Secret SSH backdoor in Fortinet hardware found in more products

A recently identified backdoor in hardware sold by security company Fortinet has been found in several new products, many that were running current software, the company warned this week.

Discovery comes a month after competitor Juniper disclosed unauthorized code.

The undocumented account with a hard-coded password came to light last week when attack code exploiting the backdoor was posted online. In response, Fortinet officials said it affected only older versions of Fortinet's FortiOS software. The company went on to say the undocumented method for logging into servers using the secure shell (SSH) protocol was a "remote management" feature that had been removed in July 2014.

In a blog post published this week, Fortinet revised the statement to say the backdoor was still active in several current company products, including some versions of its FortiSwitch, FortiAnalyzer, and FortiCache devices. The company said it made the discovery after conducting a review of its products. Company officials wrote:

As previously stated, this vulnerability is an unintentional consequence of a feature that was designed with the intent of providing seamless access from an authorized FortiManager to registered FortiGate devices. It is important to note, this is not a case of a malicious backdoor implemented to grant unauthorized user access.

 In accordance with responsible disclosure, today we have issued a security advisory that provides a software update that eliminates this vulnerability in these products. This update also covers the legacy and end-of-life products listed above. We are actively working with customers and strongly recommend that all customers using the following products update their systems with the highest priority:

• FortiAnalyzer: 5.0.0 to 5.0.11 and 5.2.0 to 5.2.4 (branch 4.3 is not affected)
• FortiSwitch: 3.3.0 to 3.3.2
• FortiCache: 3.0.0 to 3.0.7 (branch 3.1 is not affected)
• FortiOS 4.1.0 to 4.1.10
• FortiOS 4.2.0 to 4.2.15
• FortiOS 4.3.0 to 4.3.16
• FortiOS 5.0.0 to 5.0.7

Undocumented backdoors have long been a security concern because they make it possible for outsiders to gain unauthorized access to sensitive devices. Backdoors have received increased scrutiny since network hardware maker Juniper dropped last month's bombshell that there was unauthorized code added to its Netscreen line of firewalls. Among other things, the unauthorized code in the Juniper product allowed attackers to surreptitiously decrypt encrypted traffic. While Fortinet officials say the backdoor in its products had no malicious intentions, there's little doubt it could be used for covert eavesdropping by people with knowledge of its presence.

Is it time to move from Windows 7, 8 and 8.1 to Windows 10?

While standing in line at a burger joint recently, we spotted a sign in the manager's office that proclaimed, "Happy employees are productive." That pretty much sums up the Windows 10 experience from the user perspective. It's fast, feature-filled, easy to use and works across many types of devices. Although a unified experience across multiple devices (and using one account) was introduced in Windows 8, it remains a key factor in Windows OS usability. But because the mouse and keyboard still rule the desktop, it's equally important that the Start menu is back in Windows 10, in all its full glory.

Since its introduction in July 2015, Windows 10 has been well-received by consumers, partly because of the free upgrade and partly because it's a great OS for end users. These days, Windows 10 is also finally gaining traction with businesses. A Spiceworks survey of IT executives indicates that 73 percent expect to deploy the software by 2017. Let's take a look at the pros and cons involved in making that upgrade.

Why upgrade?
The unified experience is here to stay, offering a "one app platform, one security model, and one management approach" that should resonate with IT managers who must mind the budget and allocate staff time resourcefully. Microsoft has said that Windows 10 is its best and final full OS release. Going forward, the company will focus on its Windows as a Service (WaaS) model, in which updates and incremental upgrades will be rolled out as they are needed. WaaS should help organizations remain current on "upgrades," making for a more secure environment along with a less costly and time-consuming update-handling process.

Microsoft points to several good reasons to upgrade to Windows 10, such as the addition of new features and functionality, a more responsive system, easy provisioning and less overall burden on IT staff. In our opinion, a few key factors worth upgrading for include the following:

• More control over deployments: Windows Update for Business provides feature upgrades and servicing updates from the cloud, which can target groups of endpoints for staggered and more controlled upgrade deployments. Essentially, IT staff can specify which groups of devices get updated and when such updates will occur. This is particularly important when mission-critical or line-of-business applications need to be tested in advance before deploying updates, so as not to "break" anything when updates are applied.
• In-place upgrades: Microsoft has removed most of the complexity and effort involving in upgrading from Windows 7 or 8/8.1. Performing an in-place upgrade is easy and, for the most part, seamless. In our experience, in-place upgrades have taken about 30 minutes on average, with little to no user input needed during the process (and where automated answer files can easily handle such input for hands-off implementations). Clean installs are rarely necessary, and this applies to any device being upgraded, not just desktops and laptops.
• Component independence: The OS treats system components as independent parts, which means they can be updated separately from the Windows core operating system. Likewise, Windows 10 provides excellent device handling, andWindows 10 is usually on-target in the drivers that it installs by default (and where issues may manifest, images can be customized easily to include such drivers for automated installations).
• Security: The new OS includes trusted boot, which prevents malware from springing up before the boot process is complete. With UEFI Secure Boot, trusted boot allows only trusted software to run during start-up. And multi-factor authentication, which includes PINs, biometrics, a trusted PC and more, is highly streamlined and enables users to sign on to devices easily and with lightning speed.

Furthermore, Mobile Device Management (MDM) is also available across Windows 10 devices and supports laptops, tablets, smartphones and Internet of Things (IoT) devices. Enterprises can use Windows 10 IoT lockdown capabilities to prevent access to unauthorized USB devices, for example, and allow only trusted apps to run on devices.

Upgrade concerns
All of the rah-rah aside, there are indeed some downsides to upgrading, but they apply to nearly any major upgrade and not just Windows 10. For starters, an organization-wide OS upgrade is a major undertaking that requires thorough planning and testing before any production machine is affected. Legacy equipment and OSes generally cause the most issues, especially where automated deployments are concerned. Old hardware and supporting equipment may need to be upgraded or replaced outright. All of that takes time and money.

Organizations must also consider licensing costs, which can be substantial. Consumers and small businesses can upgrade from qualified OSes for free (at least for a while), but large organizations and enterprises must purchase enterprise licenses and software assurance contracts. One bright light for enterprise managers is that customers can license Windows on a per-user basis with a primary device running Windows Pro or other qualified OS. This eliminates the need to keep track of every device from the perspective of licensing.

Consider that an upgrade from Windows XP to Windows 7 costs an average of about $1,000. Although upgrading to Windows 10 should come in well under that figure, even $500 per user (as an example) in a large environment still produces an eye-popping number.

Apple Can Still Read Your End-to-End Encrypted iMessages

If you are backing up your data using iCloud Backup, then you need you watch your steps NOW!

In government fight against encryption, Apple has positioned itself as a staunch defender of its user privacy by refusing the federal officials to provide encryption backdoors into its products.

When it comes to Apple's iMessage service, the company claims that it can't read messages sent between its devices because they use end-to-end encryption, which apparently means that only you and the intended recipient can read it.

Moreover, in case, if the federal authorities ask Apple to hand over messages related to any of its users, there is nothing with Apple to offer them.


"If the government laid a subpoena to get iMessages, we can't provide it," Apple CEO Tim Cook told Charlie Rose back in 2014. "It is encrypted, and we do not have a key."

But Wait!

There are still hundreds of Millions of Apple users whose data are stored on Apple's servers in plain text even after Apple's end-to-end encryption practice.

Apple Stores Your Backup in Encrypted Form, But with its Own Key

It turns out that Apple forgets to offer its so-called privacy benefits to users with iCloud Backup enabled.

If you have enabled iCloud Backup on your Apple devices, the copies of all your messages, photographs and every important data stored on your device, are encrypted on iCloud using a key controlled by the company, and not you.

This allows Apple, and hence anyone who breaks into your account, to see your personal and confidential data.

In past, we have seen incidents like The Fappening in which hackers broke into Apple's iCloud accounts to steal nude selfies of over hundred famous celebrities and thus circulated them on the Internet.

Apple allows you to switch off iCloud Backup whenever you want, but it doesn't offer a way to locally encrypt iCloud backups that would allow the company to store your personal data, including iMessage and SMS messages, on its servers but not access it.

Give the Encryption Keys in Hands of Users
Yes, it is possible to do encrypted non-cloud backups locally through iTunes, though it isn't always a so obvious choice to average users.

No doubt, Apple provides end-to-end encryption for your messages that even Apple can not access or read it, but only if you avoid the backup feature that it encourages its customers to use every time.

In fact, the company asks users to set up an iCloud account as soon as they activate their new iPhone or iPad.

However, Apple doesn't clearly states that by doing so, users otherwise 'unreadable' iMessages and other personal data become very much readable to the company as well as to anyone – whether it's law enforcement agents with a court order or hackers with access to your account.

Although it's difficult to say how many Apple users are affected, the most recent estimation from Asymco indicates there were around 500 Million iCloud users in March of 2014.

However, the exact number of users actually using iCloud Backups isn't clear yet.

Motherboard reached out to the company, but neither Apple told the estimated percentage of people using iCloud backup, nor it gave a reason for not giving users the option to store cloud backups that are encrypted locally.

One reason could be:  By allowing such backups, Apple doesn't want that its users who forget the passcode could not decrypt their data.

How to Turn Off iCloud Backup on the iPhone
We know, there is a war against the federal authorities and Apple over encryption. The law enforcement agencies are not at all happy with Apple using stronger encryption in its devices that makes it impossible for them to collar criminals.

In this situation, if Apple ignores such critical loopholes in its products, it would be possible for the federal officials to force the company to hand over its users data citing law orders.

For many users, the encryption offered by Apple is more than enough. However, if you do not want the company to access your data, the only solution is:

• Backup your personal data locally through Apple's iTunes.
• Turn off iCloud Backup. Go to Settings → iCloud → Storage & Backup → iCloud Backup.
• Now, tap the OK button to confirm that your iPhone will no longer be backing up your data automatically to your iCloud storage.

New year, new job – but beware of fake offers looking to scam you

January is traditionally a month of change for most people, be it starting new fitness and diet regimes, promising to travel more, vowing to make better use of their time, or even just giving their house a good clear out. For others, however, the beginning of a new year is a time of dramatic change, with many taking to the internet in search of a new job.

A recent survey carried out in the UK by employment website Indeed found that over 30% of employees were actively looking for new employment as part of their new year goals, while a further 11% of respondents said that finding new work was definitely on their list for 2016. Considering the increase in people scrambling for new career opportunities at this time of the year, it isn’t surprising that some criminals have seen this as a chance to take advantage of unsuspecting victims.

False offers that demand payments
One such example of a false job offer discovered in the United States required the candidate, who having successfully passed the first phase of the selection process, to log onto Yahoo Messenger for another interview. It was during this stage that she was told that to be contracted for the role she would need a number of software programs, but that the company would provide them for her if she passed them on her bank account information.

After becoming suspicious at this point, the potential candidate did some investigating online and discovered that, despite the company existing, scammers were using its name to pull off cybercrimes and that the job offer was in fact bogus.

Another such scam was spotted on Facebook, with cybercriminals yet again using the name of a reputed company to post false job offers. The process was similar to the previous one, with supposed employer requesting that applicants send payment as part of their application.

How to spot bogus job offers
If you are applying for a job offer online, here are a few quick tips to help you spot an offer that might just be too good to be true:

• Never part with your money! No matter how good the job offer is, nobody should have to give money to a potential employee when being offered a job.
• Don’t give out bank information during interviews. There is no need for a potential employee to have access to this information for an interview.
• Try to online use reputed job listing websites. If you are in doubt, double check on the company’s website to see if it is listed there. Many of these scams use the names of legitimate companies to trick people.
• Be cautious with potential new contacts on LinkedIn, as there has been an increase in fake profiles looking to steal user information.
• There is only a cellphone supplied for enquiries as opposed to a direct landline.
• The company is using a free email service for correspondence such as Gmail or Yahoo. Legitimate job related emails should come from corporate accounts.
• If you are offered a job just on the basis of your CV, be suspicious. Most recruitment processes have a number of stages and an interview is definitely one of them.
• Be wary of offers for jobs that you never applied for.
• Finally, be aware of job offers that are too good to be true. If they’re offering you the chance to work from home and earn a huge salary, then it’s more than likely a scam.

By keeping your wits about you when looking for a jobs online, and following the tips above, you can avoid being a victim of identity theft and fraud. Remember, if it looks too good to be true, then it likely is!

Hacker-Friendly Search Engine that Lists Every Internet-Connected Device

Meet an all-new Hacker’s Search Engine similar to Shodan – Censys.

At the end of last month, security researchers from SEC Consult found that the lazy manufacturers of home routers and Internet of Things (IoT) devices have been re-using the same set of hard-coded cryptographic keys, leaving around 3 millions of IoT devices open to mass hijacking.

But how did the researchers get this number?
Researchers uncovered these devices with the help of Censys – a new search engine that daily scans the whole Internet for all the vulnerable devices.

Censys Maintains Complete Database of Everything on The Internet
Censys is similar to hacker's search engine Shodan, which is designed specifically to locate any devices that have been carelessly plugged into the Internet without much attempt at preventing unauthorized access.

However, Censys employs a more advanced method to find vulnerabilities in the devices and make the Internet a safer place.

Censys is a free search engine that was originally released in October by researchers from the University of Michigan and is powered by the world's biggest search engine Google.

Censys is part of an open source project that aims at maintaining a "complete database of everything on the Internet," helping researchers and companies unearth Online security mishaps and vulnerabilities in products and services.

How Does Censys Work?
Censys collects information on hosts and websites via daily scans of the IPv4 address space – the internet protocol version 4 that routes the majority of the Internet traffic today.

In order to do so, the new search engine uses two companion tools:

• ZMap – an open-source network scanner
• ZGrab – an application layer scanner

Censys then maintains a database of how hosts and websites are configured, allowing researchers to query the data through a search interface, report builder, and SQL engine.

ZMap scans over 4 Billion IP addresses on the Internet and collects new data every day. It also helps determine whether the machines on the internet have security vulnerabilities that should be fixed before being exploited by the hackers.

"We have found everything from ATMs and bank safes to industrial control systems for power plants. It's kind of scary," said Zakir Durumeric, the researcher leading the Censys project at the University of Michigan.

Obvious flaws in addition to issues caused by IT administrator failures can also be found.

Here's the MIT Technology Review on Censys, titled "A Search Engine for the Internet’s Dirty Secrets."

More details on the Censys architecture and functionalities are available in the team's research paper.

If you would like to give Censys a try, you can follow the step-by-step tutorial offered by the developers.

Rise in cybercrime among top drivers of investment in forensic data analytics

Cyber breaches and insider threats, which include malicious insiders stealing, manipulating or destroying data, are the fastest-growing risks according to executives and are driving investment in forensic data analytics, according to a new survey.

EY’s 2016 Global Forensic Data Analytics Survey, "Shifting into High Gear: Mitigating Risks and Demonstrating Returns," found that internal fraud risk ranks highest for the application of FDA at 77% and cyber breach or insider threat risk ranks second at 70%.

Sixty-nine percent say that they need to do more to improve their current anti-fraud procedures, including the use of FDA tools. Notably, this figure increased to 74% for the C-suite cohort.

Of those respondents citing regulatory pressure as the reason to improve their procedures, C-suite respondents were found to be the most concerned as regulatory enforcement becomes more rigorous and widespread.

“For organizations, the threat of cybercrime is an everyday reality, posing a dynamic and relentless challenge," says David Stulb, EY’s Global Leader of Fraud Investigation & Dispute Services (FIDS).

"This means that boards and senior management need to incorporate FDA as a critical component of their risk management and compliance programs. This is especially critical given the current regulatory enforcement environment and market reaction to instances of alleged corporate fraud, bribery and cyber breach.”

Increased FDA investment
With just 55% of respondents saying that their FDA spend is sufficient, a drop from 64% in our  2014 survey, it is no surprise that three out of five say that they plan to spend more on FDA in the next two years. When looking at the reasons for increased investment, the survey found that responding to growing cybercrime risks and increased regulatory scrutiny are the top drivers at 53% and 43%, respectively.

How FDA tools are deployed is also changing, with 63% of respondents saying they invest at least half of their FDA budget on proactive monitoring activities.

FDA use on the rise
In response to these increased risks, the use of advanced FDA is becoming mainstream, with new technologies and surveillance monitoring techniques widely used to help companies manage current and emerging fraud and cyber risks.

The rising maturity of corporate FDA efforts is also evident through the growing sophistication in their use of data. Seventy-five percent of respondents routinely analyze a wide range of structured and unstructured data, enabling them to gain a comprehensive view of their risk environment.

David Remnitz, EY’s FIDS Global and Americas Forensic Technology & Discovery Services (FTDS) Leader, remarks: “Given the level of pressure organizations are facing on fraud prevention, it is no surprise that the majority of respondents are expending more effort on proactive initiatives.

"Today, FDA is becoming indispensable to proactive risk management. Organizations need to recognize the role FDA can play not only in their reactive investigations, but also in their proactive surveillance, compliance, anti-fraud and cyber breach response efforts.”