPadOS, watchOS and tvOS.

More details: https://support.apple.com/en-us/HT212336

Multiple critical vulnerabilities in Exim mail servers

Qualys research team has discovered 21 critical vulnerabilities in the Exim email server, which is available for most Unix-based operating systems and is pre-installed on several Linux distributions, such as Debian. According to the researchers, an estimated 60 percent of all internet servers run on Exim. Of the total number of vulnerabilities discovered, ten of them could be executed remotely, and eleven could be exploited locally in default or at least very frequent configurations. Some of them could be chained together to execute remote code without authentication and escalate privileges. Most of these bugs would affect all Exim versions prior to 4.94.2, since its launch in 2004.

Full info: https://blog.qualys.com/vulnerabilities-research/2021/05/04/21nails-multiple-vulnerabilities-in-exim-mail-server

TsuNAME: a vulnerability allowing attacks against authoritative DNS servers

Researchers have published a joint paper exposing details of a DNS vulnerability, such as TsuNAME, that could be used as an amplification vector in distributed denial of service (DDoS) attacks targeting authoritative DNS servers. This vulnerability affects recursive DNS resolvers, allowing attackers to send uninterrupted queries to authoritative servers that have cyclic dependent records. The effect of many vulnerable recursive resolvers could crash an authoritative server, affecting critical DNS infrastructure such as Top Level Domains (TLDs), potentially affecting country-specific services. Researchers have released the CycleHunter tool to detect cyclic dependencies in DNS zones.

All the details: https://tsuname.io/advisory.pdf

Qualcomm vulnerability affects Android devices

Researchers at Check Point have published the results of a study on a new buffer overflow vulnerability listed as CVE-2020-11292, which could allow a threat actor to access a mobile device’s call and text message (SMS) log, unlock the SIM and eavesdrop on the user’s conversations. The flaw lies in a chip contained in some devices, known as Mobile Station Modem (MSM) created by the Qualcomm company, which is responsible for connecting devices to the network and is managed by the QuRT operating system. Researchers determine that the vulnerability lies in the Qualcomm MSM Interface (QMI) protocol, which, after receiving malformed TLV packets, triggers a memory corruption and allows a threat actor to execute its own code. The vulnerability could be exploited by hiding the malformed TLV packets within radio communications or multimedia content sent by the device. Check Point contacted Qualcomm to notify them of the flaw last year, but there is still no patch as they say it is up to the mobile suppliers themselves to take action.

Full information: https://research.checkpoint.com/2021/security-probe-of-qualcomm-msm/