 No this is not a drill. The internet is going to shut down in less than 12 hours for a DNS encryption update by ICANN. However, you don’t need to panic as you won’t lose access to your precious cat videos. The Internet Corporation of Assigned Names and Numbers (ICANN) is planning to update the cryptographic key that helps protect the Domain Name System (DNS). For those who don’t know, DNS is like a directory which records all the domains and the owner of those domains. Seeing the ever-increasing security attacks and breaches ICANN decided to update the encryption keys for the DNS addresses. This means that when the update is taking place on a certain website, it won’t be accessible to the users. This also implies that the internet won’t be completely down as the update will happen in batches. The update has been scheduled strategically to happen over the weekend so it won’t disturb the day-to-day work of the organizations that rely on the internet. However, this also means that there’s a fair chance that you won’t be able to binge watch your favorite show on Netflix over the week. ICANN has already run several tests and has confirmed that only 1% of the world will experience issues but the number still comes to a little over 36 million users. That said if you’re one of the unlucky 1% of the users, then you don’t need to panic. The shutdown is temporary and requires no extra steps from the users. The best you can do is restart your modem or double check your DNS to make sure your DNS address is updated by your Internet Service Provider (ISP). For more detail visit OUR FORUM.  A newly discovered piece of malware for Android raises the bar in terms of sophistication and flexibility, offering its operator adaptability to various tasks. Cybercriminals are currently running tests on GPlayed but malware analysts warn that it is already shaping up as a serious threat. The modular architecture extends its functionality through plugins that can be added without the need to recompile and update the package on the device. The operator can also inject scripts and send .NET code to the infected Android that GPlayed can compile and execute. it is built using the Xamarin environment for mobile apps and uses a DLL called "eCommon" that "contains support code and structures that are platform independent." This model shows a new step on the evolution ladder, where code can migrate from desktop platforms to mobile ones, resulting in a hybrid threat. It disguises itself on the device as the Play Store app, using an icon very similar to the original and the name "Google Play Marketplace." It asks for many permissions, including "BIND_DEVICE_ADMIN," which gives it almost complete control over the infected device. Researchers at Cisco Talos analyzed GPlayed and discovered a hefty set of native capabilities covering spying, data exfiltration, and self-management functions. Visit OUR FORUM for complete details.  In Windows 10, Microsoft added a new ransomware protection feature called Controlled Folder Access that can be used to prevent modifications to files in protected folders by unknown programs. At the DerbyCon security conference last week, a security researcher showed how DLL injection can be used by ransomware to bypass the Controlled Folder Access ransomware protection feature. Controlled Folder Access is a feature that allows you to protect folders and the files inside them so that they can only be modified by an application that is whitelisted. The whitelisted applications are either ones that you specify or ones that are whitelisted by default by Microsoft. Knowing that the explorer.exe program is whitelisted in Controlled Folder Access, Soya Aoyama, a security researcher at Fujitsu System Integration Laboratories Ltd., figured out a way to inject a malicious DLL into Explorer when it is started. Since Explorer is whitelisted, when the DLL is injected it will launch and be able to bypass the ransomware protection feature. To do this, Aoyama relied on the fact that when explorer.exe starts, it will load DLLs found under the HKEY_CLASSES_ROOT*shellexContextMenuHandlers registry key. The HKEY_CLASSES_ROOT tree is a merge of registry information found in HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER. When performing the merge, Windows gives the data in the HKCU tree precedence. Tune into OUR FORUM to learn more. |
Latest Articles
|