Large, distributed organizations rely on business applications to deliver valuable resources and services to users, and as a result, must ensure uptime to keep those business-critical applications running and users productive.
Recently, Fortinet worked with a global company contending with those challenges. Specifically, this customer was seeking to improve performance and management capabilities to ensure application availability and user productivity.
And Then There Was One
With 1500 branch offices and three datacenters spread geographically around the world, deploying new branches was key to the business’ growth plans, but proved time-consuming and often difficult to integrate into existing infrastructures. Previously, this organization’s branch offices included multiple legacy point products for network and for security, which made centralized management difficult and provided no visibility.
The incumbent solution was a combination of a traditional ISR router from a major networking vendor managing an MPLS connection and a separate firewall appliance from the same vendor. Adding SD-WAN would require the deployment of yet another device because neither the router nor the NGFW were able to provide SD-WAN services. Security would then need to be configured to run as an overlay solution on top of the SD-WAN appliance, significantly increasing capital and operating expenses, and the organization would still be forced to keep their MPLS links.
Fortinet was the only vendor the organization considered that offered all of these functions in a single, high performance appliance, with centralized management for both network and security policies through an integrated console. As a result of selecting the Fortinet Secure SD-WAN solution, the company was able to eliminate their disconnected and isolated networking and security point products and replace them with one unified appliance, thereby reducing complexity. Fortinet surpassed the global company’s expectations, starting from proof of concept, with zero touch deployment, centralized management, and the ability to auto-provision configuration and business policies globally from their HQ.
Improving Performance for Business-Critical Applications & Users
Because of Fortinet’s integrated approach and proven networking and security performance, both the CIO and CISO selected Fortinet Secure SD-WAN to enable faster cloud adoption and significantly improve user experience for its nearly 15,000 employees. Moreover, the company is now able to offer its users a significantly improved experience with more consistent connectivity and high-performance reliability by tapping into the LTE capabilities built into FortiGate appliances.
For example, sharing and collaboration is an important business priority and the organization heavily relies on cloud-based applications. As a result, this global organization needed its SD-WAN solution to offer single touch integration with specific cloud providers for faster application access and control. The Fortinet Secure SD-WAN solution natively supports major cloud providers to enhance application optimization by up to 5X, while reducing latency and producing a better user experience.
Key Benefits
The company experienced the following benefits of the Fortinet Secure SD-WAN solution:
Improved user experience performance: The performance of business-critical applications instantly improved by a factor of five.
Reduced Complexity: Replacing multiple point products with an integrated solution built around the benefits of Fortinet Secure SD-WAN reduced complexity while yielding a 60% cost savings.
Reduced WAN Cost: Augmented MPLS with broadband and LTE is saving up to 30% on contract renewal. Also, the complete removal of MPLS is on the roadmap.
Centralized Management: The Fortinet Secure SD-WAN solution’s zero touch deployment capabilities and network visibility have reduced troubleshooting cycles by 50%.
Take a security-driven approach to networking to improve user experience and simplify operations at the WAN edge with Fortinet’s Secure SD-WAN solution.
Read more about how FortiGate Secure SD-WAN helped Fortinet optimize network performance in this case study.
Read these customer case studies to see how De Heus and Burger King Brazil implemented Fortinet’s Secure SD-WAN to alleviate network complexity, increase bandwidth, and reduce security costs.
Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.
For the April edition of Patch Tuesday, Microsoft repaired a total of 110 security vulnerabilities across their product line. Included in this count are 37 remote code execution bugs, and 33 elevation of privilege bugs. The company rated eighteen of the vulnerabilities “Critical.”
This release’s most notable item is the follow-up to last month’s announcement, “Cybercriminals are exploiting two unpatched zero-day flaws affecting all supported versions of Windows“. At the time, the company advised a workaround for mitigating the risk. Today, the fix for the two vulnerabilities went live.
Here are the patch highlights:
Adobe Font Manager Library Remote Code Execution
CVE-2020-0938, CVE-2020-1020
Two font vulnerabilities are present in the handling of the old and obsolete Type 1 (PostScript) font standard that makes use of file extensions .PFB and .PFM.
If an attacker is able to manipulate an unpatched Windows system into handling and displaying a malicious Type 1 font file (crafted by the attacker), the bugs could be exploited to compromise the system.
On Windows versions prior to Windows 10, the code responsible for handling fonts is running in high-privileged kernel mode. This makes the impact much more severe on older editions, such as (the now unsupported) Windows 7, or Windows 8.1 – the bugs can be used to perform an elevation of privilege attack, in addition to remote code execution.
Thankfully, on Windows 10 systems the same code has been moved to be running in a low-privileged, sandboxed user mode process. This hardening measure limits the bugs’ usefulness for elevation of privilege attacks. However, they still expose the system to a remote code execution scenario.
Normally, an attacker can take advantage of a font vulnerability to achieve remote code execution by enticing a victim to open a web page or document that has the malicious font embedded in them.
In the case of web pages, the “CSS Web fonts” feature can be used for embedding. Office documents and PDF documents also have support for embedding fonts in them.
Fortunately, due to the Type 1 font standard falling from favor, and being replaced by the newer TrueType and OpenType standards, many software do not support the embedding of Type 1 fonts. This is true for example in web browsers and Office software, so it can be said that the remote code execution attack scope for Type 1 bugs is somewhat limited in comparison to bugs affecting TrueType fonts.
Windows Elevation of Privilege Vulnerabilities
Elevation of Privilege (EoP) vulnerabilities could permit an attacker with limited access to a Windows system to gain more control over it, typically allowing for “escaping” a low integrity or sandboxed process by exploiting such a vulnerability, and subsequently gaining unlimited permissions to the system.
This month’s EoP bugs affect an assortment of Windows components, among them: Win32k (Graphics), Push Notification Service, DirectX, and amusingly enough, two of the bugs were discovered in Windows Defender – the built-in anti-malware component of Windows.
Out of a total of 20(!) different bugs affecting SharePoint, 6 are classified Remote Code Execution.
SharePoint is a web-based collaborative platform. It is almost always used by organizations, not individuals. There wasn’t any detailed technical information about any of the bugs that were found, so it’s unclear whether these bugs affect users of SharePoint Server or SharePoint Online (or both).
However from the sheer amount of fixes being deployed for this product, it’s safe to assume the bugs as a whole constitute a high risk of compromise, and therefore this month’s patch is definitely not something to disregard if you use SharePoint.
Sophos detection guidance
Sophos has released following detection to address the following vulnerabilities. Please note that this is not an exhaustive list of protection measures Sophos has implemented, and that additional vulnerabilities and corresponding detection may be released in the future.
Net Universe offers all Sophos Devices and subscritpions also consultant services with worldwide Delivery Services. Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/sophos.
Unscrupulous marketers and cyber-criminals have seized upon concerns over the emergence of the COVID-19 global pandemic as bait for spam, phishing attacks and malware. In recent weeks, the use of “coronavirus” and “COVID-19” in domain names, potentially unwanted email messages, and phishing and malware delivery schemes has skyrocketed. As of April 14, Sophos has identified over 1,700 malicious domains using “corona” or “covid” in their names, of which 1,200 are currently active.
We’re continuing to work to identify, detect and block these threats. We’re also engaging with the security community to help defend more broadly against the surge in COVID-19 related threats. Joshua Saxe, Sophos’ chief scientist, has launched a Slack channel for open collaboration on taking on pandemic-themed threats. [Update, April 20: The Slack channel now has over 3,400 members from security firms, as well as private and government organizations.]
We’re also publishing indicators of compromise we discover for related threats in a public GitHub. In this report, we’ll examine some of the trends we’re seeing in pandemic-themed spam and scams. The data we present here is just a portion of what we’ve seen so far, and we continue to assess intelligence data as it becomes available.
The surge of spam
The spam we found to be carrying an installer for Trickbot malware earlier this month was just one example of how spammers and criminals are using hunger for information about the pandemic to lure in their targets.
While COVID-19 emerged as a crisis in China in December, references to the virus in spam and phishing emails only really began to emerge in January—and like the virus itself, they grew exponentially. By early March, COVID-19 and Coronavirus already represented a significant percentage of the spam traffic we measured.
Spam campaigns detected by Sophos included:
A sextortion scheme threatening to infect the target’s family with COVID-19 if they didn’t pay.
A scam purporting to be a fundraising plea from the World Health Organization, asking for donations in Bitcoin to fund COVID-19 research.
Messages purportedly from WHO, but carrying documents with dropper malware.
Marketing for “emergency supplies,” including filter masks.
A sales pitch for a $37 video download, purporting to offer insider information from a “military source” on how to survive Coronavirus
[Update, March 27) We’re continuing to see new COVID-19 related extortion scams. Here’s another we’ve detected and blocked:
Building spamming and phishing infrastructure
COVID-19 has left a huge mark on the Internet’s namespace over the past two months. Certificate transparency log data from the major certificate authorities has shown a significant rise in the number of SSL certificates registered for sites using “corona” or “covid” in their names.
To get a sense of how big that change has been, we looked at log data over the past six months for new certificates issued for hostnames with “corona” or “covid-19” in them. To establish a baseline from before the outbreak became global news, we looked at the same period a year ago (September 2018 to March 2019) for comparison.
Before January, most certificates that contained “corona” referred to a locality, service or legitimate brand name. These accounted for an average of 288 certificates activated per month. References to “covid” did not exist in any certificate registrations we could find record of prior to 2020, and the only domain that really stands out belongs to Arizona-based A/V accessory manufacturer COVID, which owns the .com domain.
A typical site registering a certificate with “corona” in its URL in 2018.
The pandemic changed the equation. Starting in January of 2020, there was an exponential rise in new certificates carrying these terms, nearly doubling from the norm to 558 for that month, and then nearly doubling again in February to 868. In the first two-thirds of March, over 6,086 new certificates bearing host names with “covid” and “corona” were issued—nearly a 20-time increase over the year before.
Over 65% of these new domains were programmatically registered for free through Let’s Encrypt, and another 5% used Cloudflare as a Certificate Authority (Cloudflare provides free SSL for sites that use its content delivery network).
By no means are all of these malicious, but many are suspicious—particularly since they include an abundance of sites that were bulk-configured using site templates, domains configured through low-cost registrars or subdomains configured on potentially compromised domains.
One host serving as home for a number of “covid-19” related web addresses—associated with a service that offers free websites and low cost domain name registration—had 11,322 domain names associated with it. Those domains appear to have been programmatically created and registered for certificates, as they follow the same naming pattern {covid-19[additional search keyword].com).
The raw number of domain names we’ve observed being registered that are related to the COVID-19 pandemic is even larger. On March 20, the peak day (so far), people registered 3011 new domains that contained the text “covid” or “corona,” in the four largest top-level domains (TLDs) we monitor (.com, .us. .org, and .info). Since February 8, we’ve observed 42,578 (as of midnight, March 24) newly-registered covid or corona domain names.
While some of these domains may have been registered for benign or even beneficial purposes, many are simply parked, while others are displaying basic, mostly empty website content as placeholders for some promised future content. Part of the collaboration on the Slack channels and with our partners at the Cyber Threat Alliance involves sorting out the useful and legitimate sites that may have been registered by legitimate health authorities from the dark humor, spammy, or actively malicious ones. It’s hard to know the intent of a domain registrant when there’s no content in—just for one weird example, there’s coronavirusshaquilleoneal[.]com.
Sophos has identified over 60 domains as actively malicious, though some of those domains have gone dark since we first detected them. The following specific sites have been linked to malware downloads, and are potential network indicators of compromise, but they are likely just the tip of the iceberg as far as malicious domains go:
[Update, March 27] One domain we’ve investigated, covid19hacks[.]com, is acting as a redirector gateway to a series of deceptive and potentially malicious download sites, including fake software update pages:
These pages are the end of a trail of forwarding HTTPS pages, on domains including:
One of the most prevalent scams related to COVID-19 are sites offering supplies or medicine to prevent or fight infections. Several are picking up on the promotion by some of Hydroxycloroquine and Azithromycin as drugs to help fight COVID-19 infections.
.Some of these sites forward to overseas pharmaceutical sites or to web stores offering filter masks; others have skeletal WordPress installations that appear to be placeholders for future phishing or spam sites. One offers a $9 book on how to create a “do-it-yourself vaccine” for coronavirus.
We’ve identified multiple malware families and potentially unwanted applications thus far communicating with COVID-19 related domains in some way. There are also ransomware that reference coronavirus in the ransom notes.
For example, three different versions of the DownloadGuide adware PUA were detected connecting to domains containing “COVID” or “Corona”. These may have been advertisements pushed to the adware randomly.
Additionally, a group of malicious files used the web host coronavirusstatus[.]space to host payloads or as a C2 server. They include:
An AutoIT dropper script, which we identify as Troj/AutoIt-CYW.
Corona.exe and isoburn.exe, both of which which we identify as Troj/PWS-CJJ and Troj/Steal-JZ.
Corona-virus-Map.com.exe (which we identify as Troj/MSIL-NZP).
The file aut6C13.tmp (which we identify as Troj/PWS-CJJ malware).
In addition to communicating with the host, this malware group also connects to the Telegram encrypted communications API server.
These and additional IOCs will be added to our GitHub repository.
And it was inevitable that someone would eventually create a ransomware and call it Coronavirus.
Acknowledgments
SophosLabs wishes to acknowledge the efforts of Richard Cohen, Brett Cove, Krisztián Diriczi, Fraser Howard, Tamás Kocsír, and Chet Wisniewski to track down various threats, and the efforts of the Cyber Threat Alliance and the community of threat researchers on the COVID-19 Cyber Threat Coalition Slack channel for sharing a wide range of attack data with the wider community of security researchers and SOC analysts.
Net Universe offers all Sophos Devices and subscritpions also consultant services with worldwide Delivery Services. Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/sophos.
The XG Firewall v18 MR1 release has been temporarily pulled.
Sophos has received reports from a subset of XG Firewall v18 MR1 systems, where the update has caused issues with traffic passing through the Firewall. Sophos strongly advises that users roll back to v18.0 GA-Build354 while our development teams work to resolve this.
More info: https://community.sophos.com/kb/en-us/135378
-FloSupport
Hi XG Community!
We’ve released XG Firewall v18 MR1.
Enhancements
Supports new SD-RED 20 and SD-RED 60 devices.
XG Firewall web console now shows granular reasons for firmware upload failure
Plus, more than 45 issues resolved in this release (refer Issues Resolved section below)
With the tremendous need for VPN connectivity in this challenging time, we have put together some important information here for you to achieve your networking needs:
To configure VPN Remote Access on your Sophos XG Firewall. Check out this useful Community post!
To substitute XG for RED devices via Light-Touch deployment from Sophos Central. Check out this useful Community post!
Note: Upgrade from SF 17.5 MR11 to v18.0 MR1 is now supported.
More on XG Firewall v18
Please refer XG Firewall v18 highlights for more details on all-new Xstream Architecture delivering extreme new levels of visibility, protection and performance. Also, check out our XG Firewall v18 playlist on YouTube to find out what’s new in XG Firewall v18!
Get it now!
As usual, this firmware update is no charge for all licensed XG Firewall customers. The firmware will be rolled-out automatically to all systems over the coming weeks but you can access the firmware anytime to do a manual update through Licensing Portal. You can refer this article for more information on How to upgrade the firmware.
For fresh installations, we will update this post with installer download links soon.
Things to know before upgrading
You can upgrade from SFOS 17.5 (MR6 to MR11) to 18.0 MR1. Check out the relevant sections of the XG v18 release notes for details on:
Issues Resolved
NC-30903 [Authentication] STAS configuration is editable via GUI on AUX machine
NC-50703 [Authentication] Access server restarted with coredump using STAS and Chrome SSO
NC-50716 [Authentication] Cannot import LDAP server via XMLAPI if client cert is “None”
NC-54689 [Authentication] Support download certificate for iOS 13 and above
NC-55277 [Authentication] Service “Chromebook SSO” is missing on Zone page
NC-51660 [Backup-Restore] Restore failed using a backup of XG135 on SG230 appliance
NC-55015 [Bridge] Wifi zone is not displayed while creating bridge
NC-55356 [Bridge] TCP connection fails for VLAN on bridge with HA Active-Active when source_client IP address is odd
NC-52616 [Certificates] Add support for uploading of CRLs in DER format
NC-55739 [Certificates] EC certificate shows up as “RSA” in SSLx CA cert dropdowns
NC-55305 [CM (Zero Touch)] System don’t restart on changing time zone while configured through ZeroTouch
NC-55617 [CM (Zero Touch)] Getting wrong error message in log viewer after ZeroTouch process
NC-55909 [Core Utils] Unable to see application object page on SFM
NC-30452 [CSC] Dynamic interface addresses not showing on Aux after failover
NC-54233 [CSC] EpollWorker coredump
NC-55386 [Dynamic Routing (PIM)] PIM-SM import fails with LAG as dependent entity
NC-55625 [Dynamic Routing (PIM)] In HA with multicast interface, routes are not getting updated in the Aux routing table
NC-55461 [Email] After adding/edit FQDN host with smarthost, it is not displayed on the list until refresh the page
NC-58898 [Email] Potential RCE through heap overflow in awarrensmtp (CVE-2020-11503)
NC-55635 [Firewall] Display filter for forwarded is not working properly on packet capture page
NC-55657 [Firewall] HA backup restore fails when port name is different in backup and appliance
NC-55884 [Firewall] IPS policy id and appfilter id not displaying in firewall allow log in logviewer
NC-55943 [Firewall] Failed to resume existing connection after removal of heartbeat from firewall configuration
NC-57084 [Firewall] Custom DMZ not listed in dedicated link HA configuration
NC-44938 [Firmware Management, UX] Web UI does not surface reasons for firmware upload failure
NC-55756 [Gateway Management] Gateway isn’t deleted from SFM UI after deleting it from SFM
NC-55552 [HA] WWAN interface showing in HA monitoring ports
NC-55281 [Import-Export Framework] Full configuration import fails when using third party certificate for webadmin setting
NC-55171 [Interface Management] VLAN Interface IP is not assigned via DHCP when gateway name uses some special characters
NC-55442 [Interface Management] DNS name lookup showing incorrect message
NC-55462 [Interface Management] Import fails on configuring Alias over VLAN
NC-55659 [Interface Management] Invalid gateway IP and network IP configured using API for IPv6
NC-51776 [IPS Engine] Edit IPS custom rule protocol doesn’t work after creation
NC-51558 [IPsec] Add warning message before deleting xfrm ipsec tunnel
NC-55309 [Logging] Local acl rule not created through log viewer for IPv4 and IPv6
NC-50413 [Logging Framework] Gateway up event log for PPPoE interface not always shown in logviewer
NC-55346 [Logging Framework] Clear All for “Content filtering” does not clear SSL/TLS filter option
NC-56831 [Policy Routing] SIP traffic sometimes not working with SDWAN policy route
NC-46009 [SecurityHeartbeat] Spontaneous reconnects of many endpoints
NC-51562 [SecurityHeartbeat] Heartbeat service not started after HA failover
NC-52225 [Synchronized App Control] SAC page loading issues as the list of apps increases
NC-54078 [UI Framework] Internet Explorer UI issue on certain rules and policies pages
NC-56821 [Up2Date Client] SSL VPN downloading with the 0KB
NC-54007 [Web] File type block messages sometimes contain mimetype rather than file type
Making the most of your new XG Firewall features
Free Online Training
Available for free for all XG Firewall customers, our delta training program will help you make the most of the new features in XG Firewall v18.
This online program walks you through the key enhancements since v17.5 and takes about 90 minutes to complete.
Customer Resources and How-To Videos
Also be sure to visit the Customer Resource Center for the latest How-To Videos and links to documentation, the community forums, training and other resources.
Take advantage of Partner and Sophos Professional Services
To augment your local Sophos partner’s services, we offer services to help you getting up and running and make the most of your XG Firewall, including the latest capabilities in v18.
While Sophos Professional Services can help with any task, here are the most common services they provide:
XG Firewall deployment and setup
XG Firewall v18 DPI, FastPath and SSL Engine Optimization
XG Firewall Health Checks
Here are some direct links to helpful resources:
New to XG Firewall?
If you’re new to XG Firewall, see how it provides the world’s best network visibility, protection and response on the new XG Firewall website.
Net Universe offers all Sophos Devices and subscritpions also consultant services with worldwide Delivery Services. Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/sophos.
We are excited to announce that powerful new Endpoint Detection and Response (EDR) features for Intercept X are now available in early access.
This early access program (EAP) brings pre-built, fully customizable SQL queries for both granular threat hunting and IT health checks and management across your organization’s estate. You can join the EAP now.
Live Discover
Live Discover allows you to examine your data for almost any question you can think of by searching across endpoints and servers with SQL queries.
You can choose from a selection of pre-created queries that can be fully customized to pull the exact information that you need.
IT operations and threat hunting sample questions include:
Why is a machine slow? Is it pending a reboot?
Are users running unauthorized browser extensions?
Have any processes had their registry keys or files modified recently?
Is remote sharing enabled? What about guest accounts?
What processes are attempting to make network connections on non-standard ports?
Live Response (coming in May to early access)
This feature gives you the ability to respond with precision. Using a cmdline interface, remotely access devices in order to perform further investigation or take action. For example:
Reboot a device pending updates
Terminate suspicious processes
Browse the file system
Edit configuration files
Run scripts and programs
How to join the EAP
The EAP is open to everyone that has Intercept X and Intercept X for Server, even if you don’t currently have EDR.
For full instructions on how to join and additional technical information please head over to the Sophos community. We look forward to hearing your feedback!
Net Universe offers all Sophos Devices and subscritpions also consultant services with worldwide Delivery Services. Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/sophos.
The COVID-19 outbreak has disrupted “business as usual” for organizations across the world. For communications service providers, and other organizations designated as essential, the requirement to remain open and to continue offering essential services may conflict with the desire to be a good citizen and help to slow the spread of the outbreak.
One broadband and hosting provider and managed security services provider (MSSP) had no telework program prior to the COVID-19 pandemic. However, by leveraging an existing investment in Fortinet solutions, this organization managed to transition over 2,000 employees to remote work in a few days with no additional capital expenditure (CapEx).
Leveraging Existing Solutions to Secure a Remote Workforce
The telecommunications provider had FortiGate next-generation firewalls (NGFWs) already deployed on the corporate network; primarily leveraged for outbound connectivity. With no previous work-from-home policy, the organization was accustomed to handling less than 20 inbound virtual private network (VPN) connections per day. Suddenly, it needed to provide more than 2,000 employees with a secure connection to the corporate network.
Enabled by Fortinet’s Security-Driven framework, a FortiGate NGFW has an additional ability to act as a VPN aggregator powered by a custom network processor, enabling it to terminate inbound VPN connections at high volume and with an industry-best connections per second. In addition, it is also able to perform deep packet inspection, and identify malware and other threats with its integrated web filtering, application control, intrusion prevention, network-based antivirus, DNS filtering, and other unified threat management features – all powered by an additional, custom designed content processor that enables performance metrics many times greater than competitive solutions. This meant that this telecommunication organization not only already had the protection needed to encrypt and inspect data-in-transit, but also advanced layer 7 security designed to prevent cyberattacks by leveraging the hardware acceleration provided by Fortinet’s industry-first security processing units (SPUs).
The free FortiClient endpoint protection software provided the other half of the solution. Employees could install the client software on either business or personal devices and use it to create an encrypted connection to the enterprise network. This free client combined with the innate capabilities of their existing FortiGate solution enabled the organization to rapidly roll out VPN connectivity to its entire workforce without incurring any additional costs.
One unforeseen challenge was that many employees’ home ISPs blocked non-standard ports on their Internet connections, so an IPsec VPN was not a viable option for remote work. Fortunately, FortiClient also supports SSL VPN connectivity, enabling all traffic to be routed over port 443, which is not subject to the same restrictions.
The FortiClient software also enabled the organization to solve issues with telephone connectivity. With employees away from their desks, they had trouble contacting one another on the phone since they did not have each other’s personal phone numbers. By transitioning to softphones, with traffic routed over their VPN connections, these employees now have access to the full capabilities of their business phone system. At the same time, the organization was able to be confident of the security of this new virtual phone system, as all telephone traffic is now inspected and secured by FortiGate NGFWs.
Maintaining Compliance While Working Remotely
Transitioning to remote work due to COVID-19 or similar events does not excuse an organization from its obligations to data protection regulations or contracts. By leveraging the capabilities built into its existing Fortinet solutions, however, the telecommunications provider was able to continue to meet compliance and contractual requirements despite now supporting a mostly remote workforce.
Guidance from the Payment Card Industry Security Standards Council (PCI SSC) on remote work requirements focuses on controlling access to devices and communications channels carrying sensitive data. The main requirements are that an organization deploy multi-factor authentication (MFA), have a firewall in place, use a VPN, and restrict access to parts of the enterprise network processing sensitive data. Other data privacy regulations and contractual obligations have similar requirements.
The organization was able to meet all of these requirements with no additional investment in security hardware. As previously discussed, their existing FortiGate NGFWs, deployed at the network perimeter, provided VPN connectivity. With Fortinet’s full suite of unified threat management (UTM) solutions already deployed, the organization was able to ensure that malicious content was identified and remediated before it reached the enterprise network. This was essential, as a shortage of company laptops meant that some employees were working with untrusted personal machines.
The organization’s existing firewall deployment included two layers of FortiGate NGFWs, making it easy to implement internal segmentation for inbound VPN connections. All VPN connections were terminated and inspected at the outer layer of firewalls. The inner layer of firewalls provided defense-in-depth and limited external access to sensitive data and functionality, such as their hosting and service provider business.
Finally, the organization provided FortiToken time-based one-time password tokens to its entire remote workforce. Combined with the FortiAuthenticator user identity management server, this enabled the organization to implement MFA and single sign-on (SSO) for all teleworking employees. In addition to meeting compliance requirements, these MFA and SSO also limits damage from phishing attacks – which have grown more prevalent during the COVID-19 outbreak – since usernames and passwords potentially stolen from such attacks are still not enough to gain access to organizational assets.
Meet New Business Needs with Existing Technology
Prior to the COVID-19 outbreak, this telecommunications provider had no remote work policy and limited VPN support. Within a matter of days, thanks to Fortinet solutions already in place, the organization’s entire workforce was able to transition to secure remote access to the organization’s network.
When developing business continuity plans, it is vital to understand the full capabilities of an existing security deployment. For this company, the VPN functionality integrated into their existing FortiGate NGFWs enabled a rapid, secure transition to a remote workforce.
Learn more about how to pivot to a secure, remote workforce with Fortinet Teleworker Solutions.
Sophos is excited to announce that Sandboxie is now an open source tool.
Sandboxie has long been a favorite sandbox-based isolation tool since its original release over fifteen years ago. Now this technology will live on in the hands of its dedicated users.
We are thrilled to give the code to the community. The Sandboxie tool has been built on many years of highly-skilled developer work and is an example of how to integrate with Windows at a very low level.
The Sandboxie user base represents some of the most passionate, forward thinking, and knowledgeable members of the security community, and we hope this announcement will spawn a fresh wave of ideas and use cases.
For more details, and to download the open source release visit https://www.sandboxie.com/.
Net Universe offers all Sophos Devices and subscritpions also consultant services with worldwide Delivery Services. Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/sophos.
Since we began writing last year about the consumer-hostile trend in mobile apps that we’re calling fleeceware, the number of apps we’ve discovered that engage in this practice have only increased. In the first two articles we wrote about fleeceware, we covered various Android apps in the official Play Store charging very high subscriptions for apps of questionable quality or utility.
In this latest round of research, we found more than 30 apps we consider fleeceware in Apple’s official App Store.
Many of these apps charge subscription rates like $30 per month or $9 per week after a 3- or 7-day trial period. If someone kept paying that subscription for a year, it would cost $360 or $468, respectively. For an app.
Like we have seen before, most of these fleeceware apps are image editors, horoscope/fortune telling/palm readers, QR code/barcode scanners, and face filter apps for adding silly tweaks to selfies.
Many of these apps lack any extraordinary features that aren’t already present in many other apps, including truly free apps. It’s debatable that the apps provide “ongoing value to the customer,” as required in Apple’s App Store Review Guidelines for app subscriptions, section 3.1.2(a).
When “free” isn’t really free
Many of the fleeceware apps we see are advertised within the App Store as “free” apps, which puts the apps at odds with section 2.3.2 of the App Store Review Guidelines, which require developers to make sure their “app description, screenshots, and previews clearly indicate whether any featured items, levels, subscriptions, etc. require additional purchases.”
If you think one of these apps is free and install it, the app presents you with a “free trial” notification immediately upon launching the app for the first time. This notification prompts the user to provide payment card details. In some cases, most of the useful features of the app will only be usable if you sign up for the subscription. Some users may sign up to subscribe without reading the fine print, which includes the actual cost of the subscriptions.
Fleeceware in Top Grossing app charts
While the Apple App Store does not publish the number of downloads for any given app within the app’s listing in the store, the company does keep track of how much money apps make. Many of these fleeceware apps are listed among the top grossing apps, at the time of writing. It’s fair to say these apps are generating plenty of revenue for developers, of which Apple keeps a 30% cut during the first year.
The terms for a Lucky Life subscription displayed in a faint grey text
Zodiac Master Plus, one of the apps on our list of fleeceware, is listed as the 11th highest revenue-generating app. Another app, named Lucky Life – Future Seer, is earning more revenue than even the extremely popular Britbox, one of the UK’s most popular subscription streaming TV services.
Two of the apps earning the most revenue in the Lifestyle category use high-cost subscriptions
One third party source estimates App Store revenue, which includes all types of purchases, to be $13 billion dollars in 2018, just in the USA.
After one year, Apple gets 15% and the developer’s share increases to 85% of the subscription price.
Advertisements drive more people to fleeceware
If you find yourself wondering why users would even consider installing apps such as these, it’s probably thanks to advertising. These apps are advertised through various popular platforms, including in YouTube videos or on social media platforms like Instagram, TikTok, and even in ads that appear within other apps.
When users visit the app’s page in the App Store app, they’ll find a high number of five-star reviews. While we have no evidence that these are manipulated or artificially inflated reviews, that is another criteria by which the App Store may take action against developers. These advertisements offer a high return on investment, given the high subscription charges.
But not all the reviews are upbeat about these products. Here are a few examples of negative user reviews that illustrate how ads attract users to the apps.
Negative reviews and vulnerable users
These apps also have lots of negative, one-star reviews from users complaining about the challenge of canceling subscriptions and getting refunds, with many iPhone and iPad owners wondering aloud why apps that exhibit this type of behavior exist on Apple’s official App Store.
In one instance, one user posted a complaint about being charged £148 (about US$170) over a 5 month period, when his child accidentally subscribed to one of these apps, and he didn’t notice the subscription charges right away.
The negative reviews for some of these products are devastating.
Both iOS and Android face a fleeceware problem
Fleeceware is a problem on both the Android and iOS mobile platforms. The list below is representative of the fleeceware apps we’ve seen at the time of this writing. App publishers also have the ability to introduce new fleeceware apps by releasing new apps with the same subscription policies, or by converting a previously free app into fleeceware by changing the app’s profile in the App Store, though Apple developer policies prohibit this behavior.
Users should remain vigilant and carefully scrutinize the terms for purchasing or “subscribing” to apps promoted through in-app advertisements. If $30 a week seems like a lot to spend on astrology, a barcode reader, or an app that will show you what you’ll look like when you’re 80 years old, find another app.
How to cancel your subscriptions
If you have one of these fleeceware apps and want to change or cancel your subscription, please follow the instructions below
iOS
This is how you can do it on Iphone as described in Apple support page here.
Open the Settings app.
Tap your name, then tap Subscriptions.*
Tap the subscription that you want to manage. Don’t see the subscription that you’re looking for?
Choose a different subscription option, or tap Cancel Subscription.If you don’t see Cancel Subscription, the subscription is already canceled and won’t renew.
*If you don’t see “Subscriptions” in the Settings app, tap iTunes & App Store instead. Tap your Apple ID (which is usually your email address), then tap View Apple ID. Sign in, scroll down to Subscriptions, then tap Subscriptions.
Android
Instructions for cancelling Android app subscriptions from Google’s Play Store support page:
On your Android phone or tablet, open the Play Store.
Check if you’re signed in to the correct Google Account.
Tap the hamburger menu icon Subscriptions.
Select the subscription you want to cancel.
Tap Cancel subscription.
Follow the instructions.
Fleeceware Apps List
App Name
Weekly
Monthly
Yearly
Rank*
Download**
Revenue**
Seer App:Face, Horoscope, Palm
$7.99
$29.99
$79.99
#153
20k
$20k
Selfie Art – Photo Editor
£8.49
£24.49
£89.99
#14
500k
$700k
Palmistry Decoder
$8.99
$69.99
#23
300k
$600k
Lucky Life – Future Seer
$8.99
$24.99
$69.99
#40
200k
$200k
Life Palmistry – AI Palm & Tag
$7.99
$24.99
$79.99
#39
100k
$200k
Picsjoy-Cartoon Effect Editor
$7.99
$79.99
–
<5k
–
Aging seer – Faceapp,Horoscope
$7.99
$8.99
$59.99
–
<5k
–
Face Aging Scan-AI Age Camera
$8.99
$59.99
–
<5k
–
Face Reader – Horoscope Secret
$2.99
$9.99
$59.99
–
<5k
Horoscope Secret
$9.99
$29.99
$74.99
–
<5k
–
CIAO – Live Video Chat
$19.99
$74.99
#66
60k
$80k
Astro Time & Daily Horoscope
$7.99
$19.99
$49.99
#106
20k
$30k
Video Recorder / Reaction
$2.99
$9.99
$49.99
<5k
Crazy Helium Funny Face Editor
$4.99
$9.99
$49.99
#384
70k
$7k
Banuba: Face Filters & Effects
$7.99
$24.99
$79.99
#50
70k
$100k
QR Code Reader – Scanner
£8.99
£12.49
#444
<5k
$40k
QR Code Reader & Barcode PRO
$9.49
$47.99
#103
80k
$90k
Max Volume Booster
£9.99
£19.49
£48.99
#134
20k
<$5k
Face Reading – Horoscope 2020
$4.99
$15.99
$69.99
–
<5k
–
Forecast Master 2019
£8.99
£19.99
#134
<5k
$10k
mSpy Lite Phone Family Tracker
$49.99/quarter
$99.99
#3
1mil
$700k
Fortunescope: Palm Reader 2019
$9.99
#876
80k
$200k
Zodiac Master Plus – Palm Scan
$8.99
$22.99
$83.99
#9
200k
$500k
WonderKey-Cartoon Avatar Maker
$7.99
$18.99
$79.99
#18
30k
$60k
Avatar Creator – Cartoon Emoji
$8.99
$67.99
#52
200k
$100k
iMoji – Cartoon Avatar Emojis
£7.99
£19.49
£87.99
#55
10k
$20k
Life Insight-Palm & Animal Face
$8.99
$22.99
$69.99
#26
400k
$600k
Curiosity Lab-Fun Encyclopedia
£7.99
£25.49
£87.99
#80
10k
$9k
Quick Art: 1-Tap Photo Editor
£7.99
£25.49
£87.99
#157
20k
$8k
Astroline astrology, horoscope
$8.99
$19.99
$49.99
#20
200k
$300k
Celeb Twin – Who you look like
$5.99
$19.99
$59.99
#682
<5k
–
My Replica – Celebrity Like Me
£7.99
£19.99
£49.99
#56
90k
$70k
TOTAL (estimated in USA)
3.5 Million
(approx. 3,680,000)
$4.5 Million
(4,644,000)
* Highest Ranking Based on Sensor Tower Top Grossing iPhone Apps Category Rank history in their specific category between Dec9-Mar2 2020 in USA
**Sensor Tower data, worldwide, as of Jan 2020
Acknowledgement
Thanks to researcher Xinran Wu for his assistance with this post.
Net Universe offers all Sophos Devices and subscritpions also consultant services with worldwide Delivery Services. Send us an email to [email protected] for more information or visit https://www.netuniversecorp.com/sophos.
After coming across a New York Times article from earlier this year on ransomware attacks crippling cities and businesses, I thought it was time to revisit the cybersecurity threats facing customers and their intersection with what is still the number one business communication tool – email.
In reviewing Fortinet’s FortiGuard Labs’ threat research resources, including our partnership with global customers conducting threat assessments using our Cyber Threat Assessment Program (CTAP) for email security, some obvious (and not so obvious) findings become clear.
Among the most serious findings is the prediction that ransomware will be a hallmark challenge for the year ahead. Of course, no one can forget the scourge of notorious ransomware threats of the past several years that crippled networks, caused massive financial losses, and captured the headlines. For enterprises with tens of thousands of endpoints and thousands of applications and servers spread across hundreds of sites, these ransomware attacks had a devastating impact – ultimately costing organizations around the world billions of dollars. Ryuk is one of the latest ransomware threats to make headlines. What’s most interesting is how this exploit’s backdoor was delivered when a user first clicked on a link inside a phishing email.
But it’s not just ransomware that customers will face in the year ahead, but a myriad of other threats as well. This warning aligns with a significant increase in emails exploiting Coronavirus-related themes and social engineering tricks to achieve malicious objectives that have been recently observed by our FortiGuard Labs threat research teams. Whether it’s phishing scams, targeted malware, or a combination of both, one thing is consistent about all these attacks – the vast majority will be delivered straight to your inbox.
Now, more than ever, it’s critical to remember that email remains the number one threat vector in the world, and as a result, it needs to be properly secured.
Uncovering Risks with Fortinet’s CTAP
Of course, not all email security solutions are the same. Remember, only one user needs to click on a malicious email attachment that has managed to slip past an aging or inadequate secure email gateway to compromise your entire network. It is essential, therefore, to ensure that the secure email gateway solution you have in place is capable of meeting today’s security challenges.
There are two ways to determine if your secure email gateway solution is able to adequately defend your organization against the latest wave of phishing, spear phishing, and similar attacks, and if your security infrastructure is capable of protecting you from the ransomware and other malware that malicious email can drag into your network: You can either wait for a breach to occur, or you can run proactive validation tests to ensure that the tools you have in place are prepared to defend you against the latest most sophisticated threats.
The Fortinet Cyber Threat Assessment Program (CTAP) is designed to help organizations better understand their Security Risk by determining which application vulnerabilities are being used to attack the network, which malware/botnets may be in your environment, what phishing attacks are able to make it through existing defenses, and which devices are most “at risk.” It can also determine what productivity tools are being used, and how much bandwidth is being consumed by all of this. All of this data is then used to establish a security breach probability baseline for organizations, and then anonymously correlated with data collected from other organizations centrally to establish insights into global threat activities.
CTAP participants rely on Microsoft Exchange Online or Office 365 for their email today, and many already have some features or third-party products enabled for email security. But as you will see from the data we’ve collected at Fortinet – many may still be at risk.
The Rise of Email Threats
For the month of January, an analysis of our email assessments showed that organizations are still being overwhelmed with email messages that are spam or marketing newsletters. The bandwidth and productivity hit from this unwanted traffic is clear, and organizations are advised to take measures to get this back under control.
But where the statistics get most interesting are with the data collected about malicious or potentially risky emails and URLs that land in user mailboxes. And what’s most alarming about this data is that all of these customers already have some sort of email security in place.
Even after an organization’s existing email security solution did its best to filter out malicious or risky traffic, our email analytics found that 1 in 3,000 messages still contains malware, including ransomware. What’s more interesting is that 1 in 4,000 contain previously unknownmalware. These are often advanced or zero-day threats, and maybe the latest ransomware variant – and why customers more than ever need to think beyond the rigid, signature-based approaches for protection used by most email security solutions, and incorporate sandbox technologies for email scanning.
Digging deeper, Fortinet also found that 1 in 6,000 emails contained suspicious URLs. While not all of these links may be associated with the distribution of malicious content, many of them could easily become a launching pad for a future ransomware campaign, or a phishing attempt to steal valuable credentials to gain access to an organization’s network and critical assets.
To put this into perspective, the average employee receives 121 emails per day. For an organization with 100 employees, this means that they will need to address 4 emails infected with malware, 3 infected with previously unknown malware, and 2 emails containing suspicious URL links every single day.
And this can be more difficult to address than it may seem. For example, brute force blocking of all suspicious or unknown URLs may create an uprising from end-users, or an IT support headache. Instead, organizations need to have next-generation isolation solutions in place to eliminate these risks.
FortiMail Stops Advanced Threats and Prevents Data Loss
Of course, to learn if your organization is vulnerable, you need to determine whether or not your existing email security solution is still effective as well as whether your existing vendor is able to adequately support your solution for maximum efficacy. That begins by simply signing up for a free threat assessment. This zero-impact analysis provides an executive-level summary report on your email security threat posture to help guide your security planning.
Whether your organization needs to upgrade their email security, or simply wants a more comprehensive and easier-to-manage solution, FortiMail provides the full range of advanced security protection, visibility, and interoperability that today’s organizations require. By combining FortiMail’s proven capabilities for anti-spam, virus protection, content disarm and reconstruction (CDR) with its Security Fabric-based integration with the FortiSandbox Advanced Threat Protection and FortiIsolator Browser Isolation solutions, Fortinet offers the right technical approach for addressing the full range of advanced and evolving email-based threats customers will face in 2020.
Sign-up now to start a free email assessment so you are prepared for the year ahead.
Find out how Fortinet’s Security Fabric delivers broad, integrated, and automated protection across an organization’s entire digital attack surface from IoT to the edge, network core and to multi-clouds.
Find out how Echoenergia and New Zealand Red Cross used Fortinet’s Security Fabric for protection from the network edge to core.
Engage in our Fortinet user community (Fuse). Share ideas and feedback, learn more about our products and technology, or connect with peers.
Most of our lives are now connected on the internet. We stay in touch with our loved ones, order food, talk to our doctors, do our banking — and now, many of us also work from home.
We are all facing challenges we did not predict a few weeks ago. Never before has our society been more dependent on the internet, and never before have people been more vulnerable. Each individual is now exposed to more phishing attacks and we are seeing a new wave of cyber threats capitalizing on the fear surrounding the pandemic.
While hero first responders and doctors are fighting for lives attacked by a biological virus, the global IT security standards community is doing its best to protect us in the digital world. The human body and the internet are both amazing complex structures that will always be attacked, but we are resilient.
Last year at BlackHat USA, the conference issued its annual 2019 Black Hat USA Attendee Survey, in which one question asked what cybersecurity technologies have been most effective for data security and privacy online. The response was clear: multi-factor authentication (MFA). MFA was the highest ranked security tool for protecting enterprise data, with 82% of respondents citing it as effective.
History has shown that if we come together and collaborate on solutions, we can invent cures. During the last decade, our team at Yubico has worked closely with internet giants and open standards bodies, and together we invented the best authentication solutions to prevent remote account takeovers: FIDO U2F, FIDO2 and WebAuthn. See the stats below, or read the full research here.
Since a few weeks ago, most of the Yubico team is working from home, but we have been fortunate to continue to serve our customers, partners and developer community around the world. Moving ahead, we are committed to help make the world safer by continuing to contribute to open security standards, and providing free open source tools and support for technology that makes a difference. We will also continue to donate YubiKeys to non-profit organizations supporting a free open internet and free speech to safeguard security for the world at large.
Without doubt, the world is in a crisis. But no matter how difficult things get, there is often a way, and through these challenges we can boost our spirits and immune system if we find things that make us smile. A couple of weeks ago, the Yubico team made a short video to explain how FIDO authentication works, which made me smile. I hope it can do the same for you.
Stay healthy and safe.
P.S. — If you want a dog to look at a computer screen, show cat videos. To learn more about how to secure your remote workers, tune into any of our upcoming and on-demand webinars on BrightTALK.
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Cookie settingsACCEPT
Privacy & Cookies Policy
Privacy Overview
This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
These pages are the end of a trail of forwarding HTTPS pages, on domains including:
The following sites were registered and park through reg.ru, a Russian domain registry, and may be potential pharmacy scam sites in the future:
Subscriptions.
