Zoom Encryption For All; Millions of IoT and Home Devices At Risk; Fake LinkedIn Identities and Phony Job New Attack Vector

Be aware of the impacts of enabling E2EE before enabling it to make sure that users will be able to participate in your meeting. Zoom's white paper on their E2EE implantation (https://github.com/zoom/zoom-e2e-whitepaper/blob/master/zoom_e2e.pdf) documents meeting UI changes as well as key management and verification. UI changes include: participants cannot join before the host, participants must run the official Zoom client; browsers, legacy Zoom enabled devices and PSTN dial-ins are disabled.

Lee Neely

This flaw will keep us busy for the foreseeable future. The Treck IP Stack is used in millions of devices made by an unknown number of manufacturers. As an end user, you likely have no idea that this IP stack is used in your equipment. Identifying these devices and patching them will take years.

Johannes Ullrich

Cisco, Intel and HP/Samsung have issued alerts around their products that are or may be at risk. This isn't just an obscure IoT device risk issue, though it is a huge issue there. There are 19 CVEs; in order to mitigate or patch, discovery of vulnerable devices with the Treck stack is key. Some discovery and Network Access Control vendors have released scripts and signatures to detect use of the vulnerable stack. Treck recommends reviewing those CVEs and if you have questions about a device, contact them via email at security@treck.com.

John Pescatore

Put this in the if it isn't broken don't fix it category. Deploy this fix to systems only if they are experiencing printer problems after last week's update. You may not discover those problems until workers return on-site and attempt to print.

Lee Neely

Implementing broad changes while still meeting mission objectives takes leadership and support from the top, particularly if delivered as an unfunded mandate, and particularly for culture-changing initiatives such as security awareness and corresponding culture changes. If management doesn't "walk the talk" the staff won't either. The security measures suggested, such as DMARC, MFA and USB Security, are worth consideration irrespective of your business sector.

Lee Neely

Some form of strong authentication is now mandatory for most applications in most enterprises, let alone for privileged users in intelligence agencies. It is ironic that sharing of IDs and passwords remains common among administrative users, those users where "accountability" is the primary control. Most enterprises, let alone intelligence agencies, should be using Privileged Access Management systems (the Israelis offer a very good one.) It was through abuse of administrative privileges that Edward Snowden was able to ravage NSA systems.

William Hugh Murray

The flaw is in the web server used to manage the router. The only mitigation is to limit access to that service to trusted systems. Make sure internet-based management is disabled, if possible, implement firewall rules to restrict which systems can manage the devices, and consider changing the admin password so systems with cached or stored credentials cannot connect easily. Netgear hopes to release updated firmware by the end of June.

Lee Neely

The cost of the first repair that one makes will be high; subsequent ones much lower. Therefore, enterprises will repair; SOHO users may find it cheaper and easier to replace.

William Hugh Murray

The article is a bit short on details, but this appears not to be another attempt to revive DNSSEC. Instead, it likely refers to a filtered DNS services (sometimes called DNS Firewalling) like that offered by companies like Threatstop and OpenDNS/Cisco. This type of service has been shown to be effective and easy and cheap to deploy. Having them specifically "tuned" for this user base could indeed be a good way to better protect participating companies.

Johannes Ullrich

During the T-Mobile outage, there was unfounded speculation that a DDoS attack may have caused the outages. Many people don't understand that large DDoS attacks have become a "new normal" for internet service providers. This story, as well as the AWS DDoS story, show how companies have learned to deal with these "new normal" attacks.

Johannes Ullrich