Breakthrough in Microsoft Majorana 1 Quantum Processor; Signal QR Code Phishing; OpenSSH Patches DoS & MitM Vulnerabilities

This new quantum processor design enabled quantum computing to 'escape the research lab' and become a commercially available and affordable computing solution. Current commercial solutions, like D-Wave's systems, address specific aspects of quantum computing and are rather limited in their applicability. Microsoft appears to have found an engineering solution to create scalable quantum computers, overcoming some of the current designs' error rate problems and scalability issues. The 'Quantum Crypto Deadline' of 2035 set by the federal government does appear to be much more realistic. Don't let the ten-year timeline lead to delays and procrastination. The time to come up with a game plan is now. Cryptographic agility is critical. Do not lock yourself into a specific algorithm; find ways to inventory and adjust used algorithms as needed.

Johannes Ullrich

The big challenge with quantum computing is the error rate. Microsoft's Majorana 1 is planned to have an error rate of 1 percent, which then leverages a logical qubit array called tetrons for error correction, making quantum computing practical. Even though this is still under development, it makes reference to behavior at absolute zero temperatures, and is a few years out; keep an eye on this space, this could be very exciting when realized.

Lee Neely

Bad user interface designs are often as dangerous as buffer overflows and SQL injections. In this case, it is difficult for the user to distinguish 'harmless' group chat invites from device pairing requests.

Johannes Ullrich

e selective if you're linking devices for any encrypted communication, as it increases the number of places which can decode private or sensitive information. Make sure any devices with these services have robust authentication, are kept updated and secure, logically and physically, to include ensuring apps are only loaded from the vendor or company App Store.

Lee Neely

QR codes usually resolve to text, often to a link. They are more obscure than URLs and should always be suspect.

William Hugh Murray

QR Codes are interesting. People can misunderstand the Desktop to Phone Features. Be careful with those features, and always look at what devices are hooked into your account.

Moses Frost

The MitM vulnerability is interesting. The VerifyHostKeysDNS option is supposed to help verify server keys, but in this case, it turns out to be counterproductive. Please update if you rely on this option.

Johannes Ullrich

Beyond installing the updates to your SSH services when released, make sure you're not exposing that service beyond what is needed, ideally only to validated/approved clients.

Lee Neely

The flaw can be used to take administrative control of your Juniper Session Smart Router. There are no workarounds, and applying the fix will not impact the data functions of the router, but merely cause a brief outage of the management interface. Even better, no active exploitation has been detected yet, but that is expected to change with the release of the advisory, so get this update deployed.

Lee Neely

Apparently, this flaw was found by a Microsoft employee; I'd like to the think Microsoft's re-commitment will continue to increase the percentage of vulnerabilities found before attackers or external researchers discover them.

John Pescatore

If you are using PowerPages, review your access logs, double checking for permission changes, double checking admin users to make sure all are expected, and enforcing MFA across all accounts.

Lee Neely

Are you still using Microsoft software?

William Hugh Murray

It turns out that some of the attacks I was showing in a presentation to some students have a name. Pass Back. Huh. I never knew that. Well. In the meantime, you should check for this; all printers do this, honestly.

Moses Frost

Attacking printers has been around for some time. What's surprising, at least to me, is that it took ten months to issue a patch. Granted, an evildoer would need to have previously gained access to the network but still, a long time when the prize is collecting AD credentials without being detected.

Curtis Dukes

Make sure printer firmware updates are being applied as religiously as your other endpoint updates. If you've outsourced printer management/maintenance, make sure their process aligns with your remediation timelines. SMB is used for scan to file services, so you probably need it, but you shouldn't need FTP printer access. Beyond complex admin accounts, make sure that you have visibility to actions, logins, and configuration changes, and can detect any malicious behavior.

Lee Neely

This is not their first incident, and they are not indicating there is a connection to last week's phone service outage. Genea is attempting to maintain normal service levels while keeping their notification page updated, including providing contact information for patients who are unsure about what to do.

Lee Neely

One has to love lawyers: "suspicious activity,", "unauthorized third-party access,", "working to understand the extent," Just call it what it is, a ransomware event where data was stolen/encrypted. A court will likely decide whether the provider exercised a 'standard duty of care' in protecting its patients' data. And that rests on whether they had an established cybersecurity program and were reasonable in its implementation.

Curtis Dukes

Perhaps "recovering" but never fully recovered.

William Hugh Murray

I have seen many doctors' offices and small patient practices that struggle to keep up with patient care. You can see where they have a server or maybe several servers in a small closet, and when those services need to be disposed of, you must wonder how they are handling this. They may have just asked a 3rd party to dispose of the systems, and they may not have adequately done it. There are many ways this thing can happen. The result is that data handling is still a thing.

Moses Frost

Make sure your decommissioning process includes data wipe, with a record, as well as a process for validation of some percentage to make sure it happens. With encryption, a cryptographic wipe has become faster and easier than prior overwriting processes. If you're using a third party, they likely have options, including a solution for when the wipe process fails, such as shredding the device. Make sure all your media is covered by these processes, not just internal disks.

Lee Neely

Just a good reminder to touch base with IT and make sure surplusing/disposing of any IT equipment (not just PCs) involves following well-known processes for sanitizing them.

John Pescatore

Your responsibility for protecting patient doesn't stop once the IT equipment has been disposed of. Make sure you have a policy in place to wipe the hard drives as part of your equipment excessing process.

Curtis Dukes

Valued by the replacement cost for a bit, these drives are not worth the compute power to erase them, much less the human effort to judge the value of any residual data. Best just to use a hammer.

William Hugh Murray

These advisories invariably could be one sentence long: "To keep your stakeholders safe from [insert attack type and name here] adopt the Center for Internet Security Critical Security Controls and prioritize reaching at least the Essential Cyber Hygiene levels." That would save a lot energy wasted by AI engines ingesting these long advisories...

John Pescatore

I'm starting to wonder if threat analysts are paid by the word. Just cut to the chase and implement Reasonable Cybersecurity, starting with Implementation Group 1 of the CIS Critical Security Controls. That's more defensible in court than wading through a cybersecurity missive.

Curtis Dukes

Get these IoCs to your threat hunters and make certain you're clean here. Next make sure you're updated for your Fortinet, SharePoint, Exchange and ColdFusion services. Now, check that you're implementing the recommended ransomware mitigations above, ensuring none of those efforts are stalled or otherwise needing support to get to done.

Lee Neely

This ransomware group was going after 2018 bugs from Fortinet and 2009/2010 bugs from Adobe ColdFusion. It made me wonder how successful they were, but given how much attention it has gotten, it also makes me wonder how much ColdFusion is still in the wild.

Moses Frost

As a general rule system backups are a last resort measure. However, they are often cheaper than paying extortion, almost always cheaper than recreating from scratch, but usually more expensive than preventative measures such as strong authentication and network segmentation.

William Hugh Murray

The US has a decades-long history of failing to pass meaningful national data privacy laws, generally because of the commercial world wanting to maintain easy access to and unencumbered use of personal information collected online. This has driven many states to pass their own laws. I hope the goal of this committee will be to set the federal data privacy bar at or near the high water mark established by some of the states, not to set a low bar to appease industry lobbying organizations.

John Pescatore

This is a twofold problem: first, establishing a national standard, akin to CCPA or GDPR, and second, standing down individual state privacy laws, making it easier to implement and measure as well as assure consistency across the country. Hopefully this will be more successful than the 2022 American Data Privacy and Protection Act or 2024 American Privacy Rights Act which failed due to industry/technology pushback, particularly around lack of provisions preventing states from introducing additional privacy legislation, exacerbating the implementation problem.

Lee Neely

Glad to see, but a few years late. SEN Cantwell (D-WA) has been making the clarion call for a US National Privacy Standard and even introduced legislation in 2023 and 2024 (The American Privacy Rights Act). Perhaps 2025 is finally the year that Congress acts; I just wouldn't hold my breath waiting.

Curtis Dukes

At best the states have passed similar measures using different language, leaving compliance to the user. Having a single law may well make compliance easier. However, when Congress passes laws that pre-empt state laws, they often do so by setting compliance thresholds at the lowest level chosen by any state.

William Hugh Murray

A good evaluation criteria for the management section of RFP evaluations is "Amount and number of fines paid in past 5 years, including ones where no culpability or liability was admitted."

John Pescatore

This goes back to 2015, and is only now resulting in a fine, which compared to $162 billion of revenue in their last fiscal year, seems very slight. It is far better to report noncompliance and deal with the resulting audit finding/remediation than to falsely report compliance hoping to not be caught. If you're struggling with regulatory requirements have a conversation with your auditors or regulators about ways they can be met, make sure you arenÕt misinterpreting the requirements, then find a way to meet them.

Lee Neely