THE DATA ECONOMY has too often betrayed its customers, whether it’s Facebook sharing data you didn’t even realize it had, or invisible trackers that follow you around the webwithout your knowledge. But a new app launching in the iOS App Store today wants to help you take back some control—without making your life harder.
The Guardian Firewall app runs in the background of an iOS device, and stymies data and location trackers while compiling a list of all the times your apps attempt to deploy them. It does so without breaking functionality in your apps or making them unusable. Plus, the blow by blow list gives you much deeper insight than you would normally have into what your phone is doing behind the scenes. Guardian Firewall also takes pains to avoid becoming another cog in the data machine itself. You don’t need to make an account to run the firewall, and the app is architected to box its developers out of user data completely.
“We don’t log IPs, because that’s toxic,” says Will Strafach, a long-time iOS jailbreaker and founder of Sudo Security Group, which develops Guardian Firewall. “To us, data is a liability, not an asset. But to think that way you’ve got to think outside the box, because it means you can’t just choose the simplest solutions to engineering problems a lot of times. But if you are willing to spend the time and resources, you can find solutions where there isn’t a privacy downside.”
The Guardian Firewall development team, which also includes noted jailbreaker Joshua Hill, currently comprises four engineers and two security researchers, and the app translates their collective knowledge about App Store services into automatic blocking for modules within apps that are known to be potentially invasive. The service costs $10 per month, or $100 per year. You pay through an in-app purchase using your AppleID, which means Guardian Firewall doesn’t manage the transaction or the data associated with it. The team doesn’t have immediate plans to expand to Android, because their expertise lies so specifically in iOS.
LILY HAY NEWMAN COVERS INFORMATION SECURITY, DIGITAL PRIVACY, AND HACKING FOR WIRED.
To start using Guardian Firewall, all you do is tap a big button on the main screen. It turns green and says “Protection is on.” From the user’s perspective, that’s it. Under the hood, the app establishes a virtual private network connection, and creates a random connection identity for it to keep track of people’s data without knowing who they are. If you turn Guardian Firewall protection off and then on again, the app establishes a new connection and new connection identity, meaning that there’s no way to connect the dots between your sessions.
The app uses its VPN connection to filter your data in the cloud, but the stream is fully encrypted. Guardian Firewall has automated machine learning mechanisms that evaluate how an app behaves and, particularly, whether it sends out data to third parties, like marketing analytics firms. The idea is to flag whenever an app tries to communicate beyond its own infrastructure. Guardian Firewall is also able to detect and block other types of potentially invasive behavior, like page hijackers that push mobile pop-ups.
Apple itself has already been working on baking similar protections directly into iOS, particularly when it comes to blocking web trackers in Safari that would otherwise fingerprint users across multiple sites. But Guardian Firewall aims to go a few steps further, and to apply across all apps.
I’ve been testing Guardian Firewall on and off for months, and have found it easy to leave it running in the background. The connection doesn’t seem to slow things down on my phone or eat my battery, and the list of trackers the app has blocked is constantly growing—310 location trackers, seven page hijackers, and 3,200 data trackers so far. It felt a little uncomfortable at first to have something constantly running in the background, but it was fascinating to see all the shenanigans happening on my iPhone all the time. Some beta testers have noted that they wish Guardian Firewall offered a customizable blacklisting feature, instead of only automated blocking. But I didn’t personally feel a desire to put time into customizing the app. To me the whole value is in “set it and forget it.”
“‘How can we trust you?’ is just such a valid question for users to be asking all app makers.”
WILL STRAFACH, SUDO SECURITY GROUP
Guardian Firewall has already engineered its way around at least one privacy conundrum during its limited prerelease. Someone essentially launched a denial of service attack against the service by rapidly initiating a deluge of connection requests all at once. Guardian Firewall couldn’t check what IP address or addresses the requests came from, though, because it doesn’t record IP addresses. The team could have solved the issue by altering its policy to access IP addresses during the small window when devices are establishing their connection and then delete the data. But “we determined that that would go against our values,” Strafach says.
Instead, the developers devised a workaround that uses a device check offered by Apple, but encrypts the check so Guardian Firewall itself can’t see the data that’s sent to Apple. The only thing Guardian Firewall finds out at the end of the process is whether the device is a legitimate iOS device or not.
As with any VPN, the ultimate test of Guardian Firewall’s privacy protections and approach to minimal data retention would be a subpoena that is later made public through a trial in which the service has nothing to hand over. And Strafach says that while the company will cooperate with investigators if necessary as required by law, the company has taken precautions both internally and in contracts with its infrastructure providers to ensure that it can be transparent with users about any law enforcement requests.
Not Just Another VPN
Of course, many of the same questions about trust apply to Guardian Firewall as they do to other VPNs. You’re still sending all of your data to their server. But at least Guardian Firewall uses the built-in iOS VPN application programming interface instead of trying to reinvent the wheel, and the encryption scheme protecting your data similarly draws on vetted industry standards, rather than anything proprietary. Strafach also says Guardian Firewall’s goal is to be as open and transparent about its actions as possible—and agrees that people should think carefully about whether it suits their specific needs, as they should for any app.
“People should know exactly what Guardian is doing and if it’s just a concept they don’t like, or they think we’re not the right data custodians for them then so be it, that’s cool,” he says. “‘How can we trust you?’ is just such a valid question for users to be asking all app makers.”
One thing Guardian Firewall can’t currently do is identify what specific apps trigger its tracking alerts, a feature that I found myself wishing it had. If anything, though, the absence helps solidify its privacy cred. Strafach and his team hadn’t figured out how to achieve that granularity without inadvertently creating a potentially identifiable data set of all the apps on your phone. An upcoming solution still won’t directly connect warnings to specific apps, but will instead show the apps that were running at that timestamp that could have cased the alert.
“All you’ll be able to see is ‘at this time we saw this tracker and these are the apps which could be causing it,'” Strafach says. “So maybe that’s one app or maybe three, but it’s a compromise that gives more of the answer users want while it respects their privacy.”
“Clearly the biggest risk to the everyday iOS user is apps surreptitiously tracking them, which unfortunately the majority of apps do—rather massively,” says Patrick Wardle, a Mac security specialist. “Guardian generically thwarts such trackers. I love that Will and Josh, who are former jailbreakers, tackled this. I bet it wasn’t easy, but with their unique skills they are probably one of the few teams that could figure it out and make it all seamlessly work in the constrictive iOS environment.”
It’s complicated and resource-intensive to make all of these wild workarounds happen, but if Guardian Firewall can do it and be financially viable, Strafach hopes that the project will become a sort of case study that privacy pays. With so many companies in the marketplace seemingly convinced that that’s not the case, there’s a lot riding on its success.
2 Companies Ready For a Huge Cybersecurity Opportunity
It was always there. But it would be naive to say the COVID-19 pandemic hasn’t accelerated the cybersecurity market’s growth pace. With millions of employees still — and perhaps permanently — working from home, many enterprises remain far too vulnerable to hacking and digital security breaches.
The depth of the need for cybersecurity solutions, however, may still not be fully appreciated by investors. That in turn means that cybersecurity providers Palo Alto Networks (NYSE:PANW) and Fortinet (NASDAQ:FTNT) may remain underestimated. Not only are they two of the top names in the business, but each has a security solution available right now for employees connecting to a company’s network from home.
A couple of recent predictions flesh out this opportunity.
Just the beginning
The cybersecurity market is currently worth around $200 billion, according to numbers from Mordor Intelligence, but it’s on pace to grow a bit more than 14% per year through 2025. That’s impressive, particularly compared to other industries’ growth outlooks.
But it’s an estimate that still fails to adequately paint a complete picture of what the right company could do given the opportunity at hand. Even with power players like the aforementioned Fortinet and Palo Alto in place, Mordor says the market remains highly fragmented. Both companies could continue to make acquisitions, achieving economies of scale as they expand.
Even without dealmaking, though, the industry’s rising tide will lift these boats.
Technology market research firm Gartner supplies one of the clearest reasons to expect that tide to keep rising. Last month it opined that “bring your own PC,” or BYOPC, security will be normalized in five years or less. And within 10 years, secure access service edge, or SASE, will be the norm for enterprise-level organizations.
The terms and their acronyms may not mean much to the layperson, but cybersecurity folk may be nodding their heads in agreement. Bringing-your-own-PC security is exactly what it sounds like. Rather than a tech department issuing devices to workers with security features pre-installed, employees procure their own devices and then — hopefully — take all the necessary steps to ensure cloud-based connections are secure. A secure access service edge is a newer digital security theme that creates a networking environment that allows for, among other things, BYOPC.
In some regards, they’re the next step in the natural evolution of connectivity. Gartner may not be overstating things, however, when it suggests the two technologies “will have transformational impact on global businesses within the next 10 years.” In a post-COVID world, Gartner research director Rob Smith explains, “[Cyber] security leaders should expect the need to support BYOPC to be dependent upon a long-term work-from-home strategy, and also expect to support security tools needed for a BYOPC environment.”
In the same vein, technology market analytics outfit International Data Corp. (IDC) recently predicted that by 2024, 60% of the United States’ employees will work remotely — either at home or out in the field with customers and at project sites. That would push the total number of remote workers to more than 93 million, and subsequently expand the likelihood of cyberattacks.
The cybersecurity industry isn’t starting from scratch, however. Both Palo Alto and Fortinet had remote connectivity protection available even before the pandemic took hold.
For Palo Alto Networks, one of those products is Prisma Access, which is a secure access service edge — or SASE — offering that Gartner suggests will become commonplace by 2030. It’s built specifically for mobile users and branch offices that need reliable, safe access to a corporate network. Palo Alto also offers cloud-based SD-WAN, or software-defined wide-area networking, with the help of recently acquired CloudGenix. It’s a testament to the potential of the right sort of dealmaking that allows for bolt-on improvements of the company’s existing capabilities.
As for Fortinet, it’s got a few tools in its mobile cybersecurity toolbox as well, like the FortiGate platform. Among other things, it’s a way of putting a firewall in place, managing virtual private networks that encrypt communications from devices all the way to a company’s servers, and implementing an intrusion prevention system. FortiGate customers also automatically have access to an SD-WAN solution for remote offices or remote employees, and the platform was a key part of last quarter’s growth.
These offerings aren’t exactly brand new, and more are apt to be on the way. What’s new is the sudden, true realization of the need for them. As Gartner’s Rob Smith noted: “Prior to the COVID-19 pandemic, there was little interest in BYOPC. At the start of the pandemic, organizations simply had no other alternative. The urgent need to enable employees to work from home and a lack of available hardware bolstered its adoption globally.” International Data Corp.’s senior research analyst Bryan Bassett expects that adoption has only begun, saying: “To meet the needs of more mobile, remote, and work-from-home workers, U.S. enterprises have indicated that mobile security and mobile management solutions will be top spending priorities going forward.”
While the bullish outlook for these companies is strong, would-be investors in either should note that the predictions from IDC and Gartner are long-term in nature. Gartner’s SASE adoption expectation could take up to 10 years to play out fully. International Data Corp.’s mobile worker outlook looks to the end of 2024. Investors not thinking in multi-year terms may find this opportunity isn’t for them.
Still, the opportunity is real for those willing to wait for it to fully gel. It’s long-term enough, in fact, that investors interested in plugging into it don’t necessarily have to do so today, this month, or even this year.
Emotet Botnet: A Primer for Cybersecurity and IT Pros
With all that’s going on with COVID-19, work-from-home and economic contraction in the U.S. and globally, it’s easy for cybersecurity experts and other technologists to have missed that one of the most destructive malware strains made a surprise return in late July.
Emotet, a botnet with global reach, resurfaced on July 21 after a nearly five-month absence, according to multiple security firms, including Proofpoint and Malwarebytes. Since that time, researchers have recorded at least 800,000 spam messages associated with the malware in countries all over the world, including in the U.S., U.K., Canada, Austria, Germany, Brazil, Italy and Spain.
Waves of malware tend to come and go, but Emotet has developed a unique reputation over the years as it matured from banking Trojan to full-blown menace. When the U.S. Cybersecurity Infrastructure and Security Agency issued a warning about the botnet in January, the agency’s analysts warned about its destructive potential.
“Emotet continues to be among the most costly and destructive malware affecting [State, Local, Tribal, and Territorial] governments. Its worm-like features result in rapidly spreading network-wide infections, which are difficult to combat. Emotet infections have cost SLTT governments up to $1 million per incident to remediate,” stated the public CISA alert.
With the current Emotet campaign underway, analysts and experts warn that security and IT teams should be on the lookout for the malware and the possible destructive effects it could have on an enterprise. The campaign is also using the COVID-19 pandemic as a lure to get the unsuspecting to click on phishing emails that help power its spread.
“The campaigns usually include various payloads that have evolved over the years, primarily focused on stealing banking information or funds. Since the return of Emotet this summer, we’ve seen it using COVID-19 themes in the social engineering lures, as well as sending to recipients in a wide variety of countries,” Sherrod DeGrippo, senior director of threat research and detection at Proofpoint and well-known expert on Emotet, told Dice.
“The threat group behind Emotet is one that uses timely lures in campaigns that are truly massive in scale. In some Emotet campaigns we’ve seen over a million messages over the course of a few days,” DeGrippo added.
Emotet: A History
Emotet started life as a banking Trojan in 2014 that mainly stole financial and personal data. Over the next few years, however, the malware evolved into more of a botnet with the ability to infect multiple devices and expand its malicious network. Due to its modular nature, its creators have added new features as time went on, and it continues to evolve to this day.
In addition to the botnet, Emotet also has the ability to act as a dropper (or downloader) that can help plant other malware within a compromised device. In 2019, security experts found a triple threat: Emotet delivering another malware called TrickBot to infected endpoints, which would then download a ransomware variant called Ryuk.
These and other features are one of several reasons why warning bells ring whenever Emotet re-emerges. “Emotet is one of the most prolific malware families of the past five years. It has evolved from being specifically a banking Trojan into malware-as-a-service (MAS) with a distributed botnet infrastructure,” Jared Greenhill, director at Crypsis Group, an incident response and risk management firm, told Dice.
In the latest Emotet campaign that started in July, researchers have found that attacks start with a large-scale spam campaign that delivers phishing emails to as many victims as possible. The messages contain either a malicious attachment, a URL in the email body, or an attachment with a link. These attachments and links then deliver the initial malware infection, DeGrippo said.
If the link or attachment is opened, malicious macros are enabled that launch a PowerShell script that eventually installs Emotet within a compromised device. From there, Emotet can then download other malware. In the latest campaign, DeGrippo and others have found that it attempts to install Qbot—a banking Trojan that is known to infect financial institutions and their customers.
In some cases, the Emotet-laced message appears as part of an existing email chain, making it more likely that someone will click on the malicious link or attachments. These types of built-in social engineering techniques are a key reason why Greenhill recommends additional security training for employees to help spot this type of malware lurking in seemingly legitimate messages.
“One of the reasons Emotet is so effective is, like other types of threats, it begins with phishing tactics, and recent approaches have used brand names the recipient would be familiar with or subjects that have urgency, such as past-due notifications,” Greenhill said. “As we often see, much of the success of this malware begins with users making an error—opening a malicious attachment. A very important remedy to this is rigorous end-user training on spotting malicious emails, attachments, links, and senders, even if the sender appears legitimate.”
While Emotet is more destructive than most other malware, it’s not impossible to fight back and protect people and data alike.
“People can best protect themselves against Emotet by implementing a strong antimalware program within their secure email gateway, in conjunction with user education that reinforces the risks posed by links and attachments,” DeGrippo said.
In its alert, CISA offers several ways to counter Emotet as well as other malware. These include:
Block: Organizations should block email attachments associated with malware, such as .dll and .exe files, as well as attachments that cannot be scanned by antivirus software, such as .zip files.
Implement: Organizations should implement programs such as antivirus programs and formal patch management processes. CISA also recommends implementing a Domain-Based Message Authentication, Reporting & Conformance (DMARC) validation system to cut down on spoofed emails.
Segment: Organizations should segment networks and functions to keep attacks from spreading across the network.
Limit: Finally, organizations should work to limit lateral movement throughout their network, which can reduce Emotet’s ability to move from device-to-device.
Others have found their own ways to fight back against Emotet. In August, James Quinn, an analyst with security firm Binary Defense, published a blog post that details how he found a “kill switch” in Emotet that helped reduce attacks earlier this year. That’s one of the reasons the botnet disappeared from the scene between February and late July.
Malware gang uses .NET library to generate Excel docs that bypass security checks
A newly discovered malware gang is using a clever trick to create malicious Excel files that have low detection rates and a higher chance of evading security systems.
Discovered by security researchers from NVISO Labs, this malware gang — which they named Epic Manchego — has been active since June, targeting companies all over the world with phishing emails that carry a malicious Excel document.
But NVISO said these weren’t your standard Excel spreadsheets. The malicious Excel files were bypassing security scanners and had low detection rates.
Malicious Excel files were compiled with EPPlus
According to NVISO, this was because the documents weren’t compiled in the standard Microsoft Office software, but with a .NET library called EPPlus.
Developers typically use this library part of their applications to add “Export as Excel” or “Save as spreadsheet” functions. The library can be used to generate files in a wide variety of spreadsheet formats, and even supports Excel 2019.
NVISO says the Epic Manchego gang appears to have used EPPlus to generate spreadsheet files in the Office Open XML (OOXML) format.
The OOXML spreadsheet files generated by Epic Manchego lacked a section of compiled VBA code, specific to Excel documents compiled in Microsoft’s proprietary Office software.
Some antivirus products and email scanners specifically look for this portion of VBA code to search for possible signs of malicious Excel docs, which would explain why spreadsheets generated by the Epic Manchego gang had lower detection rates than other malicious Excel files.
This blob of compiled VBA code is usually where an attacker’s malicious code would be stored. However, this doesn’t mean the files were clean. NVISO says that the Epic Manchego simply stored their malicious code in a custom VBA code format, which was also password-protected to prevent security systems and researchers from analyzing its content.
But despite using a different method to generate their malicious Excel documents, the EPPlus-based spreadsheet files still worked like any other Excel document.
Active since June
The malicious documents (also called maldocs) still contained a malicious macro script. If users who opened the Excel files allowed the script to execute (by clicking the “Enable editing” button), the macros would download and install malware on the victim’s systems.
The final payloads were classic infostealer trojans like Azorult, AgentTesla, Formbook, Matiex, and njRat, which would dump passwords from the user’s browsers, emails, and FTP clients, and sent them to Epic Machengo’s servers.
While the decision to use EPPlus to generate their malicious Excel files might have had some benefits, in the beginning, it also ended up hurting Epic Manchego in the long run, as it allowed the NVISO team to very easily detect all their past operations by searching for odd-looking Excel documents.
In the end, NVISO said it discovered more than 200 malicious Excel files linked to Epic Manchego, with the first one dating back to June 22, this year.
NVISO says this group appears to be experimenting with this technique, and since the first attacks, they have increased both their activity and the sophistication of their attacks, suggesting this might see broader use in the future.
Nevertheless, NVISO researchers weren’t totally surprised that malware groups are now using EPPlus.
“We are familiar with this .NET library, as we have been using it since a couple of years to create malicious documents (“maldocs”) for our red team and penetration testers,” the company said.
Tech News3 hours ago
Apple Loop: Shock iPhone 12 Details, Massive iOS 14 Problems, Macbook Pro Delay
Research3 hours ago
Apple iPhone 12 Pro Max’s AnTuTu result shows minor performance gains
Internet2 days ago
Google Chrome prepares new tab groups feature that creates groups automatically
Systems3 hours ago
LG Wing takes aim at Galaxy Z Fold 2 – shakes up the new status quo
The Motivator3 hours ago
PS5 Game Install Sizes Revealed, And They’re Enormous
The Motivator3 hours ago
Editing HTML Like A Boss In VS Code