Shane Chambers No Comments

Defcon 1 – Critical Meltdown and Spectre Bugs Means Billions of Intel Devices Easily Hackable

2018 certainly knows how to make an entrance. The Christmas turkey has barely been finished and we’re told that nearly every electronic device on the planet with an Intel processor (from servers to PCs, smart devices and more) are susceptible to not one, but possibly two of the worst critical hardware related flaws ever known (Meltdown & Spectre). Flaws that can allow a hacker to steal your data without a hint of detection. In cases like these we often hear “but I have the latest next generation antivirus software”, but it’s not going to help you here I’m afraid. “And I have the latest next generation firewall and a state of the art SIEM solution just installed” – no good for fixing this either. You may even be really good and have your staff trained in security awareness and your systems backed up offsite – but unfortunately neither will address the root cause of this global issue. Even Santa couldn’t help fix this one – that’s how serious this is.

Meltdown and Spectre are the names given to two processor vulnerabilities which utilise a process called speculative execution - present on almost every CPU since '95

Meltdown and Spectre could be the worst ever bugs to hit electronic devices, making them easily hackable.

The hardware flaws have been aptly named “Meltdown” and “Spectre”. They sound like something straight out of a James Bond spy movie – and to be honest – the names aren’t far off, given if exploited, spying on you is exactly what a hacker could do. Predictions have already come in from experts that this could be the biggest disaster in IT history, and similar to the KRACK WiFi vulnerability of last year, Meltdown and Spectre could take years to fully fix. While important workarounds are available in some cases and must be put in place (see below) , only a hardware redesign in processor architecture will truly lay these bugs to rest.

To make matters worse, now that the crafty hackers know about it and with the EU GDPR data protection regulation coming into force on the 25th May – we predict, this year is going to see some considerable cyber-attacks that will try to take advantage of at least one of these flaws which may result in some pretty serious data breaches and some serious GDPR related fines. Its time like these one would think “Why did we ever go paperless?”.

Read more

Shane Chambers 1 Comment

KRACK – The Vulnerability That Affects Nearly Every Wi-Fi Device on the Planet

On Monday, it was announced publicly that Wi-Fi security, specifically the WPA2 standard, was essentially broken. The culprit is a bug named KRACK (Key Reinstallation Attack) which takes advantage of fundamental flaws in how WPA2 operates, and has exposed many shortcomings in how the industry responds to such attacks as well. WPA2 (Wi-Fi Protected Access II) is hugely prevalent, as it is the current generation of authentication used on wireless networks. That means that almost every wireless device could be affected by KRACK, as most devices use WPA2. This includes everything from laptops and phones to routers and IoT (Internet of Things)/Smart devices.

KRACK is a Wi-Fi vulnerability with a scope almost impossible to measure, and no easy resolutions. We can only learn from it going forward.

Read more

Shane Chambers No Comments

Honda Forced to Suspend Plant After Fresh WannaCry Outbreak

Japanese carmaker Honda released a statement last Tuesday that it had halted operations in its Sayama, Japan car plant due to a recurrence of the now-infamous WannaCry ransomware. The plant, which has an output of approximately 1000 vehicles per day, was shut down on Monday after Honda discovered the virus had affected networks across Japan, North America, Europe, China and other regions. This was despite attempts by the company to secure its networks against such attacks when the initial WannaCry outbreak occurred back in May.

Just one day’s downtime at Honda’s Sayama plant cost production of 1000 vehicles

Read more