News

Kaspersky lawsuits over government ban, dismissed

Last year, the US government made moves to ban the use of Kaspersky security software in federal agencies, claiming the company’s ties to the Russian government represented a security risk. In September, the Department of Homeland Security issued an order that required federal departments and agencies to remove the company’s software from their systems. Then, Congress passed and President Trump approved a bill — the National Defense Authorization Act (NDAA) — that also banned Kaspersky software from federal government use. Kaspersky subsequently filed two lawsuits combatting both bans, but a judge has now dismissed them.

CyberScoop reports that Colleen Kollar-Kotelly, US District Judge for the District of Columbia, rejected Kaspersky’s claims that the bans were unconstitutional. Kaspersky argued that the NDAA inflicted an unconstitutional “punishment,” but Judge Kollar-Kotelly disagreed. She said the act wasn’t a punishment but instead, “eliminates a perceived risk to the nation’s cybersecurity and, in so doing, has the secondary effect of foreclosing one small source of revenue for a large multinational corporation.”

Further, because she dismissed the lawsuit against the NDAA, the suit against the Department of Homeland Security’s order was rendered moot since the act would supersede any change to the order. “These defensive actions may very well have adverse consequences for some third-parties,” she said in her opinion. “But that does not make them unconstitutional.”

The NDAA’s Kaspersky ban goes into effect on October 1st.

This article originally appeared on Engadget.

VMware vCenter 6.7a and other released

VMware has released vCenter 6.7a, vSphere Replication 8.1.0.2, vSphere Integrated Containers 1.4, and PowerCLI 10.1.

Download link

CVE-2018-0886 – CredSSP Remote Code Execution Vulnerability

Description

A remote code execution vulnerability exists in the Credential Security Support Provider protocol (CredSSP). An attacker who successfully exploited this vulnerability could relay user credentials and use them to execute code on the target system. CredSSP is an authentication provider which processes authentication requests for other applications; any application which depends on CredSSP for authentication may be vulnerable to this type of attack. As an example of how an attacker could exploit this vulnerability against Remote Desktop Protocol, the attacker would need to run a specially crafted application and perform a man-in-the-middle attack against a Remote Desktop Protocol session. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting how Credential Security Support Provider protocol (CredSSP) validates requests during the authentication process.

The vulnerability impacts Windows 7, Windows 8.1, and Windows 10 systems, as well as Windows Server 2008, Windows Server 2012, and Windows Server 2016.

Download patches here

To address the issue, Microsoft released an update to correct the manner in which CredSSP validates requests during the authentication process. The update patches the CredSSP authentication protocol and the Remote Desktop clients for all affected platforms.

“Mitigation consists of installing the update on all client and server operating systems and then using included Group Policy settings or registry-based equivalents to manage the setting options on the client and server computers. We recommend that administrators apply the policy and set it to “Force updated clients” or “Mitigated” on client and server computers as soon as possible,” Microsoft says.

I have noticed that this patch has been disruptive to system owners who use remote desktop to access and manage servers.  Installing the patch on a client host w/o having it installed on the remote endpoint will end in an error preventing you from accessing them.

 

Its best to upgrade endpoints (servers) before client systems

Ref: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-0886

 

Happy #NationalPasswordDay!

Today is NationalPasswordDay 2018 – May 3, 2018

The following is a list of good practices designed to keep individuals and their data safe online.

Email Security

  • Avoid opening emails, downloading attachments, or clicking on suspicious links sent from unknown or untrusted sources.
  • Verify unexpected attachments or links from known senders by contacting them via another method of communication.
  • Avoid providing your email address, phone number, or other personal information to unknown sources.
  • Avoid providing sensitive information to anyone via email. If you must, be sure to encrypt it before sending.
  • Be skeptical of emails written with a sense of urgency and requesting an immediate response, such as those stating your account will be closed if you do not click on an embedded link or provide the sender with sensitive information.
  • Beware of emails with poor design, grammar, or spelling.
  • Ensure an email’s “sender name” corresponds to the correct email address to identify common email spoofing tactics.
  • Never open spam emails; report them as spam, and/or delete them. Do not respond to spam emails or use included “Unsubscribe” links as this only confirms to the spammer that your email address is active and may exacerbate the problem

Passwords and Multi-Factor Authentication

Use strong passwords on all of your accounts.

  • Long, complex passwords make you less susceptible to brute-force attacks.
  • Use a combination of upper and lowercase letters, numbers, and special characters.
  • Avoid easy-to-guess elements like pets’ names, children’s names, birthdays, etc.

To reduce the risk of account compromise, account holders should:

  • Avoid using the same password across multiple accounts or platforms.
  • Never share their password with anyone, leave passwords out in the open for others to read, or store them in an unsecured, plaintext file on computers or mobile devices.
  • Consider using long acronyms or passphrases to increase the length of your password.
  • Enable two-factor authentication (2FA) or multi-factor authentication (MFA) on all accounts that offer it. This will help prevent unauthorized access in the event of a credential compromise.

On the Web

  • Ensure any websites requesting the insertion of account credentials and those used to conduct transactions online are encrypted with a valid digital certificate to ensure your data is secure. These website addresses will have a green padlock displayed in the URL field and will begin with https.
  • Avoid saving account information, such as passwords or credit card information, in web browsers or browser extensions.
  • Avoid using public computers and public Wi-Fi connections to log into accounts and access sensitive information.
  • Consider using ad-blocking, script-blocking, and coin-blocking browser extensions, to protect systems against malicious advertising attacks and scripts designed to launch malware or mine cryptocurrency. Example: PiHole
  • Sign out of accounts and shut down computers and mobile devices when not in use. Program systems and devices to automatically lock the active session after a set period of inactivity.

Device Security

  • Keep all hardware and software updated with the latest, patched version.
  • Run reputable antivirus or anti-malware applications on all devices and keep them updated with the latest version.
  • Create multiple, redundant backups of all critical and sensitive data and keep them stored off the network in the event of a ransomware infection or other destructive malware incident. This will allow you to recover lost files if needed.

For more info:  https://www.consumer.ftc.gov/blog/2018/03/its-national-password-day

 

vSphere Integrated Containers

vSphere Integrated Containers provides critical enterprise container infrastructure to help IT Operating teams run both traditional and containerized applications providing a number of benefits:

  • security
  • isolation
  • management
  • speed
  • agility

I am looking forward to getting my hands on this and expanding my knowledge on how vSphere Integrated Containers (VIC) works in the real world. vSphere Integrated Containers includes the following three major components:

  • vSphere Integrated Container EngineDocker Remote API-compatible engine deeply integrated into vSphere for instantiating container images that are run as VMs
  • Container Management PortalPortal for apps teams to manage the container repositories, images, hosts, and running container instances
  • Container RegistrySecurely stores container images with built-in RBAC and image replication.

For now its research time; later I get to have some hands-on fun. Here are some interesting links: