210705 Kaseya or Application Specialist urgently needed

 Recent Kaseya events just remind me of my comment on Solar Winds affair:

https://zenosloim.blogspot.com/2020/12/201222-from-solar-winds-hack-to.html

Well, same story happens again: blind and dumb trust in well-known US software company. 

Or what happens when you cut costs by outsourcing at any price and not using own application specialists.

In Sweden we have full fun: major companies are completely blocked or partially blocked: Coop, SJ...

I remember when working as Application Specialist at SAAB, I provoked rumour when I said that I discovered hidden malware on a CD received from the renowned German company Rohde & Schwarz.

Impossible, absurd...but I was right in my assessment.

Nowadays, being an Application Specialist, is no longer important, who cares to test and reverse engineer/repack updates from Microsoft, Adobe, ... Kaseya, Solar Winds...?

Consequences? Russian hackers become rich on criminal activities and dumb arrogance of chiefs obsessed by cutting costs at any price.

We need Application Specialists in Windows softwares among others, only Linux techies are not enough...:), because advanced filtering firewalls from Israel Check Point are too expensive to be affordable.

Also not anyone is using multi- layered security solutions for email servers and intranet.

210603 Google Play payment mechanism security issue - any paid app can be downloaded

 210603 Google Play payment mechanism security issue - any paid app can be downloaded

I just discovered a security issue in Google Play payment system, which makes possible for an unauthorized person to download any paid app without payment.

Google was contacted for reporting and correction of the security issue.

210319 after more than 4 years, Swedish State Authorities react in good direction

 References:

https://zenosloim.blogspot.com/2016/02/it-services-outsourcing-between-cutting.html

https://zenosloim.blogspot.com/2017/07/transportstyrelsen-skandalen.html

Background:

During past years, keyword Outsourcing was the magic key for many Swedish responsibles from both government agencies, state authorities and big private companies.

Cutting costs without long term planning and analysis, became almost a catastrophic way of thinking and a 100% sure way to IT-security incidents and disasters.

Now it seems that many rational analysers have made their point listened and the result is here:

https://sverigesradio.se/artikel/regeringen-lagger-fram-ny-sakerhetslag

"Skärpt säkerhetslag ska skydda känslig information

Publicerat idag kl 10.30

Regeringen föreslår nu ändringar i säkerhetsskyddslagen som ska granskas av lagrådet. 

    Syftet är att hindra att känslig information kommer på avvägar. Till exempel måste myndigheter eller privata företag i vissa fall samråda med Säpo om IT-system ska läggas ut på entreprenad. Det kan gälla verksamhet med kopplingar till förvaret, energiförsörjning, eller telefon- och datanätverk.

    Struntar de i samrådet kan de straffas med en avgift på upp till 50 miljoner kronor."

At last...

Sådana chefer som lägger allt inkl. känslig IT-drift på entreprenad, utan att tänka på konsekvenser, borde också lägga deras eget tjänst på entreprenad, så att någon mer kompetent ersätter dem.

210306 Microsoft Outlook.com latest massive hack

 About 2 weeks ago something strange happened.

A mail sent apparently from Microsoft Outlook servers invited me to click on a link to reconfirm my Google account designed as recovery account for my Microsoft account.

Why strange?

1. In case of account suspicious activity or hacking, there are well defined rules of alert.

2. Having more accounts on Microsoft and Google, respective suspicious email came only on certain accounts: those used for corporate purpose which were associated with interesting list of Contacts.

3. Analysis of email's header revealed only real internal ip addresses from Microsoft Outlook.

Same for the clickable link sent to click on in order to reverify your data.

4. Despite message said if you do not reverify, you can no longer use the account, checking the account from a different ip and device, all was ok, and more, the pretended email did not even existed, alike so-called flash-sms.

My Good Sense told me do ignore the email and for sure something happened inside Microsoft.

Today, the world news showed I was right.

Massive internal attack on Microsoft Outlook servers and Cloud- based email services.

I can only imagine how many US and world companies and authorities using Microsoft Outlook.com services are now in big trouble.

Such a sofisticated attack and hack could only be done by a state actor: China or Russia.

Israel is not in discussion, being an US ally.

In any case, the whole trouble was kept totally secret for at least 10 days.

201222 From Solar Winds hack to Symantec hack, McAffee hack, F-Secure hack, Avecto hack and...SAAB

 201222 From Solar Winds hack to Symantec hack, McAfee hack, F-Secure hack, Avecto hack and...SAAB

Latest Solar Winds hack could have been discovered long time ago, and avoid so much dammage as it is partially recognized today.

Main cause: many companies and state authorities have a blind belief in an already established trusted software company, especially if it is located in USA or UK.

Responsible with IT Security Management, Repacks and Application Specialists trust blindly any version and update if it is "signed" with a "verified" digital signature.

They get for granted above and do not trust if any would reverse-engineer a certain software for backdoors discovering.

How about if a certain famous software company have backdoors in their intranet or update servers and unauthorized strangers get access to their intranet and signing tools and certs or special access cookies which can emulate authorized external access?

This was the case few years ago with all famous names: Symantec, McAfee, Avecto, F-Secure.

All above, reputated security software companies from USA, UK, Finland-Sweden, actively used in many global companies and state/military/sigint authorities.

Imagine a high-security encrypted laptop being left completely open.

Imagine a cloned RSA Security USB-stick for unauthorised access.

Imagine an intranet antivirus server "cooked" with modded virus-definitions updates.

Imagine a "poisoned" Access Server, with modded records if unauthorized access records installed.

Imagine a user getting hidden local/global admin rights, after "getting unauthorized access" to Active Directory records of others.

Unfortunately, the practice described above (trust blindly and refuse to accept "unpleasant" discoveries) is well spread mostly among Corporate CEOs and high-rank officers and responsibles. 

If someone discovers "the incredible", it's like whistling in the church and gets punished instead of using precious info with critical timing.

Few years ago I worked as IT-Security Administrator SAAB Global Network.

After discovering similar issues, SAAB leading thought I whistled in the church.

What is more serious is that a lot of hacking info discovered by me was found via my direct hacking of certain servers located in Russia.

I'm sure if any IT Security responsible in any affected country/company/authority affected by Solar Winds hack, would not have trusted blindly any software (update) and digcert, the situation today would have been completely different.

Zeno Sloim

IT-Security Specialist, MSC in Computer Sciences

ex. SAAB Global Network IT-Security Administrator

IQ test done years ago in 2011

 I did an IQ test back in 2011. Got 144-158.

200913 När bankernas drömmar väcks av realiteten

 

Stefan.Ingves@riksbanken.se

registratorn@riksbank.se

registrator.riksdagsforvaltningen@riksdagen.se

finansdepartementet.registrator@regeringskansliet.se

Referenser:

https://www.fplus.se/ingves-vi-behover-fysiska-kontanter-om-nagot-hander/a/0KEQ6o

https://omniekonomi.se/ingves-vi-behover-fysiska-kontanter-om-nagot-hander/a/x3RgkV

https://www.bloomberg.com/news/articles/2020-09-12/sweden-s-cashless-future-reveals-a-whole-world-of-hidden-risks

https://zenosloim.blogspot.com/2018/11/181107-swedish-digital-bank-id-hacked.html

https://zenosloim.blogspot.com/2019/09/190912-latest-attack-vector-on-digital.html

https://zenosloim.blogspot.com/2020/01/200105-swedish-people-lose-swedish.html

Det verkar som att varken Linux eller Python, Java och C++ kan ersätta elström och fungerande internet, för att garantera ett fungerande ekonomi och normal handel för Sveriges befolkning.

För en tid sedan och fortfarande, fanns det gott om "snillar" inom Linux, Java och Python, som påstod att kontanter ska försvinna och digitaliseringen ska ersätta allt.

Idéen var mest omtyckt av bankernas direktörer samt om de flesta affärsägare som påstod att kostnaderna för kontanthantering och rånriskerna blivit alldelles för höga.

Stackars Securitas personal, riskerade massarbetslöshet.

Men tack vare en allt mer aggressivt Ryssland och Kina, insåg de ansvariga på Riksbanken att internationella politiska konflikter och cyberattacker kan göra ännu mera skador och ingen snille i världen eller Sverige kan använda Linux eller Java och Python för att ersätta elström och fungerande internet.

Men som bankdirektörerna drömt, total digitalisering kan fortfarande bli sambo med en kompromiss lösning.

Man kan fortfarande eliminera kontanterna.

Hur?

Enkelt. 

Förse alla affärsinnehavare med pappersregister som på 1900 och som fortfarande finns i Afrika eller Mellanöstern.

Ifall om elström eller internet är borta pga krig, kriser, cyberattacker...och dylikt, alla transaktioner registreras med penna på papper i pappersregistret.

När allt blir normalt igen, alla pappersregistrar lämnas in till bankerna, och bankernas personal kan skanna in och uppdatera alla konton och transaktioner.

Behövs ej längre någon Securitas, eftersom ingen vore intresserad att stjäla pappersregistrarna.

Så, vi ej längre behöver kontanter.

Bara pappersregistrar.

Smart?

Hälsningar till alla "snillar" i Linux, Java och Python, oavsett om de arbetar på Riksbanken, Finansdepartementet, FRA eller MUST.

Mvh

Zeno Sloim